eb36ca6bd40b3b9742c0fa043bc828fad9c6d5673aee619693f02c076630e281

Sharing

Copy URL Twitter E-mail

General

Target
wingytd.7z
Size 487.5MB
Sample260808-ww2gjseh33
SHA256 eb36ca6bd40b3b9742c0fa043bc828fad9c6d5673aee619693f02c076630e281
MD5 e13820e8570b2cb8efc7f4d266bf6bfb
SHA1 95fea2642642c268bf65dcf9c97306b8f931c6d1
SHA512 9a3ed916558248ba4d32394b4a0618bdf1fe95e27b3bd8c4496466a09c344b074c0fcf4a8ee21249358cbc007d91c5f65814b757b20cc873e7ac7c38eca34841
SSDEEP 12582912:LvHi447j8V64BySXI5tp38NTlkIJIKiMJ/9KArYiTdgX:7Hi447j80ZS2tpyCIrX9BMWdgX
TLSH
T1743933BEDEE6718E1B93B2049D77692D5F4516B4375E0015FA69030B02C03F6EFAE988
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wingytd.7z
- Size 487.5MB
- SHA256 eb36ca6bd40b3b9742c0fa043bc828fad9c6d5673aee619693f02c076630e281
- MD5 e13820e8570b2cb8efc7f4d266bf6bfb
- SHA1 95fea2642642c268bf65dcf9c97306b8f931c6d1
- SHA512 9a3ed916558248ba4d32394b4a0618bdf1fe95e27b3bd8c4496466a09c344b074c0fcf4a8ee21249358cbc007d91c5f65814b757b20cc873e7ac7c38eca34841
- SSDEEP 12582912:LvHi447j8V64BySXI5tp38NTlkIJIKiMJ/9KArYiTdgX:7Hi447j80ZS2tpyCIrX9BMWdgX
- TLSH
  T1743933BEDEE6718E1B93B2049D77692D5F4516B4375E0015FA69030B02C03F6EFAE988
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  depotcache/2980271_6701943406653572332.manifest
- Size 77KB
- SHA256 8863a072e82bd0df63dcf9369c2e2ca8f90fb1d1246bffb60c1f8c9fc0d32019
- MD5 f56e4249e159f0f9a968b0adbdb1ea3b
- SHA1 ecf73c7e3686f949703e9a7dea73938c35d31c6a
- SHA512 6c19c345b1676037aafcd52bf71ebf724f27d7f3950ccbd0921e765a908c496bc97ad86a953f4d3dc5a5f4532eb2ee6bba98f6d56d4ea9c046b086970c875828
- SSDEEP 1536:rlfx5iSTkPOREFGA6fyENNnzeula0nF1JgZRRGxv+3DDRLpxmMnfxq:xx5LwO8UfyAnzeulaqPgZRRGx8NLpq
- TLSH
  T180737C483535C0E7F765277BDC6DF72C8A105A700B5A68E9CA2B9C520DEEA8F3787118
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  steamapps/appmanifest_2980270.acf
- Size 739B
- SHA256 529a75dd45dbb3d3e13175ee5351b9bf1ff97498d183160453e584ce5fe91e30
- MD5 99daf294f704d6dd8bdeaf0eb14a5079
- SHA1 50b79416567fe68cbb421023f13b90a38b52627e
- SHA512 3cdc719812cc5d7010dae949cb4b85c45fd49717b71ef2c0b98caa759874cdb97226f520cc9451c2e16a4845e7127fbaf7dc0275334dfbc592f36c5b155fe6c9
- TLSH
  T1FD01903F3037D4F7D6548A1C859280E03E6D502E52C649E07AFE245FC2ADF7402D5A0B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  steamapps/common/Hackhub/Hackhub.exe
- Size 90.4MB
- SHA256 0438523e6631b4d8fb434ec62333e6258e547f040739d402fe5ff8eba8b90e32
- MD5 fc820da305a3e48d723b61440df5cbb0
- SHA1 ce6581243a4c374af058524aa1162db18c80617c
- SHA512 f1d29a7bb532b06c97526975db2b64e908dbeb630d3cf61559100542f38af33851eff7d93486aec08dde36eda251e5c4a0e9696cfa508f0486698d7e6fb1a416
