863eab0dbb9b48f4918f72d0659ed4d85dc1e87c6da3e0f18fc12bf94c299929

Sharing

Copy URL Twitter E-mail

General

Target
LOLSkinChanger.rar
Size 146.5MB
Sample260905-pcep4stgmc
SHA256 863eab0dbb9b48f4918f72d0659ed4d85dc1e87c6da3e0f18fc12bf94c299929
MD5 8582227d6bbb4d04336ed344f823230e
SHA1 ce194d1ae1c928770c37aeb1cb7d9660455c44ca
SHA512 6c12da1c773e9b3b14f6d21a62bd8c1d6f8246d90720cb6ccaf1f028b98b8f1c3f98e3ccb8fffccc6fa5f5de8ea7802b3b4b8b5c209887c7060201e112725a83
SSDEEP 3145728:G7ZpojcqZYQmwwCiztTkcuNfqIKS0OrYusKUTnik4D8IyJCjb3:G4gqZKwwCiztQNNfqIKS0OU1KqnG8JCz
TLSH
T1DF7833E1EC18E6CD792AFACADC34D495B59924A0C802FC2675E80207E97F5B8DF5E503
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LOLSkinChanger/GfnRuntimeSdk.dll
- Size 2.5MB
- SHA256 78fc4bce302745a4851ce32f33e81c17d09c679a291fc4b4d7862c7b15f56e33
- MD5 2295e64498c97512de4f006eed191d31
- SHA1 51f8f969d65d5611b9f16e13b48f4a246af26899
- SHA512 b9525b2125330111d0b463125ee702adc79e8b027858a2bd4233697ecc9d6b80ec80433afc46d97f61bf0e4490273b0e86908d2d78587397d862923a3d9cff83
- SSDEEP 24576:/dHt/wyzGnCvVv8GZ+4QYN+FhsYoCKj1nqZnFbP9JXCCcSeGo1qgbQ8IRuTcLZCL:/pGSyrsYoCiq+CWJ1qjscLZCn37
- TLSH
  T10CC5BF20FB828671D9DE22B954BD773E487DE0241F2441C371981BF9DA605C27E3ABE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  LOLSkinChanger/LOLSkinChanger.exe
- Size 22.6MB
- SHA256 f508cc812b26dd40a5d752369b69ef17c24585d16b00101a59efb1f17ad15f4a
- MD5 1a4fa710efe5fc410beaedb13bf20e90
- SHA1 31387dc21858dc1bdc47fa1a0f9fee9ddad389bb
- SHA512 d53d04dfb74cd90f75f79b98c154d5ee2fa935d1448bdf8c2bd05a5eeede8cad7ea39184d2f405dc674dad6faa01a7d9a510c3987072cac4296ac67c99cc5b86
- SSDEEP 393216:GHHEm7iAjTYhxe17xib+P3yAdg6vDG/1aKAw1uszBH9U0:GHHEm7fjTY/e17xibUrq6rGzA43BdU0
- TLSH
  T1B33723C7669097F5C3834738918B03CB57C0A856DA9A462F35CAAC037952E874BC7F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence ransomware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral2
- Target
  LOLSkinChanger/bin/addgamepage.txt
- Size 17B
- SHA256 0e164581679e59b6ae9daf224051ed5215664a9708bd0855b731c5ef53369836
- MD5 42e4e254dd06d9ebf1d82e258b904531
- SHA1 ba7160695febb3232f7b93635c3aed73a1c44a64
- SHA512 e5615e22c777839f38aa8109b8d9aff2935f62da1d542ab560753f77d1ca77f0df2e73ec27a8f9604d57c00286240a150a9a2695a3aceffc7698f8b0a67d1c29
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral3
- Target
  LOLSkinChanger/bin/config_51.dlm
- Size 873KB
- SHA256 d380b92e0ec96061bd7277c6f165fed2581150d574b32f1c46f63ae2cb782bd1
- MD5 84feb24d04e4152af86f06d3a7205185
- SHA1 558f8634a74cefa4b48374915a6efa0e15074377
- SHA512 d951783f80326794851942ce84e0b32eb3a7141df6900143376f8494575d0300f35e6e1d169f6435689f228d33bd9df7c48edae14fc190c6ca6d0820c6103147
- SSDEEP 24576:xPzlzKAM8hdkFcQk7lGOm5GtCwkBZ/hXXGx+aU:xLxKD8jPQk7U5FwkBBUxG
- TLSH
  T13C152322ED1EDC20C65957D5B316F5F3AFA3AD01141AE08DEA722433618DBAE6E441DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  LOLSkinChanger/bin/input_1.bin
