873c9e14ccbd497ef719ce8ff0f49c246a4b74a345423ec3ea0579d005411bbd

Sharing

Copy URL Twitter E-mail

General

Target
Download_SEXOPHOBIA_Taju_Games_com_zip_Archive_get_770235.zip
Size 779.2MB
Sample260809-rxc35azcph
SHA256 873c9e14ccbd497ef719ce8ff0f49c246a4b74a345423ec3ea0579d005411bbd
MD5 9996914ff6d94dc19049e76ad9972614
SHA1 af9a8a572724f84b30c66a8f9605572c53750fa6
SHA512 885832a27d3cab9fcc0a187e1e9d018b8041d279c39b94cd0877610f3c388e75ef9c76f802f87e9029e6aba5d066a9ab5a308725efcb0bb70f0cde8198dc9e9e
SSDEEP 786432:i4EN8ol8RcOe/X0vXihnPYz5SQH0TZZon:i4ETl8yO0kviVgND0TO
TLSH
T187893315CE2CD5D7FBD336B4B8B0C157993E50B132DF9298E9A931F4AD868006F2D90A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Download_SEXOPHOBIA_Taju_Games_com_zip_Archive_get_770235.zip
- Size 779.2MB
- SHA256 873c9e14ccbd497ef719ce8ff0f49c246a4b74a345423ec3ea0579d005411bbd
- MD5 9996914ff6d94dc19049e76ad9972614
- SHA1 af9a8a572724f84b30c66a8f9605572c53750fa6
- SHA512 885832a27d3cab9fcc0a187e1e9d018b8041d279c39b94cd0877610f3c388e75ef9c76f802f87e9029e6aba5d066a9ab5a308725efcb0bb70f0cde8198dc9e9e
- SSDEEP 786432:i4EN8ol8RcOe/X0vXihnPYz5SQH0TZZon:i4ETl8yO0kviVgND0TO
- TLSH
  T187893315CE2CD5D7FBD336B4B8B0C157993E50B132DF9298E9A931F4AD868006F2D90A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.d4s
- Size 328B
- SHA256 2af6e5d31fb10d33b788c3420c70cf6b9e6433f20ef7a2c91bd0163e939e2cd5
- MD5 d6b4ec08baaa75196e3baa0c147ebabe
- SHA1 85e801f183267eaad948156adc2d4368cb46c791
- SHA512 301ee69488c8ae4317ccdf94dc380dd5eaf069aaf53c31225e31b9f5834031d2c76f1d3137afc8b2da31b70b9eb961d5aca4c1e107b16ff0e49aeaa9d6866a34
- TLSH
  T105E02D0220F43FB1239009A480E60016AA041BAB5CC527222B9B0AFDA8B8CA83939190
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 12a0f041a3eafe99ac855148bcc6312acbcd8620cb8c03123a0ca79356246bb1
- MD5 ec998d682c76e0b21e46209685d1d9e0
- SHA1 6a03437b6d46e1f59a234e288eb4d393c3ae5b94
- SHA512 d5f90f5e88c6d5a8ef51be4574395b73fb4cad7d7cc4145769f4d06398d9407127fe0dcfe0d6ac7a84396655bebfc1ff0bf345895794b72e9ddb2984403d32ee
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/FS:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYR
- TLSH
  T1E584230988C710040DBC87A97105FA7CF16C6629A3EB637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 9834c6c6ab4e5b7acc2ec93f6424ebac82f8b3868fe959e2f7d0acfd3347077c
- MD5 a85c799ea0fe51e5ee1de5760a218026
- SHA1 06bbdce5b623b3029c6e9793c3ae95e172b93fd0
- SHA512 427e50425fac5472437789e4067134e25b5c408e4e899a8870cbbaba7757674908a84cab13ebdc19ac5ef841f062f4e594901aadf01a7ff1306aedcede4e76ff
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRG4:fK4FJumM68gsjFliwugQikL3NRG4
- TLSH
