31166f012c3e2374caf3ea7b611ba1d15c2ec5a3593c70bd1e2a112d71e5408a

Sharing

Copy URL Twitter E-mail

General

Target
sfnaf-v1.1.1-2.zip
Size 32.4MB
Sample260824-var6baan71
SHA256 31166f012c3e2374caf3ea7b611ba1d15c2ec5a3593c70bd1e2a112d71e5408a
MD5 a0f8ba4d656acab5fd4f3705ded2e29b
SHA1 da8d9c8392868f5f7dc954e94708aa90d33ae921
SHA512 d46c81ac22aed743bfa2abc93a0fcd31224b4d3b11cb27d1e3d87482a56f056c8fba9036422578db868adb2ed6ab9ea666b9547604399eee10da41cbc96d48d9
SSDEEP 786432:4kZxkhneoaOLkBAMKmsB4D0zc1vrqD7l89wxiCqzsxZ:HZxkhn/aGkkVBE0g1vud8HQxZ
TLSH
T1DB7733E7DA2E10DDCD98F13093E43AC44944CF474FC2D4E7E9D6A692AD88399C4A1E1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  sfnaf-v1.1.1-2.zip
- Size 32.4MB
- SHA256 31166f012c3e2374caf3ea7b611ba1d15c2ec5a3593c70bd1e2a112d71e5408a
- MD5 a0f8ba4d656acab5fd4f3705ded2e29b
- SHA1 da8d9c8392868f5f7dc954e94708aa90d33ae921
- SHA512 d46c81ac22aed743bfa2abc93a0fcd31224b4d3b11cb27d1e3d87482a56f056c8fba9036422578db868adb2ed6ab9ea666b9547604399eee10da41cbc96d48d9
- SSDEEP 786432:4kZxkhneoaOLkBAMKmsB4D0zc1vrqD7l89wxiCqzsxZ:HZxkhn/aGkkVBE0g1vud8HQxZ
- TLSH
  T1DB7733E7DA2E10DDCD98F13093E43AC44944CF474FC2D4E7E9D6A692AD88399C4A1E1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  OpenAL32.dll
- Size 106KB
- SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
- MD5 235355a8dd26903e75d5e812ecf50e53
- SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
- SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
- SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
- TLSH
  T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Please do not move any files.txt
- Size 116B
- SHA256 57dcf6529b06b7db0a44424043f7a4ab5712dfae0db7320b4f71299b77290e17
- MD5 c7ad22ba71cca7eab1c4156cd2f2e150
- SHA1 082d6c78b8c598124fb5ba1e9726438a393292ec
- SHA512 78185a981f97ea2c7e9b9370ef95fb146483c593db08acddffe785dbe25cec742ae1506aa3c7fb996c9c1386549501612b8f351325f2e60f903cc8dfaa7bcde4
- TLSH
  T112B0921DE8ABC85298909835B40A3E81D922605021194685CD6E2429E3A9BB6523319A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Super FNaF 1.1.1.exe
- Size 4.7MB
- SHA256 e74999e05c8a25af5251523af2bc00cbcf8dbcf5a2fd3562c001727a5e997a21
- MD5 6c38d0d73008d1dfed870e6e1573df75
- SHA1 1330bb854dbcfa9c7ecc642549e777ebbe7c0a0f
- SHA512 2c988f18686c03d73b16ba93fb9ee488a96fca5a45d7be7a2db49955b3912b66fc2d70f8269ea9b7068fbe4ca81fa74935ca1c28e7b35db1e9565aec5d0707a1
- SSDEEP 98304:6ywmO5NbzRdzAWGV75MvjZgLntVehudyMJdaA:xwmYhAWGDEjunexidz
- TLSH
  T16E36F133B6528837C0271A34DD5B92DD55397F111F28AC8B7AE99F0C6F3878139292E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  msvcr100.dll
- Size 752KB
- SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
- MD5 67ec459e42d3081dd8fd34356f7cafc1
- SHA1 1738050616169d5b17b5adac3ff0370b8c642734
- SHA512 9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
- SSDEEP 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
- TLSH
  T16DF49D11B692C073C57220300629D7B24D7BB9711434986BBBD99F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  ogg.dll
- Size 56KB
- SHA256 6321772c91681706ba657d2866eeca0e57ad5bf8472d5d93aa52bc4104560073
- MD5 e4a105d1f5c1bd0783b05b30035d35a9
- SHA1 71a2b71c63a3dddcee965940b1f1fe6ab115d91b
- SHA512 1fb343539d8060c421641c172f058ec199f2430e6f458b541a29d55456b5c0065dfd80da59e5288af58b9e71371cf21cfe13c9a86cbcfdcdb52a5d161dc21b71
- SSDEEP 768:9d3Yswa8DTyLaXQRMj3ci0T8Hq9RQcyGlqcqr81th24SH2lHl:9dphug+j70T8H1GgtA1S4TlHl
- TLSH
  T112437D2275A280B3C649827644E69B3B3A7F2556C7E0599367B4DB5B2C319F0F23E307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  vorbis.dll
- Size 1.1MB
- SHA256 42e60ab681713b417ffd615da0d3be5bd22f14cea5b55adcf16893b364f9b12d
- MD5 8cf7b34b55aa93c79813df225a30547f
- SHA1 48d262dfd558f12607c0c0f359248784c3af0526
- SHA512 3d47454607aac0a09d5b0a9fda8327d55f13c736da1d0be8e60db12581ef6e6c1ccd2ff022032360d51e073b3440ef025fe1d66ee16351179ad064e71031ab17
- SSDEEP 6144:7uUwZnZB8R5L1TBeWrvmPE+4K8RQu0+R0GRin:7ubn0isuc88Jh
- TLSH
  T1E335B80399A24B65C4BC41B989EBA57853313C8CAD411F4A37CCB6B138E3574BF927AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  vorbisfile.dll
- Size 76KB
- SHA256 70edf437a5c57004ab94e73d2a8b3321b3bd1accb83e7acccf74b9b31397ca0e
- MD5 cfd78435edef8bd4c654b43e3e72bca6
- SHA1 46b5531eee593b21057cdffcf0d51df0618e4300
- SHA512 5411246f9e92a5bfc5cf85fd3a94cf9b800db1f5d2fb18e4e84e5be24cb5d5b1b61747b3f89b132f7345d73b0ebf6e795c5365ceb863b90c12491d40860da661
- SSDEEP 768:6ppmGQlRKLJ4ywfBQVuNBXuSTk/Ebfn4QWrx6B4y/p9NxiB9xb6AP9EH6lYcY:6Hm7pGkBeSTksbQQ04niJVNlM
- TLSH
  T1E073BEA214E2C5F2D1CA013854A45B3BF73E75250B92CED3DB54EE895E309A2F63A347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  wrap_oal.dll
- Size 434KB
- SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
- MD5 d494267bc169604fac5e3679b9a97fed
- SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
- SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
- SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
- TLSH
  T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18