3021587a8d5407b88b40aa70cfa195c31570f3a7ec20e7cb874d7e1452180681

Sharing

Copy URL Twitter E-mail

General

Target
susie desktop pet.zip
Size 70.6MB
Sample260820-x1flbaxtgw
SHA256 3021587a8d5407b88b40aa70cfa195c31570f3a7ec20e7cb874d7e1452180681
MD5 d791ad2fbe11b142c0bf738ff5679dfa
SHA1 00c5d8d4796b5b0ca8bdfaa86e64492ca9b640c1
SHA512 ae1aad977699b0398cc9105665045a57729dd3c1ffc615032c5640f4125c14fd6a519a6c19d95c505315ee14f8de96d1884e89c76697879da507935240062de8
SSDEEP 1572864:z8ghGmVWMkhiwoeJeRUClZRIS1qMvhap83FbGaSz+7QtbDvqwaCZHtrAPSq:thGmVWMkYwoekR5hzqUUdBz+7SzakrA1
TLSH
T12AF73376D7B1CE21F09C4AB1E126C547CE5E9026A11F3C8B18A4074E6B7BAF6B67C305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  susie desktop pet.zip
- Size 70.6MB
- SHA256 3021587a8d5407b88b40aa70cfa195c31570f3a7ec20e7cb874d7e1452180681
- MD5 d791ad2fbe11b142c0bf738ff5679dfa
- SHA1 00c5d8d4796b5b0ca8bdfaa86e64492ca9b640c1
- SHA512 ae1aad977699b0398cc9105665045a57729dd3c1ffc615032c5640f4125c14fd6a519a6c19d95c505315ee14f8de96d1884e89c76697879da507935240062de8
- SSDEEP 1572864:z8ghGmVWMkhiwoeJeRUClZRIS1qMvhap83FbGaSz+7QtbDvqwaCZHtrAPSq:thGmVWMkYwoekR5hzqUUdBz+7SzakrA1
- TLSH
  T12AF73376D7B1CE21F09C4AB1E126C547CE5E9026A11F3C8B18A4074E6B7BAF6B67C305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  addons/__pycache__/addonmanager.cpython-311.pyc
- Size 12KB
- SHA256 814cbb9122c004281c6a930ca36ffd3f60c34b69c8fd1c89e3b2dd9e9eab1db5
- MD5 505294415ff80e0b8a8e15b0df3cbbd8
- SHA1 68c2c97fdb339a8430603b2a7f528c7328b826e1
- SHA512 5c293540243aed89b496699b546ea0c6953c89bc9a8cb779d878aebfec971b72d5cda034592ae467b2977cff95d2a2f31960e4f251477d2655588b4d444d6122
- SSDEEP 192:NdZSr8XNsZd2SDHWSp+xWPzYzciAn1GLE0+bweA/ScD:NdwrqsZndkRGGLETBwSa
- TLSH
  T1F44272862B85C97FFC32F67AC012090BF365C2F1AA54CB133629C56ACD5B6A41D166EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  addons/__pycache__/commands.cpython-311.pyc
- Size 43KB
- SHA256 aa3caa644eabd32fb200a2c44086601b47a4359e6ca4e5057c11a59540750ba8
- MD5 92874bb7cecc7b1444ff35f2a3b2cffa
- SHA1 10180712fc9200c2dad7c6087936ae38e7549fcf
- SHA512 cdf878175f598d746242b9d1cecb9b05da6e6b12035d928672da35e406a5fc11a7e35790d015c21ec5a5a9549517f6b228a503daf60b234b5c8b1a9ac0816ca4
- SSDEEP 384:83M79SBszr4QIdhryWR00cNLfEoPnlTQxWnkYEGcu9AvhdoKvEI/NukOBRgI7e7X:8c8Bm4JdFyMmnlrej0INunBEzhQsbAq
- TLSH
  T1F1132E886745D67BFC66F77698171A2AF334CAF0B7208303225AD026EE837A53D115DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  addons/__pycache__/objectsaddon.cpython-311.pyc
- Size 12KB
- SHA256 a462cd6ca248ef11e53736c4efd8b3e8422877bcc852d18231e469d43c4545f5
- MD5 2c110076420094acd953e605c2d10ee2
- SHA1 21fa4200ab29f6cf191cdcd10e49155a3b84e4fb
- SHA512 caaea85d8a644af9f473ce46da8d5fb2cab8113d730057be62242894bda8c6059fc7bec0d7c9dcb1d2664c1581a07cda6be8894b30a075aab9654c34bd8a56bd
- SSDEEP 192:OXjw/NzjcWPermPm3U5Zzlwsk7BVrwYoG4c+ESs:OX8/TermPm3K07h4PESs
- TLSH
  T138421E4C6BA2D177FC52FBB299171685B320CAF0F710EB475297906A8E5B3297C422CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  addons/__pycache__/test.cpython-311.pyc
