629b3eb2de7b5275c5d83703b63dfc2f09ac08bebcba2b73923da9b215443fe5

Sharing

Copy URL Twitter E-mail

General

Target
Postal 2.7z
Size 409.2MB
Sample260810-3mgjca1epg
SHA256 629b3eb2de7b5275c5d83703b63dfc2f09ac08bebcba2b73923da9b215443fe5
MD5 deff06ceac7bf8ca288bceb73993aa06
SHA1 ccdff893727c3113d2d521dd4659eeace59a64f0
SHA512 88524888a6f931690360d97d76b262b33b06c854e7b72dce98fcb7129c34742a6c114d59c424cbadee77a826881591a35413bcacafd819049dc2e6db3c9ded57
SSDEEP 6291456:kfB4KMke8yqjS6YMm91oiuh2ct29tj2wy5e19gmGVfy0+vc7EMlgKnLc85dT:kdHe8f2h1Ja2ct2LCtqMU0EI6eHT
TLSH
T173293302B3BDACFE49B6853B9555552FDB34F130292B2540F87472828102793FAB9FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Postal 2.7z
- Size 409.2MB
- SHA256 629b3eb2de7b5275c5d83703b63dfc2f09ac08bebcba2b73923da9b215443fe5
- MD5 deff06ceac7bf8ca288bceb73993aa06
- SHA1 ccdff893727c3113d2d521dd4659eeace59a64f0
- SHA512 88524888a6f931690360d97d76b262b33b06c854e7b72dce98fcb7129c34742a6c114d59c424cbadee77a826881591a35413bcacafd819049dc2e6db3c9ded57
- SSDEEP 6291456:kfB4KMke8yqjS6YMm91oiuh2ct29tj2wy5e19gmGVfy0+vc7EMlgKnLc85dT:kdHe8f2h1Ja2ct2LCtqMU0EI6eHT
- TLSH
  T173293302B3BDACFE49B6853B9555552FDB34F130292B2540F87472828102793FAB9FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Postal 2/4-!!INFORMACION!.txt
- Size 2KB
- SHA256 75285aa95c35d16d37340114f4fa3d31f16423169ce14e875a3388ddcf719df8
- MD5 380b6287eb839789a454c66a67119d3e
- SHA1 03e91559f735c14b6bec4dce5f1f9fb90476b15b
- SHA512 0152fe75d6dadaf0a48a26ec5de1e663b63bb61b7d128e865ccb074e3a456871c3ca042f67fa4a79098255399d1d3efc668daac11ee4c74d11c15f63775e1eb9
- TLSH
  T1A44173E52EE4C7B428E223C1A3C9DA66E05974DCB142C0A5E477833450E82C882F7CDA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral2
- Target
  Postal 2/gamedata/Animations/Animals.ukx
- Size 3.8MB
- SHA256 63418d6161ed9327d823839ae833ec172c2d0c24291ec091124282d2c111f6e3
- MD5 f4a53033a346f91dfab65d9e00b4fd8c
- SHA1 33cecb79bf984f0580185b85be253a085780b8ed
- SHA512 9569b5eafb6b529178588ad2332fca7ec123831a60c713b8f726bbf75ea1951a423e835e1b2064d71004dd5f0857ab3b04770c30a04a105358f53a4b55d58c12
- SSDEEP 98304:DzBU3ZQ49dj55555555555555555555555555555bo5rS46/ndKX9BP5nWZ07gdU:XeJQtjydKXv+ZfKuT/fAl6Q
- TLSH
  T17F06D023B779DEC6C5980D701CE73F2AA3128FBC50B4750F6B7AAB5E5CD814D6804A86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Postal 2/gamedata/Animations/Characters.ukx
- Size 20.1MB
- SHA256 b01762059c342fca29313163997db6df18b50f4f35c3af4e93c925941bf09c03
- MD5 8dd9b12fa7c25703d7c80f649fcba7e4
- SHA1 564e8044e64b358fa7d1f45cd2c452f4b75a4861
- SHA512 ce004acbe0706388c709e1f13eea988849cbaa8e0e88fe4e2c25c8eea20dbcbf0854b33f666bbb47064df8764ae035728d8260d7f340d7c50e14c5b5de01606b
