af04fa46ee57931ecc3f53d4298a0b62c95c02003525789d3c2c27078c008034

Sharing

Copy URL Twitter E-mail

General

Target
Project.P.I.T.T.zip
Size 236.7MB
Sample260821-15passdj4x
SHA256 af04fa46ee57931ecc3f53d4298a0b62c95c02003525789d3c2c27078c008034
MD5 a5b536263e3b3aef307c76b5830704da
SHA1 7f4dbcf6c458bc68d745d6adaa44bfc06b03246c
SHA512 332b0a47adc5bdb0f4f87a3be4add153d1443aa852cca4f4f2f78f173e2c7a6cb9dbffb6534103f491582ec3d2c2bbde031dd77fe1d03acd9acdc7476904e820
SSDEEP 6291456:E+kmDYSNWWfU75fI0jKbd/DVY3pPeTZh/YkUZaXCi5AjlT:EBAYuXfU7pTjKB/D6F2h/YkHXCiejlT
TLSH
T1DEC83312D855471FF00839F75A02CF2D9B14897AA119CFF9F39D89696B9E0C303FA296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Project.P.I.T.T.zip
- Size 236.7MB
- SHA256 af04fa46ee57931ecc3f53d4298a0b62c95c02003525789d3c2c27078c008034
- MD5 a5b536263e3b3aef307c76b5830704da
- SHA1 7f4dbcf6c458bc68d745d6adaa44bfc06b03246c
- SHA512 332b0a47adc5bdb0f4f87a3be4add153d1443aa852cca4f4f2f78f173e2c7a6cb9dbffb6534103f491582ec3d2c2bbde031dd77fe1d03acd9acdc7476904e820
- SSDEEP 6291456:E+kmDYSNWWfU75fI0jKbd/DVY3pPeTZh/YkUZaXCi5AjlT:EBAYuXfU7pTjKB/D6F2h/YkHXCiejlT
- TLSH
  T1DEC83312D855471FF00839F75A02CF2D9B14897AA119CFF9F39D89696B9E0C303FA296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Project.P.I.T.T/HOW TO RUN GAME!!.txt
- Size 283B
- SHA256 0c900302567a013f6764799206e944178630a191e35eedbffb62841dbbf1f2ec
- MD5 2dc5085698fbc2cc839f7dc35742dbe4
- SHA1 cd6216ac48274447f4ae52e534d3ea17420d00f8
- SHA512 8c162a639d1b3cb103e66202b371b6d9816321e41ff88283aea2103e830f00de0c94e601a1c2c548b5cb39b888dbf9d13b50728ee704ad2bf2bfa4e539ea72df
- TLSH
  T1ADD02BAEED8257A23FD441D2165E3E81B30DC41972311944BCBB82A54306B74C0349E9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  Project.P.I.T.T/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size 52B
- SHA256 72f4d3e137db5ae8cde66c1b8d000488f16e2ab27a761fe287647010034887cd
- MD5 e2e460fae8682d83a0f080dc3fc6ea99
- SHA1 1f3347c00b7a83709406e7f67659741fffecc48e
- SHA512 a741b7f3c34b46206a6146c34bd01fb71b06de856dc1271ddf13a19e9e1adc85e23aaf3cf690fa17dace117b7db25167916d38383fb50bab1b0ea5bebe81fc03
- TLSH
  T1EA900256451AD0599316084C851195579842219949AAC464D241DB1C588B15485A4708
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Project.P.I.T.T/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral7 behavioral8
- Target
  Project.P.I.T.T/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  Project.P.I.T.T/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Project.P.I.T.T/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  Project.P.I.T.T/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Project.P.I.T.T/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  Project.P.I.T.T/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  Project.P.I.T.T/_Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  Project.P.I.T.T/game/LICENSE.txt
