c8d65ebbfb10cb2e94e9a3f0f61b7d051e590c156fbfdfbb6a9c344c9dc23805

Sharing

Copy URL Twitter E-mail

General

Target
Scam.Line-SteamRIP.com.rar
Size 138.3MB
Sample260828-cfehasem5w
SHA256 c8d65ebbfb10cb2e94e9a3f0f61b7d051e590c156fbfdfbb6a9c344c9dc23805
MD5 871413dba6532230530479a7451083b2
SHA1 6bffe527318b919c2099d4c31e949e395c656168
SHA512 908990c7890564e6bf1931d5d9b309f82c89af59ebc376e25f249eb905b6a11fd2e2b4cc73ffb0d40e343c7a4f1c0a61804800b8d14e249cc60ef5e5f057be7a
SSDEEP 3145728:ys9ctEBdtlQixO7ORJIbHSPA4AXK0AscHXL3t+ikIfkoJeZTh1ftJfCIleV:ys9ck5w7OvIbSsK0KHrtiIfJA7s
TLSH
T14E68335B0937BE31F5A53AFAB17BF1973E3618135CB3CAA1E1C9085E34510A19FA214E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  Scam Line/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Scam Line/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  Scam Line/OnlineFix64.dll
- Size 11.8MB
- SHA256 cfd01ca6bce83d110365883be797ce22ab6ee436d8bc1cbfb4f91732a24b1e3d
- MD5 9ee80bf36a62e022de8ea7ed0e7f3ba6
- SHA1 1469e9cd8a260949b899981d57558c7da907026f
- SHA512 bfac7658f84fefe3c4c5b85f3f250f1c39a443c1587424278363013cd5d943c9948dfadd40f2790ecbec44aac4502be7faaa575d55997f2ce7fe8370f1e76959
- SSDEEP 196608:j+Q/IEsbemkpcKjV1uQ5hVd7YXgkiK1SFCupxPq+oJEIUEQ1PiA/8kxWC:oE8bgJV7D1YXwFV7iVDQ1PNEY
- TLSH
  T143C6128568D4D2BCC4808274E64155FDF1DA3C898CF9982AFFC758217E71D68C8B9BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Scam Line/Scam Line.exe
- Size 656KB
- SHA256 4859a40503915dc3cce6d8c6a3d49ce794774b8a0d4d6642578de06f33fa896e
- MD5 fa9e3f3c4e492a02673c5fb6dfcc9a53
- SHA1 e4860cd6630e7d580bc1716db0fde53abe30a803
- SHA512 0f4d0b9226149a92ce55de81ad0f514a5a3dffb1cf31b687bc29215ce4909571943f50480bb0e560d21cb0a70faa03141092e741c8f7fa59829d4f4e3124890c
- SSDEEP 6144:p2E4CD20ZB4Gr34QiHqv96SmwUZYCKtj93qzEyf+UUzfUU:p2NCDdJr3d4aDqAqzE
- TLSH
  T16AE40C9E6E66C55DE207CD3B40FA0769D6E8DD17EA11E2429813FC62EB342C21FCB425
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Scam Line/Scam Line_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 80KB
- SHA256 a2f64eba113fcb87b875c25198e467208d492aa5a31b2083583a3f3d4e8e3648
- MD5 badedce8a051532bedd7df6add54aa6a
- SHA1 b13019196ccdef68c34a12ec8430bc0cc88ba81b
- SHA512 40dbc5dcf5cbe1dc6a59bc9b0b098ece9c5f15772eb077d952b335016fbea35de0faf53667183930a35bb0ff6284d29f306d1c9119fa56e6a7ee2fadc235d8e6
- SSDEEP 1536:hRNCdHQT592dWHvOFPffetSrfjJpJMmZOfrxs:F+C2cOFPqMjJpJ/ENs
- TLSH
  T112835C7517B85B32C7CF5BFFA0A466400B7492A59522EB9D294DF4FC8017BC21D8239B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Scam Line/Scam Line_Data/Managed/Assembly-CSharp.dll
- Size 524KB
- SHA256 40bb5a8541eff923c61681eff85d4337c4a927444576a986aa14058573d5afce
- MD5 cde8146f7a0fb13237102468b56d1c67
- SHA1 cd9792da823142e6878c36575c2f0886dc671fc1
- SHA512 cee5b935e76417122c23431e2924eb8496d839754f497f83ab8cd5347f89be40bf61ddd27bec063597ee0164fa345d998fce1a912f1f8e516f3cc67bd8d7606b
