0a7a18b466e4cabba5e7f6ce977ba6b1b83e83c2326040f59434f8d6aba8d10d

Sharing

Copy URL Twitter E-mail

General

Target
RimWorld.v1.6.4871-P2P.rar
Size 473.2MB
Sample260810-p9kbvst1as
SHA256 0a7a18b466e4cabba5e7f6ce977ba6b1b83e83c2326040f59434f8d6aba8d10d
MD5 e51d37428b4b39b8804d729065450077
SHA1 b24544aba71bb1351a101cc3c53919745037fb96
SHA512 c0cdbd29e92528e8663c27a3ac64ab721b96979d305289b317b2ef46de426b2a406ad16dc4660fc20f082ef29b2a6b7cb4e020d8aaa97f39a440decc7442ce74
SSDEEP 12582912:xxtL/x15r8/EP0bfm9noH7ckmiHcyzinHeVpDJKOC2i9muI3m:U/i0bmoKUbLS9muum
TLSH
T1B63933F339DC0D8FA64995362584C7AF42EA83A4C9D380125D2D3863AB4C64D9D73EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  RimWorld/Data/Anomaly/Defs/HediffDefs/Hediffs_BodyParts_Prosthetic.xml
- Size 30KB
- SHA256 3057ae755d88a1992a5f09c106bc7a6a82e54fde25a057c83a5aca1016fe3b7e
- MD5 4b99733d127e86447161173530dd3bfe
- SHA1 a5eb41d045d2911efcdcbb0fe46c598fecb91457
- SHA512 1c745fc5ee8cfaf451a01507c0e896000ee4163a6c960cfa2e0a3c30813214195ce8ad729b32b4539066bd31617d314ab3be16e197d390a612a01a16c23a73d0
- SSDEEP 384:8tNAtlU4Fe9Po4PbAtlU4Fe9Po4PVyZy7T46B0hq4dIY60KZHC0SHH0H94Jm02AP:HRkfaRkfGy7T4y4dIh4gs
- TLSH
  T103E243109AD49922007E4225DF1545A6CFF2C287D70B9195F0CF839F2F76C9A9EA3738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  RimWorld/Data/Anomaly/Defs/HediffDefs/Hediffs_Global_Misc.xml
- Size 46KB
- SHA256 2a10915d94d6815b736f9fb16db95171c442bfd2874d85a36c511d3ffdbda6fc
- MD5 e8fdea5e4bc1d302295482f08feeca9c
- SHA1 3401a832d2988e942e89c30b0a548b99d019186d
- SHA512 dc240d418ed1b7a8ca1f7380d34eb934164ab94a41373f803cb38c212e6bfca47517051587e07a97e5b0214f9f6acf9ac82cd38170912bf67c48dfe3e671d3d8
- SSDEEP 384:GyxX7MHdnXSTOcij46QSrQOxzadQtnLxA3Wy4Ii8nB17mT4LsbQ4+24b4ItqvQbC:75IrQOxzzLxAm4LsbQ4+24b4kDGJ/XbF
- TLSH
  T10B2363205AC09B6644730215DF215021DF729283DAA693D4B68DC7BF7FB4C9A8F6793C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  RimWorld/Data/Anomaly/Defs/RecipeDefs/Recipes_Production.xml
- Size 1KB
- SHA256 8e7ee60f8df7082bedf061069f3c04dd88b923034e2dc067bf0382e3e154d492
- MD5 fc1e6f38dc20c2f4fee4b45064f1e7c6
- SHA1 29247968b9de7c345561398ef56121657efae93c
- SHA512 7745ced672f8c5e8f0b95406140b6d5ee8db43420afba4ff639f74d5dad94f53ffae3139d8393269f1511a2ce3f3bb4f29b62716ab18587beb6167fa1c5c7338
- TLSH
  T15B218E4267E8A090603AD099EE125D3DEF34958B921B52E0B08DC62F3F7180E9E9736C
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  RimWorld/Data/Anomaly/Defs/RecipeDefs/Recipes_Surgery_Misc.xml