  T11D63021A8149B73BB410EEBDBADADC44C534FAC03EC603A39F59798853D4DA03656BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 7875bf2df736c2c40803cac77bdc6fef2402e0a705a497ad6fab278d8ed89a2c
- MD5 983ca8cf8472511a1ec643be5fb9413d
- SHA1 074d675169dbc26bb9aecb3e1f155d1d798e2184
- SHA512 977961382b2b437afb9af3d0605706c48598a2523673c79d4d95c7b651d8ac1478ce7d37e6fa1ba5a794386f91460d9f1c3c3e60594e21dbae79e02255fe3022
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaK8:Z77jHIL0vBzbiE54gbyDdkqL///qHad
- TLSH
  T10DC31323BA3C584858A47C0ACE81AF9A06E04C0EE68FBB4B41867C9C9C1F552FF50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/shaders.txt
- Size 338B
- SHA256 d832de8763bd4bc259516712b735f0da002f7bb75d9508ff3ce966550df8d0f0
- MD5 3596e542e8e6f185529564937c7d9460
- SHA1 b5a8fffe886af7f243aa869f7477c820ff8e5bb0
- SHA512 6d5c1e3e837f75444f9113140174aa39cc4958bdcd52ddcd4f32e63648ff7d2d7ada5adfa3a6bfd7523da632e2f5f6e5fb663b4251220d2931b8f01044927376
- TLSH
  T1EBE07DD6152CD841EADA7821E8F088CC36D7F4409FD59CF98D871AD05BA072611F88F3
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 080773a1c30cf89c8296d9087ce1bfe0014d96da826102269a91b903ef41b80b
- MD5 8dfd2246e8e103f1ba3b4555ee4843bf
- SHA1 60c248696975192bfa91e32c718559398128178f
- SHA512 8aaa2337ae9e31d0f55cd95d639db479081d63f80f8cdec3352e1a195adde34495978652b017df79488b29694f4a97042d77506723be029ffd1e00b9c0f07adc
- TLSH
  T14421A1EEE32E5FA0A394DCAA907466F3CF1A2315F9EC745C54476B701A47A336046BB0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  data/gui/bar/left.png
- Size 623B
- SHA256 160dca477d1c37d70a84d260653a0e554be8131cf1ead022d8e704a54cfdd2f5
- MD5 8c383ea143eab8398b4d06a9656d8372
- SHA1 eff89b76eee24f5399fb9df13254939ae406c333
- SHA512 494c383d2ed167be496b69982b936e779b85f7c6143eb7d310118b7635f62b9468278d7ab688b31b731a2b346e5839281c025b508fa335afe651ef97427bb2c2
- TLSH
  T103F08B84D710D237711912A1B2865BB298216E3E3C70ED9C86C33D1F1687FBA2D74EA2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/right.png
- Size 753B
- SHA256 e0d5b6e72a09d06425cd11291cd381f2837fa27afb91070fe31ea20d9637a5d0
- MD5 cc6e07ec6657fe3c565cac159af1b2d8
- SHA1 2c9b4d2eff12f279811c9234675fbd1e6eb96a51
- SHA512 5d0483f68735bfaeda661e97f57dca8c3d3b30914812e414fe5f9d23e9e5d6db8e9fa515caafc2db997e9816fbf2d94a88d0fe6d361bd18c6b91d94cf0e98f11
- TLSH
  T185011080F200D53771A85951B2874AF388600E7F7C64DD2C41C3362F0656FBA7D78EA1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/top.png
- Size 958B
- SHA256 35f03a3d5be43342c78c1acc433b898f63a41aaddddd3c4213d88dc089763eae
- MD5 db5dd11b7f2677efb5e524d8c04246dc
- SHA1 aaef03441a5f4c53e5bc8b7416b90b22bb0427bc
