b453032e3e7a97430e6324ceda1f0324d2095b11255b470f2f351a76d5bd8c90

Sharing

Copy URL Twitter E-mail

General

Target
flappybird.zip
Size 28.0MB
Sample260815-e662caztfv
SHA256 b453032e3e7a97430e6324ceda1f0324d2095b11255b470f2f351a76d5bd8c90
MD5 05d9335bcb73f319e650b09b12f1cbbe
SHA1 62d0c822ab96b771ffddf519a0c94a9e3c0b24a3
SHA512 6a0372f977fe7a3c7364f05bb2d9a1c9247963a0fe7a1cf8c2afe5cb7ee99395cf4243e5a59259d0656427ade7b2c86cae6ae983496a8c5794c3e581ebe66e32
SSDEEP 393216:lkJ6IIL3KXwjHGaXX9ij3CV6IphIHXMe4AS1MzkM+ctMTHm8Xp98JfYQZ:lk07zKXwTGapw+OHXNS+n7YmA9i/Z
TLSH
T13D573346C3319F1428B6727E620994277B0D11D52D67282BE5AD33DAAFCD20532BCBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  flappybird/FlappyBirdsTacotrucksTake.dll
- Size 34.3MB
- SHA256 855e2c106519e7b77f2f378b2c64f898e088db54093079829a36c8969fff2ba4
- MD5 1e0de80f2e3619a2a4f0af09e5e0cbff
- SHA1 b8953e510480e303664cd94d6985db070a652dc5
- SHA512 ede010d3d8f4d1f1a7c4cabe04fe1f2840809e291d2e425f3fd71980f5259f0ff29ac018d12a00cc4bf09d7bf20a89bdedf9e29fc160e3909a840f2a56fa4309
- SSDEEP 786432:QmyAarSe1FfGNyrO8XJR9LLVAKXf3/9sKnkBZchB:RytQD8XJR9LLVAKP3VVnkBZcB
- TLSH
  T19D878D17F602AAADCC64177445C7CA14BEE3282526B78346BF24CF2E74BB5297D87B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  flappybird/FlappyBirdsTacotrucksTake.exe
- Size 571KB
- SHA256 9d9b60e6391f3e2f7728283c531d761a06e9ee88c3d69e7c84b5728f7686bcfd
- MD5 d465a43a806cfaad93d8174571959862
- SHA1 bf244dc5b4edd489f5af58262a9554faa1c10218
- SHA512 c7b4d1169c1750fd658a4a794acf0574fa52aa7d9d5283db88db7842cfef9db25dacdbaa2558b9648a2dbe4243a506da01fc12923dbce449b95fda353d839a95
- SSDEEP 12288:Dvd4daxmshIupSk40aCKO9iPYG26eU8GlD5:JoubXaCtmsGd5
- TLSH
  T147C44C362AFE43D8C4A29CFA49966251EAF971830F17425BD6A14E7DCB3C6805D0FF90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware ransomware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral3 behavioral4
- Target
  flappybird/NAudio.Asio.dll
- Size 33KB
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH
  T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  flappybird/NAudio.Core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH
  T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  flappybird/NAudio.Midi.dll
- Size 45KB
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH
  T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  flappybird/NAudio.Wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH
  T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  flappybird/NAudio.WinForms.dll
- Size 33KB
- SHA256 b313f530227fd31fc2b6fa74547f4c8a964cde7696c07624dfc19b693fe9c468
- MD5 2da1307837dc63aaab828470701a2761
- SHA1 3d862f84328d8fba810da31fffcdfc53a8cf786c
- SHA512 503fa2ff0ccea1d51aa59c4f38a2d552626556b0cc692a699f15714b9af901d9e664642adf5e25d6cf5ce77a6ded59427dd1bd23e030aedb3891ae943629d2b4
- SSDEEP 768:+GRcd/kDtaVL9ugB/0p6oCPREb4DmHBRrne5:zaVL9ugQLMOb4Dm/2
- TLSH
  T166F21919239CC36BC67F0FBA50A611430336E681F552EBED6DC831A99EA37510761BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  flappybird/NAudio.WinMM.dll
- Size 56KB
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH
  T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  flappybird/NAudio.dll
- Size 7KB
- SHA256 c001e49d31497f608b14066b0f10304c0ccb7e3b9df9d5fec5cf3196f92961b8
- MD5 555d4c629b3d58d3d4314e2fa51d2f63
- SHA1 0aae01bac50a5abfe42a6cde715f391069fed72c
- SHA512 b3cde721761fe1210a5b31da4637ae6e501d489d3209a179669ad80c03e4ff717af81f82d130673080194e5f2f7a17fcd4891ac598aedca14c10c7f2b0904b8d
- SSDEEP 192:7HBYhRUzpGapaMW2Son1MRl4CAJj6GjSm8:7HCMzpGbx2Kvm8
- TLSH
  T1A7F1C739A7A4C237CA964F75E81707940374EB40DA57CF2D0D8CA09BE913749AB727D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18