- Size 4KB
- SHA256 a35ae3c3b969fcfab67ffdbb7b402327091f73672cad60d05024326d5bfaf91a
- MD5 3f82f8c2a32b611a04496934788c2ffc
- SHA1 7ffc7e1d13bcb904b0d32b1b099041431e38b4a4
- SHA512 0e28f06280a00b580c4b00edc251f566c0ea1dd5de0cfb19f81a5ce30b5ee879e785987c538eeea4f0ba0edcdf257071daa15b88abbec9cadf69312f4ace59ee
- SSDEEP 96:Cg7ZzywTKVaiquKhv4EHuF7hqZeLJnRaiy3UbjIJKKsKf:Cg7DiaiqcEHuRAZcnRaiyyEf
- TLSH
  T1EA91BA258BC06280647F5196FE00067AEFB0C3DB520B9494F49EC35F2FF59269EB7629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Buildings/Buildings_Misc.xml
- Size 53KB
- SHA256 d291b1628db420b3ca00e9b5e598ff03e3e5c9c0da3df50c02e71e2cde1f99d3
- MD5 379033efe4acdc7a538be10d0aa5b95e
- SHA1 456e0daeb94ad57f8eb19308f595079624bf6843
- SHA512 ea3d9772bc05bc9fc0acf0ef3c2386e31be8ec9d1491ab8c602d57d8ce9aaa4f5f6e47da8c536a8cf4152fb74bc437ce2967d5a23178d5ac1f6f9bcae7c35c32
- SSDEEP 1536:yWsk5cSfBmflnIPqK1bZWU5MSnBlflnYPKWO06NFhx4iQhxnkXUe7AG128K4YusM:dsk5cSfBmflnIPqK1bZWU5MSnBlflnYK
- TLSH
  T1A7337411FAC5665542B2922ACE715263CF91C1A3C24B86ECF18E436F5F32C95CE7392E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Buildings/Buildings_Obelisks.xml
- Size 18KB
- SHA256 47089cd3e231712efac2c5c39cbebd5e63f78bfed89af4a226db1603a02200dd
- MD5 f2272e0d775a192e8f3a9c9380d04d9a
- SHA1 3aa8cd9fde8d16dd6d36be5d7a80b1f338120b0f
- SHA512 5a67a077248a285df63661da3d92518c685804777eb9b7e031845e1e12874018014fca7eb7018599a7f14865f1b9fdea1f33c9f91019b3874e6b6a31c63228e1
- SSDEEP 384:Z7OF3clRtLbDGT5SsAcAHL82LpHGW5InAo52BL8SLRgGW5A/ADAKClLiNI+AW:hllRtLbaT5f0HL82LpmW56ZMBL8SLRzW
- TLSH
  T1F582731076C0317C46370277CA205AA7DF51D0EB116642E8FD4E6A6F7F32CA186BB62B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Buildings/Buildings_VoidAwakening.xml
- Size 21KB
- SHA256 216127d95f16ac18fcb666c003a2fb3cbd35c49bea374f8db715b4f1ef5fb756
- MD5 f9d3a1abdf1f99525a4b4742e949fb03
- SHA1 de7a8ca3921b50cabaad7dafbccf7e8349be821d
- SHA512 11473f5e4950794751a8c7f186cfb9015fcc38d8401554a5b27bf8b94215c440991d90f65414c2e0f929f28d9a13cb39fadd7515bda276dcced2c4661b45638d
- SSDEEP 384:+TbJsiveVL+6ZnvHUtybgyGa1R4Kuqfdhn0Jwt/NO:2JsiveVL+6ZnfUtybgyGa1R4Kuqfdh0V
- TLSH
  T130A263217DC1B69455B2D26A8D351293CF10D0FB920B86ECF9CD832F5F358A1DA73A29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Items/Items_Various.xml
- Size 26KB
- SHA256 8fbb565ae1db8de976e16ade62dec2836ca3f59d8da0a7df20fb219b85a21c67
- MD5 78097be19c9306656aa2fce9af743a35
- SHA1 b5e806850faa07ab74a99ff9b128870c31647e88
