acb04d1611f19a3ad40eb5fedd2c0614e93858cb9796ed4c80d770dc2d56bcde

Sharing

Copy URL Twitter E-mail

General

Target
Persona_3_Reload_Premium_Edition_files.z_Archive_file_2956.zip
Size 692.1MB
Sample260814-gepdbsdn31
SHA256 acb04d1611f19a3ad40eb5fedd2c0614e93858cb9796ed4c80d770dc2d56bcde
MD5 f8c764c8554a9b85814b189973013789
SHA1 47c5f22728daac62bc4da2115f8aa003b60b22ba
SHA512 aafc514732d642f3196f785ea509a026778332b8a91eab172d54f1f2f721cda39d4f91d6786d11cf3eb017973c6e9992c02c053c23e6708eac1765ea9b1e69c2
SSDEEP 786432:DtTRxYaROuO10X0vXihnPYz5SQH0TZZom:DtNxYSHOKkviVgND0TF
TLSH
T1F9793305C929E5C7FB9376B8B8B0D157C52F50B532CF9155F9AA31F8AD8A9002F2CD0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Persona_3_Reload_Premium_Edition_files.z_Archive_file_2956.zip
- Size 692.1MB
- SHA256 acb04d1611f19a3ad40eb5fedd2c0614e93858cb9796ed4c80d770dc2d56bcde
- MD5 f8c764c8554a9b85814b189973013789
- SHA1 47c5f22728daac62bc4da2115f8aa003b60b22ba
- SHA512 aafc514732d642f3196f785ea509a026778332b8a91eab172d54f1f2f721cda39d4f91d6786d11cf3eb017973c6e9992c02c053c23e6708eac1765ea9b1e69c2
- SSDEEP 786432:DtTRxYaROuO10X0vXihnPYz5SQH0TZZom:DtNxYSHOKkviVgND0TF
- TLSH
  T1F9793305C929E5C7FB9376B8B8B0D157C52F50B532CF9155F9AA31F8AD8A9002F2CD0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.x5p
- Size 328B
- SHA256 3dc62faef97cb56b1e8a5063b21676f844f858dede3cdb41af0dae9af670867b
- MD5 5fe41de69b42df2057a9d1add334823a
- SHA1 c09bd7d9521627db99468bb2e74c7cf20bec934b
- SHA512 e29eef42871c6c141bf5fa04a6d45fe776f1572bd67a74a1a0134e23c6f9d6d46e0a59168d4907c799e00647f1c2ce3c21dac6df309878750365174dd16e140f
- TLSH
  T15CE02D08EFE10EBBCF1727080D94C40CC421E26C4323C819310404C6A76206E4F11AB8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/ZgwenmEjpyoA.9f
- Size 10.6MB
- SHA256 bfea8e7718b4c8417881d37053fd911cfb29cd1c58cb495e84eb06a7a4b29d8a
- MD5 3db81cf7f2fd95a45eb76284df428bf7
- SHA1 034a8a2096de4e2ec193a35d59d60f36733a6002
- SHA512 837cd5b509a454c3b5bc23e1527004c6fb929602aeddc326fcd55c4456395f21d24f35abc6a1ea2b82baa31fb9d6bfd213a6da0ed3f9d29190aa7a823cd1db80
- SSDEEP 196608:rjTqFCA1RPzsCQiMCFTgz7jIUELdLv519Erwvam6RRVjLVSSxiqyZIHbt7UKs0Is:rjTqFCA1RPzsCQiMCFTgz7jIUELdLv5m
- TLSH
  T18EB61AF899966F584CB8A5CBD6BB9EF0810F8477A25F0134A6CD091C1B8DEFC1128B75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 151958fc711aa298f3c81acce7175d8dea3e3a143e87bf0786d6bd9bb4579481
- MD5 adb38b15c8594d6c400e0604b7ffcc66
- SHA1 4032540f23f00b0836a5806992744eb7a88a8444
- SHA512 fd4e18825a8ed52888abb1c0abfc9b985648b863b4e7471c914009882080cc8d351ab01fdf301a00825acb35c117ed59b1dfb23561082dfa315e62dce7fec994
