a370e0fcb6ae150f72d14448a58222111a34183b5e82171c3d2ba2242e0cb075

Sharing

Copy URL Twitter E-mail

General

Target
Geometry_Dash_PC_v5.8.2_Archive_x86_1528.zip
Size 691.7MB
Sample260815-s5we4sgf25
SHA256 a370e0fcb6ae150f72d14448a58222111a34183b5e82171c3d2ba2242e0cb075
MD5 4349cb314f4f7c09e12576599273f915
SHA1 36692db3f339f30f6aaeaa4fa6fd7b635ecfb92e
SHA512 d393298d0468ca4fdf57545172670096db8cdb7e7737584c407db89701a5cf67ea94b261b3adae5ae5bef8640a2101b2cee69e662e4916a4c801aad54d6cb847
SSDEEP 393216:UR8/4PJU2Z45Rroo7ClgGbOtssWLYhcYX0RBt5jO57CUlJimQJWJQgYgOOiSH2tn:sJpQelLbOYgX0vXihnPYz5SQH0TZZoB
TLSH
T121793305CA2DE4D3FB9335B9B4B0D157DA2E51B136DFE194F9A931B0AD8A8402F2CD09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Geometry_Dash_PC_v5.8.2_Archive_x86_1528.zip
- Size 691.7MB
- SHA256 a370e0fcb6ae150f72d14448a58222111a34183b5e82171c3d2ba2242e0cb075
- MD5 4349cb314f4f7c09e12576599273f915
- SHA1 36692db3f339f30f6aaeaa4fa6fd7b635ecfb92e
- SHA512 d393298d0468ca4fdf57545172670096db8cdb7e7737584c407db89701a5cf67ea94b261b3adae5ae5bef8640a2101b2cee69e662e4916a4c801aad54d6cb847
- SSDEEP 393216:UR8/4PJU2Z45Rroo7ClgGbOtssWLYhcYX0RBt5jO57CUlJimQJWJQgYgOOiSH2tn:sJpQelLbOYgX0vXihnPYz5SQH0TZZoB
- TLSH
  T121793305CA2DE4D3FB9335B9B4B0D157DA2E51B136DFE194F9A931B0AD8A8402F2CD09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.0WE
- Size 328B
- SHA256 3144ae441e836ca7220d0eee505be5fa46b83d64ed1bfe0e098637bcbe71e794
- MD5 fc8c0d5af69d24ba0ec0e206762c980e
- SHA1 1ee1a827f4001a841ac5f6b559131be2f97f787f
- SHA512 98a4b4b049f155e860a226a2844d70c7279cfe559b6677306be104cf222f1c6dc2d348e098eaabfbf226360cb1ab7ba93ebe7bd1b83113964865d93a10760bb3
- TLSH
  T11AE02DE2AFA6AAD0DE284F10E000E0C320A04A892BD4D38C933CC40208B3B863132574
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/PoSM3p4T0T0q.vi
- Size 12.9MB
- SHA256 5a65bf32855cc96b6555c10175c2bb61c571436461001094743c5db6c1ee895a
- MD5 65983d7f143c7ab943aefe48b5d5d035
- SHA1 b06baf16f9075624b35e3be25d9555429d7fa4c7
- SHA512 e99954fcd3e97d762db49030fc6b57d58f82b78680a115927f8d988f1fde69a767a8c46d4e2ff9920768fca8e5803bfee19e2c741962d7f205a3453045c137ea
- SSDEEP 196608:3bva8Rl/NeajcCV3KQeUb9aPymWBvCUn7FNsV2FHfaD:3D/NeajcCV3KQeUb9aPZWBvCU7FNs4Je
- TLSH
  T168D6D661200F7080346C75AEE3A2953AE2BB4286CE8F371B741923719651757BF7ACED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 0cae46a7ba6f530b54594f7891917333ca5f3704355f68b866d76fb3537c2860
- MD5 3ec4bcb10c58dd5ad3c822e830391896
- SHA1 e345e68acc58e1ee30f980a686eb38c8789aa8df
- SHA512 5730f1c13d42f804d477027ed4faa35d09663d9708f74ec92cbdf916a51de5d1ce860d585de03f69f3f6992dfe7f6be596814d05796612e7e0f1c0062c01aff7
