d7c9f7b47df7f6ee9900d50c8113e4250da1b59c82200e1a0087ecd07efd7ed6

Sharing

Copy URL Twitter E-mail

General

Target
HowToFishTrainer.zip
Size 155.9MB
Sample260823-dq8dssxset
SHA256 d7c9f7b47df7f6ee9900d50c8113e4250da1b59c82200e1a0087ecd07efd7ed6
MD5 13c2cc4ce080cb471be807c5b53ce61d
SHA1 f47529dbc8955dd61a10c3278d28f06be1d8099a
SHA512 a97a96f59b8b16a20350494d562ac0026f759deb73812ad7f44f31f28e378acb2df97f4b6abfb1e48ea078d2db31d92578af3b8b63a9b88746b8aea044a78370
SSDEEP 3145728:8imLmTfiv2i942nNtZ/rNl8v4+CBr93/CkOlBvetNXfkshlpkMk4Cl0IGu1UPfDA:8imLYfa73TN04+CBJfkBvetNfks/pwL5
TLSH
T14578339EFEDC9E3CC357913682CB6E4E9ABC702575380957DA3484518A3F27AB1B1C12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HowToFishTrainer.exe
- Size 111.6MB
- SHA256 043afea45ab69c748c037262aa8c057e001e21853a76ddf601ba79940df1a4b0
- MD5 db9ebcd828d4d75312a3aa0de2f83ed0
- SHA1 21d5de082f60d5bdb3c63ed94315e8d33fc07423
- SHA512 485037d8e6196aa020a4196d1d1f47617a2f70ef4c2c90e53fdf3b93eefb4acacac2d177f566879781851bbf1cbcbb4e23210b369ca4fe682e407e96f981455d
- SSDEEP 1572864:1Pp36F/iKRzHo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZO:1PpIlHheuXpX/z/5NivOcC7hlTrQ
- TLSH
  T1BD48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 17afc13607ffd6b7f8df79cb744c3e4deda388efcfe9faa43fec36c8971450cf
- MD5 be711529b8cc572a2119d4817d458e51
- SHA1 b908ce3f600aa6c189a423379cb0942bb7eaff2b
- SHA512 12c0fd5c4424f211b5c84aaad10a36895f249267730fa59909816a83d3824118ad471d97ec7d5b1ab1b88f8774c09867412d73807ac8ebf6e77bde95c43f595c
- SSDEEP 196608:u+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKGvU:u+kNf+BWWyUA4Qjnw6+RsKGv
- TLSH
  T1514729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 254b008debcba0a3d4b728dd7fd256576ba2373a94bb4534a8f4b255f3f19532
- MD5 d504e51f0882e9cbbed0db04326115b3
- SHA1 5c79cfc9dee013ab3b7193facfa7cd5f082831b0
- SHA512 d21a3f38998d166532435d9be1ad500495ce740b0c14b09a14a02dfa2090af0416f608d7a5fca18fbd6ba8d17375dcae8c32dc49bc8a6147f4738f59f00ff90e
- SSDEEP 49152:3ESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:3DaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T151E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  libEGL.dll
- Size 492KB
- SHA256 6b9f036b3f9fb96c1941a9871ec84b319be1b773de2ec2b0dc66855080d7e77d
- MD5 04fd825b35735c91015dc53e5affd3b1
- SHA1 070661d25f776410103ec636505e48998c7c34b7
- SHA512 745e5584454709415bf281477539b203308101908addc6edb121fb03b591b09cc43d7bbadccbea6c1a50dd2fa43686207f04b2d11fc288d811f0070e92678409
- SSDEEP 6144:rtqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoS3hg:xqwvC8SrZmNEIsPwa6R3/8cWqt0HoSi
- TLSH
  T1C1B49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  res/Engine/Common/Include/SteamAPI/steam_api.h
- Size 14KB
- SHA256 5e58e7c06a476142e154983cc3a8a32e32a05fb65fe425208157f378911eea5b
- MD5 031e29218eab8631035eaf52d893362c
- SHA1 ce7630f78d948b305fa263f8ff43548b8e71f99c
- SHA512 db12c47acc89b206d88dde408547223828202a569a5824be61ca4e46cf1aef00c187792b8cb6276b5834ce4f42607f1c437edc2447641bc26522980d1ab4b0c9
- SSDEEP 192:rQSAh805VK5m0v22GoW2RRlP4RWtuxqz3HphqO1ZtAjhaK7:r9Ah805VK5m0v22GDaQRousHpIOjtvK7