- SSDEEP 393216:VOPgu1mqgYkp9W4DcYcRb+w7J7VAFQ3wTEzZbQVXqM88xq3JU93eA47bzMpRvH8Z:EPB1mqPkp9rDcYcRb+CAFGwTEzZbQVXw
- TLSH
  T18927D0A3B37BAEC7C2A91D300CDA3E1EB3368BBC0075756B8B72072E2CD95596C05955
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Postal 2/gamedata/Animations/FP_Weapons.ukx
- Size 6.6MB
- SHA256 a65eeac6c6ddb3afb45f5e44d85ac7a0e7d7b1d3bbbefad42594b72283a0c0bb
- MD5 bd6d90e44001c46b939bdb664455db8d
- SHA1 92a287f4fc36a1147ed5c92e9d870071177bbd86
- SHA512 ed3772d6d480a5a459b11e2561b6d923c6671d258d96383bcecb219abcb5d92bd36e5e84185071f42c269de06ad0c34c38ca446f2c23110040fa3d685e670ba9
- SSDEEP 196608:VbwRu74yCOB+nSO6mJWkbJGSjcBjJcWArbEMBU:V/speSjWAroMa
- TLSH
  T10F66BE17E34763E7C9798E7015E96F1EF334D4AD9034AB370A7A90686CCB41E2CB1A52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Postal 2/gamedata/Animations/Gary_Characters.ukx
- Size 6.6MB
- SHA256 b3acf7d954d8d892a388b43fdc306ab3d14289d50cad56de6475dee04f4ddf29
- MD5 31df86927cd2caa94636d441057e53ae
- SHA1 2218beead651a569aaa8e11ff94d8f22bce07545
- SHA512 85cf0b339456d7eeff9eb856e2e190bbad521494bd27988bc8fa24aaccf4781ec78dc011adc952dc1b9eda08d25030cefc6f9abc5a57c66a123faa5dc4303768
- SSDEEP 196608:whoT5SUZBW4RzfXJiadkNsdFzIsAcIxOWLKSFRSrwBTewBTecSyVzOa9wBGWKHae:wh6MUPW4tw43GcI/KS60j7aa9PhHMF3M
- TLSH
  T1E866D0A3777A9ECAC1D80D300DEA3E2AB3175BBC50B1365B8F76072F18D8651AD18C56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Postal 2/gamedata/Animations/Heads.ukx
- Size 2.0MB
- SHA256 9ea89d925a2e0890a16677e9f9a2f0c8033bc3fa4f15681f7de302b258afdf49
- MD5 370b64cc3260a0d0d4548a3a42f405ce
- SHA1 820295542b00119b081983f330b21950045427b7
- SHA512 e36ec4f52ee281cfe4b8bffe153a366bedde86f14771da6d222b206b5166f95a150b768ea2180dadc97d6d303a38d82e275f3154bb26f5ad97b3073bfe99accf
- SSDEEP 49152:4KnUjMyhYy25L5yTIkfFHXkl9QTJ69OTM30H:4FDhBi1qkl9QTJGOTM30H
- TLSH
  T10F955A6B721A36CFC87E8A3066BA4F2DE739D88D00349B3B5B34646D6CDD20D3D51296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  Postal 2/gamedata/Animations/Krotchy_Characters.ukx
- Size 6.5MB
- SHA256 02adf1615201616196349f7dc845e75e705cf416d059fdeafd8992d1fb1d569d
- MD5 27f397494ff1957ecc46c988bd35254d
- SHA1 f8a23998322d5b69080dce08fa96d88463d5a555
- SHA512 42caf6bffbe8157341d8973f2d344aa560ec89261704b80cb33ac6253a9870f812260b000e92bb6f8126573b060b23c87d982aa22d58e669c37ed605550b2e41
- SSDEEP 196608:PP95zNisPPVcvSX0zepoc39V4ZWPdWq4C8ZVIS275W/kT6wZis4jYEpJwFGAU8a2:PPtzPVcvSX0Q9wS4zGS2lW8Jeje79X
- TLSH
  T1A166DFB373B9EEDAC2D80D700CDB3E1A63171BBC60B5315B8F76072F18D8655691889A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  Postal 2/gamedata/Animations/Patch1_FP_Weapons.ukx