- Size 1KB
- SHA256 b9d644ccc03b4d62f474ed4096065dde73620181d90ac7a4f5b967810f4d4966
- MD5 9cd2aa66c8fdc51cdba1862134dab47d
- SHA1 5c6d343a031ba62476e164f4ce0d943639c397d3
- SHA512 836792c6ba511c57e37a470bc917df91dcb6707e4c9bba24ab65012544d36b21f3be44199860883dffce850f3eaa34d092301093980f5f50ef3a3f4daeeec608
- TLSH
  T1E93114E077CAF637FCA6F3759956150273E6CAF1AB40570B6A6884B3EE4B6014D10581
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  fonts/deltarune-english.ttf
- Size 14KB
- SHA256 df2426e40c7357137234c6a9c900f6f7a3dd40488b4afd924ebec548de3bba63
- MD5 9928f51c004b58472caa4efd4ff7cebb
- SHA1 e3383d9778436fe7982691f4486d49e8959291e5
- SHA512 a475feb9404141822d9b58f2b90b6c63b26244b4f412b9609e175a5a918f98b6274861ab5afee7f2d780c11579b8e5fdcee18b861b83d162eb4393398dd8247b
- SSDEEP 192:weaXMsPpsiOM/Bj5OaRZqZS4XkZ0wZjfj5OaRZqZS4XkZ0wZjN:iXdeiOM/Bj5OaX4XD6j5OaX4XDQ
- TLSH
  T1456230327B98D565E5568AB4EFE2D354F3A6F8880F23834721B64314DD9F2B38C122D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  mus/Vs. Susie.mp3
- Size 1.9MB
- SHA256 a6f0f962c47af98e04c47d6149104452bd70a0a4c78a5f1c8fc1188aa5dd04c3
- MD5 bc172706cf642d14d1519db8dc21469e
- SHA1 9c54136eca66144c03875ddb40765faba7ec8726
- SHA512 79a8ce262f0e375421ea82dc2bd36d4787b56e51a7a5a56d1bc8ee0a9c2250ec7ab19cac51dceaf30180761f10299cbf303a297b9b36b84a6fbc5b2e91a146c9
- SSDEEP 24576:nsa0dVl41OqEdLHmpkOA8x6IksFAInE1mfX8MFsZ8E06yGKirgO885Tygbw1ps0u:nx5E14ksFAojPFsQG1z885I10cuh
- TLSH
  T1C095330BC7584CAED3FF63798A9B48285F220E6B3700B0C69056B387D6BB2957CD1759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  mus/vs_susie.ogg
- Size 1.6MB
- SHA256 5ab7a2f874896d9093d6d3091d15c280810879a8ac26417ff808521d4276d42a
- MD5 6a48ed774e2c04177e8fde3689872035
- SHA1 29b4dda19a5446fd37e04d264758536c803bc129
- SHA512 d16e683319093f2af2e4798492f829cf5d9820a8dad246e175813fe2f926c7a0444da27f667e3d50c7a020bcf4e10e7358d6c00cfd4a1ca13440acf55017f765
- SSDEEP 24576:ku0Ld9j9DCQMJYxgGTusgEcxjmA7hIoCcDmOSnJuVNkUtFAiU215+Pv0oWSMm3/:k9dbDFMJ0TuicYAhI5pQNkOFnl5SiS1P
- TLSH
  T1BA7533B294220692E10571FE298AC72173ECB1FF93E1DB61098903595C6FE62793FB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  other sprites/icon.ico
- Size 1KB
- SHA256 e8aedfbf383edea6391f9b79d32fa29abd3d5124e257f3c46ce613e1ad60301b
- MD5 1005a51996fdaa038fed2400ba9ad41e
- SHA1 000d99482aec9c015c6aba64a2da9b6c8d042651
- SHA512 a4dd56364c1613a42050ff17ab5123b42dea800a1bbf190bd05820b796e8e57a3b5f43a048aca8ce8167c165629749f1a82e6003f15da568b8d48c93921a7cdd
- TLSH
  T18A31A8B5E5587B94C8596D3020D2AD32E00BBF4081010E3562BC5773BA9B3182EE82FE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  other sprites/icon.png
- Size 437B
- SHA256 67d36c894696eb0134377d09054e1e92a7241fd6394f286bda790308b9f7bc68
- MD5 9f96d72c0c453bdedc971d8a6cadddb5
- SHA1 665fe091f9a4963d5d0171f64bdfde2809d1a3f6
- SHA512 e7ae40894799e4fc61601acb9b75c59b5b2abb10b3692aa520bce874844cc7d5f355a73e963cefd5353f6828d4c9f8ba7d1f6a9b1e761a12225297d705bd26c5
