faa20648243b1248bd2c5249853f065abcbadebfcb02d905a448b64508da64c9

Sharing

Copy URL Twitter E-mail

General

Target
SteamLegacySetup.exe
Size 270.4MB
Sample260823-edv4dasdrc
SHA256 faa20648243b1248bd2c5249853f065abcbadebfcb02d905a448b64508da64c9
MD5 d2d61894b8618442430dae9b1b750d40
SHA1 316677622f5e398af993e8e307f8c70d06f6009d
SHA512 9a7cc2908b06216ef51fd40716acc908c3c47b0b7ec2560d68379ae0f9cda66f3499080df9c0ce241c9205bfc0f4dff92b7890bafbfb62152222ee217498bc96
SSDEEP 6291456:XpDtsAKZzst/EUXxU9Qvjgqg16BiKVwrgSy0K6UwCVRU:5DaxzM/EUXG9iE1+VpSyB6UwKRU
TLSH
T1FFD833CF2BD40919CE1EB9B20ACF0122F2AF176451C5B32495F686FE5D70B296B131E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SteamLegacySetup.exe
- Size 270.4MB
- SHA256 faa20648243b1248bd2c5249853f065abcbadebfcb02d905a448b64508da64c9
- MD5 d2d61894b8618442430dae9b1b750d40
- SHA1 316677622f5e398af993e8e307f8c70d06f6009d
- SHA512 9a7cc2908b06216ef51fd40716acc908c3c47b0b7ec2560d68379ae0f9cda66f3499080df9c0ce241c9205bfc0f4dff92b7890bafbfb62152222ee217498bc96
- SSDEEP 6291456:XpDtsAKZzst/EUXxU9Qvjgqg16BiKVwrgSy0K6UwCVRU:5DaxzM/EUXG9iE1+VpSyB6UwKRU
- TLSH
  T1FFD833CF2BD40919CE1EB9B20ACF0122F2AF176451C5B32495F686FE5D70B296B131E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  controller_base/images/api/light/shared_gyro_yaw.svg
- Size 7KB
- SHA256 c7320225b627330db3f9db374b9f9cf1d352127ddc102ab5bbf2006d28cf8a4f
- MD5 60d2369852038ea43292244383d16b34
- SHA1 0d67803885de121874b5af3eb7ab713f5824bb69
- SHA512 4671a386b303daf258e791682a0fdbf0c04240d720a5550a6bab4162a52ebc48925cc558654e12bc0ea7ca294c391d0ae79ae4e4c52bf42d2e2467520625dfc7
- SSDEEP 192:wA81MgvIwOoDsKOshBaypNMz4cg3d5n6OmtV:wB2IIwOoDsK5Bay5LNgvtV
- TLSH
  T1F1E1CAF593B875EC508AD3B9A0EF9076315F38BA3312CE1A03653D98AA1302C96DCD90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  controller_base/images/api/light/shared_l3.svg
- Size 1KB
- SHA256 82195d2215675309708625063d240a7df6b6f523facf1121b659a1c8b9868b64
- MD5 7b44dfa1afd19df9ec13ec3584c3296f
- SHA1 013bd6125ec2a51d16d65d7b507c1b56bcb5131f
- SHA512 d289f63975bbde2e37bb3e1ab2b9f45563ba52ecdc6cfd4fbe244bb9cab27521fbb0b9530730b4f51fefc59158ef7cf487bdd5243ac056ce4e10d58938e01ece
- TLSH
  T1FB310FE483CC66F1E14EE3F4842EA4B275A334F9392BCE5C91B03A66F20206D58CA901
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  controller_base/images/api/light/shared_lstick.svg
- Size 472B
- SHA256 38d30d6cc18a27e4df993b9c3142d8bbdf41689efc5c9ef35905f7c28ea89094
- MD5 e230da874245e550066a554134ae07b7
- SHA1 bd0f363fafeab9aee33dec3f3a4eadc5faa03ec1
- SHA512 55c269108ab24ff0d2e15a67dff54d8044cb118b550f594bc4fd710e547975e43f62be41a08d01a048a9b3fd9e4818a131495fa23148306d5b9e79dab99b98f4
- TLSH
  T17AF05CE0099CCCC71A4DC778D63E35F6A2B360D472740C949E703733B14B327A859A60
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  controller_base/images/api/light/shared_lstick_click.svg
- Size 558B
- SHA256 936fe7171c447f222b67d2b941eca371e150963d8ff99f9ffbc189f97634d8e8