- SHA512 155a6e9f059370e6b4689519d74b882844c608a83905f6197a40ccd17349f0f6e9723f9f444c181428e8bbf42d7abd581ee5d4b5719cc23308dc305dab1c7650
- SSDEEP 768:oXUybGgKU7LJ15mdA6wtqN507Oj33wd+Nb2vuYXckMHOV3OzMUtqW:QUk7Lf5mdA6wtW5dfbAcRMUtp
- TLSH
  T146C2D914F7C072284273522E4B24116ACF9181D782AF42A8B98E432F7F794D45B77EAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Races/Races_Entities_Misc.xml
- Size 52KB
- SHA256 393692536e5a24caa03ec94530a979084e4bed1aa7c851e90b0280daa1869004
- MD5 a71c9f0e379786d0ed473bfd511c61d7
- SHA1 7eeccc28d742074473da35e9bd2a8a0e51753f5a
- SHA512 eb3d8572b1f3deaff0672154f4c07d3075d88cac32991e56caab100550f7a11615b2a317fa5d3336249ff11ff3549260e985dcf2cb9c470595b7ea59a1872fef
- SSDEEP 1536:ytCM9Nt7I2D+t/tetKtMtnoWt8R+RNRmtv:ytCMnt82it/tetKtMtDt8tv
- TLSH
  T1B3338260E3C169168571501E4E202266CFE2C0D3D24E82D9B1DE876F6FB8C961E97F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  RimWorld/Data/Anomaly/Defs/ThingDefs_Races/Races_Fleshbeasts.xml
- Size 22KB
- SHA256 f3dbd5c5366cbebfdd43b41821bfedd3ff6da3959b832106ff9a32ac169d6988
- MD5 c81aa4c7625c160265c74d233e26a1c8
- SHA1 b14bf682ef492a562b1a182e361cd239e54f5861
- SHA512 b42bbfa69571ad6741275747449d7c4a3330fbf0d955e58dfb929e00b38db74b5c580427e4d279ffd75374a842bc7c328c1e7256c4dddf783f52d8fde593e12b
- SSDEEP 384:Gk2FNP6SrvNtcImdWZU6toEajt+q7aG5wjKDn2Utnaa/aha:+tM6toEAt+q7ijKDn2Utn3/F
- TLSH
  T14DA25359D3C164098436910E4E9161B5EEE2C0C7C24A438AF09FDB6F6F78A681F67B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  RimWorld/Data/Biotech/Defs/RecipeDefs/Recipes_Surgery_Misc.xml
- Size 10KB
- SHA256 fc8ed24d74b4cf16bdb79b4506b26484262d4e67598a02abc57fc2200d6874b9
- MD5 84f911d141b0e73f908fe6349976b177
- SHA1 afe93fce52a9d68d12f17cc8d6249672f8ef61d2
- SHA512 07d96fa6e1457b64eec1a4a478ed0689a33e8b442eaff24d6e8b1bf30f53b2854c0e63b2814a1115b90c3794abb7f7bf67dc874a56e2d462e19167e3102983c2
- SSDEEP 192:/e99IAf4aohB5OLKXWdkg8+rw/b9dkmxhpBd:Uf+OOGdk0rw/b9dk6hpBd
- TLSH
  T1A922D3224DC06AD4A07B02A1FF000526EF71D2DFD61A5080F49DC79B3FF69565EE7668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  RimWorld/Data/Core/Defs/Drugs/Alcohol_Beer.xml
- Size 16KB
- SHA256 23d8a68bb90075de77c019fb964dbe122798049b9bfb7f5daad4eeadc9a1b211
- MD5 80d8e689b1d672e05e09e669bd73f706
- SHA1 761e88c6bab82fb94874f2d1b1e04c43ca964848
- SHA512 fe0fc38f09af4a529f6774ffd186cee5d513194a8db184aad7e3b08738a5df22192d45170b2d53b0d73410fc7d2459223d537b2d683f0dac232657a03b261cfe
- SSDEEP 192:CIz1jY9ww9wdMziSAEa8yTS7tItTNW5V1r90rSPkqyeVtcw:CIz5gww9wd4HAGQWtC0jryrSPNRth
