6d020d51d47734607c9009aa7405da5755ea7be587ec342a919e4099452e8cc0

Sharing

Copy URL Twitter E-mail

General

Target
Nagasagi Yokai Tales ~The Lewd Demonic Arts Threatening the Yokai Hunter~.zip
Size 829.2MB
Sample260827-ef52cszajb
SHA256 6d020d51d47734607c9009aa7405da5755ea7be587ec342a919e4099452e8cc0
MD5 736ff5fe1a69eede485ba07721612c3e
SHA1 d4b41d3837fde7093c3cb6a48c730c208f00caf5
SHA512 19b9869df7882d01db005b782ebe5873aa2af48a39a07ca4be27f3fe676b1e6f6cec4a6dc96d1915787aa64f4a167f2556942765347001ad345441ce1fc9a414
SSDEEP 12582912:9qddGq5673/QD91OWLCfJ0/iMqBM9iiulgSPfk1ypS6R4kuXHpjXOVMjNZuBqJPp:9fqM/UHOHBa2IwnOCS6R4DJjXOVMjCqH
TLSH
T1D8993340CADCD425C4BB72B56DE0A10BBBECF64983E9B0925E3DD7D067AC9642B05B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nagasagi Yokai Tales/Game.exe
- Size 2.0MB
- SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
- MD5 f760c2f862cf7d98b570bae41364e05d
- SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
- SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
- SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
- TLSH
  T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Nagasagi Yokai Tales/GameUpdate.bat
- Size 2KB
- SHA256 c50d6aed8a4f5a102c4bdeee178dbf525b40aa7837ed0bce69522f1b3c9f3082
- MD5 4053bf6fd45fecbe537b6b9f170a8c09
- SHA1 2bfe14726cea269d15bfd23abcdc672a78afed80
- SHA512 4be230db3564fe7c66cf476c7442bb30506bffdf047a4ac1c849f3f89749b4ff213615ff0e5631628d10a61c911b82afec138715644fa6051e2d85b1e1a7b33b
- TLSH
  T1CC510DB121488B1A543E963917791523F51E41AF5A2497ED7F0D90080FBA3864CFD9CD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral3 behavioral4
- Target
  Nagasagi Yokai Tales/GameUpdate_linux.sh
- Size 1KB
- SHA256 5f842f84ba1751669a219c2b7146f2d68306f0664ed05c9f3785c980fdc29700
- MD5 fa65e325cdbf14d04df09be1f8528752
- SHA1 618361e1d1f4f500238403a19e3da839c02e0632
- SHA512 60d28d85c63b57394b872c41db36d84cec420a385003e8d36afdb2e859edb231a1b951f834bbb7261cdee6b4558bcaff7dbd83fa0ee73cecbd3df1e185f688df
- TLSH
  T1A7212EF25C808636010B8654178F424296174ABB47ED6EB8B8117014BBEA6F83DA62BB
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Nagasagi Yokai Tales/README.md
- Size 4KB
- SHA256 2d36196615e3c2ad8d36ae13d8df7261d332779256d79b973256510e8aa5e0bf
- MD5 54051c54bc8f357d6ea06e8b6a991255
- SHA1 a7e658c879f6fde26ed79f0ba995c128424ed6e2
- SHA512 cc8a986c06d57daf45ec0817efb3de13ff611242b9e138fa1cc8a227368881bf537325fd5840914eb390fe63994af7f6d00ff3b9677e9f9e030b46c1edf43f74
- SSDEEP 96:nHjon3rE42Xz9puFZl8X2pYwpIBo4fjhRLXvhZ/YBpOgMGm:nHA2j9pOZl8XYYmynXvhZ/MPM7
- TLSH
  T1C9A1B7B75398C63302318578CB8F39E59F2BC0BDA29E5A1879BD20484157DB14E2F29D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  Nagasagi Yokai Tales/audio/se/Voice_E_Hpre-12.ogg_
- Size 56KB
- SHA256 6bd352a4630a046083c8b029bdd7d7a107a81f8962533776418b6987a984cb69