- TLSH
  T15C62C99ADE4B37770630F2D79782B297E69C64B313681CB4C88A32A82145A4F477FF45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  res/Engine/Common/Include/rapidjson/internal/regex.h
- Size 25KB
- SHA256 160f64375368b70e6611d704413432a1a3d6b582f6fbba6f01ddd07bbda94372
- MD5 c5aa62d5542a13e660d9e07983496a6a
- SHA1 c861612c2d5f71153cef8fb265af36be286e12a1
- SHA512 b959a126001415c4f9c6919f43678bd57f5302236b24cd8079005e2688b3eda9fe874578718561ad2a4fa10bbab7ab5b8ffd360a2c2fc8a1bff3ce88ef3b4178
- SSDEEP 384:G8mO8ZN6U+ub/mAr7FQZqFaGxjv66FL4Szoe2xGhLrpGUge9DxsaPc6mPUz:GZ+JuqAkG4Szoe2xeoHe926mM
- TLSH
  T189C2B32014E38227D6376239FBDF40427AAE7453B7A8AE517E8C6604BF4017987BD3B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  res/Engine/Common/Include/rapidjson/schema.h
- Size 143KB
- SHA256 a1bee85b45d1c60516436f0b0f7e49d933adf6747a1f657eca3a5116edb0f15e
- MD5 18d26a73f7a47b2ea7b681c2b8d5a807
- SHA1 96836fa1d9d9042327ef0a702fd3b7664a412ad8
- SHA512 8b15e138ec1b5a9269cd8a085c80f400ceed72db802ff87a411b16cbac22ef5f952bb4a698bbd6aa1c169ba80b97b3d39864214d7e902c52fe16a4af6bee2c5c
- SSDEEP 3072:EAQ+ZN1ami8S3l/6uRq7PW88nR8dGZFBwad8d7NlBM0kmrmSxk0xB060G0e0O0e4:AoajHazD23
- TLSH
  T124E3C70579AF4457AB2323FDDB878041BB685003F634D9B9F98C27086FC2578CAB6799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
- Size 2.6MB
- SHA256 8648c5fc29c44b9112fe52f9a33f80e7fc42d10f3b5b42b2121542a13e44adfd
- MD5 4f1611f2d0ae799507f60c10ff8654c5
- SHA1 56ae8221e8024c8deed430e01a6160795c64cf53
- SHA512 f9a9f31010bcd890c1755ac3de2f6821a707aaeae2644cf083124dbdfdee86bd46206762e2487b942120970ca2ced2a87931b778e9fe4ae087d67b1865dd4b1a
- SSDEEP 49152:OqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazw:OxxLFfY/KCCpKk9aWMzZyaM
- TLSH
  T162C5331259C0D23AE0A223B45EFD29635B3D7CB8772027EFB78650968D262C164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  res/External/Redistributables/2008/vcredist_x86_2008.sp1.exe
- Size 4.3MB
- SHA256 8742bcbf24ef328a72d2a27b693cc7071e38d3bb4b9b44dec42aa3d2c8d61d92
- MD5 a92a4d8e784d8f859217f828fe879047
- SHA1 0940ec60dcc3162e482c1a797ca033d5996ab256
- SHA512 13a550e1135f49ae5ca6429381dfa4d5b2b4299012d662fb2262026ac499f1732b13683a19cb2569364f977990e0535f63d1a42a0f88dc1a6e9cd413c12bcf55
- SSDEEP 98304:LT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Q:LKlhE9U6476itR+mLPw6lyZY6
- TLSH
  T1792633EE1E32462AD31B42B2E4352783D67CF0A68C778DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  res/External/Redistributables/2012/vcredist_x64_2012.exe
- Size 6.9MB
- SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- MD5 3c03562b5af9ed347614053d459d7778
- SHA1 1a5d93dddbc431ab27b1da711cd3370891542797
- SHA512 6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP 98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
- TLSH
  T1B876333286989427D1A32073F618D5217FBCB15C1F1048ABD3549A6D3B68AC6BEFB347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral18 behavioral19
- Target
  res/External/Redistributables/2012/vcredist_x86_2012.exe
- Size 6.3MB
- SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- MD5 7f52a19ecaf7db3c163dd164be3e592e
