26e690ebed2a9cd716cb685ca57df36711a7a5d583c1b51fb4b9c44ae7df254d

Sharing

Copy URL Twitter E-mail

General

Target
RimWorld-SteamRIP.com.rar
Size 517.5MB
Sample260810-q71rhazfjg
SHA256 26e690ebed2a9cd716cb685ca57df36711a7a5d583c1b51fb4b9c44ae7df254d
MD5 af692ef55350bff6c334c0e030910000
SHA1 8beba40f5e9f4bb73e16e05e4ab0d2327fdb616d
SHA512 d373152edc8cd4ab742b90afe7c3bd8ecd8d0c2d6df8a2885721aca0b25edaa12a737b3867433b5070033524d99e02e840cdff8042ae4f624e929fba8af3325a
SSDEEP 12582912:qk/mjIotFBTTHgnZxX8SERPixHoE6Q56OZ:XmkevnHANERPzE/6OZ
TLSH
T1AF49332701D18B4F8490E502226359CC4FA4D1A63D9F442BF59E992AB81E9FD4E0BFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  RimWorld-SteamRIP.com.rar
- Size 517.5MB
- SHA256 26e690ebed2a9cd716cb685ca57df36711a7a5d583c1b51fb4b9c44ae7df254d
- MD5 af692ef55350bff6c334c0e030910000
- SHA1 8beba40f5e9f4bb73e16e05e4ab0d2327fdb616d
- SHA512 d373152edc8cd4ab742b90afe7c3bd8ecd8d0c2d6df8a2885721aca0b25edaa12a737b3867433b5070033524d99e02e840cdff8042ae4f624e929fba8af3325a
- SSDEEP 12582912:qk/mjIotFBTTHgnZxX8SERPixHoE6Q56OZ:XmkevnHANERPzE/6OZ
- TLSH
  T1AF49332701D18B4F8490E502226359CC4FA4D1A63D9F442BF59E992AB81E9FD4E0BFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  RimWorld/Data/Anomaly/Defs/ThinkTreeDefs/Noctol.xml
- Size 2KB
- SHA256 fd34983f2c64fd5b5add61571677b42483f3086d8eb2b5f7fce1625e5369460f
- MD5 8e5e6730f8a423e1ae734c549ce63ffa
- SHA1 9d3e6c7c1d0f31f431d079cd454e98176d7a84a7
- SHA512 d9b59d1a1df00cd5b6e779f7fb3f8bac0c5da27559e0725f9a60372023c183f51b6ce16cea24edd3ee8379f80fc3041730e6cf5895467809a3dd2f5150a493e7
- TLSH
  T1C651AD0201C651633632C593ADA0D669EFD5806BD66E82A2746C3A1F7F33C162C83ADE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  RimWorld/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  RimWorld/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  RimWorld/RimWorldWin64.exe
- Size 651KB
- SHA256 4c30e2105b49f2d0130f5d861947fbe82b866042299da48ef1c8cf6979a8564d
- MD5 39f107552a7312b8abeda6612cf73d78
- SHA1 41e8a64483ff7ac0042129eea68a2653e2626fd3
- SHA512 d12860e5ae8b40b420b304a07d4ec1c165cf6de02615b8331822fe5990e5018bd4f1668c826ac62b61ecac07f47f61743f2ec66dcbb219178c7f91d0a9f7b204
- SSDEEP 12288:s/744aOD8fyHAHDHHNHHN+rolBH5H9HWHHUHHu7:W9aOTHAHDHHNHHN+rolBH5H9HWHHUHHk
- TLSH
  T186E42A93A5B44655D290C27288A1C2BB7B2C1CBDA15161BF3AD0FE1338F96838D1ED7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  RimWorld/RimWorldWin64_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 78KB
- SHA256 ea2be99f11e65557da06bb5b8f9010098f37608de13f1c582e705b0dfabaca60
- MD5 14061deeed50907ff44e12f676b88e0d
- SHA1 f2c567e72ce1cd1d7bb1401c9d7ef167dc81b463
- SHA512 387f1bdd1eb1ffde0ae34f27baa533076e1a1a1bff4482a338ec2dd331dc96e279fdb762a91c80a7342dc36ff05a99285c5c064be9317f53f195ee26818d656a
- SSDEEP 1536:FVw2aZM5tWCrutyzhKSDYCfYCHXZLP34hqswC0GepLzkuOfiwh3HX+xR:FVw2RtWxyoSDYCfYChPIs801Uiwh3HXa
- TLSH
