General
- Target Terraria-SteamRIP.com.rar
- Size 626.0MB
- Sample260811-13ectadr5y
- SHA256 56979823567601e17ec0e5a0328b3207a129697295d51824b737fe51d77ff007
Malware Config
Targets
-
- Target STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/CUESDK_2015.dll
- Size 256KB
- SHA256 a31f57ae86b6fbced20f01a7d30687d57a2854822c446be631ff25edc40317b5
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/Content/Images/Extra_185.xnb
- Size 5KB
- SHA256 abf71351aa409098bb7e9f8f6e528b044dfea475d2798d18a700fa62ea890861
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/LogitechLedEnginesWrapper.dll
- Size 17KB
- SHA256 d6f0d46f86fd144114040b29ebe7ecf3dcc64ff45c402db623ad0a07888c34cc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/Microsoft.Xna.Framework.Content.Pipeline.dll
- Size 530KB
- SHA256 1ea481da62eb9e66bad8589df83f173725e62d22362801e1264cd02347721c69
Score3/10 -
- Target Terraria/OnlineFix.dll
- Size 8.9MB
- SHA256 7b770f41bc531de7edf3437c1c80e6029b72093d7db4307e03bcb2e2b027fb29
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Terraria/ReLogic.Native.dll
- Size 97KB
- SHA256 0c132a8967c4cf437b3edbddb00f8e224b989ca8b90252fd965f73dca7f531a0
Score3/10 -
- Target Terraria/Terraria.exe
- Size 24.8MB
- SHA256 a89a24c6531d88a972662821044acf1b3b5817621dd6c81d4bd7523bc4bbdda9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/TerrariaServer.exe
- Size 24.2MB
- SHA256 d619a3cf7bae037961c021e2564d214948304d576b306930f25351685afaaca6
Score3/10 -
- Target Terraria/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target Terraria/dotNetFx40_Full_x86_x64.exe
- Size 1.5MB
- SHA256 1a1e67809c73cec352fa6a2cc86aa8d09fb41c1d39db5ca8a75f8575f1acaf10
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/nfd.dll
- Size 178KB
- SHA256 1610aafa510fa776db62686f3ba7ad55abb535ec97f9d18a40fa13b548e1b22c
Score3/10 -
- Target Terraria/start-server-steam-friends.bat
- Size 145B
- SHA256 162e2b50355f931f2b3004c4c3ed3a6a588d6f9fd66ead9e7c14e9bc31085955
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/start-server-steam-private.bat
- Size 159B
- SHA256 50fabafc30cc3ee37e353dbc05c25674877abb9625fe4ca4668105b258df366b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Terraria/start-server.bat
- Size 123B
- SHA256 131e7ea3f8e4ae359fef01a689ec0c6e113752712cb86624f5705333ac6a41f3
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1