10e22df1208059fa479b400734a8bc16646a46d4c4255f0482de7d64e0463b81

Sharing

Copy URL Twitter E-mail

General

Target
Lethal-Company-AnkerGames.zip
Size 756.9MB
Sample260822-yafn3aydmb
SHA256 10e22df1208059fa479b400734a8bc16646a46d4c4255f0482de7d64e0463b81
MD5 116f334ac017a1da18c6b9308c3c9fd7
SHA1 778fa3ad4175da7794f3eefe3b6751c424d2687a
SHA512 e9e79d504d1b6e31887b39fe1eb32abbcfdd8e5bfd2d49037a2a769cdced19ce01fed3f105df8d4fdd76e58b99d3ddd018ecfc5e668546dd4c49bf57e3681568
SSDEEP 12582912:Lvya589lZaT05ryHMIIPdImqXuFbT8fsGT4oooKPTdhSON2aBDEXQ58TO9aMp/xR:LKaq9lZxrclmPF380gKoKPTHSOMaBD8I
TLSH
T16C893383BF0CCE74CE4925BC742E565CE0E6FCAD5B8487272B15AA14D0FB55A8B0C798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lethal-Company-AnkerGames.zip
- Size 756.9MB
- SHA256 10e22df1208059fa479b400734a8bc16646a46d4c4255f0482de7d64e0463b81
- MD5 116f334ac017a1da18c6b9308c3c9fd7
- SHA1 778fa3ad4175da7794f3eefe3b6751c424d2687a
- SHA512 e9e79d504d1b6e31887b39fe1eb32abbcfdd8e5bfd2d49037a2a769cdced19ce01fed3f105df8d4fdd76e58b99d3ddd018ecfc5e668546dd4c49bf57e3681568
- SSDEEP 12582912:Lvya589lZaT05ryHMIIPdImqXuFbT8fsGT4oooKPTdhSON2aBDEXQ58TO9aMp/xR:LKaq9lZxrclmPF380gKoKPTHSOMaBD8I
- TLSH
  T16C893383BF0CCE74CE4925BC742E565CE0E6FCAD5B8487272B15AA14D0FB55A8B0C798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Lethal Company/.DepotDownloader/accela_wrapper_metadata.json
- Size 27B
- SHA256 ef187141c80517559c7e817c75c7dabb068ea547b2c0ce86b8d68622f451055e
- MD5 ccdee9a4b503737fe97a29a63f9107c9
- SHA1 8538e893c7f1494113a76892d50629406b560053
- SHA512 851966173d43fc288e92a564934a80ad167f88bbe45d3c81b908c7f01bd3b40a067ddc4cbcb16561a9c2a0dc792b5244a6ccea65a4e74d02be9dc9c304eefc68
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Lethal Company/.DepotDownloader/depot.config
- Size 19B
- SHA256 e601c275af4a96da5f91a3476f6ef24ff4a12e109e7eab4b71f3202b31d73f3d
- MD5 14b5bdc42d2b1073cadce2483b6ed2f4
- SHA1 96de8d99dc743b375e0f6cbaae8f418185b0e494
- SHA512 15cfda75ed0f386e891dd9366891cf7ba528172049d5e86f75a8d215eb615fda2bb02be226ed4d7de9a993d9795d32435a03106517467cff6f764d00dbf0a4d3
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Lethal Company/Lethal Company_Data/Plugins/no_plugins_were_generated.txt
- Size 61B
- SHA256 1e74a17681a2a73f1af10c8bd74426d22d842966d147f81da30bc9200cfd4e6b
- MD5 5ed0e92bedb900eebe1d4b5891d2bafc
- SHA1 2acfa3da43c1613f002a01fc8a2cbe68f2b5ac52
- SHA512 9f8f9df0bd03a4e9bcc475d70b7a7dc723388c349bea231665c1c39bf28a5a94ddc649182bdd93b219faac4276fe4545fd4af2840bea72b1e389b5752489f810
- TLSH
  T197A02203CB30820000FC0080802222C080EE0230C2C2FC200C3C8E03E200838032000B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Lethal Company/Lethal Company_Data/app.info