- SSDEEP 786432:35pB7eMEPc+/ydMOG2Putf0MI1lZE8TDjXLW2KSJJHBycnCD6nQ3c:3fE0+adM9RwfaiDjy2KS3HBycnCD6nQs
- TLSH
  T1FA286C03F29A41D9C01DC1B95B5AA633FE71B8494B25B6DF0B9047522B66FF42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  steamapps/common/Hackhub/LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  steamapps/common/Hackhub/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  steamapps/common/Hackhub/dxcompiler.dll
- Size 24.4MB
- SHA256 41004dbf82da5dd2f70c92defe2f0e0fce030daf85c072bd7922917ec90a6c28
- MD5 29d337ed011e087bf561cc2128a2cae2
- SHA1 fbf717c0d0979fdcd17ca045eae697bb72330215
- SHA512 0447d1fa22ceb9191c02c54618b97b84a127607da6ea9c056d49508464a31b62f1c62f557355dcfeae285a61a9e1744c9aabb8c8ca2ad029b7f41ef90052ac83
- SSDEEP 393216:e3rB/qi9bG5sQInN1HN8YMEBfc6uOCv5:ASoN9MWc6u15
- TLSH
  T10D473A122646D49CC099C879C7678B268A2C30E73FA7B9EFC0F451252B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  steamapps/common/Hackhub/dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  steamapps/common/Hackhub/ffmpeg.dll
- Size 2.9MB
- SHA256 d17c2a0ea5683ff02006676845b84ef2afe18b8f75a5fdcce2b364f85c37a34e
- MD5 5b582d8fd8e1d857746a46607ffb1e26
- SHA1 899e41b95907c9dd62a2d3cbfc102d0569bb3a5c
- SHA512 b82f220ed5ee02cf69846e63e33fd1bc64369dbee2286eaa825ee11bdbae2259306469760d11a6da3e14e02e056a91dff71e10f88b303210e3e47a323ef1aec2
- SSDEEP 49152:vhppXiAW075k/ZjSgbdzKKtBr4ZjB+JBlR9oMaLu1vj+Kd:vldVk/Zu+llaLu1v1
- TLSH
  T1FDE5AE02F6D251EDD019C034979FA213F271780A4F20AAEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  steamapps/common/Hackhub/launcher/LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
- MD5 68bebb0e4b93ed694e4493608a77f457
- SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
- SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
- TLSH
  T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  steamapps/common/Hackhub/launcher/resources.pak
- Size 6.4MB
- SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
- MD5 225717135d7853f4f79372a197eb1a5f
- SHA1 aa8627b1e66fde80e812bef290aefa657643c487
- SHA512 0edaf8862f7e7350a602c0d5d20e84bd2e2a4f6dff88944357ddc82345aa226c8151fcdffcea468d0304f89be1b41fdb3424c871b8a3a5adbef447abf7839650
- SSDEEP 196608:4EVBRafszNQoCmkrB0QMguFBgt3m06Rw+Ki:4EVTaV9mkr4jFWBm0iw+h
- TLSH
  T1D06633DB72352C4FC54883FE4528417A786CA7A53D8591A2159C6228CC3E34F7EC9ABF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  steamapps/common/Hackhub/launcher/resources/app.asar
- Size 2.3MB
- SHA256 7dd8ea914592d7b3305f2717b30024426eac8ce6d5cb03819dd27f861cc7d129