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fs:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYh
- TLSH
  T1FC84230988C710040DBC87A97105FA7CF16C6629A3EA637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 01b57115c0482f3032d06b03db55ae4e418bd628919754dc9005d854e0730f1e
- MD5 1c5312646cb535e90cc322b6e0c9f6f3
- SHA1 a9528cdafa3a44ded2e1a6b5be2384f6fc32f4a4
- SHA512 e579cce023c1046322e4b50c61d97661d8d9c133676e88592475ec1e3873d97819f25a3878d4be05a2825efdc52af4f52baca7a3ef66fe4a605f62085eda838b
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRg:fK4FJumM68gsjFliwugQikL3NRg
- TLSH
  T14663021A8249773BB404FEBDBAD6DC44C524F6C03EC603A39F58B98853D5D603652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 574f44ba1ca9af89cd11f59d3dcb6c395cc6193beb07c92fc227d70599379699
- MD5 7a43ab7f6e6056bd9d9dac09fc9db1e3
- SHA1 09bb535de2e3b506ed0c8bea6f5f4273a3b7ca9c
- SHA512 ed2a497adf92cc3742a057fee3b1801daceee763e16abd6bac360b033722b1cced1ab41290493c89b24a0f1d7b6e9c4e224538132b2954bb2a394d2345fa0585
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKV:Z77jHIL0vBzbiE54gbyDdkqL///qHa8
- TLSH
  T15AC31327B93C584858A47C5ACE81AFAB06E04C0FD68FBB4B42967C9C9C1F542FB50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 591B
- SHA256 fc31ad9b69988bda64d13a13fc850369befb3b37ab2744ca1e1b191b7b49bab7
- MD5 a932828dc98f9c7a8bff2a1ce7d6f216
- SHA1 0bda307038f5c09bd3dc7eb0a01df2d4e822d5b4
- SHA512 c8301976637cd02cfef7a0eb7a5639ccba43fdf4f6d3481c97d58b1f3ec00e86ba1230201bb488b50fd00557e68683b70db840028cfd9ed8ed305734a81697f5
- TLSH
  T1EAF0E712714FC511F6751A0556905A0C3E41D5D133DC4EFAC54622B1E373B60D5F9E93
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 14e4e99e8d48cd3145510588c81e9a9dad4a118ab8a84263c84833d0ec86bec1
- MD5 a29192b8ccdaf99add7c9f8df15a604d
- SHA1 0eb5aa361467bdc78b83a5cc73ac0837fb351fd8
- SHA512 3c72bef3b96278629f25ddb6090e9d99ceb220a5e770243c6f5e2127a47b9cd50a79abc81d614fb0b22fb93ef57b517c4dab448a181e46f24e1d4422bc801924
- TLSH
  T15B3129AEE3291FA0A704ECE5923165F3CF0D1314F6F9A45C549B57B10A47A73A4897B0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 909B
- SHA256 61a5bad41e51b5072fc88c5363d0463d5764454724a9ef0d88b5344c43063933
- MD5 6f8cb51aaeb34f2f3ce515bcd9ffbb62
- SHA1 4e4f114f6b678adc11c74924981db69dc1dbc482
- SHA512 462abf51f48dfc6c64660daa5a58d1367bdecc81d52101416b5bbe0dd847bafbf90367f52733fe8e9c1c773991b67443a7335dd3968d15dc1bd9fae288e75641
- TLSH
  T1FA111249D7A8903772181156B2414BF354321EBE3925DDAC66C7391F4293F761C35FA2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 1a017e27cbdb6fb9a324a1d94e2f1e589c361e5f67c8eaa8030a383423afe8cf