- Size 27B
- SHA256 3e1f5a0ea18d7da1cae98c211720e4ea314d0a9432bfa193ef3418793aa3ed2f
- MD5 d53c1edd7c6805ed2d04b7e9a4905cf7
- SHA1 3928ba31b583891542dca6c90bc063619730c5f2
- SHA512 7ad9b33759998ebc9fea890aa20aadb8eeec197e09f98c65b0c249ebfcea2d5df7a0763f97ee57b635a80185e0559e6e6d490f6aa0dc6a12a0ad45105a226baf
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Lethal Company/Lethal Company_Data/sharedassets10.resource
- Size 158KB
- SHA256 459e9d8056e2c97fd655adaae9efe93ca9aa648f92425d8fa3f609f8df499acf
- MD5 17b8f60a4eae8c4546c121117c6a555b
- SHA1 4b7e949cb8fd65d191f4279c416f1657072614c4
- SHA512 0487bd9d47b4451336c2149013db85c1fd142c353a2e71537f1202a674c18d533b7c2a16a17e536545f2a83d86fff9fe4b53c8b11c4495c5ead650f2224e658f
- SSDEEP 3072:6LWeI2caJbAoZ+DWlwaisaM4kDumN9tJFM05+/HoKg6:sTIqJk0UWaan481L/n4g
- TLSH
  T159F31249DB133EDBC5584730957B4E213FB743BA07225ABF5300A81A2D831B7B65AE23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Lethal Company/Lethal Company_Data/sharedassets14.resource
- Size 427KB
- SHA256 19b205b19ae6183e41cf1e90e349e363a8c21088f6c33ede903fc914572108d3
- MD5 17eafe5f0c0de599f27de090f6172d48
- SHA1 a8888a6edda36febdbdad4865da0f98e45cb41a8
- SHA512 1d23b543813fd6d31e32e29deb34eaea889117d137020b454f7e52a76b0c4400534860892ac647f82f70ca8afe77c1067420d545218dc605188f26370fb05f38
- SSDEEP 12288:4lFFS49KjxJrVmi2np0FulMD0Iz84UOIO:4EpxJrVN2FlMD0IG
- TLSH
  T12C9423470552CDCBC4F8BF3086FF168E8A5481BDAD3692B885B9BA51668C57CC23D4F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Lethal Company/Lethal Company_Data/sharedassets15.resource
- Size 501KB
- SHA256 7ef036102593486aec9f2199408a27dbb211b79684ddb19c6019cc18f1b17c0c
- MD5 6b6eda31c2d2819a0840cfaaeadd9e32
- SHA1 50a60ac9288db727ce38f99d811c97387db79791
- SHA512 05505cb7a6bf7c38d6aa13aaf52ebfcecfb6a26bf98656cbeec94500a064c3e80b57f311851f8d91b320c500d29126260515bf179480bf5e7ba1ad780e11d266
- SSDEEP 12288:JFir+aI0Qi/xLiZpKsbMGLT6RgO2573EE+Oji9HLUc05A:yrj/xm/K9GCN254Ehev05
- TLSH
  T1D3B4230EFB099E53F13BBFB582320905CEF4423C9825B2A55AF61788DD543F5A6429CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Lethal Company/Lethal Company_Data/sharedassets16.resource
- Size 198KB
- SHA256 c8a02162457364b94fb5cee895c9284ee7639cb4b2ffdff2dcb97ae740aa935c
- MD5 7dfc6b50319b5ae9f567a04996f336ed
- SHA1 362ad592a0605c2473121ef8e6876a946ab17f4e
- SHA512 b17582ef8f688dd436481c2b95f39e5ed4bea61002f383ca943eb650ad410dc4084ccb92664cbaa7d217cdd9a888191c8fd744362a2de9e2866a1726bca6843f
- SSDEEP 6144:N22p9QRvVli5wuYxT6JgYm5YgxsT7jEjaoM:WVl0wFygYmmIjq
- TLSH
  T1E514120F880069A4E8DC533246A3B6AF8E2B6EE5CDD4B7D741BFDAD74211445B76421C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Lethal Company/Lethal Company_Data/sharedassets4.resource