- SHA512 7b4d0e1de41f05faf9012ef9e1c788724a96dc0f372754e5da8c8bf1365e09f60cc2eae585ace519deb4ab0f2e746404d7d62d7cc4537751d838321e29d38916
- TLSH
  T1F81128DEE2391BA19341DCDA613166F3CF0E1314FAF86498645B9B7406476375189770
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 f5251d4968807613cf98021252b2e8ae71d6159344ecf517249baaa599fd7742
- MD5 1209be91ab6a6db822fb7fb5bab57b7b
- SHA1 5bed8ad4b96bb7d5953567e7965b2759ffa94077
- SHA512 16a1c57bdadb196a4bf15f6bdb1ba14f2168ad9086a7cdbdd5fec63f0bcd9cbb5008254e84220e06c752b5aee851b4a1ebdde35d215237308ebcd31c094df3fe
- SSDEEP 96:ttTlZ6i7DfbKvW2rfhcJ7vZH7z6G+WsB2llHnJaKmpm4RVbC7NtxOi8iutj/:vzR3KblGhHiG+WsElhnJ3mD3SNnt5u5
- TLSH
  T167E18E01899CD62AD7B600E188946757EEB11A3C06FECFE2DCCC0D66CAB094B5B5D8F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/button/check_foreground.png
- Size 1005B
- SHA256 f6ce96ec8abf57a3ce0d47c10bf752b3e0f9fafc5e3792355e5a6f7e63e1822e
- MD5 56520b8f88124a758c0287b2361cb6e2
- SHA1 1601f3269959c0db759b7414274917031bcef8eb
- SHA512 84f78456935e6bafcca22fe73a9a1b824891ec58429bfa295f4046f5b835cd8cdc20cb8cbacd277c3f0d11b4c43b0a697af5bbad302c13ee57ecf8708082146b
- TLSH
  T19311A873DDA0B9758D580712E01B8726BA3C49542429546AD6B0C777F177810F75D3CE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_selected_foreground.png
- Size 904B
- SHA256 94ae55b1739fd01607b481a627f64b78d36a695f9231925b55c1c67b772b1042
- MD5 83052376c04b1ef27d677074b22aa305
- SHA1 3db4e80c7faa90835c540e833afff3ac9d35a287
- SHA512 f5115ae29ad543f51dd3b5dd7fe235d36d396b1fb740f746d8a45ddd01420939d823cd88c36d3e065c652b7d35bc87acc66d6aab7cf816695dfe50283b101656
- TLSH
  T127118C36D460154CD74047F7977607509D41B19C137D6171C482F5ED96E402104AD70B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 bb4624ffc70dd02883ad8b7920f86c3e34e0b74be3cb1dc3c9652701a0ac3fd8
- MD5 71fa339f6f4c55a4cc585c7dd41c9e4b
- SHA1 7faa39263c8ec65d81e0f6be40051f2f444ff624
- SHA512 936e400e7caf0e1eb89739e4a2d2a5043c942ef76d9a4c076de9b6039500ba97fa9ff136f48181b3c017279c35e4a10deb46591cbdce0c74b024b37809d96b8f
- TLSH
  T1C2516F81E368043735814104B259892781895CBB7824FD1455C7B93F8BBBF7DADB1F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_idle_background.png
- Size 2KB
- SHA256 102e6788dcd98448e2ed45febfbf8e5e42f161fca26aaaada10a5d04021ac0b4
- MD5 bf12f1740f3d14e6b5cd4dbffce656d1
- SHA1 c65072399afb3927fa50afcdfa6f3ec864b85b91
- SHA512 b739d6bb6028bdccda5970ef1a1dcf85a635d2d185c3b482c1122b35965e35bc6506159605c9b2db6b5f1970e7ac497a7eba416785d14258a8eaedca607e5575
- TLSH
  T1FA41FC01D36A0173BF992A68B4EA00976A854C377C05CC624DC7B5AF0387F7BADB6D60
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32