565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86

Sharing

Copy URL Twitter E-mail

General

Target
Cosmic.7z
Size 179.6MB
Sample260811-as1vysbe66
SHA256 565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86
MD5 f86320193aac60a1ee83731cd2cb799f
SHA1 73cc0d213713a885b477e1ca4ad5d8d115224969
SHA512 6cfa2d32f19a3d6227e90a81e43466d6dc48d5af92d0df6ddd9fd3be41bee364a4d39f8c8a6a59cb5d32ab39b59299e428da24fc6dca75e40102082cabe4e91a
SSDEEP 3145728:nnq6261DKxW+lKgzMBB7EeVMLVOqjgG3tW53ni44LbdDRvch4z2b9JiH39a/vVjJ:nnq6V1GIgzmBgOMLQ6t4c44Lbdltz2DN
TLSH
T1449833467583CCF6C4D5698E280E522FED313C3DDB36206DA0716279CA3BAE74B4999C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Cosmic.7z
- Size 179.6MB
- SHA256 565b5881bf58b3837a53f24a37825f2bc4cfa56233d660ecf45377c00378bd86
- MD5 f86320193aac60a1ee83731cd2cb799f
- SHA1 73cc0d213713a885b477e1ca4ad5d8d115224969
- SHA512 6cfa2d32f19a3d6227e90a81e43466d6dc48d5af92d0df6ddd9fd3be41bee364a4d39f8c8a6a59cb5d32ab39b59299e428da24fc6dca75e40102082cabe4e91a
- SSDEEP 3145728:nnq6261DKxW+lKgzMBB7EeVMLVOqjgG3tW53ni44LbdDRvch4z2b9JiH39a/vVjJ:nnq6V1GIgzmBgOMLQ6t4c44Lbdltz2DN
- TLSH
  T1449833467583CCF6C4D5698E280E522FED313C3DDB36206DA0716279CA3BAE74B4999C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  HOWTOUSE.txt
- Size 419B
- SHA256 d637a646fd608502dffabb60550cc65d0fb1a081c789231de552bdfa22134a43
- MD5 dd3fb4d9c038e16e26476fa9792a77bc
- SHA1 cbbebe8750241d321181d64c4d6a0757e1997db5
- SHA512 b294cef5c06916dc4b82b9a247176e0417c91478f8c2f3bfff061701059db66aeb630c2e41348e5534ad2a8ef7a2f25f6496cd3c24c82ab2d9fb2c8d7d6dcc20
- TLSH
  T164E0ABA7F18632B7702112ED1BAC0AEA6B1A3ACF001F1900A058B3180FA4709B1871F1
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  UI.exe
- Size 16.8MB
- SHA256 d182e90cd23d0a49c09714cc354de34f9ae73673a8cfd3d1be2219f0d7a9bd38
- MD5 c47650ae80ea6f01b31c5e66be2a79f4
- SHA1 ef487390ae03b7288c94e6eb74b60a5ebed3d35d
- SHA512 6bfa5840bc413a97202094decd99d456f8b6c416c4d0ff6ab009fae28c9047b74459f9ce4cdda539cd6180a10d03cdeba96d373035832a805b3535edd1ff3a71
- SSDEEP 393216:P7AsyOLF2xBsuphiF0cSU+uPaayFsmkTe:P7AsyOLF2xBsuphiF5SU+uyDsmH
- TLSH
  T17A0718257B5A996CD19BC47483478AA20A7030DB0F39B9FF548596383F79BF46F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral5 behavioral6
- Target
  bin/Injector.exe
- Size 15.9MB
- SHA256 5be1c4f31ff25fe4b07942e2b1e3751049f9dbc50986fbe437fb0a4fbbf5ccf8
- MD5 4b585b56457400e92bfa71ad8bc99f0e
- SHA1 9919070a5ceaa9d5f70754f101a17fe3024f2253
- SHA512 d4b080a1ecacbe5ed6fb87a4fc5fe5d561868e769c3cf0f2e901ba6796ce07e18acb222c435c6df9bbd6965eebaf90563fe10b36e5e85e7332e6941bcc66a8c6
- SSDEEP 196608:/awnrzZtTMia3xV0f7a+j2Dzz3DRoPwQBqFJ9DLEcBnuCs5pzjL388n5nK:Xn/Zt9a3xe7R2DzzCIE0unp3Jn5
- TLSH
  T133F68DE730E3A6DDC506C5BB8352FD7FCA8FB13A051AE8A3A218B1159E27C507614F19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