- SSDEEP 6144:wsQGK/D1vxlLCTZ0Y2CPVIpWM6q9VHaVhLYb5qToFdMBXQT6u6C:wBGK/D1vPCTZ0Y2iVIz4+SoFd0XSR9
- TLSH
  T165B4C41466E95A96F5BF1BBE90734C205773BA4239B8D74EA9CD9C9C0F93B018C10B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Scam Line/Scam Line_Data/Managed/Concentus.dll
- Size 383KB
- SHA256 11a6de9cbf2ccf27fe359c4847ba63d8ed593284b97ef884e0dc2e9dc7583a01
- MD5 85d4524fbef01483fe0556c5a2b0af99
- SHA1 05685a978267d58b09f5a0e3a0b632cb8f6c0884
- SHA512 f1b12f1741036efef8893d2a533f2dcf6d7bf40d5a3d4c8300c93a36608107900a8881e8338024d18f302ea0c07a8f82a692aa9f60da3159fb3b72de793d7492
- SSDEEP 6144:Mqp2NpZvMhQWzTB14Pl2iXo8Iy/mLmYOwEL/3beD8541A6+hS9bywTYCYajF:MT/WPxK/reD8541A6iSUwTYCj
- TLSH
  T14984A04977D886A1E6FEB331A055098EE739D6FAAB1F97467C8018F45F63700C406AE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Scam Line/Scam Line_Data/Managed/DOTween.dll
- Size 171KB
- SHA256 8e90fc43ab564a5a51424af56531ab074a5a2e9cab271b2d653d287954237b83
- MD5 c278d7f5c05b8470da58390f1a1efaa9
- SHA1 5785a56e7938608debdb1c67960d1cd5bdeb337c
- SHA512 ca749b0bcf368e5a9d273025b7c945cb0ba9b3886d42f1b483cdfc56009c9f2c1ea76a1717a065f60861a41a115603a3840c7996d3799fe3835e44fe2c0cd6e7
- SSDEEP 3072:6+OseYXEszneCqlL5lVu3GiO8J6Ye0JeUjnC+ee+e+4LWGOCdXaYr8yzi+:RO4zneCqlL5lA3DD6YeWJLWGOz88ye
- TLSH
  T142044B48A7E95632CBEF537FA0382D58A335D55DCEABF7DA2950A8F41C03706A801397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Scam Line/Scam Line_Data/Managed/EPO.dll
- Size 58KB
- SHA256 cae7c0f9c4f719d53fee50a5fc23c4f8ba9a247051d6e96d8213bc9768e57886
- MD5 00cf202fc8c8d86fd32212c355ff0989
- SHA1 35fae63f92cbb9d4839bc7b1573588aa52a09ce9
- SHA512 904f226c86a1aaf27ca728ad207b6fd00a2bf3f71e22dd736f8cb80f2bc9aae54bf62f39726c15202e79ec348b0e4c70609048125831216fc9df5a2a1355ef55
- SSDEEP 1536:vQF1Oc4gJB7d5I1riKaIN+9rYnGDTXWsnRK9r9eBxsB2yvR:vQFgc/B7d5I1vQ9rYGGsIrV
- TLSH
  T155434C5537EB893FDBCD12F9A571099A03B1DA436507EFC96C887CDA2843BC04A09767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Scam Line/Scam Line_Data/Managed/EPODemo.dll
- Size 14KB
- SHA256 62e39b633f64c2f440490e07f023aae5ff99a50e8969cae9d7e707a65d954a91
- MD5 d113f1f26b2aec8eed97604c7a5abf43
- SHA1 5fb1b31748e8090faa7c728a04cec3f1375b6463
- SHA512 9ba3db3fe39d09abed15c6ddf666a0d4b8fced603d30f7588418eb02fee5fbeb76aba607e37880794b957a108d29e9048aa7964a8323953009cde2d0487cdbf4
- SSDEEP 192:QvyTDqcr5lIBaS9mVvq0ujohOZ+jYvZoTfER+jDlLE1nUejhk31Oi/ub8YBX:QaTrlSoJkjR+k6RDlLE1UejhuJY8sX
- TLSH
  T15B62F875A7DD8B3BD99E0BBE04BA529032B153A23545DB886CC87CC45E877D00D227BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Scam Line/Scam Line_Data/Managed/EPOHDRP.dll
- Size 8KB
- SHA256 41261b7cf97131fcba6d56454f7bb893df9059bec2eb463493818623cbdc3d06
- MD5 e5c44f70577100978352f1f2d432d646
- SHA1 787bea52204abd687f13b55504ed959853a3c62e
- SHA512 84c503c9b758ef5ac759f56322e52ac4ebf2baf6f005fd93f080f72878f8a8be49fda3b57d6e578d3cf87552ada8e60e5ed4728310e9e8affa5094d1ad33cd3f