- SHA1 96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA512 60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP 196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
- TLSH
  T149663333B9549032D26214B3E555D670BE3D70282F2048FB9794DB1A39B89C6BBFB247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral20 behavioral21
- Target
  res/External/Redistributables/2013/vcredist_x64_2013.exe
- Size 6.9MB
- SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
- MD5 96b61b8e069832e6b809f24ea74567ba
- SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
- SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12
- SSDEEP 196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
- TLSH
  T131763331E7B05023D6F201B2E411D528BD3DB2291F109CAAD794DD2D3AA9AD6E7F7213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  res/External/Redistributables/2015andUp/VC_redist.x64.exe
- Size 24.3MB
- SHA256 2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9
- MD5 703bd677778f2a1ba1eb4338bac3b868
- SHA1 a176f140e942920b777f80de89e16ea57ee32be8
- SHA512 a66ea382d8bdd31491627fd698242d2eda38b1d9df762c402923ef40bbca6aa2f43f22fa811c5fc894b529f9e77fcdd5ced9cd8af4a19f53845fce3780e8c041
- SSDEEP 786432:tEp+Ty2SfUfnLZnvko+Me/ht8+0c4Nz55TOZHzqnIlh:yp+Ty2SfWnVvkodepC+05NbOZHzqnIlh
- TLSH
  T12F473333B598C92ECBF60933AE98E9342E3DD214331549B7D7E8DC0D5A2606726FB116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  res/External/Redistributables/2015andUp/VC_redist.x86.exe
- Size 13.2MB
- SHA256 ce4843a946ee3732eb2bfc098db5741dc5495c7bea204e11d379336dcc68e875
- MD5 732d0ac9cd31b8136f1c8e72efec1636
- SHA1 17ad0ffa87ebb1ef27210061577a9ad9d5592430
- SHA512 02b959b3f008e70674f3fbb119601701057a0b3620e897a1b514a93ef22e930841d776d81506c0dc1d5d17899188ff489772ea5f9ae2f263fc1e304ebb7a491f
- SSDEEP 393216:AIHdlptVYmfr7yBG/4Ex080gNQXxCFLU5B1/e8s:AaXpttD7yBG/7zNKUO7/6
- TLSH
  T1F5D63332A5588039DBF31573A999F5246E3CE618231485BBE2DCEC1D2F740926BFB742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  vcruntime140.dll
- Size 94KB
- SHA256 1729421a22585823493d5a125cd43a470889b952a2422f48a7bc8193f5c23b0f
- MD5 02794a29811ba0a78e9687a0010c37ce
- SHA1 97b5701d18bd5e25537851614099e2ffce25d6d8
- SHA512 caf2a478e9c78c8e93dd2288ed98a9261fcf2b7e807df84f2e4d76f8130c2e503eb2470c947a678ac63e59d7d54f74e80e743d635428aa874ec2d06df68d0272
- SSDEEP 1536:yPHLG4SsAzAvadZw+1Hcx8uIYNUzUgHR4xecbK/zJgXTG:yPrfZ+jPYNzgHR4xecbK/FgK
- TLSH
  T185935A4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B646AA4F67BE15E3D355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  vulkan-1.dll
- Size 898KB
- SHA256 c8616088f984fa22d553335fe3d2628d24efa8d7d59a14b40261c0ab8b74d82f
- MD5 68341d29c364636263f5678af281fccc
- SHA1 434279105b600acc12a862e54b36595f7faada2b
- SHA512 2a2f0453967360231cd680f3e9ff926b28d4fae26e10dd633c8354fbb2088eee5197e2ba58dc9bf613d4127f7c9545f8c8387dde611a77d91da3cc743fab5422
- SSDEEP 24576:N2OW+3Qt4Z5sdQoAUx+W06Z5WRDYsHm6g3P0zAk7NJG:KkY4ZOdPgW06Z5WRDYsHm6g3P0zAk7N
- TLSH
  T180154A23A69485A9D576D034C9D28703C9B174822316B9CF02AC5708BF6FFF46B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30