  T19B73E965B2E499B3CABF4EF915384D01B3B5959F242AEBCD6CD628DD69E7BD00810303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  RimWorld/RimWorldWin64_Data/Managed/Assembly-CSharp.dll
- Size 15.0MB
- SHA256 8fd7e750a38a856b87004af7ac91363e8fbfe7c6e362030970fd91bd6e7c3505
- MD5 e9641222d6d7b54398dfde1237b063e8
- SHA1 843441ffe27c7dbe7b0052fcfb9792a86acd5932
- SHA512 89114bac3715e4fdf57c830cc720548a1f0a7860d2cf36a840d09365c1ac748b3902cd830356cb08eb247ec8b9560d9fee0d8889e7203d2c07b4fa325345e63f
- SSDEEP 196608:OMA1x7TMv1N3eOmVijxq96U6mBURn5xXX3w:90x7OM9BGjXX3
- TLSH
  T1DDF67C02A3F8CB3AE1BF1B79E536405103F1F86A9B56E35E1918B4BA2D537408D62377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  RimWorld/RimWorldWin64_Data/Managed/ISharpZipLib.dll
- Size 53KB
- SHA256 c517eb6c2185942758325cbd6b0ceba01c705ca0bf2c5827d81c0d008f2b5d1c
- MD5 1b078cba46657abedeb6bb5499fe6086
- SHA1 b1789c5b38f71504630c1b1cede4de23b1084d3e
- SHA512 975ef7c09722e5622a813b2f2d125cb6149e82a1d7aaccb58587b092f9280a8a3cbd0d298422295a9fae45ff46524ee2b51c25cfabc8b2048b93ce1862732931
- SSDEEP 768:zR1cu28BpOKZEr4gs5iDIs5sNzq1/M9D0fn1AbG5lp3LpJ5bcL:9p70s5iDh5sNW1/60NB5lpNJtG
- TLSH
  T16533080C7BF89715EAB92BBDE4B1021507B4F2567513F31E0F4494A62D33BA0CA85A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  RimWorld/RimWorldWin64_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 d29150bcd02ba843f99eedfbd13938e0f2e6b7d5457547efafa485d4d64b4b9c
- MD5 edf587c1ec3d05c026611c1be917cddb
- SHA1 baa93f7a1a7f6a0e365fcef3a8c5a272d878a17d
- SHA512 f8c725019cacdae85a216e8a298b00ecda6c5de3aa1a48937b4dafd32dfe899080a9c33df8e72989ae69862a326a587949bcbba970153cb4cb313df59487669f
- SSDEEP 6144:lUjTQ70cnf8MoVRxS9iJdBF119RJXG2yB+Q:0EiH119RJXm3
- TLSH
  T16B344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  RimWorld/RimWorldWin64_Data/Managed/NAudio.dll
- Size 440KB
- SHA256 0df62f4e48776870ee22450d1735f00a69493d3c2c6dfb91cc4feab27150d6f1
- MD5 0263b3fecc4425d6e60cb418e7bc87aa
- SHA1 85a853c2ed4091a1ec7952d296ca86a3f7b5cffe
- SHA512 2d5abf7ae77594204de7f090cf1d58d3a19fa816a532b5968fe5ffe60937ca06176f8b0390ec637950ca556eef89953120d4498a4421d68904481f6eaf16ca46
- SSDEEP 6144:m4LCokY94HEdKxpdD2xx1q5008kbboovFnctnkpvJfDTSfi0DHonFQbUFrUzxlqF:m4jkYmEd268DDWflsFd7j
- TLSH
  T1C5A44B5233E45A67C5AF6375E8F2092243B2F4563227EB4F1580AB7A5DA37828D407F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  RimWorld/RimWorldWin64_Data/Managed/NVorbis.dll
- Size 66KB
- SHA256 255de9ac2a2a4dd71306b82784dbd067edbed5810564ccaeb2ea2f1994378339
- MD5 014d6dfa271df8e7e57725768392bac2
- SHA1 2189c98232eca869d8431b12669c8dd19030eee0
- SHA512 9844896f84062d14f22cbdd4b571e2627b6b85e34e5d3471e992ab4801bc94ae871c0b11c873c8c70936d3bf2839ff74331a028f41b3d2c4d33caa64d510c04d
- SSDEEP 1536:UiZtqpgCE6U2fHJH0EhCbXx943G/iL7GRpRtt0Z5Xqj:UiZt5CU2fFESZxg
- TLSH
