4efb8a54eba8b4b8d1cadece62153f37d50d55d133daf36ec4220d88e0640760

Sharing

Copy URL Twitter E-mail

General

Target
velocity-fixed-main hackvshack.net.zip
Size 2.5MB
Sample260808-agyapaej5w
SHA256 4efb8a54eba8b4b8d1cadece62153f37d50d55d133daf36ec4220d88e0640760
MD5 6e7728d4bcb42aeff44a73674b0900df
SHA1 0ff90325afa9c2d17d8366b95aa7d4c05acfadb9
SHA512 6f61381ad440a436a0ce4ff8dfa58fe11692cffe8fa763fa2280c2eb5a54e94845a01c3c0bd451fac691fc9acb37b33c39b641b14caef2a8caf549a07fc70f60
SSDEEP 49152:Wiikf/v/GRjiA5A4yQgCyVku/ebdVgx6+eWGWoxhSG:Wil/v/yN5A4NQWbXgodWGlz1
TLSH
T143C52378C3397E09F29C25BECDA2CE1EDD94258A116153831FF86904AC6DE434D6A72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  velocity-fixed-main hackvshack.net.zip
- Size 2.5MB
- SHA256 4efb8a54eba8b4b8d1cadece62153f37d50d55d133daf36ec4220d88e0640760
- MD5 6e7728d4bcb42aeff44a73674b0900df
- SHA1 0ff90325afa9c2d17d8366b95aa7d4c05acfadb9
- SHA512 6f61381ad440a436a0ce4ff8dfa58fe11692cffe8fa763fa2280c2eb5a54e94845a01c3c0bd451fac691fc9acb37b33c39b641b14caef2a8caf549a07fc70f60
- SSDEEP 49152:Wiikf/v/GRjiA5A4yQgCyVku/ebdVgx6+eWGWoxhSG:Wil/v/yN5A4NQWbXgodWGlz1
- TLSH
  T143C52378C3397E09F29C25BECDA2CE1EDD94258A116153831FF86904AC6DE434D6A72F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  velocity-fixed-main/cs2/velocity-cs2.slnx
- Size 254B
- SHA256 1f99d5cc5c7d1ec09c5409beb62b0c83e55804500c20d7f1ae15d290ebd3b9d4
- MD5 40f03e9431a35229e2d8b76f608668cd
- SHA1 2824c8dd818015afcfde202ecd2a352be61cc572
- SHA512 6db6c1694e25f0049d2ee466c393a98f46c0cb1cd38beb91d4602a57ebe89a27ad6b22abb4268b0e479dc07bb206c099686d11bf0c38354eacdb76f89378feed
- TLSH
  T1FED0A7B2FC20CD63E0C61637C972DE456CB1C3EB0109455CD45E341C139D41856130B7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  velocity-fixed-main/cs2/velocity-cs2/.editorconfig
- Size 3KB
- SHA256 ac61a49bf8cd21591c9688b28d354d80c3e0270420a8aafbdd7b37314f6cbe3f
- MD5 7151aa08778510a21e28320f3d67b3d4
- SHA1 424e06533a210c1405b49f7a58cdbee5cb96ec0c
- SHA512 b5ee1bcdbd00bd5efd1385ea4ecf814189284de5600fbb40451ae461e33024cdcc90c388b9809930cced6ebaf7200254eee8bdd1d5550f7eb255015fb72acd5d
- TLSH
  T19861882A88BEED3EC175BD90712AD9F0E5759D25620328F7CAB7400C31C4DA74A1FD59
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/changer.hpp
- Size 8KB
- SHA256 c699c5d29b860ef21dab6c1ac89144a536498cb656a75fa38e1e08d80e29103a
- MD5 b6e333c8137697efc671a595a4633e18
- SHA1 c83966fc0b178921081213d674cbaa59bde14b60
- SHA512 cd81c14f218b5f20037f163754f04a4786756f4f4b019212fb971468b76bf68227e29371c40cb56cc9e3328ebd7334c3fc5f77bfea7ab67e839b3dec3df41a53
- SSDEEP 192:9X4J3AUUjpRB7pjztz9922R6EEe5TaO2RTpIOiDRILq:C2UUjpRB73R6u5TaO2RdIDDRSq
- TLSH
  T1E902EE870E3EFD0F19A392E4D92A1D1165583CA4E3CB8FD5EC5780FCA5A5013CA3A976
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/impl/agents.cpp
- Size 5KB
- SHA256 07de68490a996341e9c37f21a9ff8091e029c012fa897591e3988cb80a831c56
- MD5 fb752598426cab9f1070435b7cff7c7f
- SHA1 03e6f8431442fafe500cc44f53addec618235b79
- SHA512 54590d51ec2c2e54a0d52b41141d571a70b01400383a9facd992a0900dafc11bd4fd94e8fcbe72156b9248f065f7e629a4229c054b6a9c444eab149b05214541
- SSDEEP 96:d4byyB5MH4KxNTTyaCGtvVyTm1QNp05wIWg+DpwMtB6hjHtO1LD+7D32:iNarCGhVyTm18pxYMj6hjEM7D32