- Size 584KB
- SHA256 f08f472a28f45c65fb8b698a66088590e4b0055179e4bc947a79cdf4e69ff8e6
- MD5 6783d94a1b6dfb479746da6a3a52cc3f
- SHA1 63199b44ad58cfbbcf2f9e11a4c5d96b73731daa
- SHA512 d3fcd43a3295ff98ff733541e35f0f75a564315e0bc03376e9bcbefe85782c7663c8b6025f6d79dcf4a5f94d9fa64e95bfa1836b7d7ed3ff766cd900cbac7fe5
- SSDEEP 12288:4RxppuONNJ9qiJDTPdYuOIp8gZP5XidJu/QROWxyWyoFDseMg:ixppuKNJz9Tq3Tub/Q4WxioIA
- TLSH
  T1C5D4AE57953FAFF2DAB40DF696B82D0EB334D7ABD87C9A3E483151A70D8242E1807191
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Postal 2/gamedata/Animations/vssver.scc
- Size 128B
- SHA256 09478ab1b29fed76bb969092dbaf9829e9e26bc5f47489004ac9903a1dc98d9b
- MD5 82395e733169bcadcb541010fdeedee0
- SHA1 072479e96816dd9b0db78fda6159417c47c0b989
- SHA512 09533cc70165ba8cea2184e46ac9ee92f34d7b3fcbaf21e4a672794507c2eefd4d822f10a6e9d84e82903f67ac3d89f6db7e7df33a3d62871617fed1573768cb
- TLSH
  T1ADB01265AC7450CEEC16433FD83B47D2E05C53717484F24E18E7E917B4516D3CE20442
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  Postal 2/gamedata/KarmaData/All_Big.kaw
- Size 156B
- SHA256 d53d523d452dce3bfa1daadb4ee2152882434db1d590f088412b897b6a8a0d5c
- MD5 3814fc7d5a1b7a65abc04d57d1990dd4
- SHA1 2f4e253aa3f0126d850c1369a5c5649eab058f4d
- SHA512 c8894900ceffae6437c787dc4e4789ff000ff771ca43a34baa2b56e58431e72909455b12523481d50c2dcc70094f635740bd929c6d170539206f858db8939488
- TLSH
  T163C04C7632019A278505070A96751F4153272AC625B4540820FA71FFB36F56972541A8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  Postal 2/gamedata/KarmaData/All_Characters.kaw
- Size 157B
- SHA256 1e38f4be3d47eab31e72097c4c796fd03801b55a14f09442761b92c04bd9fd74
- MD5 82bb73de7b27405a863746e391ee47a9
- SHA1 f3e8f004e6e0e4152522e8419f7cfb08a42b4e00
- SHA512 3093285f23cb10c4db57e23017671de7166cb78c8d388cfc69d7abbf256299176ce92314fd1dff1158cbe6ddc54daa4e82e9280887ed4a5542cbe01792083ff8
- TLSH
  T161C04C7632009A278515070A96651F4053271AC625B4540820B971FF636F55572551B8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  Postal 2/gamedata/KarmaData/All_Fat.kaw
- Size 156B
- SHA256 0b2a8f6e6b8811962d8390ae7e52aefa72a208b870dd5a725f18af9ca20c6fa7
- MD5 9cb00d09de7f6af2dbabafb9b13c3c67
- SHA1 5722fb0012481c65e9a29504068d5899ccfdce8c
- SHA512 48b9d070e6916fd557c45fbd3d8a0c1393c28f0ce6a976b62203a7c099cea7376fe9339189190669d8800e6f9ac7e3502ccfe2b9acbb710c68907d3254f8c927
- TLSH
  T1B1C04C7632009A278505070A96695F4053271BC625B4540824B971FF676F55972541E8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  Postal 2/gamedata/KarmaData/All_Fem.kaw
- Size 156B
- SHA256 943f3b61d7c4ca0dc8060fb87ac1a498dbc77c7c18c9784744f8a32a307c13d9