- MD5 5e8ef5254ca859e1f477d7622570bbc8
- SHA1 050c2b60de8d84c2ddb249c676325a7a752ec713
- SHA512 afd2bbee4d732c4d1a03fc4ccde8702dce62353505c26c836aadcbdf46cff8eaceeb5fe0914e1a896b22827fb8ebadfaf68f26f267f1f988869b11e224e2eb5a
- TLSH
  T149F08BE4089C8CC21A4E9378AA3D35B6927264D071A80C944AB43B23708A3E7A859950
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  controller_base/images/api/light/shared_lstick_down.svg
- Size 917B
- SHA256 b866ae9e7df047267e45160278dc0982281175c668898461bf3bfa8c34f98e38
- MD5 3dba7ecb5468ca11d5e5de921671dcbc
- SHA1 391f4a34391d325c7127b797a9db15f69db8cb1b
- SHA512 f2070dc2d804a78201287507701d8243464580d8f35ea36b1596ac4b0305ac0a2ca831d373497571c7b9c8094dc3bc5ac1205e44311d75dc4d8f898b9bb9c939
- TLSH
  T1361100F84BE049F4848ACFF9871B29B8376324BE3D44C1DA1394BB28D0854DF6C889E0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  controller_base/images/api/light/shared_lstick_left.svg
- Size 1KB
- SHA256 7f92f350dc95c0a304934a99707e1c5ae4d3057170f2a0a6fb0d7a1225c14985
- MD5 720e20b7c95d2b9ff817c72a0dee6601
- SHA1 3d57a7d51e1295d0cee894f6ae8e27838aa991ca
- SHA512 d9e3edc6c790339f5af9a490e2325c1672d75010eaaa2731b233418560c8dfcd2057d96b934f86b812ef287601ef8dcc3fe6672e501279d6c30d4627fee79f14
- TLSH
  T1C7111FF553D089F9889DCFB8831329FA731336B87E06C1DA1380B63B949C5AD2C84498
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  controller_base/images/api/light/shared_lstick_right.svg
- Size 1KB
- SHA256 476b54aa66aaca80103880c3d4a5099a66036182437f6081808724d2ca0f3030
- MD5 820d37d5473263aeb71c40394b45778f
- SHA1 64900b89257b1733cdaca81f4678f9abd098917a
- SHA512 e7a600120c7a096ae1d6d2c55b6ead2c4f401c79b20c4cd6d3bce466f59e567b25dd94d14e6907f4c7bc005e286234ab0bc743613cda2e2a6075d1ef861d618d
- TLSH
  T122111FF857D04DF9488D8FF8830B39F8776335AA7A44C29A2784BA2A944909E6C855D0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  controller_base/images/api/light/shared_lstick_touch.svg
- Size 1KB
- SHA256 501feb52f67739b1756e5e24e940c00e640ff3913941b14e944de0f7f59ead72
- MD5 58b2b8c0e10f3c344bba65306b959383
- SHA1 4b307768dd66b952ced3b454da68f8cd141ebffe
- SHA512 d073ef00e751ae7cc334625fff6c18a9915161755a611a73c3672fb6e1b1a01b185883a363e6fe6ac520bc93f2f6ef7577a6ad48d6267e6cefc3ae90cd35be9e
- TLSH
  T134311FF15BE515E6C44BAFF1CA2D18A27A2314BABF00C16903909F26AA730DE8CC0C90
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  controller_base/images/api/light/shared_lstick_up.svg
- Size 1KB
- SHA256 6a58b69c5d697f83c4beb211ae01d1d2d063799749a1643901fffd376cf5bf23
- MD5 af2c335917261c606b4601fc2bcebb18
- SHA1 a3ef150628b5f1aa5fa98c1f066b0408264cac3c
- SHA512 18e760e3bae3e4722b1486182542bffd2b9c705844056aa0dc3e4a51e8191193cb312e61fe070d41913d39b03c3c15b5bcacc2b8594ba4cc1024633233a25cdb
- TLSH
  T134110DF853E489F949498FF5C31B28B8726235BD3E49C0950394762AD05A0DF0C854D0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  controller_base/images/api/light/shared_mouse_4.svg
- Size 1KB
