1083ba7e418212efb03439232c9f0939d6031662dc8b5ceebe4a834ddaa06629

Sharing

Copy URL Twitter E-mail

General

Target
Odyssey.zip
Size 610.0MB
Sample260820-h49k8ssbmb
SHA256 1083ba7e418212efb03439232c9f0939d6031662dc8b5ceebe4a834ddaa06629
MD5 29c9df9f7aee013d7c7da003365cf949
SHA1 42a49e237652618f07fc9f8f79a5e4facbfab392
SHA512 aac055bff1499fca07394c50da56bd8c016551ccb912a10eb47543a83d244a4dace321d88bcdc1e6c8d6363956a908ad38fc4207b7e4f04f08aed60e84dcd102
SSDEEP 12582912:LhSOiBBPKMgRohcn0QyWGNh8ZicDpnv+OtZpaRkPsFE:LhcBPKMgRoc2bNh80cDZtf
TLSH
T1FA6933A9DA4FD797DC6FC131D8490E09214609A50584EEBE6E7CF18CEAD7A87041BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Odyssey/Game/GameRunner.cs
- Size 853B
- SHA256 07e2e8de573bed1bc2fe72ba881672746ad8779a7be5a62c44b051e096058921
- MD5 bdc81417b481e52b2dc9afb8ab2109e0
- SHA1 6afa2e5ec9dcfda20cd73adb6613ef08018095b6
- SHA512 d5cebd9ba6b2f79e498cfb570be3866c2bbcc7586f0cbd1a450c291c1395d71fc180f82657a853424208be9d060964cb1bf6e01d33bd278f9d1834ffb2477abe
- TLSH
  T1B101788D3A4B9B09087397249F25A101EB6B026703654920BEECA3437F7042493B4F8B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Odyssey/Game/Local.cs
- Size 2KB
- SHA256 b815991557580b58af51a0bab97326f1c67b96d2df82a23af87d278e682f1774
- MD5 5595f31518d084a090d1bd5b8dc84032
- SHA1 f0b2a9e9fd5b8856a2eb924b5d49cabafddac188
- SHA512 b4890583b9a23d6f417218a90ad7f1d7cd49eb474324ff95940abf6c1ee779f2f201225e9a1b0e73db79537de5c42f9b4b80aafcc6e5b8e37669be5c7cb6f19a
- TLSH
  T14B51EF8CAC8BD7054C72D13EDE37C659EB57221703299A64BAFD4E042FB441886B4F98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Odyssey/Game/RegistryImporter.cs
- Size 1KB
- SHA256 b3add873d467ce42d513b0c1322a2333e759fd9932d47028e8df7472f773f991
- MD5 ca9033ae69e101933f3315516f5a62f6
- SHA1 1c377adc5cb7ab7c0504cd348e300fcbecf29074
- SHA512 74f48c213375c5acce2fdbc9fa4b1520f3cfb524bca4c49ba1d7b301c8fa895dff0ab1820debb19daa0a62169dd13fcfdac50ad0c6aca5d7bc3f2c4b0b1cd8f9
- TLSH
  T11E21C88F280787164EB39328AF425107FBAF022B43658064B9BC92543FB002583F0FCA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Odyssey/Game/TimeChecker.cs
- Size 1KB
- SHA256 52c914274e9fe67967c3085d6f742b7d0ae95024428060df67f776b45f49179c
- MD5 f53859c4a97f7a31b01804b4863951bf
- SHA1 7c8851a7433353817e556eac71b2ced38e2b49aa
- SHA512 1d4f185dcfeb7d3f65fa05c5810e964464b6666c830514b4a6f903b4f00d0eb50694b6777d438129464f257d9308e6ab68c31c475469cc11840dcf24189caf28
- TLSH
  T1C021A26B7402C60B2E72616A9A0751A0FF73833B178D861CBDCFC1115F3481882DDE88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Odyssey/Game/VmDetector.cs
- Size 2KB
- SHA256 7c5c129146ba142f52254669a400e642617af9185026067b713b008358c0bf67
- MD5 6f8ca63153a7e880dbe4f32cdf6c8221
- SHA1 50e415d3b774f82881f6096856491bd904a742ed
- SHA512 3df24af5a725a1306152024d4822bb86840b0148679ead17ab9befb63db799ebe25e4ba78d449c1b14f50e0825f80dfb8ce157bf07925b69e04f4fb9a54be674
- TLSH
  T1CA51D02EBD11C6532973633ECE4A8000FF264B2756EA5674BFDD81551F7950983B8F28
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Odyssey/Game/obj/x64/Release/324tofuashd.exe
- Size 106KB
- SHA256 96111c62a1e33e952572a81d976dc36224e503e0a4028abc05c3120d8514ce35
