eb36ca6bd40b3b9742c0fa043bc828fad9c6d5673aee619693f02c076630e281

Sharing

Copy URL Twitter E-mail

General

Target
thingy.7z
Size 487.5MB
Sample260808-lpfamathkf
SHA256 eb36ca6bd40b3b9742c0fa043bc828fad9c6d5673aee619693f02c076630e281
MD5 e13820e8570b2cb8efc7f4d266bf6bfb
SHA1 95fea2642642c268bf65dcf9c97306b8f931c6d1
SHA512 9a3ed916558248ba4d32394b4a0618bdf1fe95e27b3bd8c4496466a09c344b074c0fcf4a8ee21249358cbc007d91c5f65814b757b20cc873e7ac7c38eca34841
SSDEEP 12582912:LvHi447j8V64BySXI5tp38NTlkIJIKiMJ/9KArYiTdgX:7Hi447j80ZS2tpyCIrX9BMWdgX
TLSH
T1743933BEDEE6718E1B93B2049D77692D5F4516B4375E0015FA69030B02C03F6EFAE988
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  steamapps/common/Hackhub/Hackhub.exe
- Size 90.4MB
- SHA256 0438523e6631b4d8fb434ec62333e6258e547f040739d402fe5ff8eba8b90e32
- MD5 fc820da305a3e48d723b61440df5cbb0
- SHA1 ce6581243a4c374af058524aa1162db18c80617c
- SHA512 f1d29a7bb532b06c97526975db2b64e908dbeb630d3cf61559100542f38af33851eff7d93486aec08dde36eda251e5c4a0e9696cfa508f0486698d7e6fb1a416
- SSDEEP 786432:35pB7eMEPc+/ydMOG2Putf0MI1lZE8TDjXLW2KSJJHBycnCD6nQ3c:3fE0+adM9RwfaiDjy2KS3HBycnCD6nQs
- TLSH
  T1FA286C03F29A41D9C01DC1B95B5AA633FE71B8494B25B6DF0B9047522B66FF42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  steamapps/common/Hackhub/LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Drops desktop.ini file(s)
behavioral2 behavioral3
- Target
  steamapps/common/Hackhub/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  steamapps/common/Hackhub/dxcompiler.dll
- Size 24.4MB
- SHA256 41004dbf82da5dd2f70c92defe2f0e0fce030daf85c072bd7922917ec90a6c28
- MD5 29d337ed011e087bf561cc2128a2cae2
- SHA1 fbf717c0d0979fdcd17ca045eae697bb72330215
- SHA512 0447d1fa22ceb9191c02c54618b97b84a127607da6ea9c056d49508464a31b62f1c62f557355dcfeae285a61a9e1744c9aabb8c8ca2ad029b7f41ef90052ac83
- SSDEEP 393216:e3rB/qi9bG5sQInN1HN8YMEBfc6uOCv5:ASoN9MWc6u15
- TLSH
  T10D473A122646D49CC099C879C7678B268A2C30E73FA7B9EFC0F451252B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  steamapps/common/Hackhub/dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  steamapps/common/Hackhub/ffmpeg.dll
- Size 2.9MB
- SHA256 d17c2a0ea5683ff02006676845b84ef2afe18b8f75a5fdcce2b364f85c37a34e
- MD5 5b582d8fd8e1d857746a46607ffb1e26
- SHA1 899e41b95907c9dd62a2d3cbfc102d0569bb3a5c
- SHA512 b82f220ed5ee02cf69846e63e33fd1bc64369dbee2286eaa825ee11bdbae2259306469760d11a6da3e14e02e056a91dff71e10f88b303210e3e47a323ef1aec2
- SSDEEP 49152:vhppXiAW075k/ZjSgbdzKKtBr4ZjB+JBlR9oMaLu1vj+Kd:vldVk/Zu+llaLu1v1
- TLSH
  T1FDE5AE02F6D251EDD019C034979FA213F271780A4F20AAEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  steamapps/common/Hackhub/launcher/LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
- MD5 68bebb0e4b93ed694e4493608a77f457
- SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
- SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
- TLSH
  T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
behavioral10 behavioral9
- Target
  steamapps/common/Hackhub/launcher/resources/app.asar
- Size 2.3MB
- SHA256 7dd8ea914592d7b3305f2717b30024426eac8ce6d5cb03819dd27f861cc7d129
- MD5 853a5d3a799d16824a3b400f288a0a76
- SHA1 61252b3cedda6334db641776e41b31676cb5a9b8