- TLSH
  T183B134C4AF7ED86D11AF02C96B0A2890A01DB472B58A4DC37B99E5E8708434DD26DFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/impl/econ_item_system.cpp
- Size 25KB
- SHA256 38d58ea7f698fc9095c74e9b49c42f41f7bffaeab31f68a35bc9d6a686b8b1f7
- MD5 56496906827d04887cc666ff83d919fa
- SHA1 d26f9a8f0262b682f5c030b0ae104f290eb982a5
- SHA512 c918a69c29ea4da06590fddece816e83ecbeebde4f7bf66f8ea37668b6c39d599d241cc340d4e74b038a0969018983682c6489bed8d2cb3e7f9e2b6f8c0d015d
- SSDEEP 384:A6I1+bevKLj79HjIIgrGZ077Cm3P+WRnQU6nJsa+cy7Gy9QURen:A6I1+HLjVjtgP7xWWRQtj+rQURen
- TLSH
  T13EC273D29F7EE88E177611809C2B14A4306CA832A7948DD3FE8E8264B45915FC37CFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/impl/gloves.cpp
- Size 10KB
- SHA256 80e1caab624706a0298e8ecfdb176046f9ab23c21e59f69729b02b878e8cf281
- MD5 962f27b0a15ee46f6a01d1e1b74f9385
- SHA1 287333b7f3fcf7c48b34f9fe19ee007e8579bbf4
- SHA512 57a6a9236a2acd225bd4149c2f5a77ee996e3fffb94d960939dae6b03c551f0691489829e620fd30eabca48187631394f765712f2dbb6c0c61e09e29774fbb8b
- SSDEEP 96:dicCcbyjPfkjfwu/5Ghxm3f0lUjrKkvgM3MHcvJOgeSla+ph9peiUp76TjgEEi:0cfGSkq3v7gM3MKfek4I
- TLSH
  T1463243E67F3EAA7F6E9302D5B96A0C9051187436D2C5CDA3F49AC068704C15DC1B8B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/impl/guns.cpp
- Size 7KB
- SHA256 f7bd0f756d3f530bcf38f0e31cc223a828a394ea88f867e5131a5339cf9b92cd
- MD5 3e5559107cdaa49996a6092de8810e14
- SHA1 f12b26e8736a73b349c394024ff3d92c21a72f23
- SHA512 5b677fc0fb45d61f0af7ee33418074e311c236414e5731c4a8f7db2cb0118d7903740381e86bd5534247b0d98a102d4deafd9ccfa7d56ce1a1533cc05279ba2e
- SSDEEP 96:dvsgymH1LDryQ9/DhwPwWCApmvPJPJJoIQg36g8XD0TgismObpa19Vf7r17VtPhz:Jsicq/DhwVCAp6jJoq9NU5HkVt
- TLSH
  T12DF121C4AF7FA96FA3AB01D87A142D50B05CB971F6C84FD6755AC6D0908424BD23DB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/changer/impl/knives.cpp
- Size 13KB
- SHA256 4451ecdebd5896125b8f07e77a33a712d1c380b364c81db452bc8a16c9bc476d
- MD5 dfd1af488bb589b15e1eba8c0df421ec
- SHA1 ffc51676ab651dd6706ca301c2b7841c835e0a13
- SHA512 392fb1b8d6ad9f971129c53264a43b2889ff594caaf87d61bc040127c4ff99292005b55554ca26fc0e9e9951d20cf2ba9a11e690ff60b2d79710f1b6d5421abd
- SSDEEP 192:vjIbATLpDwsiIj/DveK2D9CAC6jFdzQWf5pB3q9Joq9NUawjL/3p0XbGfDo95G/7:j08zDhAddzQWQ9JoAiL/3pF3sg
- TLSH
  T1B25253C47F7EA96F92E702D5BA142DA0A05C7432E6C55FC6796EC4E4908824ED33DB34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/combat.hpp
- Size 19KB
- SHA256 2b4ac58740432a053926c9f4d63b93e3b23d6268f87d4cc476ec72ac04b75911
- MD5 0bc5b36cc063b3bce9161ceffd4a5746
- SHA1 0a16c3b4abb36fbc15ccaa3e678ccfee8a3514ba
- SHA512 2a58e773962d67a029188d1aa71b752c18107fb44547fc1d62dedd7259beea94f3aa8ce7d86a717f5e48b7ffaa9c8c0cd6f1d64bfe3879b9cbcf0a71f6e07b9d
- SSDEEP 384:2IHC1dJyZv3gsDFh01G3O4u8fcqZ+NFABdaonWXdn0z1TsdY8PWxh1qWr4GRf00q:2NspUGbhYthXI6uxrq3cMKlE
- TLSH
  T15092F0C13B3C94022953B3E08D564E01662CF9D1B2DA68C6EC8C557C8DDA61ACBB6DF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/impl/extrapolation.cpp
- Size 7KB
- SHA256 8da06085b3c648c2b1f6142cf03e34aa56d8119718fe205c3efc538557614922
- MD5 eadcf0902f984b1cc5f28437382dd3b6
- SHA1 4b9f139fdebcf5d67a45aff3209e43c67cea2f45