themida
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral7 behavioral8
- Target
  bin/SecureEngineSDK64.dll
- Size 28KB
- SHA256 a989c8bcb5f111fa6a2e538c4c79c62be515f1713b2310cb9f60c58d6536166b
- MD5 92ff442bee98d2df4c2bbc2e8a3e019f
- SHA1 95c7637bbfc6c1ba583068769589c7ffc5a0955b
- SHA512 9949f6e7eab3e2fd14f276ee0fac83ddfc2be40ca668c15f0c3e897bd3e7517fad04e8966d022c1efa8605cc14629d71943af1eff9aed1633206d64feede14dd
- SSDEEP 192:I+Ai08s5GvuxBdKKCeotPpWZlNCryWlHqX5xS5haBWUcSAfMVIBizxUv:I+AdZxBnCeqPpWZglsfSgA0V
- TLSH
  T1DCD2ABAF05B56EFFFC0D0CF4058F3A9822C3F7D22DE48669276E458541EA81B651F289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/lsp/docs.json
- Size 6.8MB
- SHA256 e7415a539374bd04a347d5eb8ae445fd80eb7044df1a9da4f8feb055c7155952
- MD5 033130529fe198288372e1864f9ecb31
- SHA1 c0ca7cbd8f063a9a11d01c85b176eb92bbfdead5
- SHA512 1268616544a8a6c1f1650848bab706a5cdf0722a0e9d7a1deeb797158ed23b40086462cae7e24ecf08674c70714eef001ba60519ab2edbbc6801a40852af89ee
- SSDEEP 49152:NcvOmlo/aZUJGYbihxzWwvke9vJtwG9he/K:o
- TLSH
  T16466CD72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  bin/lsp/globalTypes.d.luau
- Size 799KB
- SHA256 816a806309ca4332abeafda229da1fbe8c4378c30039f50c9becddb50e541ffc
- MD5 6efb4de7dd2784f917b91a41de522aea
- SHA1 a701758da88c9c6a37bdde044eac5913b8fc0bc9
- SHA512 f48cea0b828258ed350129de76358e69ddfc087542c03571dff83dc4c0d467ed677c8975d0b0f7ebf7129b0aabd5d09664026554fa56a2556287ab2e1c5068fd
- SSDEEP 6144:6Mk1ZUqKGQqF2CZIzBXlyvLbtdxQc3zVvD5ObRGyaIFY/OSRlXAEAPpl+m3TU2AV:ixQc3zVvD5HDnXXYw
- TLSH
  T13A05450DB604A130594F53F66E9F8884ECB5D2C5612C90F494FCBB461B7F83E26A6ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bin/lsp/lsp.exe
- Size 11.1MB
- SHA256 911203eb5acaaade326eec106b48824f64881269c85513fdb30e6455d9e6d721
- MD5 f8c9f2f036ac7c6e8d100834b5c49ee6
- SHA1 421a756eb507ab22a3e5c714231c2a5d7d22f2e9
- SHA512 6c0ba341633e3b362beabc140d73c88dde88c9d716f80e88d2164fd38e6ed826473e0aeb450a735f402963e196fdc974d3adfb9d643844b8a576a7d01a5d268e
- SSDEEP 98304:VKETtoj3FI6XomceAPRHB7YABv0xn+QW0WHk:cCSjFIWXAu0QW0
- TLSH
  T147C66D77229C01D8E0BBC07D8BCB9E93DBB2340903719AEF05A045565E5BEE95F3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/lsp/sunc.d.lua
- Size 25KB
- SHA256 61dbe3cbbcc60adefe1b8fad53560d83893fc60ea93fa1ca9ab3a548b5593089
- MD5 0125416ff324bbdf84633babc980d427
- SHA1 5bf2acd0027c8859127690a53e60a821f5a481b2
- SHA512 1db0ae12de64e4e1eb3e79c8a9dd7fe6d75523d83c66df01d125701b71ace6551586265748d390a2af6b4579de5064705ec7642f5ed6bc6d44af7e5d4232b0ed
- SSDEEP 384:n6WH55qkrzzOzWjylahPuh4yEF82BC41HGkD6FHPYgPpxA2hsn4x:KgzzOzWgahPu8F1C41H5+FQ6Zhsn4x
- TLSH
  T124C2954AB740B37289671313F5AF624DFA799159232120E8B5FCC19A0F3247D42BBD9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  bin/lsp/synx.d.lua
- Size 1KB
- SHA256 0392122f51e956c0ff3e7c5dbf3b3e3bda72d7ca7a19cda319fb43cb4c859fe2
- MD5 f7a1146486931e0420605a58a6df3f88
- SHA1 d0e94c89b174805d0af4edeaefec1ea2967765bc
- SHA512 3642f4de759c8eedb8eb226c6a4a50f09ffe9be12a863d64e19bbb17d6a2d3e73e3f0b9864266c50faa01ea891e08b6588ca038678ca1b07313bb3919ceb4f17
- TLSH
  T18B3146072F89A3B295F14743D2AF41F5AA234713361540B7F4B4C1961BB607CA6D2CCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  bin/lsp/version.txt
- Size 6B
- SHA256 21a36273381c898a80859d987c4edd6ae3af899e9512bbb614ad40aaa8483282
- MD5 1c7f99915702968bc5af5e61c488dde6