- MD5 70b8adc53b245a587aa050d5b42f84b2
- SHA1 117d4099bbaa1466a9f9904da29c2c60442595d9
- SHA512 487717e6a4865ab8b595f06dec8199eab8a852ad6404fd5778f9bcdcb741f0ecdf82e990413fe826bc07dfa7c734d7051894498d07412268cdce4ab321b20958
- TLSH
  T178114280D31AD2337194262072851BF284241DB73560EDAC45C33D6F0155F381E3EE52
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 e31684bcd9ec361986a603c3a53e6e0ea3a8492c6a6da7922b6080064dcd8813
- MD5 c2cf826398eb6a26d360b93a82c488f5
- SHA1 a0b1cef1f23d8f4d03132feb96c5aa5e74937720
- SHA512 3603d6e91a4e8e9ec2bffed13572369f6e2ced396315bd43f0e4bb79dbc92a0e2c6fa0f4f38e9991bd58afb8cc7edde5e86087853392da2996fd375a500cea77
- TLSH
  T1D9315CE9D7790B905380DDDA9071B5F3CF0A2340FAFCA45CA48BA7740A4B537A586BB1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 6KB
- SHA256 27dc2af9368e6f01d0a12eeb4fd30357bd02b17d512cbb33a5d39e5366f2b9df
- MD5 fe61de800aa04e5bb2b4de288d423cbe
- SHA1 a230faac49030d4244475452b9f519620093e324
- SHA512 a7f2b79b64e563cc0a5adae3f46518884c06c58e0f3535d397220ddf9e614ae3b789d23fc405331e745581b92e794f3a610672ddaf753c6e6cf842c8b6555c26
- SSDEEP 96:ttTlZ6i7DfbKvW2rfhcJ7vZH7z6G+WsB2llHnJaKmpm4RVbC7NtxOi8iutsw:vzR3KblGhHiG+WsElhnJ3mD3SNnt5up
- TLSH
  T1ABE1AE1289DCC266DBF540F188842B57EE710A3C06BE8FE19CCC0D52CAB0D0B9B598F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 440B
- SHA256 ad5f2ea002dfc15153d9eaa346159eb7c9fd5433d8856da20d9f4401ab14fa57
- MD5 cdf802c4f47ad5fa4f838ce2f59e9b8b
- SHA1 f310181e710c923518153c161ec242632c3d7fda
- SHA512 dc06beb09b71713c71dc0bf618f8f7f3ca4657de4b77845a074fcc0a000aeae5ef9835a153aa4cd2839024ecd01c548608ae70487b69ca1e35114a1b36bcd6ea
- TLSH
  T1B5F0DCC79F7CA90C88DC2082471B8F1BD9DDA954980288C086099C39D793903C5012AA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 971B
- SHA256 65e60a5efa5afcf77e8c1137c4ca13279452dfa1eff9853dbb203750eb04a0f0
- MD5 6180aa04ae1c1486275e3b041056ad51
- SHA1 ecaf3a9313c88e6ffe4f03673b521172c6f0d7b6
- SHA512 55c92d6cc1864dce4e21b082c9c6c010223a318c7f6bef4eb3f9ac57e1ef54efde107945c435dfb8c25e79c1edc4f4078f288526873f8ae1d534dd3b879f4303
- TLSH
  T14F11987DABF15AA3B1381DD10B7EB980FC1272C2451E112F447AF68DC4114454696557
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 1KB
- SHA256 6f7e457f45e2bd83d9870a0584571c80b9f96837ab12fcb7bcb4a146dfac4916
- MD5 9c7824f862b30d00c1f06d27879d75aa
- SHA1 bfa0c3a6915c2ae40f2f31786969ce393718d388
- SHA512 5ac9e09e660d7238e798e3c64a0f42a388f13d7e6430233e4a78b63bad639399c6cf760f33e648425762448af8ffbb5201207c6b72db835a593fface2e206c6d
- TLSH
  T1F5418682E360047332860104B259495341892CBB7968FD5855CB793F877BF7A9EB0F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32