a46d81060a0f6accf3cc4b846259e08cacb635debe3ca723d9946208eed7093b

Sharing

Copy URL Twitter E-mail

General

Target
Animal_Crossing_New_Horizons_NSP_XCI_ROM_Archive_free_918178.zip
Size 737.7MB
Sample260808-vwsc7sap8z
SHA256 a46d81060a0f6accf3cc4b846259e08cacb635debe3ca723d9946208eed7093b
MD5 542f16747179b247b456526c802d22aa
SHA1 1b58158acf3705e9e96ab4e77800c4fc9430ebbe
SHA512 a1d24f4fc432431eaf48ffc200dc4018feec7fc94eca3128e55a73b6fa9f426d45742fe073450899da752cf8cf2978711e66382ff1434aec535e23e94c82c9db
SSDEEP 786432:YQQpzYrdxvOfLX0vXihnPYz5SQH0TZZoU:YQQdYrd1OjkviVgND0Th
TLSH
T1F1893315CE2CE4C3FB9736B5B8B0C157D62E50B132DF9194F9AA31F4AD8A9006F2D909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Animal_Crossing_New_Horizons_NSP_XCI_ROM_Archive_free_918178.zip
- Size 737.7MB
- SHA256 a46d81060a0f6accf3cc4b846259e08cacb635debe3ca723d9946208eed7093b
- MD5 542f16747179b247b456526c802d22aa
- SHA1 1b58158acf3705e9e96ab4e77800c4fc9430ebbe
- SHA512 a1d24f4fc432431eaf48ffc200dc4018feec7fc94eca3128e55a73b6fa9f426d45742fe073450899da752cf8cf2978711e66382ff1434aec535e23e94c82c9db
- SSDEEP 786432:YQQpzYrdxvOfLX0vXihnPYz5SQH0TZZoU:YQQdYrd1OjkviVgND0Th
- TLSH
  T1F1893315CE2CE4C3FB9736B5B8B0C157D62E50B132DF9194F9AA31F4AD8A9006F2D909
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.Aqn
- Size 328B
- SHA256 12c2d12a59ab68a4b0b3ca686746dc7723cd2b719ac46c8eeec7b41193c8f93d
- MD5 7b97485ca7c9db6f5451d41787feca85
- SHA1 ce0b3c3f718b5e0d246563a5c32f1d014aa4e38a
- SHA512 2b2ea092cfd2250d06d653ee6e689f0e8976c9ae08fc27f84a8b68df178e03b42985942d424cc0bee1fc9f5e6cc67d8ae6f73356a786eadcbdb707a53ec4f426
- TLSH
  T17FE07D2490B30D53925EA470F9222EC4DA5B3960FBC6FC057FB6C81A38F2B4B7956940
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/GVvjuYSlH6TX.RO
- Size 9.5MB
- SHA256 7b247886a71a663d6264f3be946b4c8833387cb4beb21ee2c65c924fbc03bc3d
- MD5 c1e10835e62d9ab46f8e13b1db472d52
- SHA1 f0040fd873a2a62a2c545e7dfc1ee1c511b10afa
- SHA512 48a44659276d8bbc0cb13b619b0d771f69db878cf2c70a7899a6dae78f9d5c3f0017482ec1dd2ad71d49c1e3b2ba0cc03b67c426c067ca9884820aef54cd54d4
- SSDEEP 49152:nxpotqPNb3fZfNfUpjM4wyMooVxIctrKM:nxpaqPNb3fZfNfUpjM4wyMooVxIctrKM
- TLSH
  T177A68473ABC8D90E543D9AB4CB0736B15165764C32C0B39B20E89F2FA1EC696D4BC5D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 b6c0481b9fedea51e9f2095154602272708956ff38dccd5a88e15a5eb4236ace
- MD5 0edf0614709f76bc6556300c7e1a7442
- SHA1 5234cacab676c03ff0fe15f03ed757c682fef245
- SHA512 d34c12857d302912fbdcbca259143459d732c8fc5286de46dd923a3e1f75eb3deae5bc2bac66203e075a51c0e00237e29421272b8ec8d12442a505ff879459ed
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/F2:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYJ
- TLSH
  T17884230988C710040EBC87A97105FA7CF16C6629A3EB637959E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 d14ee6f3ef7b1bc00bfb8b1f8f85131a650cdbfb22e0e6de04c6cd32bc7c664a
- MD5 4c29463e3a57b7456c5fea39904c3e93
- SHA1 dd9aecfa1115f9d292c6ac4bd38dca1547b33fa1
- SHA512 be12c3ed320c87e797d93863a65b67a024893d96054e35cd830914e4ebc6c3b28bb4948e389f18821017bc9d4c92a07409f8dbe9309cabe7a655ec74c8b6cbe4
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRa:fK4FJumM68gsjFliwugQikL3NRa
- TLSH
  T1B663015A81497B3BB414EEBDBAD6DC04C534F6C03EC603A39F59B98853E4DA03652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 074c6b16cd96a4bdc1d4fa1863dc1e52657fd640d330e00434c01eaa57df0e4b
- MD5 b4ec4daf187ef624f463cfd6239b7185
- SHA1 05ea4e944c2c934bd835525dbcce61e028e9826e
- SHA512 5be96cadb27aa9ae4333c619b5badad3d59622c92f7e3e8edc18dc95a03590064032824c0d0555dda025f58e980a05f24d56fe5b8e774d7e2d0a96f333034c2f
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKm:Z77jHIL0vBzbiE54gbyDdkqL///qHax
- TLSH
  T181C31327B93C584858A47C4ACE81AFEA06E04C0EE28FBB4B41967C9C9C1F552FF50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 297B
- SHA256 6ab4d6b4f1583673d4767fa94c8c38354a3309b66ffaf1181551018afe330f6c