- SHA512 aec168b663f2e8b290d89cddb46407b3a76d990d78f15b1d6a00d823c992c3f82d029e341d8d2e88b56f075391979a0b60761c80eab09a303deee5ec9c82e140
- SSDEEP 192:lrEH4it2A4l5uV44PKcjPvKElnhaBeh7449cF:qH4itb4l5Q42DPfVh74ucF
- TLSH
  T193F1339C7BEDA50D03632294E900188531BCF872595B8AFB7F4E83C475C5125E36E9E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/impl/legit.cpp
- Size 24KB
- SHA256 5e1f1fc5c796c95730287a89f73995c90ca3d68ffaadbc3ef47a8336b421effd
- MD5 1dd3ae43dae2d21a0cc6b72ec3b9a456
- SHA1 ddc7147c8faca52696e8215f00e6d33806a5ab8b
- SHA512 4f4b54ba1261e72289568a8a0600f799a0790de1c1052a3dcf808ae661181319f544ced451791dbe471d658c4d7e3fdcd23e934c61d1289a29b49b516ac01d12
- SSDEEP 384:MIK2v2PceWDHqEp0hgsAd1pRFMZP9w69wyBbZOfw99x:jGLWDJsiV29w69wYbZjx
- TLSH
  T13DB262C1BF7D908F1BF91198A45614D4743C65F2AE484DEBBE991328A48610FC3BEFA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/impl/misc.cpp
- Size 28KB
- SHA256 8844790419bf5f5c32cddf3997ea6becb7ebb88c871349984410896640a6d1b0
- MD5 1322df8c4bc4374b94417d43f917785b
- SHA1 dbe598ecfe68e24e652aa7679be80270829223f8
- SHA512 a90a5d4db204fac60da1fb0ff128e563a9125181b99a22b32e26c2ccd39aa5583723e524d202c6d565833be62fe897ac8f2f6689b3b9f33af3d392ce8100df43
- SSDEEP 384:czKNqZBclslDCa7Y23whnCVongVgI7oSLT2RAA3+TG8Ko1hglWnW5Zh6+egq0/H8:qbclslDkoRcz3+q8Ko1+wnW5ZzegU
- TLSH
  T1E6D262C4BFBEA94E17BE11C44D520890703CA8B2AA898DDAFE5D41E891C514EC73DFB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/impl/rage.cpp
- Size 65KB
- SHA256 d8398f3c70275cbec89a03c259841fa88883b623b16da7dda928fb0b3e56b2bd
- MD5 7c6917c2fd642734b95102d5e3d7f9fb
- SHA1 023e7be1299b34937f7656b0112a9ad1f93cd1a5
- SHA512 f75573d98bd11872d7bfc217b7bb247d12c59f881ba2e6dfb4927e075fad82b23ec215a6ce48f57946024851ab67770a10bb1178866456465b425cb633ab6cd5
- SSDEEP 1536:YkQhlKt3I3MnIBLHfkOTbsoeBCUyyFzR+JybCkCE18rsK711ctXBiX9vqCj9w69c:HQDKt3I3MnaLHfkIbsoeBCUZFzR+Jyb7
- TLSH
  T13D5383E1BF7D906F17B912909C161A85B47CA472B9885CE6FE8C1258609214FC3BEFF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/combat/impl/shared.cpp
- Size 48KB
- SHA256 c23b51d6e2e4f331be56f95d80721e8d761d82c521b64d909f79bd4963560663
- MD5 84b5771b681b70c5d484f09668b0ca87
- SHA1 0c2d883f62c8b8ab1e5829956b93a90632083c63
- SHA512 2de613d9c160451a97ec68134c11953a55a01f438a540b87eac0cc28de3fee6592a0d6eb66e10b7020d821a73eb231a004de534ca11bf14ff7335d18e0cc2509
- SSDEEP 768:HvUaobPvc8UY1WxmLUceThVahehQgHonfu9DcoqDt9ETZtL0:HvvoTvZ1+meh/DcDDQTZtL0
- TLSH
  T1B123B5D57FBED48E2BA611C06E190954B1BCB0B1AA896DD7BD8C8294608524FD37CFF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  velocity-fixed-main/cs2/velocity-cs2/project/core/features/esp/esp.hpp
- Size 9KB
- SHA256 f590a7621100af95c65ae88e570f37f059f6fe0a17933cd5440ad779e753490c
- MD5 31fd5e0047c3970fb1562aa95ee36e43
- SHA1 47d701e7ed97fc80ad46ef9cb53b89eed9c8e841
- SHA512 194b43c209e0b6da93d73057ccd070ba9ac21ec3d11ab1412a6708cbae1c24698733a0d61f3fc644277adf14e254a596255d9f6eeecda3f9e6bc9bb781945582
- SSDEEP 96:/KCYGakh+I1sdMUE0rIXe5CtyH7o1aF2gsc2gNc2gec2gqc2gYc2gdF2gvVUmXii:/TekhdsdxUMIhQn28lS
- TLSH
  T11F22284A3F7CA80E4B9363F1D47A1C81B12CE9A0E7F89791AC9E81FC6980905DE34576
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32