- MD5 011a2e74065381efa192408995271358
- SHA1 79843c60771ac379ef4ab24bde3fbb6a08f7bede
- SHA512 abdc9bf0695ad9bab46975e3ebbfbba5de548b6e25d97aee5606e1b830961cbe1eda038b15d989737de1e134aff34834b565aaa860ffd04d9ae97dced13643b1
- SSDEEP 1536:4WqU7LLLEWwFCj/YVbSaejDtohDhFaZQRHgnAsofvcD2xZK9B:PqU7LVwFC0Qa63ynsmvcD2xZe
- TLSH
  T1BC43024CE8458F05C7E3F67249E52AC52DCCB8BE26D19AE6E71894F4DBE3420B8111DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Nagasagi Yokai Tales/credits.html
- Size 4.5MB
- SHA256 d9729b75ddaac7b9b21c62ccfbfbd12edb0619ab04da3d0cfaf1ff31e77dfc41
- MD5 9831b9e75e0208ce0dacb6db23d4acbf
- SHA1 065886a77a6eafac21c5c297bfbd4d2cb50751b5
- SHA512 27d57e91c41fd4cc000622daa7a404f9ff40c95589f5ced7d7beaf5336b4480ef1ffe972928794c76fabdc923b787bd6673191e1c5a1815d74b9438695637e99
- SSDEEP 24576:8wEBqmnLiLIi2hrErjKvMPkUoVAwurQBzun:VcqmLAstCuUcBq
- TLSH
  T17126D56BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Nagasagi Yokai Tales/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Nagasagi Yokai Tales/ffmpeg.dll
- Size 1.7MB
- SHA256 44917512b58d193b4361f2d07b723346feb7bc69f2b0ff51002b3c76f88d0f71
- MD5 f2db31ad12fd16c5359ac583181fbfdf
- SHA1 4721511f6b0294713032d3c3be82e638f1084e06
- SHA512 17ea72069aa2a601e4e5e2ae433d529796f153dbf1cd2d2443cd2b514ee7bdc73af36ba1fce2f54b74f2e4a4148a2e51dc2bae7b8b9fa4013fd3a9392497437a
- SSDEEP 49152:4pvlwTaS4rzi865zldVJQSJt9eJACdcVEhM:rTaSczQ/VJ9enf
- TLSH
  T1D585AE07F2A505EDC06AC134879B962AFB3178494B246AFF17D0B2293E77BD05B3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Nagasagi Yokai Tales/gameupdate/TranslationUpdateCheck.js
- Size 16KB
- SHA256 76821b2058f366d4a9238db9f259f61d95074c24a83b032badcafc41c3e9dd13
- MD5 1b2db81bab3fbc81919dbe352cefc662
- SHA1 e9ad707f55561e9a0b8cad01a85fe8b356e98ace
- SHA512 0284c2e5e9915acbf0b142e588d426ad8bf912f0262e6ad4cc5b36a278b44781e7b361717bd00d66708d52b9e7785cceb5544e8e83afd09a28b930837e001583
- SSDEEP 384:OoorsfuwV69V1u6dEdUflgBiViocHFEdks:loYfunTrtEocHA
- TLSH
  T11372A69EAAE705A25923313D4FAF1420B176C1230209CE103D5D9659AF90CBA57FBBFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  Nagasagi Yokai Tales/gameupdate/patch.bat
- Size 8KB
- SHA256 71b14d25bc853acfb71fce3bb9b71346671dd3e319a7787c068838d529665b82
- MD5 0a1948cb5f9b8223035d44bbc9bf30fa
- SHA1 77cfa70be5f47f3063bf6a2dec47bb34ce708de6
- SHA512 2b6303091942c00b73ebaa43de066bc572061a186d9107fb2c0ed4c282996543441c33632edb631f93a799b56abd1597e4657d1ac53a991d16244ea413ad3e0f
- SSDEEP 192:7pteVEB1NlL0+rVT5xdDMmbxn28+ECWB87O10f4nJhWeoWNBgm21YOO:7pteVEBbZ0+rVtDMmbxn3+ECWB87O10C
- TLSH
  T1260264B53CC621264079C2B4EA090165F60FC0DB671816EEBD9EC0965F393EA58FEBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Nagasagi Yokai Tales/gameupdate/patch.ps1
- Size 36KB
- SHA256 d7b848206ff1be9df4da8b06a8b802735bb1c5ff8383ed4cb5696db0fe3120d7