- TLSH
  T13EE023C39F548C4989042227C30FC166C4085D5603224096F13651F51A412C84A62747
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_0.png
- Size 548B
- SHA256 b3bc39628d0081e0a9584875822a1310d2d3e139b7cfcc6de1df3d92df41fd56
- MD5 c02236dd14e60e8db03f870d1533afac
- SHA1 51bb9921ab5f3c79deba482b14cde1e76a13a149
- SHA512 f149c1fce5553186de665e0c6c6c802056c08127a2871cc670f546f72438529fce835af00a2352519aa638a0ae73401537e82f0d0fe5bc3087622068d9cfc8f3
- TLSH
  T1AFF075FDD530B560C95717512E020215E892832B57A78944D771E2040AC4FCFCE0AFD2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_1.png
- Size 620B
- SHA256 6a68f7392ca9f18c30da4849a89952b651f9e86d42fe2257549b9137803d6f82
- MD5 37f95fc87e8dbcd6fb7789c4530cc6d7
- SHA1 35c86b40c68fef1915cffbfd1d155d5b6436e762
- SHA512 11554b64906651f17d1cc650f31171373cb938f7c960fa18cf903418bf02c12f247ba3bd1daa65cadc16779a7800889461f6e26ee031b0bd208204951ce83256
- TLSH
  T123F0A2F9D8308994D84E1B641A445784EEB3C54723BF4E5CF960D58C1998F4F1E93BC5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_2.png
- Size 585B
- SHA256 f7037f46a102392a83414c676c637c877d12f3ed1951494598bac5d2b20f0b67
- MD5 8fd244f699ce253cbb47b0590d5d2189
- SHA1 c784742f88face5feb0f225f56757d88d2f9f7aa
- SHA512 c9911f76c5ce5f3a043321e89434bd9bb87d5960a1fbf8f5c0bbaf96658224a717f07091d56ef9dea05cf45da71170f543aedf542203d795de5793fa003c121b
- TLSH
  T107F0E1F9D430E528C7FA02102B011745C6324A435A5E5DC87790AB1C8E4EBAB67AF3C6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_3.png
- Size 395B
- SHA256 629693f53ae8d8156f89bbb46477c879054a412f83ec2969e4000fa570155a2d
- MD5 2d4ecfaeb497962116fd35f39a850de7
- SHA1 c3bb55d59108cf85c5345bff2c67cf5fe82329d2
- SHA512 d657f136d4fd22834881183d29d3289a4c045dc4d0c1653527134a2be2385950da4f4596a33340e3b0b627c85cc6ab053207ac004e048775d00d2ceb81760524
- TLSH
  T168E068E99430C1E4C9C60A3B26095794E5F28A8F063F4D4CB689DA48498CF8F97A76D5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_4.png
- Size 299B
- SHA256 d0a467c64cd68e51ea0859e818fcd8a93b6e21b0f5cf80920106ab05a32f0cff
- MD5 af8299d0d641d570374177f6a18867a9
- SHA1 c58fe3c664d5d8e536a39c249453a874ba55ac0f
- SHA512 99cfdc1f339dd318e413524733570b377a24cb55d2c5ca3e01ad254d247248a31f83ce1e9cecc4474bd50565fd5b9f68f1eade57dcb1d85ccc4d75eec8b2c310
- TLSH
  T180E0C2E9A130C194CA9B223586045350F5B3D607026B0D8C9595E12D4908B8F2E657D2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  other sprites/spr_attack_mash2/spr_attack_mash2_5.png
- Size 299B
- SHA256 d0a467c64cd68e51ea0859e818fcd8a93b6e21b0f5cf80920106ab05a32f0cff
- MD5 af8299d0d641d570374177f6a18867a9
- SHA1 c58fe3c664d5d8e536a39c249453a874ba55ac0f
- SHA512 99cfdc1f339dd318e413524733570b377a24cb55d2c5ca3e01ad254d247248a31f83ce1e9cecc4474bd50565fd5b9f68f1eade57dcb1d85ccc4d75eec8b2c310
- TLSH
  T180E0C2E9A130C194CA9B223586045350F5B3D607026B0D8C9595E12D4908B8F2E657D2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Enumerates connected drives

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32