dd9c6e46eb11e279debc5840f9fbb970a0257b6d4544fd036fb8ef5c15f174f6

Sharing

Copy URL Twitter E-mail

General

Target
ReStory-CER-SteamRIP.com.rar
Size 687.8MB
Sample260809-cqek2sgd52
SHA256 dd9c6e46eb11e279debc5840f9fbb970a0257b6d4544fd036fb8ef5c15f174f6
MD5 272aab7fd7c314ff0fc8176cda28f418
SHA1 038eb5d0097e65eafd087d0bfc9ccb2ef2004093
SHA512 9495f8dfa5b8e09d410e08313c4cad56b52f9536031f6e34e9b638eaa8520406d95cc2c96d54b462c0111cd9f96f0f6161a4758947782add5860f100234e12a2
SSDEEP 12582912:JRD09O7GmsrPT5EJlxKSPIlWYR6M/Rj7zgzdokfYt89A0I0fq0DQR:eO721EJlxNIldYGR3idoNt8S0I0ft+
TLSH
T17E793399FD86D0B1C2C6783186A9CAE38F5031FA5AD441429993AC106CFFDF2253E9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  ReStory-CER-SteamRIP.com.rar
- Size 687.8MB
- SHA256 dd9c6e46eb11e279debc5840f9fbb970a0257b6d4544fd036fb8ef5c15f174f6
- MD5 272aab7fd7c314ff0fc8176cda28f418
- SHA1 038eb5d0097e65eafd087d0bfc9ccb2ef2004093
- SHA512 9495f8dfa5b8e09d410e08313c4cad56b52f9536031f6e34e9b638eaa8520406d95cc2c96d54b462c0111cd9f96f0f6161a4758947782add5860f100234e12a2
- SSDEEP 12582912:JRD09O7GmsrPT5EJlxKSPIlWYR6M/Rj7zgzdokfYt89A0I0fq0DQR:eO721EJlxNIldYGR3idoNt8S0I0ft+
- TLSH
  T17E793399FD86D0B1C2C6783186A9CAE38F5031FA5AD441429993AC106CFFDF2253E9DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Restory/D3D12/D3D12Core.dll
- Size 4.5MB
- SHA256 625bd40005b1c3708695d5256ecf230d278e6b8edba5a88af70f3d91324f3052
- MD5 8bed03240b764906c937c0d6ccd560ac
- SHA1 2a38a4d7116b9d067e9d24d7da2646e2fc9f61c6
- SHA512 6fce3c735a101794634c53fd622be20e69e75c68ba216d0caa0fb48aadf97ed55ceb6ef205a4ea22f405bf5e663638add2f489df720c206739920093479863a7
- SSDEEP 49152:+h38HT1tnrx7KGN6McyBTwbreXHYTNeZQROL+qgGVO9EflU7slMWr+IGrh4TeeYo:IMBxrfwNFrfau5e/H
- TLSH
  T1B1266C07BBA840E8D4A6C079CA6B461FE7B278654370E7CB169087995F73BE1193F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Restory/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size 596KB
- SHA256 de5cbee932b9e9ffefe86dea523bd865a65c029221fd606748973ad26f0a91cb
- MD5 29a08fc7e522eb7e40de76d9f1b5a05c
- SHA1 eea6402956ae5e1075a054672c0ebcf227032b6f
- SHA512 42a12eb39a7b029b6e16376838b47f9eac9d81f6eaecb7682302aab9a003805c2ffcb8f0770678a912fac8fd463f1b6cae80ab2ecc90a322e24c4c48fa2b3252
- SSDEEP 12288:WOmNAmdeVH9Mwe9Ek/7jY4hOTBPyt9Ga9:WnAmdcMj9Ek/7jYSOT8v9
- TLSH
  T1D5D47C56B7A402B9E577D138C6834B5AEAB27811572093CF03A897AB1F137E11B7F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Restory/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size 7.5MB
- SHA256 453aa7a6cb0f6f09fd9011055fc183350903f5b302c31a7d137c932ae103f095
- MD5 30836581d4f50bbc888cd4ec1ef4d18c
- SHA1 20b56a408c8ed581cb8a7eab8842c220b49eb9be
- SHA512 dcf69ce08e47d85cdceb454b1d62ed3b768375b9097befcea1f0eec6fc10dd725cb8cd500a4ef15bc5b2ffacdf9ccd6c2784d1aa83c02bba671eb3bc6a738e57