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/FL:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYw
- TLSH
  T1E084230988C710040EBC87A97105FA7CF15C6629A3EB637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 029c5a34c11299f4825e4f130f4d79cd99b5601ceb43b6a62a8a5070069c9b81
- MD5 ab39a9729be5c6183e222f5f8440e585
- SHA1 3034e85d0122097cd0f651e799fd4138d3966e38
- SHA512 9733b1423f67614a50704e757df197a47185c4197ec841d089d92b9cd0fccbd16ac8056ac4eb720e97d7633793850b07a9997d36e4de48fc2cf18f291c06f512
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRM:fK4FJumM68gsjFliwugQikL3NRM
- TLSH
  T1FA63011A81497B3BB410FEBDBAD6DC45C534FAC03EC603A39F58B98852D4DA03652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 02458d256c9ed6874de9c5955ad62c671d249c0e8e3de3bcd2297481d389bd7d
- MD5 5a2b89f539723c2a8de6efb69e3dd241
- SHA1 91d3514d1c938e3dbf7f3014cbdb5992b39f5f1e
- SHA512 9710fad58408f815ecd21cff04334b0986ba8715d11a9acca517bc94079a0d6eeba708e141b6af429922fba29fc72be9febce46e4c9de107896e007894398d91
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKs:Z77jHIL0vBzbiE54gbyDdkqL///qHaf
- TLSH
  T18BC313277E3C584858A47C4ADE81AFAA06E04C0FE68FBB4B41967C9C9C1F542FB11DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 311B
- SHA256 1197f4354d7128528283a9afb45be22fa3776e1c382daddbd6aff662cdfa0565
- MD5 99a91a47f36b3b486526ffba98c16dfc
- SHA1 06f82236dea6efe42dbdcb27e8f756e1ea924a65
- SHA512 6dbaba1f34c51cbf8309d3392db744e95d841d4dc4bf0d05a585f3b7bd428229894480fc8b937083664899bd039000bdc2e5ffce93ec1fa35172a37fef929c7b
- TLSH
  T111E07D5EB1ADCF08DC5B57005878095DA946D6040BCE49FE085228D1D363704457CEB7
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 2e7ead8f0f980e3f07daa27eb891ae27bc142da1c24c4c3ce0be4d5eeb46a6c3
- MD5 3a0861e2abaa1096d61efa32f33fd21a
- SHA1 7ade2bbbde034539e89fee37fde9db4db2e9e0ed
- SHA512 10bdbbcb6d3e4bde4200c0deac89f77307cd10d3e0bd55174270cc97f569fea4af0f9661d2b8426efcb59fc93b0705b73e3eff881a67c4bc3680833ddc92f32a
- TLSH
  T11731A1AAE33E2F949380ECA6503475F2CF0E2314F9FD7598A48B57600A8793751897B1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 696B
- SHA256 b41ca4a284d75641c31c9bd9af219de557200d0f072cfe394f0949e1ac9a3d41
- MD5 760878a5287fb84bd4abafa3711f5f03
- SHA1 f18c4411cd73d8f7c53e682c1d512fb98c339126
- SHA512 93eaaf99091de46ef358eceda93c56919d99f6bbadee3b68973bd72ed8486a8f27fdf7bba5b034660da41665f7a4c59722de04dd22c599d032b88938e98ac5d0
- TLSH
  T1E7017D90C754E533B11911D1B18606B294106E7B7C24DE9C06D3796F46C3FBD2CB5EA1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 17e29d75d7768c122651a8870f973d3294cf434d9759f4a40c054e9e720ae560
- MD5 969ee3cef721a7ae263b69e58eaeaa72