- MD5 08e89ae949b2f75836e6c2445a63a994
- SHA1 d02136fc9ba400dbfe7460fc32b70edb07f86380
- SHA512 a55f5ffbde7fbdc927060f3bc281e5b21858e9d79331c43b7967fb0a82f7ddf04a825ce3991440f48061287fbc73c50d071fb7548fee6670adb577164908274e
- SSDEEP 384:Lr8bLoK3e454BQTNfK6VEKPK6zgKWsGn6vycFsnrab9z7Z8kz5t85tOheC4tnNaR:nyUKR9gZu15RaNaGdPdQRWy1KoSGt8GZ
- TLSH
  T1E4F2D92939E371261A87A17D5CAC5814BE5B815F910C1E00BC9C4389DFF6A79CBE8FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Nagasagi Yokai Tales/gameupdate/patch.sh
- Size 15KB
- SHA256 5172299236b4222209c47769847f95e90eb0de7ed46dad70e725e5129a805ba4
- MD5 1fd3dfe1935a95e2f997ccb28db0b230
- SHA1 0665feab20e9b05206be8cf619c3b8340a4054b0
- SHA512 f267d64524e2a0058750ece3a7fd01ce8e6e03371bba80d253a07c62d27055daa8390f53098e5a02732f45d7d4cad9c9bbc46b5c5105c074e345d83c589c4595
- SSDEEP 384:ybCHDPist2lobTbJKd7v6v0qFR4Xr0Oqzkb:DbNQTz
- TLSH
  T1A86297963CC24270541AC0BC4B8B2044F50A911B5F483F69B92EB9587F3DAF6B5FC79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  Nagasagi Yokai Tales/img/pictures/edo13.png_
- Size 4.2MB
- SHA256 44471999aad33576ff8a6e69e11664bcb2833cef70dd75592f35eb21a15658a9
- MD5 5f2d674e043b677c75e7d18160f3e4dc
- SHA1 3cd33fb66a88fd77335fb128b25d215f5c946f9c
- SHA512 2adcd85ecf53f113c6dac3bc970db9ab9eda36a8efa9935453a95a68afcef1e007fcf383c8aca61ed6daba8ea0904242cf09176b33479a42504b861227898403
- SSDEEP 98304:1Q6ET2lKAT1laAWeLE0/nmE6N8KiCXcvaWuVB6IXsG35Xvel3kxOz:W6nFvaAWkE0fGOKi2eaWuC494pz
- TLSH
  T1F2163386D39CE272EADF2014954219676CFE3994CA7F1C4F1E9886C829CE14D5E37B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Nagasagi Yokai Tales/index.html
- Size 647B
- SHA256 7e04c5ffa3a9eaf40eededb918c09527136fee56c3c7a9b6640fc1fb7b356643
- MD5 62ec129063eee6bcc7f8391beef1a992
- SHA1 6e2357125d63b71461def6f519077bc11ed554b7
- SHA512 8b0813ca2db8aa63a58f8cbc56e31a2ef0aabd6f9591a218b7e014f4e279d886ab2a091f4240650f31bcba7b5157e5e966fe416f4df8bd15f00bead0f0b860af
- TLSH
  T1B9F0264548F25C0936104948DDD1F8148C99415BD690DEC4F1DD107A8FE8FF904C3AFE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  Nagasagi Yokai Tales/js/libs/effekseer.min.js
- Size 189KB
- SHA256 49d8f79328495bfd9f47fce8378aa7d898adfb4238c36abc5801c78586d11dc9
- MD5 02f74608f9d6dbc0cb9ef88570da2eed
- SHA1 ce845dbb6fea3f369b06eaf64726b4f291ab1bdb
- SHA512 7d8ecb790f2ef58ad1362602bfcbb0e327a8932e89f605fcba5af5502bf3524c6bdfc255d89b08f7cf1f5a485e3107439f4b0e4eea53f57d4fb7aad9feb170d2
- SSDEEP 3072:xKz+yOG2j0AGx5mc2+kSPGJBOWLW9rjKJcUiJqzy:oOzj0AGx5mjS+zC9qiR
- TLSH
  T150143B88BB49E066C593B7BB943F060B39B49452A80CD05C90ADD4C48BF4F9AD5DBF8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Badlisted process makes network request

File and Directory Permissions Modification

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32