- SSDEEP 98304:O1JKQuu+DfvOtBQkSMDu0moP74cJGOlwor:O1JKQurDnOtykNBP7vJGOlwI
- TLSH
  T13E767C5E92660068C8ABC23DCB676B73D375700443306EDB46905F6AAF23AE5537E7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Restory/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Restory/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Restory/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Restory/Restory.exe
- Size 652KB
- SHA256 ad7e0d4f72226c5741250658762a4b2f2688a9bea4288ba218ec80d7726630c6
- MD5 0ca2633afbb8f822bf6d9659c8a83975
- SHA1 59e4c648784c4bde5050f99337b852dbaa35a8e5
- SHA512 b0b98e5aef81d5ef0596dbb248cb6dfdaccba7fb6968302dc09324df3642f802406189214ea2008277a53f5829e8a3616675c8727119e9e7e181265168ead99f
- SSDEEP 6144:WaMjvuUwZpaUhLbSh7aw8S9/tvavDXEGZBv56VyvN8nsXxng58OFz+1IdzW:WtVwZpXhyh7zje7f55RvNqYgY1
- TLSH
  T1E0E48373DDA6CB86E9989836C40601FDBB320E6ECD63619BCA94BD7037B5C11D8C522D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Restory/Restory_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 4KB
- SHA256 33a899940e54b082f8d2af39b219dfdce093a14cec782e9037f2569990d42704
- MD5 6f1d165f9e2dba19ba234ddb802d7121
- SHA1 fcaf2814dc1e677231bd27d2f2f9d4c0fd8dd999
- SHA512 6b5c8e4768ac6c799ab3a45fb5830bbd1876c29641c1f026ed31645bcd25e427758bc2594cf3fb660dadbaad6a9bb8059a3114820f45f8204c2558a51f15304e
- TLSH
  T1CB8154665BE40267F9B707B06DE383262379F400CE63D76F19885639AC25264CE72F70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Restory/Restory_Data/Managed/Assembly-CSharp.dll
- Size 8KB
- SHA256 194ec066671c4b885dcf88e6165042869df621d15e356dd4510483c504e4c3b4
- MD5 0da1bfa054f9354262fa1a5aa79c0528
- SHA1 154ae56a63fe116413d3a6d03ba64f88127db224
- SHA512 ed5647a39569abe4db26bc75d1852473edac069f59d446d9ca0baa0fb03f4fa2e633007886b520d46046a367821ecefbf157eecb9f360a8c0ddbd846072979f7
- SSDEEP 192:+6mT/0OpBVr54SDeSlBoJcNJnCrDMoFd1bbBEbuoLJSa:FmT/0OpBZ5lVlBBXnCrDMmd1bcJSa
- TLSH
  T12902B75667AC8533EC5B073F79F783132331C2585993DE2D19CC99688E23A490BA2B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Restory/Restory_Data/Managed/Autodesk.Fbx.BuildTestAssets.dll
- Size 4KB
- SHA256 75494b7267c1a88f17db0554fe81c56e7ffd865cef3febe3ecb0568db2197c9b
- MD5 7c691e3c02853e569a66fa27f1082194
- SHA1 ee26fc71a2dbb73017bcc78bc7289ae09464dce0
- SHA512 2294b5d0736790893980363166da66f100e76e8eb9015f341552409c8f8b318ba607b03266409ff0ddb380536e7c5babca27868ff5310e336f0ee4a8f55122a4
- SSDEEP 48:6Ze+l2z7O3UT3tkbdT7i2bHtmfTZ+wA1qYJQLMt3U/SKhkxk6Rb72X5f1ulxEHqS:ejQqwtuPi2bHY8wIIi3SS0kxkYw5QTE
- TLSH
  T18891A5375BE80327F9BA4B755EF383A62370F804DE66C73A29C41629BD222540A71F74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Restory/Restory_Data/Managed/Autodesk.Fbx.dll
- Size 4KB