- SHA1 4d8b0a0af3639b44b988b5b83a46447407833c95
- SHA512 c16ee491e8b853a84c30e050fb8bc8077ffc09a77e643f4fea11aeb4504c45151fe4802f27e37eaccde2789ca4f44618e5652390b6d9da03870cc9ed0971fcb3
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral21 behavioral22
- Target
  cracked-version-d584fb6c717a43d9/Module.dll
- Size 6.0MB
- SHA256 204fad9ea15e3359f3b4e1a7b4d549952b90800d698030126e46e158a2f1128a
- MD5 3c003c36eba98291c2d75aaddf020f60
- SHA1 c10e920e874861f4a34586076daec11b3bc5ac87
- SHA512 ed60330e42002ef745f2f506b31b3bfc978ed1429904c3669d1f07e8ea9cac8e9cebb14814536302b79be5cc1dd0dc9917aa533468987a9d089b97f60b458ea8
- SSDEEP 98304:ttKWa/1sov7v4MX7hu7g0bGAjlUeCtygTL:fKWaHv7v4MX7hu7xbGFjL
- TLSH
  T14A569D66B3A102A8D93BD1388B53CB13FBB1B454133197DF16D0469A5EA77E02E7E390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  cracked-version-d584fb6c717a43d9/RobloxPlayerBeta.dll
- Size 18.7MB
- SHA256 76d0be8d9a54e665e8ac577cc46dd7650199c5c4c0e519e3eb7a493704d095f3
- MD5 27944446b8aba263df91b496302fb5a8
- SHA1 325e59923577c5731840b5fc95665012516e7226
- SHA512 bbe8b8532f4d975e887e5eea17a40954591691a65c08f60ed06a73f4ef81ff3c6b34be2e2d579b14b64c994d97f57841deb1b852992bc562ebe57df70e89c42e
- SSDEEP 393216:AOVLiawKuVXlKEbWe68j0aUygLBmQ4a2Wc1DA0Z:ASNtu3d8ygp3chAg
- TLSH
  T14A17F1BDE68157C5CA156CF991DF3DE6B3C0393C8F2AE4715E1E8286A370110AF64E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral25 behavioral26
- Target
  cracked-version-d584fb6c717a43d9/RobloxPlayerBeta.exe
- Size 134.1MB
- SHA256 46c0e6bc67f78d2898616702d270ad4625a6bdf3fb0afbafe4e6c4af0a2981bd
- MD5 4269ed3be8123ff251761dc24a745a53
- SHA1 4c0917518fedda9a3ebcbdadacc61d7a02de54f8
- SHA512 fa0af08fd4d84e6f56a13bb6c232e0c47216461b01dec78a7393756dfd72200d8e5413ccad8c18901c431b2087756f58f2e088b5933fcc00190500934a66265b
- SSDEEP 786432:vyHPnU7Yx0R86STjQM64HS8o41xFm0qHDivNvrynj8M/dKYxc5hieP+ygFjD8I:Inxt6STjxS47qHDiFvOnFjxc56BD
- TLSH
  T10068BF9AB2B940E4D17AD078DA1BD913F7B13804033097EB06E45A5A2F77AE45F7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral27 behavioral28
- Target
  cracked-version-d584fb6c717a43d9/_RobloxPlayerBeta.dll
- Size 18.7MB
- SHA256 76d0be8d9a54e665e8ac577cc46dd7650199c5c4c0e519e3eb7a493704d095f3
- MD5 27944446b8aba263df91b496302fb5a8
- SHA1 325e59923577c5731840b5fc95665012516e7226
- SHA512 bbe8b8532f4d975e887e5eea17a40954591691a65c08f60ed06a73f4ef81ff3c6b34be2e2d579b14b64c994d97f57841deb1b852992bc562ebe57df70e89c42e
- SSDEEP 393216:AOVLiawKuVXlKEbWe68j0aUygLBmQ4a2Wc1DA0Z:ASNtu3d8ygp3chAg
- TLSH
  T14A17F1BDE68157C5CA156CF991DF3DE6B3C0393C8F2AE4715E1E8286A370110AF64E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral29 behavioral30
- Target
  cracked-version-d584fb6c717a43d9/_RobloxPlayerBeta.exe
- Size 131.0MB
- SHA256 bf384c9f880f4ef1073a3853656adf487f45a499453eec4ace3b4874409cadfc
- MD5 1689587c6587ca3c48757b2899b5c1a0
- SHA1 72dede910f7b1ad2f62295e9bca4d1bf5d3fce43
- SHA512 daa0ba7d3dec17cb1ae48f83115271b368722942b8e66e1440f674d7bc21e6b4ff19048bfa84bc81b4a01dbed558d9103b2ab549db31a29e0b731775c870b85e
- SSDEEP 3145728:Tf9GW2wGUzg/sQGcQwxyqvzRGnxr4m4yfVI+jx+6Bd:b9Grbxk1wxyqvkr4QfV/Q6T
- TLSH
  T1D86802E2F7259AD2D5028D369D5A41C07731ECB04A53E38B36E8720E9D6E1CD8F67A70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Network Share Discovery

Discovers running processes

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32