- MD5 c79974b77d4dbf9f44af8daa53cd2747
- SHA1 78a2e4a1290ed9e6bc95fffd834cb9d8ef51c64e
- SHA512 addb632f096d08f8a315a7b32c04d5d3d19372a32fb2ad22d764208f01c711f32d7ab5cc9014f7b37cc7e9a1fbe7a1071aa0d662e6fe59b1061bc5c1949939a9
- SSDEEP 3072:5brIp4WMZHVy4/Cjjjnw9cra4TVbmqADyoxPT:5br/WW1y2Cjjjnw9Ga6b8DyK
- TLSH
  T12EB30118EBFA8348F6FE57706AB09314047BFE25866BDE9F1CC4620B1432486CD167E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Odyssey/Odyssey.exe
- Size 206.3MB
- SHA256 62fb314f6171a8d4aa2be063ed533e07667b3675975139af73a8f4b114f7a572
- MD5 2f4c319f9218db52889421985cfe7d7d
- SHA1 d9ee741068c06c6b62f883de7894ee3326dc39ef
- SHA512 3bec4cb42c844ad979b870dad135fdec72667a203b2e174d3398f241511a9f947d4feefcb9c010ad441dc39d80bcbcc03e5c262b7cd39fb4d72bb02dc3a60bfb
- SSDEEP 393216:/d0AIo0ccs63YSCL1/7PSW6UjzreqgDB8LCl:kW6UHreqgDB8L6
- TLSH
  T152A8999C97A9D139E491E732E47AB7F7E0F34D6AE30774330528BCC634385D6868A264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  Odyssey/lib/Managed/Assembly-CSharp-firstpass.dll
- Size 75KB
- SHA256 782d0888dec96ab65c73c900fd922dac2c6d04f46fd7073029e8136f897d2da1
- MD5 27c741098713a0e4f7f0195b0d34f0d5
- SHA1 c030fe5175be10fbdcce9e73756dae75d1f98377
- SHA512 255d17fc86350ec48a0b7115cfd57eb53f7335f56d894e9cc84a5d46c00893fc356aa07b87ad92df87afab23bd2a8f74884a760b0939ede820f2facb0b8d29a7
- SSDEEP 1536:A2Kt3qR7Ja6oj5MivMhifQDEA/SXDWWez:A2fFa6qMi0hkQDbSXmz
- TLSH
  T10E732A659BB88062C7DF5B7D5434363087B2862B99E2F786AE5DF0F818177C168023DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Odyssey/lib/Managed/Assembly-CSharp.dll
- Size 675KB
- SHA256 ff44d5e5263c44f61bd95ca8d3378e217bfc6f8ef27da69ab8fc7ea767b2e6e7
- MD5 3e83719172346e547784ed05b38d876e
- SHA1 2c136dbd515b4a21e524b0dd3091b8d0c41434f8
- SHA512 342d54298b128d8f445f63b3fb7b4ed6a98740933682962e9fcc1e909c141893c972a026cb8d3a5f0f41efc16915f8ca43cd87d08c042a5f4c43d2b2e99ee9ab
- SSDEEP 6144:odfUuzxkDm9pw88cYz01k8eiHCodvAgojv1btUfF+jwdj2AbeaizNVCeDuXWd5/I:ywtcD7A5vURRizNVWXW81Kr4hAx6
- TLSH
  T131E4C658D7D41532E49D4B7B2139240A6272A0462ECBE38F39A5D1E13CD77E9BE843CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Odyssey/lib/Managed/DOTween.dll
- Size 171KB
- SHA256 8e90fc43ab564a5a51424af56531ab074a5a2e9cab271b2d653d287954237b83
- MD5 c278d7f5c05b8470da58390f1a1efaa9
- SHA1 5785a56e7938608debdb1c67960d1cd5bdeb337c
- SHA512 ca749b0bcf368e5a9d273025b7c945cb0ba9b3886d42f1b483cdfc56009c9f2c1ea76a1717a065f60861a41a115603a3840c7996d3799fe3835e44fe2c0cd6e7
- SSDEEP 3072:6+OseYXEszneCqlL5lVu3GiO8J6Ye0JeUjnC+ee+e+4LWGOCdXaYr8yzi+:RO4zneCqlL5lA3DD6YeWJLWGOz88ye
- TLSH
  T142044B48A7E95632CBEF537FA0382D58A335D55DCEABF7DA2950A8F41C03706A801397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Odyssey/lib/Managed/Kybernetik.Animancer.FSM.dll
- Size 21KB
- SHA256 58e8da536998d1a74d6d124c0e8dc2315d78828b6d3d0d31f3bc9cfbf82542eb
- MD5 f71793b50641ee0d59eed953c2d33402
- SHA1 d67ac45adcef7e50d954e59da810c6c8bb19edcd
- SHA512 3f0d32639901c10f19b8ef7f7bead8f36724633636e06e1a2657c258c743ca99a720c7db74265dc67a3d343811c43362a6e94eb1c60be25254400db47500ef45