- SHA256 1713d195d17e7ace2eb7d501a652ff8ab53b9d26e000c2f115b5649eb2c8812d
- MD5 69ec9a87f6d1c32aaa0c59aaa6929219
- SHA1 ecf8879760f0c46bf8bc750bee366bebe48cca22
- SHA512 101134c5986739d5db6dfce98d43ffc32c0720a2a383682f8d3f1cbaab298b4fafbfbc46e6ec6f78b6073b7124b16048ad633c4cb0f5ef00801a3b8ad8840c98
- TLSH
  T153811066ABF44676E9B657B19EF3831222B1E400DE23C77F58840279EC122944E76F74
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Restory/Restory_Data/Managed/Castle.Core.dll
- Size 374KB
- SHA256 15778ecf78f1eb94915f2c1f2cf8fcdea06e3ad0533c2dabc88b4fb8302ec6cd
- MD5 db95bee87211c41d5e414563fffc5af3
- SHA1 73e6d7523df612ce7514edc3a208fb2d8221ec26
- SHA512 48d3d38ec2272b03653fbf2de0032839587bc9f010b5fcabaeb9eb4d78c0081660f5472f090bc0329213f1504a6c83277ea8252b55694ddccee9f7ef2084e93c
- SSDEEP 6144:7TOoJzzUbu/rfNZY39IrUAAXw8Ue3BbFBOJB/o4qRBHYm7C9HZF:HDJN/7QKrjD8FFoJB/o4qRBHYB9HZF
- TLSH
  T1ED84486623EC8326E6EF0B35F070192586F5E80764BFEB4F5981E8B91C53B809912377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Restory/Restory_Data/Managed/CrossPromo.dll
- Size 20KB
- SHA256 9a6e927aba9971dfbf2fc3599d6efc8d7b7c2cda1aa5bc2379489fcebaa8e40f
- MD5 ccfa7b6dbec9edf0a75702db4047e7d3
- SHA1 fbc76091b3c2647d8ab94c578106a10d68db92cf
- SHA512 da5ea0b7ab0f494c66f9c0371493cab2ff4dd337ceee7a3d522fa34e4f2c61f898ef75a5605c4b6c8dd45eb9efbe863673be804c027aa4160af0fb7737c5a6cd
- SSDEEP 384:uQid+PWClp5tGvpdWAxvTaj+5aJ+ZoKr6fKQ9C1tejhTSFe7Mxkra6x:J2+plpmvpsAxv+j+5apKuCQnwxkraI
- TLSH
  T127921A0193B8863BDEFE1BB5A860969113F9C712E912DB7F1B2E50B53E637924500377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Restory/Restory_Data/Managed/DOTween.Assembly.dll
- Size 44KB
- SHA256 c362a09450bdf17f11fe71a3a1d08afe87df6a2c752b1a6fb69de4246b2c218f
- MD5 b5f5fbc4c6df61b04256e5f9635739b2
- SHA1 3597777d0b92ed069658f910567e824acb5835e7
- SHA512 577575729eee18b681a3fc60cfc6b9c4e2fba5c876749ed6a4ebeffa7465ecefe78cdb23b889a4430841b1123764d2b5ec6f10b6f76d49577b1d5d2b51023cdc
- SSDEEP 768:aLuP08eOBk/hzu+i6N275yqB9WWrf88VygIdp8uxLpBS:aKPVDBk/hax9yKBrf81+
- TLSH
  T1CD23F9AEDA640373D68F5A396078960257B0D7179A12E392BD4EF0F4C4A7BC239413E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Restory/Restory_Data/Managed/DOTween.dll
- Size 168KB
- SHA256 a5d5f45d862b2fbc6f4597c2fd01d31f505918459005c461b7142cf898f3b861
- MD5 4d122cb6ccf0f1acb4e05aacea3f3de7
- SHA1 07625b4cca8dcd4d3fbf12b9e7a7863e52bbd753
- SHA512 f3e508b3ecb74dd4194ccbd3bebb277b00480ea1ae0ff6bbec29e436c63cb0ca0096fc06b409ad1755f0a97d062b7b1d0d1a99155bf511c0820b381e91aa8f4c
- SSDEEP 3072:VLahNmBIczW5dqz++wjRqkoKZKEziT0D/l3R8XWrVtD2:VLSsBIczWC4Rqy/l31VtD
- TLSH
  T111F35C1467E95A32DBEF077A90791A0D9238F21ED8ABD3AF5D85E0F42C07B5598003DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32