- SHA256 e73f5f8c3d33e6907e02c16fca4ac0a081afc5869c3fcb71dbfbde4d54dfc87a
- MD5 b37f212a05aace97a997933882f60c0a
- SHA1 cafbd6c8f6f398480b4842c9d262422a35f5caf9
- SHA512 c98646c08a9c0618c5fc329d9305d26b0e9fcfe1674cba1c7351e03eb3d08e818b73eb40a1b578401df0e556f86646cf142ce923b8fbf6fc85cd2eba442e20f7
- TLSH
  T12911ABF84A49D9C241079738C72E36F137BF24EDB54500C92298F9A9B9594BD8C58F84
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  controller_base/images/api/light/shared_mouse_5.svg
- Size 1KB
- SHA256 bbc2c3309f29f413ed6444a5e949ba1170394098bc54f9436eb6147e587658a5
- MD5 9e303de9cc4857eb95be03ef3b84032f
- SHA1 b10de1512fc3e62430f83c854d6e107717c07b90
- SHA512 63e96f7ac49f78ba41fa4c3f14286b70eddd72981a61847b57a26eff7f8f77e987328a33ed6f1e9d1c1475fa9528f07e0cfe95e02d452f10591c80ad54fa416e
- TLSH
  T10111ABF84A49D9C241079738C72E36F137BF24EDB54500C92298F9A9B9594BD8C58F84
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral23 behavioral24
- Target
  controller_base/images/api/light/shared_mouse_l_click.svg
- Size 1KB
- SHA256 8607f1c6f3db68f6e28a082765abeae4d00bb69b0d72e09fc365c0d6b221552c
- MD5 61a47105f7da339c30a80999e6284e58
- SHA1 7ac52238aa7475813f330183918fdc95055b6374
- SHA512 faa9c7c3a26d28dec60a645b71556d75c03ac7a91c3c6bd71dda4f12bcf45fcc7f54e811465bd4d8d083452913f7afe2d15bb6b8ddeb0064b987372d373f807b
- TLSH
  T1661165A40344A50D150C533DFC25F4FA704954FA97D3CA08C369FC3F344A96B284B961
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  controller_base/images/api/light/shared_mouse_mid_click.svg
- Size 1KB
- SHA256 e794928c6c4a2504398a1977b6e7e99e55fc3c2633295868b6994516c35f32a9
- MD5 c66e0f8a0fc6957ca6db2b3a1aeb66d4
- SHA1 8fdc8b3f368b2a09253cbaf0b725aef5e477a8d2
- SHA512 63aec22b5a5d87a9e4150dca719616b21bc840cc4ef50e29a4d9c27c02a1df0bd6ac7de474ef30cce87753e49a2c54639172ba0cf433d3e50295915947a7036a
- TLSH
  T17F1132640688764A240C9339FC3674F6701824F7ABE7C90887BABD2F344A47B159F811
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  controller_base/images/api/light/shared_mouse_r_click.svg
- Size 1KB
- SHA256 1777edcba5bbdb3d0f3b08a69d28311aee0bc522534ba1161ca573ffe2bc3ff1
- MD5 26c6bd2b77bbfde2cc97c7f57975c4eb
- SHA1 fd131c50d8449dffdd804b211401f91e0c56b64d
- SHA512 bd00cbcde493d4eba3cd448acec46e96ce6ddf014b3577d67c0173154ada78d4c4ae43268c45403cc70e1e588dc06fbfdf6d02f630ff4e6b4a88425f50b334de
- TLSH
  T12D1165B40E94A85D050597B676343EF2F00530FAF7E7C608CBE975AF348E5AB09C6524
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  controller_base/images/api/light/shared_mouse_scroll_down.svg
- Size 1KB
- SHA256 5e69719739483989e207bd3e8cb23fb09371c6e4156035b3365f618e5ccc5f2d
- MD5 624760c0ca584f9fc37f77fff724557f
- SHA1 fe33cb4c108d1e5c9ceeadbe0058ac5202f19d85
- SHA512 3572c7099ac468e477224f9d8ddee37df36cfc1b9ca6b77b08014b49cb59ed2d85d6972a9927a44fd86f5b346067eb04b2795f1705ecb72adf64db38bec3fa44
- TLSH
  T1852110D648AC7F625984937CCD9EB8B765B370FABAB5C8A152403F5BB6920381C1A5C0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32