- MD5 853a5d3a799d16824a3b400f288a0a76
- SHA1 61252b3cedda6334db641776e41b31676cb5a9b8
- SHA512 66d33e1894b40060dff5fc9c76230071dfef14cb2c64c1997a91a5584d7d4f23c7f7058b3f513d0a6a5b11034857da6fd5787a5d67f219696b8c853744724907
- SSDEEP 24576:jn7gbMay+g+MlphMKFyknsjinQ4BYBn7gbMay+g+MlphMKFyknsjinQ4BYzka0rf:wJg+MlhQX2Jg+MlhQXz7QOwQqH9Abs
- TLSH
  T1B8B56C172217D94BC3099E34C75E9B7238924CE1BA11F183FD6EE92B9A5B19D188CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  steamapps/common/Hackhub/resources.pak
- Size 6.8MB
- SHA256 77f82c006ca57145a385188e67f06c8a1136c0d86de10dc5889f0dbd6117b061
- MD5 1969d96a94a9c112819c3d600984c7fd
- SHA1 41b64f94293dc9f4e09004b2769f933e999ac739
- SHA512 68fc3ec3871225c7004ecf6f34c148b8dca16c2df846bc00df6dd924f552aa734a0e53ae3d835df5d0ade23126ecbc7ee3cea94b67b2264b375c5b5ea0e627b7
- SSDEEP 196608:BfttJaCBVfWG6T9x3GBkrR9NK+EHB3wBi3cGiklILmzuLz:BTMCnc9x2BkrCpcGlCqSH
- TLSH
  T1D57633E762DA4C0BCD44537A05188736829EEF6435D670D282CCA29DDCBCB6D5F82C7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  steamapps/common/Hackhub/resources/app.asar
- Size 721.2MB
- SHA256 f6bb5baea9b28c786510275e5fdb0dcc0d9f9228945a10842a540ea275a4fab9
- MD5 0c6fdc1569bce90e2c9b9a262c11dada
- SHA1 ff5ab4e5ef403eaaa59f512c77309e699dde122f
- SHA512 f80e64fe07f68513b0e6b52f844a6e514b1654741658d08d63c18cb5368f020eb4bf6f89e08f5dbd87a160a3fd99b24e0047fbc45d226725e417486f2ff71d27
- SSDEEP 12582912:4lnhBUnIjHIXaChyBrSYy360PuMfGu6j21XwWtqHh3FqKKvDpT:f/Gu6j2X+NFcDpT
- TLSH
  T11779E06573E21275E5839376C97F9001F62A1C57381485947ACCE39CAF22F28E3B7EA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/@parcel/watcher-win32-x64/watcher.node
- Size 511KB
- SHA256 f316d0bcd926c4651f967a0d193609de1fc18d3b0408f525f7ce0d08e566774b
- MD5 cc80689a3b3f80cc48c303db84c29a58
- SHA1 e011a34fbdd87e8e46cd793446380146f547d8ab
- SHA512 7f6d974c5cc7786cbb0a5a39b55caf37ca8ee5525d95d03811603f76234772285932276694431b42ad3bdbf951e4ceb297adcf082247c2548603857336e5ee27
- SSDEEP 6144:ArJ25tIp8/5uvLtqZJXhobH8xT1nUNPZMDrr8OsRXIYB3pMHYTerf:Y0Q3Z40+UNxMoOuIw
- TLSH
  T133B47C69E6A803B5D1A7C178CA534903EB717C5607619BCF03E08ABA5F27BE05A3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/linux64/steamworksjs.linux-x64-gnu.node
- Size 1.9MB
- SHA256 022be9dec1bd5c64e625ea08efcd12df6cdb6284e923ae5ee4e874da30a3a919
- MD5 74fed6450140ad178204ceeede57c032
- SHA1 3cc44f372b67dba9814a29156e983f9707a728eb
- SHA512 8333802d3f37b80fe62bad277eb288e9adb2b4ce30abffd19630819d1f5337e848e3f40c94fefe9dacc5746e178f04eeb334e75fcad0c977505d2590efb6c011
- SSDEEP 24576:CSjx/Tz+YGg5N+cixkj8fF4JIt/cGE+2cqQIi53ki53QaWqfB7c:C324kj8fF4JIt0ZUIiJkkAaRfB7c