- MD5 ddd00d0ac99bb75e45674ef9652f41ac
- SHA1 527ed718ff311dc8e8ebbbe1a93a01ca3069373b
- SHA512 fafe34de285a1d76573a939896b37992f3dc13331ef8993305a0d531a18048448d06b6289f5354300df80d5fef07a7c32a57eb5b782148fed7adff889df95e3f
- TLSH
  T139C04C7632009A278515070A96791F4153271BCA25B4580824B971FF676F55572541A8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  Postal 2/gamedata/KarmaData/All_Mini.kaw
- Size 157B
- SHA256 6e13f0f4b4ae796b9ba8b7bb939b064b490f96a1415e7f5331ce157404db37ec
- MD5 55c7b47708eb2854617bdf2e2774ae4b
- SHA1 beb5bcd57e66d6540ffbdbb323f6f6e618438f83
- SHA512 d3fb03cb442a4166c0bf76b4e17b99b4ba97ff7817ce380ee9e25fe3b2c3a5fee2428d588918a2f0468b3580d84ad424418b3e5e0db7664e74000c33126b1f90
- TLSH
  T17FC04C7772019A278515070B96692F4053271AC635B4590820B971FF736F56572541A8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  Postal 2/gamedata/KarmaData/Avg_Big.ka
- Size 47KB
- SHA256 7ca5bcff3b14f87ba07f53b96e7870ab142801eeddc569c8814c18590db7be62
- MD5 0f8662ffaf9789b15767a1f42f7c60db
- SHA1 f567c724a1493aee67eadd1b46cd6083bda0bf8c
- SHA512 5aa6435d54cbb5635e7b9738831269513ff4f877a3922fd84b24600d8aca4262a849ccba22e258aea2db205a5efd2abeb888698a80ba6c4a6c1b97dd2ffae096
- SSDEEP 768:68kHgSB/xyKkiII9x2vdzbQzSbz4cMRNr9BX7+3vZLz+/WMK+rIEn1E4LMs3:Go2G3X2XLj
- TLSH
  T11F230CECBA2C449194187F1B58FFFA75305FED89934A2A5E50E37D3B7110E8112A24AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Postal 2/gamedata/KarmaData/Avg_Big_Skel.ka
- Size 46KB
- SHA256 10021ef922c2087bdca1e39b303233bc856cda57f91d8627f7f7910aa36e3135
- MD5 7721b0146f88108cf49b2513f1d1924c
- SHA1 094635eee59c117b69b024644423b72a75c09c52
- SHA512 8b73277bf124c85069f7266631ddc1f4854ccd81e855efba025536b00f7f0b004b0e0afad21093cf678b4580b5336c81f45263e88f4f4679a5453ef145d8510a
- SSDEEP 768:6x4HgSB/xyKkiII9k2POnbQzSbz4cMRNr9BX7+3vZLz+/WM4+1SmhpfxBPmf4W:/u2G37ESQpTK
- TLSH
  T1B7230DACBA2C449194187F1B58FFFA75305FED89934A2A5E50E37D3B7510F8012A24AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Postal 2/gamedata/KarmaData/Avg_Dude.PSK
- Size 81KB
- SHA256 ed5670748a7628aea4edcd5560eadf8d61ba4dbbb1a21a5134846d2f1010a598
- MD5 8933c65b3aca06e1d7e48f7a1225bb36
- SHA1 1a5a8a1f8e0eb58cbea29d6262b012d22cc4cbaa
- SHA512 642857ea1f628b7260d70a72dc721098e1292b3a9e32dea5b0511e8547d8801968fa79d96988d68cd5e7b098b4fc4dd17ade6c14843affd823d573413bbe84a2
- SSDEEP 1536:eh2wrN4HafEDxGUgJHA9BY3aTHENP5wy0Ad5bah/Z/gpH9K6oM:ehnS6fQ0UgpMkrwZko/Z4pHyM
- TLSH
  T1248340D6844BD11ECABA62B1E0212FE875B5E0164D78E79B337D74ACEF9DB0C488164C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Postal 2/gamedata/KarmaData/Avg_Dude.ka
- Size 50KB