- SSDEEP 192:ZFILRKilOB1ru2DeZhQsnwug5NluFi8x5n:Yw1yfisno8x5n
- TLSH
  T1B502091A9BE8C622E5A6073B48E2059413F6CB244E0BD7BE6CCC7E5F6C531844E51F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Scam Line/Scam Line_Data/Managed/EPOURP.dll
- Size 4KB
- SHA256 f625e92928c0fa22841e09ccf6d05889739cfef4113b57e5a26d42ef31d5b068
- MD5 88f659a8020ab1a856384f564855094f
- SHA1 53cba0051020363a5e987a657fd5c12bb786d1ab
- SHA512 323044909a7a591a0bb5d92e97a39795ae2c64f6fc874af82e18c1a9a040e62c8138f571245526ec21185a0b83a7cf1c0e018399ad843eafc164f4cd56ae05c1
- TLSH
  T18B815356ABF84967E4B707B85EF3871222F4E810DE638B6F1D84057AAC176540E22F70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Scam Line/Scam Line_Data/Managed/EPOUtilities.dll
- Size 5KB
- SHA256 0a681264354946e8e59103b7e03231d0f4d4f0530dae0d6b2b2140204743d28e
- MD5 f82a28ff0284de47bd152ef1a444caaa
- SHA1 54a220ed0eb46fa5488e9b12e00b3e7d1d401bdf
- SHA512 7dc4c24a77de60007c9501beef64c5decd611202a31957eb03874ad7ed26ba2c1f270e5834312807f5ac818563d6e85923acc7fc403fc9f0d2e7be43a022035a
- SSDEEP 48:6XXFcjFSonajx586SUERKW2Li5+IMnv21qYJQ7Gz7P/Johkxkp283+LrSBN4VMPi:bjfngxaUBW2WQhSoM7nAkxk9uXgL000
- TLSH
  T127C1E72ACBE9452BEDEA07B3ADF347512374DE214E97D72A3940491DAE141D40E22BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Scam Line/Scam Line_Data/Managed/Facepunch Transport for Netcode for GameObjects.dll
- Size 14KB
- SHA256 0ed0e7030d78d94318434e7bf684fbb2f99a303494303e26f0ac3df0293277b8
- MD5 eb43de111c964335895ef1d73eb6dc23
- SHA1 67a22d44f02ac16b19f6bb438b9ece298cad70a8
- SHA512 5e9807e6c66802e012b987a8a3586e545f8f3ec8c66b4abfeb1bc38bed297ac2f0e294fafa480b147c5652c15d93c203808265899bdd2473c82f64a1b2d862bf
- SSDEEP 384:dw7mzl+VTm/C84eCr006OJvqyRqWejhcR+9:aLz8hr0pUyRy
- TLSH
  T16052A44563EC4727EAFF1738AAF212511B36BC136933CB9E55C4016E4D63B844E263BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Scam Line/Scam Line_Data/Managed/Facepunch.Steamworks.Win64.dll
- Size 534KB
- SHA256 7f4e025564e9b2dd6ac248727b37c9767212c567b18a422629256737524d23b8
- MD5 9b6881f3af33f662ee9a2a8f07016b98
- SHA1 06e4b53d3d7177d2465c9f53e7881a8c4cfb8ac0
- SHA512 39bf3ffa5456db92f5d44c78764efc6cdc5a4c52e7493a1a1940dbbcf4268120538b0b86db3ccdbf9cc3453b11ef3d6827db4fa38ce18968f38829a1e600253e
- SSDEEP 12288:4dMCyDIDge2t7yOcEXJ5HfuhftgUT2lCeamE:sVDge2t7JJ5/2ftgUT2lCeamE
- TLSH
  T17DC45C7A635846B2E5AD4239C1624E1F27B1C16B13036F8F2645E1BB5CF23302E569EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Scam Line/Scam Line_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 89c5a8f103357dab335ac52fd968b9262e6b9a758971e17a0738cd94472a446a
- MD5 6a0dc3d48c67a06a231af3bec8d51df5
- SHA1 2d4fb403e36e99726b1be69aab03991003e562f7
- SHA512 e5a2c58a31a540f5d875884f4efb8ffc4b2d7775ba98f80ced9bce54deb83d89168026c048c17b5401496ae80bda06426ce10752a24ef04940bdb952f4d8bc92
- SSDEEP 6144:0UjTQ70cnf8MoVRxS9iJdBF119RJXG2yP+Q:lEiH119RJXc3
- TLSH
  T105344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32