a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd

Sharing

Copy URL Twitter E-mail

General

Target
Five-Nights-at-Freddys-Sister-Location-SteamRIP.com.rar
Size 953.7MB
Sample260816-124lbaybqc
SHA256 a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd
MD5 f50ae3d38e09d5a7b1ab975889c2b408
SHA1 36ac0b3734db8e6b876df8cf073ac382f8048c97
SHA512 9509ec2b6be3830515a91105cba1ddf8436018de8818b399042381deb4da3afe2ac8fca1e1a305d493e3f5c11e4e9eb0e270beccad8cd77fe423f12fcbc9c198
SSDEEP 25165824:ABtY37CGE88Mdv6aOS/vFLTEnIj2TmofwUeOj2ZPkNN3IZTRMzuE3I:OI7CGDfQaf3iXTJA8mc793I
TLSH
T13AA933B744C1B41BD6C27E13B38D9339BAA1455B21DD38E8724D0782DBAB5AB44E38D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Five-Nights-at-Freddys-Sister-Location-SteamRIP.com.rar
- Size 953.7MB
- SHA256 a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd
- MD5 f50ae3d38e09d5a7b1ab975889c2b408
- SHA1 36ac0b3734db8e6b876df8cf073ac382f8048c97
- SHA512 9509ec2b6be3830515a91105cba1ddf8436018de8818b399042381deb4da3afe2ac8fca1e1a305d493e3f5c11e4e9eb0e270beccad8cd77fe423f12fcbc9c198
- SSDEEP 25165824:ABtY37CGE88Mdv6aOS/vFLTEnIj2TmofwUeOj2ZPkNN3IZTRMzuE3I:OI7CGDfQaf3iXTJA8mc793I
- TLSH
  T13AA933B744C1B41BD6C27E13B38D9339BAA1455B21DD38E8724D0782DBAB5AB44E38D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Read_Me_Instructions.txt
- Size 1KB
- SHA256 3772c26ca52f08d197868ccc9f9e3c56307b018b648983948b40ddf74aaf949a
- MD5 27b923d4ff2ea0a7616231b34e60beef
- SHA1 8141053a1472795ad199f397363bb1c71a326af6
- SHA512 5cc09fad674c99c2b10ae4dce96021e6c511ccc708f48325a5f59b15aae5e9329d39b77a96174a1a4ba0844055276cc250444ba38a8c10ef3d17f783f5ed376f
- TLSH
  T1E42108E76B773B9E0270E225614DF0A1FA4AC03D0A6DB470B7CC0049234923B0B204DF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 121B
- SHA256 83b3dea5feeb0e8b98b33b647634264abeb7a069801833bf3d80836405921786
- MD5 2c50d64e61fd60b0071ca34e7f2c21a0
- SHA1 f7eb323fa0a8634535678b072dc1247a679cd0f2
- SHA512 ceee0f559b04b85951e2e52b4db05b8e6ffabf7fc0692be19787b0dadb247ffb667550ba0dd052facdc4f4b9b0ff97bfdd2497fbf2ece37dffe09eb67abe9186
- TLSH
  T126B012AD5345C18ED361981A70B0FC08A84F7AA50CD6D0BC6694DE9B1C890D1C4A9F3A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SisterLocation.exe
- Size 906.5MB
- SHA256 c60e1c7994316426d824b82004aa5c76e3aab06d4e78e0c9391628e0d52b2c73
- MD5 cc2b5b61426c2593ce050edd44249211
- SHA1 4a8ce3c74cef76fd67b3e5ca80eb5bd1b36576cc
- SHA512 21ad96969b1e2fd6c09714bbd21389d392fc74b2b49f9c8dd5b166300c98845b2e021bb57cb06a7fe9a2ea0c02091245e9f7c5bbe1fcffe6fb4e61e9167c73e1
- SSDEEP 25165824:Q7zWfLoEi71Cimdgsp/r+t/XSAMphd3ieHA9+:6zgLop7cimdgsdr+tQphZAg
- TLSH
  T1F1A9338CE5E7DC42DDAB5032C3AA7E30B7AE0467432244DA1235B5842D9A5FD0F76A4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral7 behavioral8
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  _CommonRedist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  _CommonRedist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral21 behavioral22