- MD5 90c5e0b9dfa8154d0986d59e16d3dbca
- SHA1 8e7efb9060c0072b187e50fb6e8ee1342ebab5bf
- SHA512 540e49e350a8791dc2bd5535dd29c0e497ef2851166992487600f2570897aea7509bd88689dc2878cd7c0f6c81b7a2177c7cb10071c7b850d385bbc352aaac6e
- TLSH
  T182E0C263AA189D1491E8A8202AA5CF6DB543DE1163CE6AF8093638A4464876A03B9D23
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1020B
- SHA256 97b28198ae7c89074a26ed4fb741a7081e55aa5d211a9e958784daf4c2824010
- MD5 dfc50363d0d4522276d679ff7d8e04cf
- SHA1 ba1d76bd94cf4a1a570b3320e6ec0f83480ec0cc
- SHA512 4b3668ce82320b8ccd1dbd428817ae751b90be899e6be71180ee53afbd6c3bb52260ce3f65224034ed07cc56e22ae1b827a1515ca8d4ee298981cece1cfff9d3
- TLSH
  T1C31178EE933A2FA59341E8A9917175F3CF0A2700B9E8645C94475BB40A47623604A6B1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 843B
- SHA256 2cf9b733a1b8c97159c611e7d4217d295f3814b658b8caac03ecdd8603ec6384
- MD5 32a7eb0217fc0ee67ad41e97c5654667
- SHA1 069698956ab9bb2a473c1c8a880f42d1c1840a97
- SHA512 db7bbbed8cff0140ce271ad3c04236088afec6eafff255034794507339dddc907bf4be60e81bccb8f49c7c737cf7c5bad5af29675722ed7c4a71e028288e2517
- TLSH
  T103018984E602C537B7196186B28503F245113DBA7C64C8AC56C33A2F968BFBA2C75D92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 983B
- SHA256 98173ce14abbca20740b4f5e5e0411b7ba96f8d4deba8f4b4ac047cfc443a1fd
- MD5 43a87febcfcd6feae92139fec8a59872
- SHA1 cd0938f61a85f06208f5dc4a54080c293524b1a5
- SHA512 fe41bc49b1933bd796ddce658c29a13191f2cd36f1d03ce6f55e8bb4186696ebff75671fe25591069cc05860fd7af0000c6706cb81d55332b041ead301712733
- TLSH
  T193112180E250D53731A11190B29957F3EC211F7B29A0D56C86C3380F00D7F782C35E62
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 db10dbc8dd82f1a584ccea499f856f7afacdaf6ca1001476b551455628b6cf41
- MD5 97fa0fa3cabd36e45a3b97571998b45f
- SHA1 8ef79d4c9723ee75c479b8fb63463b0049d70ea3
- SHA512 f61edfa313500f3715c21195871d35b47d3ce31da4775f0e92032d803fd3bfd4375c48837ba20bfa56fe9a334f02ac06019dfbc47405f4bed0b984ce61175626
- TLSH
  T1932141EAE3792BA09380ECDAA17166F6CF0E1301F9ECA46C684B5B700947633504AA71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 2e85ef32fecb5a58b264d34bdb7a97169bd468071011b3804a8501870d42139e
- MD5 ea4464279703deead759087faaa38152
- SHA1 16535a5d094f53495b0610640a2354606e27b523
- SHA512 c844d108555f637fb120afcefc05106bfbb7896ba2c21e44d08d699c65c45d54522d9a0f0403451a23cdeae1a78ffbc14daf47239a1d2cf5bbf6516cd2cad583
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5ulbN4:7R68hCedDtOSJun4
- TLSH
  T10BF1BF0299D8C556CBB640E198882746EF71073D06BECFE1ACCC0D9BC9B4D075B59CE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 816B
- SHA256 707a659ee71e67dc22ce43ee2a3192bb7cc2d708ffc539c76316b9a2c9d894e6
- MD5 346589ccc7a1b63433263ac0e131984d
- SHA1 d78147bf1fa32d26e0c0af7dfc334cf842df45b1
- SHA512 f20fb20d74360b9d057ddff2658357f0015545c1280be57eac64311efddbadb6161aee5ea8cff0d829536900cb4f6db832c10ebb98ab440681b8046eea748953
- TLSH
  T1790152D34AE0FD01D0991835182B4F0980B5A049160B692F467561B6BC7A773208825A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 850B
- SHA256 e5571305323515933ae790044a13d3fc154bc5b85289a6058835a30da40b0b1e
- MD5 819a0feb7e62e0933d275afb8e2954a3
- SHA1 11f88f27e57b32736f7923430412ef46d43733b0
- SHA512 98f033ff91fa642b1cbdaf99d6ab3dafeb403e52b9bab89962a9ffdf69feb5d4aefe2e698b8bff0b3457066ecb151cc90eb61e3cca9217c7aa188611b8fdaa20
- TLSH
  T1A60163E5AAA3A8378189A103FFAAB464D860E2C89A8056C84120F8929B150535E85B99
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 1KB
- SHA256 3e7f002a94f08ecd4c5ce4ac70cd8c26b741fef94bb7f77c308b32bf8b0ef728
- MD5 2dfe6b744dfe5fe697de894f1a527614
- SHA1 6fb7ab980da999d4d7113ea0527cde7ae9ebbb21
- SHA512 1c7d6ac2b69c792fab58adb48152acda5b42c901545e6b17c9f4377430ef577bf33ffcc866e5b558977b0c86b7a1209e76958542c16b8965caa9c5173c2710a0
- TLSH
  T1D141C8C2E364117331450154B129895381C92CBB7564ED5859CB342F477FF3AAEB1F83
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32