337f176e0cd73fdad1bbe73b1728cabf142659bb91f9346e1308577b83b0d76c

Sharing

Copy URL Twitter E-mail

General

Target
FarFarWest_Fix_Repair_Steam_Generic.rar
Size 11.0MB
Sample260828-yyzf3sshjh
SHA256 337f176e0cd73fdad1bbe73b1728cabf142659bb91f9346e1308577b83b0d76c
MD5 0ed76c1784acb303c86318109fae062a
SHA1 5ce202a7511d77b87288c0a32c01e7f6868cb2d8
SHA512 d4d4e4274b76b60761e3c2c28436ae814c14033d86aeb53802343102bbe762a3252a047c9fd477394535f5089329328163188e81dc18617cb030a58ae01ee57e
SSDEEP 196608:IyEc76Hk97SanTksq0BXb+6ygCM/4hKAL1ERmSToJxxyaDyR/tabv08N:tEUuinTdjXK68FhKAL1BSToJxjDK/Ov/
TLSH
T110C6336C972FD2FACEF63EEB403276D38DEBF5967898531500278A998046F3504E56C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Targets

- Target
  FarFarWest_Fix_Repair_Steam_Generic.rar
- Size 11.0MB
- SHA256 337f176e0cd73fdad1bbe73b1728cabf142659bb91f9346e1308577b83b0d76c
- MD5 0ed76c1784acb303c86318109fae062a
- SHA1 5ce202a7511d77b87288c0a32c01e7f6868cb2d8
- SHA512 d4d4e4274b76b60761e3c2c28436ae814c14033d86aeb53802343102bbe762a3252a047c9fd477394535f5089329328163188e81dc18617cb030a58ae01ee57e
- SSDEEP 196608:IyEc76Hk97SanTksq0BXb+6ygCM/4hKAL1ERmSToJxxyaDyR/tabv08N:tEUuinTdjXK68FhKAL1BSToJxjDK/Ov/
- TLSH
  T110C6336C972FD2FACEF63EEB403276D38DEBF5967898531500278A998046F3504E56C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FarFarWest/Binaries/Win64/OnlineFix.ini
- Size 464B
- SHA256 2450da864bf00c7f2f4305b7ba0e91040ae2de10b0204bee65e2fcd101010b28
- MD5 bb0ac71fb59d60e47f2f337839b65e6d
- SHA1 2c1926f58aa45f43824b3667b912b60ec2bebe1a
- SHA512 1c3ecc2ed1ec28e35b8b656d35bbe03488122389bb2d478c4204fb81660dea326243d53179f8f82418c3470371abeb471068a25e0858c61e275f580b2ea4ac6d
- TLSH
  T16FF0A3C07CDD763CC5A60E4D2CE33CC32AB914DF324F180079565EDA210EE40925531D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  FarFarWest/Binaries/Win64/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5 behavioral6
- Target
  FarFarWest/Binaries/Win64/OnlineFix64.dll
- Size 13.2MB
- SHA256 27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f
- MD5 00813d08c8a0cdf3420bd38fd72c80e8
- SHA1 992119b11b5067959776b18f609c594c6c888bb9
- SHA512 a842617f0fc320fa90661a7b7a7809252a5b935ce4249a79f3fe520565a02db6c55ec80b9eb581aac1b4b29ad5954adf6f29bcf1d3624ddd86a5b8b03ad929bc
- SSDEEP 196608:OrATka029FenZW3Q8YrVNnZv9/F91mWsz0kg4kAHh3Zkghk0XV4YPNOLOOKj:KeLIJ5d9/FjxsGTiJ1hk+HPNTj
- TLSH
  T1D3D6129925D4937CC4408138F5451AF9F0D97C888CFD8826FFC749127AB1DA9C8BABB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  FarFarWest/Binaries/Win64/dlllist.txt
- Size 15B
- SHA256 fc0befb4aae4b7f0eeb1c398fccea03cc795590e09db6628974520091fcfc516
- MD5 d7fd711e5e5f73da110115ce98beca0b
- SHA1 a04719d38bec9a97b8f098cf29bc863006c43a33
- SHA512 e96b14c280a83d4a0d5eca3ce6af8ea5ef679feaa6b70c2775ace90c4ab54682c74d620a681ae3bc09baa534ae643dc7551b8b650f7d84658f38a8934448af87
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  FarFarWest/Binaries/Win64/winmm.dll
- Size 494KB
- SHA256 cb8baaa2054a11628b96e474e1428a430c95321f8ac3b89764255cbd6628a9d6
- MD5 67c049e74d242975ffd0dcab9bc3b041
- SHA1 1f5b8e6dfa8e2132264a7dd1f66948a0948fe4c4
- SHA512 f98d04258d3f77362a023278713a30c3cd4f8013adfcea5a26a548a6f95d0786da080a8fbffde40579bd783d818fd9c4f4714decbdc34f84bb1b10e5fbd0fe28
- SSDEEP 6144:0lHx0Al1TCgUfptsdNqB9G03mKt/SI+vnYvvooI7IreqdDp8:0hx0AlYsOdKJYvvooI7uzdt8
- TLSH
  T1BEB48E19E66842B9F56BE138C9530A07E7B17849536097CF03E09BBA2F27BE0573E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  FarFarWest/Plugins/SteamCore/Source/ThirdParty/SteamLibrary/redistributable_bin/win64/steam_api64.dll
- Size 312KB
- SHA256 670d654aa3255c5061cf0236a1cdbb2f5076cbd5ae44f613b6f4921558e83e2d
- MD5 b3caec4d455160acf21a318073c40dc7
- SHA1 fcb09f9da2172d58fbf4aa57bdd30d607ccbf237
- SHA512 bd3417c5c5c022f2b3f729283d77a335200fab8a7c439eee00f9d298608f804a3f6698049d30351d8a5dbfa3e728518691472fc78b91b8785ca5d1a5c52c6142
- SSDEEP 6144:JfgdBtTW65Q6tW31ghwXRTRylO2CXuPu+SQ:JodBtW6pte1gsbys2Cza
- TLSH
  T199645B3962750CF4E077C13A88565E0BFA79344B23219EEF236062769E537C21EBB791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14