  T1CE635B0533DCCB2BC96E47FEA07A155613F981B22733E399AD40E0E56C53BE096A2753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  RimWorld/RimWorldWin64_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 b8edaff96831e557b1c9b6bd74596255e787ef8b99a67f10bf69838d9a40884d
- MD5 a4e4d1865ed51da744a9e7faac3740df
- SHA1 aa491333c90edafc9dc7737538991b1973d463ae
- SHA512 7821aaad5a51f8a59b6a72c6cea1d225cb327c06141c2f0071217b9a783e6252c19e6defac8b2320ecbe4761a653e4dcd2aeaa98374ab8951a7fae7c2afb144f
- SSDEEP 6144:3kwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:3kwkYfx8ZNCxL
- TLSH
  T1F144281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  RimWorld/RimWorldWin64_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 405e095bfda98fb2d3c86016ec14a0be6b67012943b656406e626d9954b87e93
- MD5 2101dcf2792abf5fd57d756d8e964950
- SHA1 c7add384ab245479d91f7b5fc80c36be509f644f
- SHA512 349f6925b96996fe2f11f52ddaa8d1b32df1fc3ee35fda17177eadbd0fcd6cae01ba84775e00e8184fd1e6eb7c5282171e5e2d1beae667eb9f811a4ca6a0e857
- SSDEEP 3072:tGHTFkizuGCOE/htnREcacWown5WJGL0MIePgNe:tGHT5+H/33vJD
- TLSH
  T153C3F92563EC872BE2EE177EF8B515110FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  RimWorld/RimWorldWin64_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 e0912bd91fb1836723e7c838ed666e070b98fce3d40aaa0c1f1aaf409f2fceb4
- MD5 34d783f2e258929e9aef19ae110b5742
- SHA1 b04bf864525c719fc8fabbb6b38adf42d21771bf
- SHA512 a7cdfcbce735855615ecdfccc00920297a9150ced04357f358bd343d2372b6f78e8e4685ba9e93af3f3ea3ea778fd2347683f2b78f31493ebd74268951c87caa
- SSDEEP 12288:0WK8Xi19FV57751umv0RX15PgLdfJ18VjjvM44hvetIX6e+1xHzR:2l/umv0Z15PyC9vMNV1+1F
- TLSH
  T1E3354C01B3EC9B27D5FF7776A4B442A007B6FC46AB3BD78F104891A95D56B008D887A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  RimWorld/RimWorldWin64_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 226d97289e858be298eabb9291ffd662796a984d900f70dbe9b46920c6313139
- MD5 5132e1d3fd0381b34538920b8836db92
- SHA1 bbf0d8e7e3d6aaf214af1c80a0413144a463a563
- SHA512 93fcef80dce9e41f04774c183fbeb1e5bc9e4eae1e3659f33e06d553f04f89077f9a4cdba312542902387756d909464b05566203ea9cc40a051e770e991bde87
- SSDEEP 384:6EAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOx0snRbli3ESmMadMkrVr5UhH:6cZC8Ll4LiMXkv2Y2McdSsj5Q
- TLSH
  T153D2C815D3EC4311E3B727B5BCF9518A8AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  RimWorld/RimWorldWin64_Data/Managed/System.Data.dll
- Size 2.0MB
- SHA256 35aecd3e8f9c4de96224c708fc3f56fdff99def96d49af36e10fe1cf0066bb42
- MD5 87a874a6b8160f2fd07f4be878386d40
- SHA1 99f8e54ed87a20ac48f7d3ad1b0852c9194c9179
- SHA512 476be5a97e556db95197ab1802e08f744a5b729ecbc58101034e60aa76ea6682d95e1d75edbb11877f5cac45cede51d89bc3568bb4223b8828dbf9347ab3fed6
- SSDEEP 24576:sTy8NQuznGO4TiWB1V0Nt8OZUuhHwjpj5zuctRoOB4M6Q4cggyT:Cykz74VHV0MOZUsgoOB4M6i
- TLSH
  T1A2A5185077FC5A16E5FF2B31A871101567FAFC16EB72D38E6508A17E1C62B508CA23A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Network Service Discovery

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32