- Size 1KB
- SHA256 9d11ba5edb3e0c5de2d597bf10a30573450c9a546d9a651cc2b55b8dd2e0fd6a
- MD5 d430d6ab187139fb1754b70e598a7e0b
- SHA1 48397146ff2895941e79f61799bcec702d8e363a
- SHA512 9971f5af3f73ba09d1cc810777b0f3c6e34499179ca8147bb6ec05f5638bf0eca975087e363c8b1d36f63938236fad1ad05d6290712d36cd6250e5ac18926496
- TLSH
  T1F221B46F72994373289607B10469E8C6F12BB05ABF5B1A41346EF20D2327019EAFF864
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  Project.P.I.T.T/game/libgodotsteam.windows.template_release.x86_64.dll
- Size 3.7MB
- SHA256 20defe9aeffd888a639f8afef5544cc9cff46b2074459a47207927d1f783ce47
- MD5 719aa8f9b2ce63bae064d77aeee683ae
- SHA1 d2266807bd55e40985963d7f94be7c9751d9cd45
- SHA512 a40e35ef4ec3d813404f3a5840412edded731186ace9ef5f9c35e171a473c558548e5dd7b92821407dfa45d307429230573ce72b1eb5ee4f281b3b79da4f7736
- SSDEEP 49152:kPTGk1rkArkPJVu5dj6CXRW9gAH3tRnx/4bP2fEHouVuRpEzstulSEj5TlX97aPb:QRr0GXhb28HoGSEjB7aPlbiq3F5qklt
- TLSH
  T178063917D2A351ADC86FC37A926F6236BA70B8455534BE2E6950CB302F71F60072EF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Project.P.I.T.T/game/projectpitt.exe
- Size 104.1MB
- SHA256 4339e49f08122e014404697207cc102180819835e726daffc40a733138f0b94e
- MD5 60edf8a55497c733d81badf993fec1c9
- SHA1 635b7b3f0b7b22bffa76dec387ffdf1ffdfa7d6b
- SHA512 2318cdd733aea3d4ec2161eb462382ce109d92725ff3ae2e65bcfbd5310bb3a05101948399aecbbae7c3038d9fb5673de398e562d4fa01ca71b28b89f8366cb7
- SSDEEP 786432:Ncmyjf1VYlSXxQnpJ9c7YUd4/KpRaFuQmhzyb4pbMAM2M8:Ncmuf1VYlShQpdUsKpBC4pbMAM2M
- TLSH
  T130383B53F27370ECC56BC13492DBA633BA73B85951386E6AD6A0CB742F21E50632DE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Project.P.I.T.T/game/projectpitt.pck
- Size 180.4MB
- SHA256 d210588b88c967754642fe7bed05c5e247f2b9f3b6bb87fd9c677e4afd080931
- MD5 b84bad976fe7faffce964c994eb0dcbe
- SHA1 8ea7bc3ef11ecb91a465a4ef0f624d62d4ebaa41
- SHA512 bb1e1e7db3b9ee04ee3000a5c4fa77fa1cfaebfb468685859ffda60778a3cf768384ef29917e0403043e04d8ff62f88b6535905cd3028a1c131be5790b973a4e
- SSDEEP 1572864:VMTJhWQJvrZZqEc0CArAGfDh2i8k8R0FuYvgmosz6ptoqDo807VkSBdavRo+QO29:oiMZBcOrAUP8hUBQtxsZVBQoP6yC9He
- TLSH
  T16398EF037782DD27E44546320D96C7E4B275FF868F13839372A5B72E6EBB3C14A8215A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Project.P.I.T.T/game/steam_api64.dll
- Size 10.9MB
- SHA256 42b8d7211866d060f342e382168f7a7bf660c9e8a294bc5028b15372a3161431
- MD5 898c7fcab03efc3309078409047c17fc
- SHA1 eaa0ed560b1b60d3313d54565bc1f81595a68323
- SHA512 cf66288bf3e6888df187b04f7d5001ca5d35a3f4851cf76da82fbbe3d8eebd6ae6fd449eecf335cef8b124d22ab69b0d33532bd943e7cc337179377c97a286ec
- SSDEEP 98304:hxDQAKHobcOdF0UGoYHigBqD/TeEsSfWjrWHVAPv1V7:hxD0UGATepSOj61APvj
- TLSH
  T125B6F917E7BA01E4E1FAC1789663623BFDB13495933497DB9A80560B1B32BE0E93D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32