- SHA512 66d33e1894b40060dff5fc9c76230071dfef14cb2c64c1997a91a5584d7d4f23c7f7058b3f513d0a6a5b11034857da6fd5787a5d67f219696b8c853744724907
- SSDEEP 24576:jn7gbMay+g+MlphMKFyknsjinQ4BYBn7gbMay+g+MlphMKFyknsjinQ4BYzka0rf:wJg+MlhQX2Jg+MlhQXz7QOwQqH9Abs
- TLSH
  T1B8B56C172217D94BC3099E34C75E9B7238924CE1BA11F183FD6EE92B9A5B19D188CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/@parcel/watcher-win32-x64/watcher.node
- Size 511KB
- SHA256 f316d0bcd926c4651f967a0d193609de1fc18d3b0408f525f7ce0d08e566774b
- MD5 cc80689a3b3f80cc48c303db84c29a58
- SHA1 e011a34fbdd87e8e46cd793446380146f547d8ab
- SHA512 7f6d974c5cc7786cbb0a5a39b55caf37ca8ee5525d95d03811603f76234772285932276694431b42ad3bdbf951e4ceb297adcf082247c2548603857336e5ee27
- SSDEEP 6144:ArJ25tIp8/5uvLtqZJXhobH8xT1nUNPZMDrr8OsRXIYB3pMHYTerf:Y0Q3Z40+UNxMoOuIw
- TLSH
  T133B47C69E6A803B5D1A7C178CA534903EB717C5607619BCF03E08ABA5F27BE05A3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/linux64/steamworksjs.linux-x64-gnu.node
- Size 1.9MB
- SHA256 022be9dec1bd5c64e625ea08efcd12df6cdb6284e923ae5ee4e874da30a3a919
- MD5 74fed6450140ad178204ceeede57c032
- SHA1 3cc44f372b67dba9814a29156e983f9707a728eb
- SHA512 8333802d3f37b80fe62bad277eb288e9adb2b4ce30abffd19630819d1f5337e848e3f40c94fefe9dacc5746e178f04eeb334e75fcad0c977505d2590efb6c011
- SSDEEP 24576:CSjx/Tz+YGg5N+cixkj8fF4JIt/cGE+2cqQIi53ki53QaWqfB7c:C324kj8fF4JIt0ZUIiJkkAaRfB7c
- TLSH
  T13E957D23FA6104E9D9EAC8318A6E1167B731740A5721BBEB5B94DF102D18FD28F3DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/osx/libsteam_api.dylib
- Size 596KB
- SHA256 025a42fe02a40411429bc6afa7ff0092547408b03bf57d89da68413faed80176
- MD5 a56aefdb99596d116cefed1a3f46475f
- SHA1 98cb078edcf854bd256988bf670601b23aae9306
- SHA512 f091bf5b1ca444a815ba8a6cfb3603c6365e05f5fe72473d9dcc2c98f5c75724f0a97222e4053dd833c0eb2f880a1a2e13ae9b12e78cafe65666cd64fe1ea196
- SSDEEP 12288:oe7ha/jwhCZte5Kdh6znZte5PW6FQZte5:rha/j2CZte5G6znZte5e6FQZte5
- TLSH
  T16FD4C433242C58B4C485B231DA42AE1F2620F14B37556CBE79C0467DDAE76C7BE3B1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral16
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/win64/steamworksjs.win32-x64-msvc.node
- Size 1.8MB
- SHA256 2de336c07573754bb954cd136546276e093a82a4e09e6b1f7da35be57ea75067
- MD5 fd8810d1a50f28298da977fdff68c8d9
- SHA1 3a10457222d6d101fa2a5cb54beb2efab811af20
- SHA512 593950d7dcf90e9d3ad387b6550578c82c967231bd8dae477514c3c084a7b2a8db77a6d9b50acd62f851e1fa01300eb5d3b4e6ee7709745158a4db65dccd1dba
- SSDEEP 24576:MVKCXVLfnOGJ9zFLfU4E1LVP1H8HD5GfkvaCDRrIcMzv1Sc/ceyEAdZOxe2LD7mS:Tk/1yfAdZOxegDxUFtBRlio
- TLSH
  T19285D6217A6A997CC54BC4B0C3578AA66E6130CB0F35B9FF44855A383F39EF81B39614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/index.js
- Size 2KB
- SHA256 8e8cb8b7465a7c39a7e85da07bf262f83904f203ea987a81b6c3d90cd56b566d
- MD5 3399e80fc7852202c0d2f375d57485f6
- SHA1 a0a082024af96a1b47f06d7e5d3d6371f4af7889
- SHA512 79add1bc7ebb382ea93c4f33e75d9b4e414d8fbb4f0eb6462906c75fd398190d8125505656aa18f5bc297126e59761079ff2248850166b5bcae15f7861eb77e5
- TLSH
  T1755141655B6B32334DB9A3B6C5C6424FE5B54033194A1094780C669C3FFE6D212E8FCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Contacts third-party web service commonly abused for C2

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20