6d532a2a6b33fdcef193fa9407629675429e08b5ccd95143843b0a261ebdc6c7

Sharing

Copy URL Twitter E-mail

General

Target
ScheduleI_Fix_Repair_Steam_V2_Generic.rar
Size 37.8MB
Sample260823-cv7gmasapd
SHA256 6d532a2a6b33fdcef193fa9407629675429e08b5ccd95143843b0a261ebdc6c7
MD5 e0cd0a15b91c8c58d4ca434a2fd32d7b
SHA1 a256c431cf36b554c408609339c4aa0d58e4ab7d
SHA512 947191e4257498390e35b78e7524e5d7abb601b4a8d2fb426012bb41fab410305b54b66d05b1b0cad30c8c1cf6bb2aaa06d5c923fa14b45cad7f3ef8e5216b26
SSDEEP 786432:dnZzn2e1gbZXe2JyKRE2bNupL1OCt5GAHlbizkSmTFeZzC8yKz8Aej/:dnZLgbE2zsjJFbizk0ZmFe6L
TLSH
T19C9733BB0BF003065B9011B1D20D57B51E8FE39DB5D0DA4AA5709F587835AE2C1BBE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/GameAssembly.dll
- Size 62.9MB
- SHA256 9531a85606af7a5c545ef44895c19f3f08f77cc221479b686539fa5b72141626
- MD5 c38fb89eeba9757c9ac4bce92d297bf0
- SHA1 638acffde6a194d98be47096a53ee53e6ea176a2
- SHA512 123df94fe082754489dbb02a4c5c37f327e27ff49a64b44d73f85625478ea1efafdab866f2dab48b1bed5ff29bc42022a959d218bce19294542ff2aa5a8ae635
- SSDEEP 393216:D8KRq3vsA+uAdl1ICA1PRiDkyMex0iJRwotkfilGr6NLyKjPM5Ef4fR/Cp9cVUYV:ZQ3vhyjk0fjPMh9jRlsXL4wgoQxGg
- TLSH
  T1D7E74B497AB55048C1AFE2789923145FDBB238446F24ABCB26804B9D1F737D8E877B70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/OnlineFix64.dll
- Size 11.4MB
- SHA256 54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
- MD5 485fa45f1886c44a1f2dbf7b8c132971
- SHA1 3833e8c37c6181ff148e0ca19f28145f9b80a8a9
- SHA512 e1e77f0f710abfa92261305d893597093177250d57630ce459bd657c09fc05773b1fbbf0387c1ca854650e52a8071a0c152b9011cdb197d97149990943e75e5b
- SSDEEP 196608:NlMHThZSFtSb3v19yOO10Xx9OYRNJsV1aUIu:AHTTSFt8N/O+u
- TLSH
  T131C622ED55D062B4D1D38640B18B539931C1A14D81FD0D193ECB2D412FAACBF6A8EAFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/Schedule I.exe
- Size 651KB
- SHA256 ec99366083ae5a4068d0c8091d80f857b65c57fb6ef603ab952d835469246ecf
- MD5 9b2ea0d02e6c4a12b5e5f9873f1654b9
- SHA1 5471385f8d668d156fe27dd97fa1ae6eed8cf69d
- SHA512 129604428678521ea9b78097bc140443179a9445dd675b1216d960de35e3e857b4bbb07c2cfcfb78c6addb0935038272141120606a6e7dc2c9c3907b06e20b98
- SSDEEP 6144:R/7Fu9mpcJ/OD81hfjjx5Bi/ppuzHVlXgytqbXLP5JRbBPEAR0qO1xfz+L9z:R/7g4aOD83jjAxMV5Vqbf5BVv6eR
- TLSH
  T162E46B960D99E074F00ADCBFF51104F66A90BD71D9CA72175640BDBEF9B6270AE88F80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/Schedule I_Data/Plugins/x86_64/steam_api64.dll
- Size 293KB
- SHA256 1add7f151fa644870a735ae86e68d1f019f296130d8e7c0a7ed3ecc7482dccbc
- MD5 240d8c3d2988d66d1329d38a92525bf4
- SHA1 20e6879434cb715e59eed7d4dd8c2cd749ac10e0
- SHA512 f602c0838e8deb32b440d857489e8d25f6c9f25e9ea50bf3fbf269e10f36b9cd0e67715ed596732361b24592e5c841917262a4c508ad762ae4bba77ec1386bd8