- SHA256 2105418ba928028644e4316954dd48bc4ea33e60d0f2ac98e88454f90ab2eed8
- MD5 e750e2c68b1b59181fe1afc5bc2966c6
- SHA1 ac2210afbb3b2998a9e1d324b93d9ad04cbb3703
- SHA512 20ce62fbbe34d8d7bc4c685182f41cdc8808b2bb0a4a58237837afc4b526ad8c2843640026c355942e67233df4191aaf780f5598f8518ae9d2f7f38bdc6a9574
- SSDEEP 768:MHohzWsOqbYTQq3u9ZB4fBU5stgSUxPvPR3dcoqfEAO3vMzHoASFV8oD9KNBSj:XEeXP/3JQA
- TLSH
  T16C330FEC792C588190587F1B18FFFE39606FED88935A2A1E50F3BD3B7510E81126246B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Postal 2/gamedata/KarmaData/Avg_Dude_Skel.ka
- Size 50KB
- SHA256 1316511243b6b012a73400144361845f3596df3e38f752d5e707b58aea0d53a8
- MD5 70bd96f216cfb98aeb2fdb0b0d8fa7cd
- SHA1 8d386e432ae7f60d614311f09f5dc2ab88a71d3d
- SHA512 324b82ab50682ae03fb2078c30e368643dcbdff833417fd173193ead82c5e6b88ec5ab740705dc3a70d907441fb97093c5200f1efbe2d0a7dc1b49af49ca9218
- SSDEEP 768:MHohzWsOqbYTQq3u9ZB4fBU5stgSUxPvPR3dcoqfEAO3vMzHoASFpI9LIJJOOJ:XEeXP/3i9O
- TLSH
  T1313321DC7A2C588190586F1B18FFFD39706FED88934A2A1E90F37D3B7550E81126256B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  Postal 2/gamedata/KarmaData/Avg_Fat.ka
- Size 47KB
- SHA256 372e48566ecbfe4ed850768a9f2e1c13568df3fd64c8a0f0b6d03aaf7d8aa572
- MD5 84f1165f8e6587b55e6ddb7bed79f131
- SHA1 162ca3e3b54d6a87317fde2dbe8ecb5b9c133ef0
- SHA512 66f4fd923508b99046d949cd6542e554850f4febad4599a0c88e017de56b8857ceebc6a75d735c5edde27383f05fff2d620dc94201c7df8c954eaedaf195bb49
- SSDEEP 768:o28nSeDZ4niZXvP49l4Ks+3GFBgFQHXQNwEd43vdeF/0K24wWwv6nukt8fPFJ2av:s6HO34ukt8fXX
- TLSH
  T1E723FDACBA2C4491941C6F1B58FFFA75305FED89934A2A5E90E37D3B7610F80126246F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  Postal 2/gamedata/KarmaData/Avg_Fat_Skel.ka
- Size 37KB
- SHA256 94de4bd67dc4b4bc450c6e603229fc0b39de093742f089eb0c591edccad9ecfb
- MD5 06537ddf480af9d662d45fbc6366557b
- SHA1 d467bdee44ea840a012adc9f1715cde80219a9d9
- SHA512 462d8212b6d8b7fd7744d2b747d5e7c63d6e4c22b7541fa7f9f14197880a2ca9ec59e2c9ab64c75a90c56ca3421cff544349adb6b13732b7a2f00d0933ad540c
- SSDEEP 768:o/ynSeDZ4niZXvP4KlLWs+3GFBgFQHXQNwEd43vdeF/Fp/OpIhRsyPjvsLT2nNnr:VEHO34jsyLznNr
- TLSH
  T1920363E8762C54E164187F2F64FBB969206FFD9993121E2DD0A3BE3B3900EC115258B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  Postal 2/gamedata/KarmaData/Avg_Fem.ka
- Size 46KB
- SHA256 d6003297d63c7faf3abec3591f3c27c9b252a920b76574a285b47417dae012bb
- MD5 0bbf6a68f1ffa5f4cf0081823bf2dc6f
- SHA1 6324477d5228ae0ed989053bf1b3c7293ce13ed7
- SHA512 e3aba747156df56bfd11664a85589f96e670d94aac67477e606c5c69a4b1367392dd61ac16b0b91d37d5ac482a8300662b14f0147b54dc1051c9dfc52e72a135
- SSDEEP 768:yqRrB8cxl47lDzQb6NmDwRYlmUiTM1AMoLcd653vlqP4/X2vLw5bTJv3ednGz:KIw3BB3Sni