- SHA1 309c672897f0089e1391a0c52bd04849066036e7
- SHA512 54519985ccf10dd4ea262b4555e9368bcaacdc6a3264799270d52ce78a8718f4fc8a547683b6720dafab05c6204e99860e2de9e66e3f10caf42ebad4c33259fb
- TLSH
  T13F21B780D760CA3BA19426107AE18AF294105A1FAC50DDBC40C3372F40AAFBD1C34E51
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 1cf033bff1dc3481a285604cf567c4d19d8c88e382fce5651eb43f60e3ecb3e2
- MD5 c44545ea0a7ad1beef0b83e5ec75ef73
- SHA1 86f77aea8dfab945fb20a0598f95f29cb9c3eba9
- SHA512 412fec3c484c5d3ee3b27f6a5b94093c0d6630b23d8c2f8ed959c72366372621565e3127607449eeb9a44b8179116f958068dbd2bfba0fce3e7c0d87d08d921b
- TLSH
  T16D31F6EAD7392F609341DCE5513466F3CE4E1301B9FCB8A8A88B9774094BA7354497B0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 6KB
- SHA256 ad49c1afe5dde253d770dab4a4c796533f2f4ffc9599c9cfdf763eecef563c07
- MD5 965805dea4d17e0acb2d58b1d2e3be50
- SHA1 a7aee9e8d599d08dc3a7561029d80d23a1126a34
- SHA512 93e3fb7c9770ff4ad10add5078d0b453c46de5da9c4ed8a53fcc5b4c1d5c6ac16458fbd2580434f35c68c2ba37b64f7cf8b58b074caf3c6337c9e33b6a510eae
- SSDEEP 96:ttTlZ6i7DfbKvW2rfhcJ7vZH7z6G+WsB2llHnJaKmpm4RVbC7NtxOi8iutEUr:vzR3KblGhHiG+WsElhnJ3mD3SNnt5uf
- TLSH
  T1B8E19E01999C9626DBF540E488442B57EEB10B3D06BE8FE19CCC0D53C574D079B998F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 429B
- SHA256 4b37be645d0b4a9675ee7cea089c191c33073a6b378197aec9dc156180d567dc
- MD5 8cad8929afd4f89d7671e8535e4249c0
- SHA1 4a413b9f5fd7b6cef20466dd044c79d65cac9237
- SHA512 de8ef4fbbf6479231fc983f2935022d5c9340162a19b45ae6eee77f635ebbf714a12358a3c009cccd03f680f3433d91ca00967d694b12b767804062cacdd361a
- TLSH
  T198E023D34FB12D38D74AB537762E8E350C74C18C582F19160508A03739C263465473AD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 439B
- SHA256 162d8011801fce42a54ebe31e15f75a2d549db1971c68f9572b2a2b39f92fea0
- MD5 592813f0bf81460a96511dd9490f793e
- SHA1 d9ecaaf95292da5d2eebc2da519225cff85983e3
- SHA512 c86eac7457f317ad964fdc876e0dc5ce129f2954675aaf9ceee29aa784a0fcbd1243d131de44b27475c871eb5762982084c866224a3fa7db0aa192be47e0526c
- TLSH
  T175F0DC2F65270AA8619482DBCAA18654F064A2D5130505A51C1BBA32CB1F040099D366
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 1KB
- SHA256 9bf7f2fa592c1b102bc383fd8a4b17f7ab6edbb1892d02d5da6ccb9ec9cfef47
- MD5 14ada337c1b5bd64467e38cffb1c3994
- SHA1 fad9d35f5e0dfa05adc1d3fffc7511afc1d11403
- SHA512 70105207f5060af481cd91e5d8cd2986c16a797dbf959f2017614c7c99bb13dc272c0180e9bf85580ebe3aee3953cb8019d231b7d8770482de605f207c398ff2
- TLSH
  T1BB415481E314427332850144B259895381895CBBB969ED5859CB793F4B7BF3AAEB0F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32