- SSDEEP 384:RppqDdPUzvHtK1bqvqRDvbl9c86qaknVmfxrS9Oldv08u90MqLZGZ48uGYFwh/BS:RppqDdPUzvNKxqvqRDvbncrqTnVKxr6a
- TLSH
  T15EA2E904AB88532BDFFE077EFC3C52010571A989B80297672AFD7618BC537C42AA9371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Odyssey/lib/Managed/Kybernetik.Animancer.dll
- Size 265KB
- SHA256 2e49b26ae34493bce31284370e8bc5e200c49e1550653a5bca981be4ddea874e
- MD5 921b22295bc238273d7b34e4d46e3d1c
- SHA1 6e29d985477467a19578211539936bf45f7c3d5f
- SHA512 a3cc9cd8560bceb73079408b7ab70acbc715563e656ac0d81ef4a6e949ea4ab6443d58ce898a42561155ae8a56bee9ca05ec3c009e9c0b0f4a6c4e91b96bcb74
- SSDEEP 3072:BDL7qRD0lZ5ohrxrrTt04jPmA3cxklM0ltkBlhAoXjL7gWn8Zb+of:B+1S0t04fYklM0ltihdzL7gWnuCo
- TLSH
  T1D1444C101BE85B36CBAF0B7EF03841020275DC86719EEB69697599ED1C937C46A933B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Odyssey/renpy/CSO-PC--0-1-7.exe
- Size 442.7MB
- SHA256 d8034415a50d7fdf49a598110c62147784b36d6dc4c0be5ea547a1b708a514a0
- MD5 bf84d2912680def6d64c7d5269b8c6eb
- SHA1 e01090ec64773a80067f82ff537ff938d567fd3c
- SHA512 0b4e21ee4a090ade624bed6d667a0b058b31c8cf315b0eef77eb9057ce8dbb5948967fb862daa183325f162903650466a05d0b7f269d2645568593b9580ca50f
- SSDEEP 6291456:VRo9r2YpQAP1ivV0gYQPWuKhk1qzYOAH8BA3qsQNdAkbXk:6PgvOgfPWvW118HJnXU
- TLSH
  T1B529F122B3C65FD9E087E5F885D61D17BFB1F832062A828F67037A359E5E6D78215B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Odyssey/renpy/lib/Managed/Assembly-CSharp-firstpass.dll
- Size 75KB
- SHA256 782d0888dec96ab65c73c900fd922dac2c6d04f46fd7073029e8136f897d2da1
- MD5 27c741098713a0e4f7f0195b0d34f0d5
- SHA1 c030fe5175be10fbdcce9e73756dae75d1f98377
- SHA512 255d17fc86350ec48a0b7115cfd57eb53f7335f56d894e9cc84a5d46c00893fc356aa07b87ad92df87afab23bd2a8f74884a760b0939ede820f2facb0b8d29a7
- SSDEEP 1536:A2Kt3qR7Ja6oj5MivMhifQDEA/SXDWWez:A2fFa6qMi0hkQDbSXmz
- TLSH
  T10E732A659BB88062C7DF5B7D5434363087B2862B99E2F786AE5DF0F818177C168023DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Odyssey/renpy/lib/Managed/Assembly-CSharp.dll
- Size 675KB
- SHA256 ff44d5e5263c44f61bd95ca8d3378e217bfc6f8ef27da69ab8fc7ea767b2e6e7
- MD5 3e83719172346e547784ed05b38d876e
- SHA1 2c136dbd515b4a21e524b0dd3091b8d0c41434f8
- SHA512 342d54298b128d8f445f63b3fb7b4ed6a98740933682962e9fcc1e909c141893c972a026cb8d3a5f0f41efc16915f8ca43cd87d08c042a5f4c43d2b2e99ee9ab
- SSDEEP 6144:odfUuzxkDm9pw88cYz01k8eiHCodvAgojv1btUfF+jwdj2AbeaizNVCeDuXWd5/I:ywtcD7A5vURRizNVWXW81Kr4hAx6
- TLSH
  T131E4C658D7D41532E49D4B7B2139240A6272A0462ECBE38F39A5D1E13CD77E9BE843CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Odyssey/renpy/lib/Managed/DOTween.dll
- Size 171KB
- SHA256 8e90fc43ab564a5a51424af56531ab074a5a2e9cab271b2d653d287954237b83
- MD5 c278d7f5c05b8470da58390f1a1efaa9
- SHA1 5785a56e7938608debdb1c67960d1cd5bdeb337c
- SHA512 ca749b0bcf368e5a9d273025b7c945cb0ba9b3886d42f1b483cdfc56009c9f2c1ea76a1717a065f60861a41a115603a3840c7996d3799fe3835e44fe2c0cd6e7
- SSDEEP 3072:6+OseYXEszneCqlL5lVu3GiO8J6Ye0JeUjnC+ee+e+4LWGOCdXaYr8yzi+:RO4zneCqlL5lA3DD6YeWJLWGOz88ye
- TLSH
  T142044B48A7E95632CBEF537FA0382D58A335D55DCEABF7DA2950A8F41C03706A801397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32