- TLSH
  T1B623FEECBA2C5491941C6F1B58FFFA75305FED89934A2A5E50E37D3B7110E80126286F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Postal 2/gamedata/KarmaData/Avg_Fem_Skel.ka
- Size 37KB
- SHA256 4fb343fdc7a759382fe39d29cdd2ffb2062b9e2f1e74dcd699840c1debe38b08
- MD5 9ad11cc08dfda0d3fe4fb91532067919
- SHA1 6f2345d73553837d983cea3a82ba7ece50b00641
- SHA512 d67d7a3f50ce2367da41c58aaae93592ea0d84c61d13dc220b55e0f7e060e57a9e0ee60ad6d12624787858ce7d26ff4102bb588b279141e613339e7ea7fe3b46
- SSDEEP 768:yShrB8cxl47lDzQb6umZsVYlmUiTM1AMoLcd653vlqP4/u+EJaLadEcwK6vin+/v:4fw3PXi+/v
- TLSH
  T17A0364E8763C58E1A5187F2F64FB7969206FFD9993161E2E90A3BE373400EC105258B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Postal 2/gamedata/KarmaData/Avg_Mini.ka
- Size 45KB
- SHA256 0b3d43c7724cc5d4257071734b6b4cd8c7e66eedb937369b7346087a04c1c0ee
- MD5 cf25d4c2d0e03faa783ba26b64bfd5f4
- SHA1 76f64602b0f504365938b88cbe5c53c6320e13fb
- SHA512 7dee352a017e26fd290eb02270c9a071cf91f4a517542864f28a068cf6caa7e1141e7ad2edd55579e9a8b960456e97c9fc2199f32f31c89c159a6e3150d1f760
- SSDEEP 768:LpULEA5IS++3sn7MHHNSiYV5lUyc7OzjOnSEJX3v0O5/XV9pX79WAbKx6Eqa9+D:Iz3979WAo6Za9w
- TLSH
  T193230EECB92C849190187F1B58FFFA75305FED88930A2A5F50E37D3B7610E8112A656B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  Postal 2/gamedata/KarmaData/Avg_Mini_Skel.ka
- Size 36KB
- SHA256 af739f3eeb6931f0f6e3cb253f3f4edb442f16c8c760a1ea9cbac6b5145ec551
- MD5 5bca59935945f0670e28136141665e59
- SHA1 9d4ca3191216f3eb0848d781988425b364b4154d
- SHA512 2217180e349b1fc6caca3d63b8a82cae2e6e631a0e9d93026e2d53fd112a13d2e3df86e5cb5db9c5a105fbc03ef0180f0eca5e7e4bbb5e939f236309b0fe8248
- SSDEEP 768:Lp8LEA5IS++3sn7MHmNSi+V5lUyc7OzjOnSEJX3v0O5/JV3ChaItd15ODPU2mmbG:1z3YaItd15ODTmEhsVTdp
- TLSH
  T1230385E8762C94E1A4187F2F64FBB968202FFD9993111E2E90A3BE373900DD10565CB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Postal 2/gamedata/KarmaData/Big_M_LS_Pants.PSK
- Size 89KB
- SHA256 1ccb5298d8289393e88c1a6fbf8b6b0f41ffd1299373d94a83b173508bde86f1
- MD5 7f725c885bc26227a145ffb7e9c3b276
- SHA1 5590d765d2dd9fbe931982cff6aa01c1e60cf870
- SHA512 c350b7098cebb38ce12a088e488fb44be70db1ed6e3f61a346ff5ec979850de42348da7dde07cfda0eec5c895242679cc15fc2778df881cb49b8b47d708dcf51
- SSDEEP 1536:dexGbLqiRLixVDCZysp0ybwwsz0aFwZ5e6MH630kN+GP:kAVRGnWH0i5MH63ppP
- TLSH
  T130933DD34486955FEBBA4732E1281FE1B036E51A083DAB172F7DA474EFA970D58814CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  Postal 2/gamedata/KarmaData/Fat_M_LS_Pants.PSK
- Size 82KB
- SHA256 18eeafbd422ac93ca3b74f457c6fa39ab581086cc613b3adfdc3f2e959c5ff30
- MD5 5ee105abe6192102c73660facaf8e44f