- Size 2.7MB
- SHA256 f6a9abd361f137640e204e50292ff966c9c847c7fdd3dd05ec8447bcfdf71a1f
- MD5 c32497724442783301cd20e08186c09c
- SHA1 6cd6d980cbdfbebf78491cdfba6fee623dae927e
- SHA512 7d0b5dc263a3cc61b58dd3d5bc004a884105958a15230939f937fa065c5e57a3800641d15bd19bacbc0cf53b056ebeaf77c987e4bdc6bc074c05a01af007b7bc
- SSDEEP 49152:t+x9/cjuPwe1dEG5Dqs5isk+DENXTdyPbNBpGLGNAhzt5Nq:ttjur1xxRkLj6ai+f54
- TLSH
  T11BD53353CF4EA7C2C53C0C3011FB1F0797B1E8F68264271B2A295975D8A3B21A59E9ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Lethal Company/Lethal Company_Data/sharedassets5.resource
- Size 778KB
- SHA256 22015e66e802858af84bc119b0bc9e65714d54f1e752464d2a361d2bc0a1b208
- MD5 5c0c12571a48b4373d57b07de8afb673
- SHA1 de8174613c725d77462de8600e4feb9121027373
- SHA512 551bbe867f3f1ef261bda66ffee8a58be90b89a05604400799a9aa82c17ed16674dd2b81050d2c3599b2c05746ecb431f9347fa6b53c988d9469c14ceef8f37a
- SSDEEP 24576:FqC/OsYugPctsE9QvUgYCZAolv73t+Afy:FTWabPfAv73M3
- TLSH
  T111053302D49F4888E0ADFD222AEF417262EE7DEE9070592534FE30F5FE91D3599982D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Lethal Company/Lethal Company_Data/sharedassets6.resource
- Size 626KB
- SHA256 2c94e073de7349473645765ce79764ca8105391a08eed796fb828907dc5eec4d
- MD5 cd84804422726fdeba40c7bf889469f7
- SHA1 7b4c9f294c9c36ab6794a11ed02b3a7420216584
- SHA512 82025515b03c6a90c0e9f7e2f6a79614fc09c69718cd3a8475949fdebcd6a6e5214c69a86b8f1800664d725e452226560253c016ce4667b361b43fbe72a5c95e
- SSDEEP 12288:ITSKxcki8bAb62aBDREOB0NjCxNIO680wTwWmH+sbmP+0kQo7RB1j5O:ITkkOCDCnNGihibme6zt7v1j
- TLSH
  T104D4235BA182DC6DCBAD19B816F96BC3252ACACBA676B30F708D71F9D0917F04090177
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Lethal Company/Lethal Company_Data/sharedassets9.resource
- Size 699KB
- SHA256 12cb0ec7e41fd10841753818b3e5132ec954ca80b7d35f9d2353501bcfdb0962
- MD5 7235eeace24eab190c9318f3eb66e313
- SHA1 85cb7210104122ba3d153f854f4298dfef71a000
- SHA512 d1441b67ed605e0326ae881a8cb3d7668dcbf7b5535a8d4755cb0efd0682faaf393b544f00732acaf147c10ea783c9ee337e83aabd4c5c94215d0751a2fafc7c
- SSDEEP 12288:NPBis+V9q9AFkI+oEdhrLFE5ETeNm1YObFsjL+3F4Joo58NWER9Etdj:NMvVRk1h1peULbFwDgp9Et
- TLSH
  T123E423A955D329C1FE1D46B567F81E8B763C61F3DA206B3F1F082E24CCB3E0595AA502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Lethal Company/dlllist.txt
- Size 35B
- SHA256 662dd415e2796635702c49586fb99ae62a3c6f595976d6923ec8a4e7c23fa8fe
- MD5 ff98c62757cb7c9f5dbedcd67d3781f6
- SHA1 82076991ee9a824bcf9969b416fcc163d02a6160
- SHA512 42973bbb4feb375354684c0356c45bfa7f0bf63056906244c2c0ac89720326cfa41c9aa51e2522d1d9da66c019ccf3dba570a732007e8b3306e66920faaae791
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28