- SSDEEP 6144:KT91MKEQSBTYn5kH3nu7c4DylO2CuixbGU:KT91MKEnM2Mys2CBhGU
- TLSH
  T1E254493AA2710CF4E176C1798C565E0FF672344B27219EFF226053368E536D21A7BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/SteamOverlay64.dll
- Size 114KB
- SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
- MD5 0a5429b888c75f6525e1100e32dd2b69
- SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
- SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
- SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
- TLSH
  T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 96587e7be1175b2793af53ce867e4539bafde15e8ee4c57141a38290ff60b459
- MD5 9303266970d57402a35d9d8ae48990e3
- SHA1 98e2aeb5f15d68ab643d1eaf6fd85da0fa75b20e
- SHA512 c29bdc31c4530bffce2ef1e163a78bdc75ec8553625aeafac9c99db3a203063d5082a2ee3c94c658a96b33c7fdadaca33ce0919ddf689c6dea34cc876a1a2d88
- SSDEEP 12288:wo4M8g5CFF3vK3YjRJKC1Zj4xl6PwsinRZw2mtxb4TRq7QsoPo4nEcKylQfz2fz:wo4fg5CFWYii0zRZw2mX0M/wnVKz+zA
- TLSH
  T186457C6A66A800E9D5779135C952490FE7F27C1907609BDF23A0B7A72F336E41E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/UnityPlayer.dll
- Size 29.6MB
- SHA256 43fb0aea1b80c74963dae88ec7fc1c3c1993d893ce94d12972000fcc9b653ad1
- MD5 6d269a45938f4b88f874cd288daae77b
- SHA1 ccf74947910b7310ae3ac8c28a1514717cc8e131
- SHA512 15a1d7cdeeea11ca7208e1684c09d5187e10349aa4ad54be4ec4639e431e33f6604f3290f02848632e90685acfd89334b7dfb9dece124193fbe8b808897baaf5
- SSDEEP 393216:lpBjrJMosYRIljFjAB/50980v8+B6SaDi6GjIxlV:lnr8ABxrwm
- TLSH
  T1DC679DA6B2B800D4D47BD074C65BA90BFBB1344A033086EB52E149996F73BF11ABF751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/baselib.dll
- Size 409KB
- SHA256 e4d1fc45c23b320496f851b8be98914a7507418c174e9a6567afcc4f92472894
- MD5 0acaa25795a364ab02b8d5268509828d
- SHA1 7edc77a01b00b255880480d2180067d4022531d4
- SHA512 4f20aa5bfaf8d2d6e6968bbd7286249ab30697ab40788465b4c1c8d4f9e67de7223a0b2260f513a08e7418d432889722bfb001453998c9408b9293ad307fffea
- SSDEEP 6144:vuInkY6mJtoLpzxkzt0R60Htptb+REDqDY92q31YM9Ci4DTFc9GCXTnD:WInZ6mXWM0NptoDY92qFn9N7D
- TLSH
  T1CD946B59F76408B5F5A790788973850BE7B23C8A176487CF23A4439A2F33B91593E372
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ScheduleI_Fix_Repair_Steam_V2_Generic/ScheduleI_Fix_Repair_Steam_V2_Generic/winmm.dll
- Size 512KB
- SHA256 ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3
- MD5 e59aac558d9f9c5d1312ac24d09c51d5
- SHA1 2f11c4b00f5f92d4466348f9501aa657c9bf6fa7
- SHA512 1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0
- SSDEEP 12288:XQxOD9ZC0WKOy8zMtJKpBmpMgBNwQuQmMzWq0hNwnoAZwl:XQxOD9ZFKpB+N7JmMzWq0hNwnBZ
- TLSH
  T1DBB47C19A2A843B8E577E178C897460AE7B17486233196DF43F046AE1F277F11A3F361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20