- SHA1 e5988b985086359afd7447efefbdf00e4d945c20
- SHA512 f39772d5583381f5c732a5c45847a59cdecdf5adc4308f4861277ad440bfdfce7a0f59dc5ecca6796ffd782114129b97d328d65adbdca7c6eb22920f7dfd0d89
- SSDEEP 1536:JS76ZaVqcIpzB5pOrit6+ZL8ZcYS/jJaU7:RZncIW+t7asrIU7
- TLSH
  T1C283815BA687494FDD3DA270A179BF2461B2E41C987DC7633F7D6CACAFD918C0882640
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  Postal 2/gamedata/KarmaData/Female_LS_Pants.PSK
- Size 82KB
- SHA256 182799462d8cafc2c5a5cbaaa9f3a13ebc310817641569137de1ac62f4ffccca
- MD5 5037f3124b9209a9f3371b52213537c5
- SHA1 62557f27d47ce1aaa278ef9ff495ad66b43bb9c2
- SHA512 f9ddc345efcee4d6b441066f1f40bfa327f230f34c1bd0d72695bd6daf774436ff84f8c59e51f9ba466a20411ec005002a70bec134a3e3d8acbce79844782c4c
- SSDEEP 1536:ZTj3KllKlKn8Y4R4QMPyskJoacqIHmfkqsDxg6KWo9DMRXyIT/cBBZ427:Zit8l4CLaaclGfkqexg6KWo9DMRC8Uvn
- TLSH
  T1C18372268687B10ED9BC537060692F2C62BAE6195C7DDF7B3B3DA0F4BFD914C48A1640
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  Postal 2/gamedata/KarmaData/Mini_M_Jacket_Pants.PSK
- Size 82KB
- SHA256 7f054c2f1e8a74f05d29351f9434b0bd3c9f38654baa3f37a6bc53050b79290a
- MD5 98276612ffd292392fd96e97ec677ba6
- SHA1 b30389e2cbf60ec606e3f91ffefe459e207e7908
- SHA512 e2eee23fb1392f3e7a4614f39634bd4c9d5bc4487f5bb01d149f5be5700546045c26a6e1e5a5a730a09b80e3c876d9ca3a82fd0d1d47a7f08a8422719c873f82
- SSDEEP 1536:p1T+ZuatOlrLFeMp9Mq/5oVasV8VN7YhtpM/pQx7T7LY4y/DbqB:p1uklPF3p9D/6aVVNgtpMY7LY4yrba
- TLSH
  T12F83A3125656991EFE78933260368F64A27671DC283D4B233B7DDCB8AFCA34D58806F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  Postal 2/gamedata/KarmaData/vssver.scc
- Size 352B
- SHA256 ca730ff850bba086700e396cea783f4a0b605a6b851ffd99a219aad50f15d3b9
- MD5 926149241043e0d5064db41cc9b6f546
- SHA1 97e3bf68f2fdc0523473d8e9a1b0460d3d40a866
- SHA512 f13f08edbbe1d3f3486cb6733a135a22e46c821e328a378b1a4fdc2b4590bea2c25cfa32e88db750af84d9daf7b22d140cc1c30dddbf8f06429b21020ef8ed8e
- TLSH
  T1EEE02E648BB28B56C0F08BB3022063C94A18C34A6948512F8445CD3AFC0448B0C9122C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31
- Target
  Postal 2/gamedata/System/changes.htm
- Size 4KB
- SHA256 e3e1f2e4f0df27848096290a186ce527e7e6bc55a5b4774deec90cf9dca7b2e4
- MD5 b58ccba15e581bf62b3cadb3489dbaf5
- SHA1 ac46009bfd68ddf415af1c26d3343af63b37518c
- SHA512 0e2ab8bfafa23a0f43443d990690df4fbba0f8957bae90962db3bb6611b4bc0e7aaf3090d6a1cb93ce0fc3ab85b1b0c41cf9b3b223a430d180362d41ad084907
- SSDEEP 96:t2Jc4eLM4aO8bSeGRM4L9s1Zpl7+3J+8Yay3:ozeLM4aPyR4bl232
- TLSH
  T14791515327D42A5141725165BE4AB3932B29E068736C0FD678CF500F30CAB684EFB6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32