- TLSH
  T1C5721D20A7C0A95280B784199F2551B5DF71C207E64A83D9B19E836FBF74CD9CF83A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  RimWorld/Data/Core/Defs/DutyDefs/Duties_Misc.xml
- Size 26KB
- SHA256 9bf1aa50460348e62d1a2f57a001b7086666839ab8824d488133b7f81967a88a
- MD5 78feecd7590830a28ee0a637e1ea6777
- SHA1 51b323017e59639b98e6103542ed4bfbe1dcd234
- SHA512 0d7e5189da93faca99c7c732a114a1098f5a191c6c012f3a8ff89f66d28368e3cedf2adb5f361f80f1d616458b27c929ff4556ebd4e34427937d490151b41ecc
- SSDEEP 768:JHEh4UelQlgULGXeJoxyOMIwiJUybKg1YvO1OVgtqfUgiK:RBUK4rCUhayiK
- TLSH
  T1A3C2EEA323C951A3273B5196ED648AE4FFC5C093C6264264B89C376F6F32C1A1D03E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26
- Target
  RimWorld/Data/Core/Defs/HediffDefs/Hediffs_Local_Chronic.xml
- Size 17KB
- SHA256 1d0f971eb2f325498d0d0c32391e6e7909d84a363b0e260a4977176e3102fa30
- MD5 0f879f201cd3815a165522bcf0a209d9
- SHA1 66205bf0c1502c699462028be172b2087ba3e0e1
- SHA512 cd3cf92d374088f896729b9cb8a65e9e407c3fcb94c66e10018c6418b4461bc242d090c29a2ef56b22f2accfc1cb6b564f8d6e17945d2b0cede21318b2555dfb
- SSDEEP 384:DW/H6qAbKwJS0AR7QHrq6RXD2XTXHXqX/XKZDb7oOCI:PHJj+XTXHXqX/XSII
- TLSH
  T1A87223210BC74A1742B74619CEA01561DF33C28BB685C2E4F05D9AABEF79CCA8D5393D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  RimWorld/Data/Core/Defs/HediffDefs/Hediffs_Local_Misc.xml
- Size 9KB
- SHA256 ffe94286656c36b4458e5e10961df0299d1dd46a0f3305a95b7f7ef0ace822b3
- MD5 3718284d5f1e7854d8d146564391d61e
- SHA1 e1aa1616ddee74b8906b7a4bf5dad71d379d927f
- SHA512 6d35ab728092ffd875cea5ad579cdbe25babf671265cdff3043bf252f1cbec09fa887e2b47d7929a72bef82ef51664e5e9864b0219f500d83f41c2472cfa4fe9
- SSDEEP 192:t6IV7DjEZujJ1ciTRPu4jJJUU2GU6gz7FOBE3:JYkDcid4UJ875
- TLSH
  T1052240225AC46A5B403B0255EF154069DF70C24BA60A82D0F45EC7AF7FB4CAB8E9373D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  RimWorld/Data/Core/Defs/JobDefs/Jobs_Misc.xml
- Size 24KB
- SHA256 537728d9066def61890253439953631e86afb7f2d5f08501a2a70172bcf5d714
- MD5 81b26c62dc9ab1a232500920171a6da8
- SHA1 9a1b98d13708bca2a5f24660bdb5f0148bf0cc75
- SHA512 22f386a1c2f9fa94147fad87b61269e853136bd5defddc4fb128633c6373fa7b22823180a0ba45a8c1274b3ac29ad86fba8b7ea30a4443c1e804d6e0e50b290c
- SSDEEP 96:kfGHDGhiKtGuGoGoGsGSonGSohoxUvG5Ge/f45bAGopShKbOIrgnaGIGbI3l4k9X:qiKGUzVClWOYONCNU
- TLSH
  T11DB26916ECC8BC98D5710262BA821175EF42D28BD3B2D894F45903B39F79A8DCD63B1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32