- TLSH
  T13E957D23FA6104E9D9EAC8318A6E1167B731740A5721BBEB5B94DF102D18FD28F3DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/osx/libsteam_api.dylib
- Size 596KB
- SHA256 025a42fe02a40411429bc6afa7ff0092547408b03bf57d89da68413faed80176
- MD5 a56aefdb99596d116cefed1a3f46475f
- SHA1 98cb078edcf854bd256988bf670601b23aae9306
- SHA512 f091bf5b1ca444a815ba8a6cfb3603c6365e05f5fe72473d9dcc2c98f5c75724f0a97222e4053dd833c0eb2f880a1a2e13ae9b12e78cafe65666cd64fe1ea196
- SSDEEP 12288:oe7ha/jwhCZte5Kdh6znZte5PW6FQZte5:rha/j2CZte5G6znZte5e6FQZte5
- TLSH
  T16FD4C433242C58B4C485B231DA42AE1F2620F14B37556CBE79C0467DDAE76C7BE3B1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral28
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/osx/steamworksjs.darwin-arm64.node
- Size 1.8MB
- SHA256 6d6a90f4bf557b6aa02977e0deafa0299b72fa8bbcd97c5c3f7aeb0d2bbcaa37
- MD5 cc7ba3ea536cd5baa8cc14653464d604
- SHA1 cad7d6ed595417fbf5d537de4e634d20f2fe75f8
- SHA512 ab3d65ccfaa5ee3983f002b5bdd33fdc145c14c35cac6ccfc13539d2342be0e6eb5edd63cafc6b5f1dc4b402209032e00a3dba0efd4c38e4e65580f2143b8990
- SSDEEP 49152:wKRdRWHWmmWWWWHWWW3WGGGWWWWWWWv2G8lNnpIgx+:wKRaG8lNnpIgx+
- TLSH
  T1C4957D127A8D28BEF5C3B1FE4D5E449A222BB9001101D7EB7C13E66ED9533D6C12EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral29
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/osx/steamworksjs.darwin-x64.node
- Size 1.9MB
- SHA256 f46826c74d6c80905fc26560a4076c26176d23dbf2926b9315bdebc97da2c5e4
- MD5 b9e84763148521fb3f4844eccce36ad1
- SHA1 6d078863a6a120f9ce6e8d443f8c0b0dc5e1ed74
- SHA512 f3ab64c43b6d389638ee59e66c68c2c13201bc5f144587730dde67aea469a9698ff5daed286c650cbc108df3441d443b7e9f86170e72ce8090256d3f49845c5a
- SSDEEP 49152:kiEtwCPU4Nn9SJ5U3NF5U16lbD3U9t8YS7lfElKbmxp:rlU31sdqMlKbmxp
- TLSH
  T11D957E37B2516468D283C0349BEE49B22722F82B1925BFBB57B4FB352E75D42920D707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral30
- Target
  steamapps/common/Hackhub/resources/app.asar.unpacked/node_modules/steamworks.js/dist/win64/steamworksjs.win32-x64-msvc.node
- Size 1.8MB
- SHA256 2de336c07573754bb954cd136546276e093a82a4e09e6b1f7da35be57ea75067
- MD5 fd8810d1a50f28298da977fdff68c8d9
- SHA1 3a10457222d6d101fa2a5cb54beb2efab811af20
- SHA512 593950d7dcf90e9d3ad387b6550578c82c967231bd8dae477514c3c084a7b2a8db77a6d9b50acd62f851e1fa01300eb5d3b4e6ee7709745158a4db65dccd1dba
- SSDEEP 24576:MVKCXVLfnOGJ9zFLfU4E1LVP1H8HD5GfkvaCDRrIcMzv1Sc/ceyEAdZOxe2LD7mS:Tk/1yfAdZOxegDxUFtBRlio
- TLSH
  T19285D6217A6A997CC54BC4B0C3578AA66E6130CB0F35B9FF44855A383F39EF81B39614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32