- Size 50.0MB
- SHA256 bd0f29b19bfce3a335d22d4a2924a02da0bc202c8efff5998c4ca1092ac7afcd
- MD5 34207979cf1207f8c07a994f9dfeb29d
- SHA1 c114d981e87f58d160978b915e6772cd5c0d5053
- SHA512 344f53747e31cf5b39d1b772b944df780f9d0509dfb2f711d306aed64fad3e2c403b2c6619202b56077b6e7e3d265090049b46ec6b4398a7c54dd710f153c054
- SSDEEP 1572864:2glGEibZEvECKovl2O8R8k7bctBUBm77vX:HlGsstoEOs7bcnUgvX
- TLSH
  T1D8B7336E09ACEC7B5D346E1F7043A69BFCA4F25C5BAA4F5E24C8E903A1339CE1D40495
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  LOLSkinChanger/bin/libavcodec-62.dll
- Size 7.1MB
- SHA256 861d200b4a35bad9a2eaac069c8fd9711d2296e36287308f927c247c86135bcd
- MD5 14cc0194f70845dc4f410e2120cf83a7
- SHA1 579b8f04346334021df80126f6eceb5bf0eae30f
- SHA512 748bdb86b40b6b334203e88f90710fbba717b7c5f6a717661041be980936e260a07df1d72bdf290c81c0047762cb7f3a9e4dd34edb619e122575ed0c60912ed6
- SSDEEP 49152:L05rexkQJ13WzkZb6W8Vt4wYVrKHaRAXNlkVpai+TYEDyellDQdT6CrLHCQ5OHnB:LHN+u1EWsLt2U++legnh
- TLSH
  T1F576AF9AF3A222F8D53BC478856E994BF668341E432057FB1AE485642F33BD0573EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LOLSkinChanger/bin/log_32.dat
- Size 801KB
- SHA256 00bc266ca60a78b24f80280e3bf8845b096ee7363bb0b238af13e77c2d36d154
- MD5 74047e5f1d1a938ca7b61d5df34d6787
- SHA1 0d5bfa6840bd4d129809fc360d7f57699655e1a7
- SHA512 ff9b6f109e0e66786b85fabf754cc5666c2e02138d1cdef2da7346886e3ec80e9e4887f273e60400de0dc2353982777e0807f674e05a4e4dadf540c203f424ee
- SSDEEP 24576:L648KSFlivsW/hp4St1qVqRgXGpm+SAtZwP4W:L18KS6sW/VOwgWpm+NUPN
- TLSH
  T16C05230348C7FA40F39925049D55426B83155BF78DAB2CBA7AEC23C69AD81CD6370BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  LOLSkinChanger/data/config_51.dlm
- Size 873KB
- SHA256 d380b92e0ec96061bd7277c6f165fed2581150d574b32f1c46f63ae2cb782bd1
- MD5 84feb24d04e4152af86f06d3a7205185
- SHA1 558f8634a74cefa4b48374915a6efa0e15074377
- SHA512 d951783f80326794851942ce84e0b32eb3a7141df6900143376f8494575d0300f35e6e1d169f6435689f228d33bd9df7c48edae14fc190c6ca6d0820c6103147
- SSDEEP 24576:xPzlzKAM8hdkFcQk7lGOm5GtCwkBZ/hXXGx+aU:xLxKD8jPQk7U5FwkBBUxG
- TLSH
  T13C152322ED1EDC20C65957D5B316F5F3AFA3AD01141AE08DEA722433618DBAE6E441DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  LOLSkinChanger/data/libavif-16.dll
- Size 882KB
- SHA256 858624061d7cb14c2801ec64af698537a1bf16ba337e2dd989f235c50b9745ba
- MD5 3ebe3fda3a4fed5a3dbf56c58ca9dfa0
- SHA1 bedbe1779c65b0816d468b386b6a9100a22c4174
- SHA512 4ed87d92d0bc32f48d8f48dd933995507c57abd2c69338451404815ad07b6b627aaec114f1b1316df834e08b9cc99c501708d968dd4b242b975db4a103e0abd2
- SSDEEP 12288:8w7Knpp3rU1Wqw8RBpUDj+lmjSrLEV2gKJoQT:8D/7U1Wf8RrUDHmrLEVbKJoc
- TLSH
  T123159E6267EC12DAD0B7D13DC6978B5AEAB1781447209BCB02D482A53F23BE45B3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  LOLSkinChanger/data/log_32.dat
- Size 801KB
- SHA256 00bc266ca60a78b24f80280e3bf8845b096ee7363bb0b238af13e77c2d36d154
- MD5 74047e5f1d1a938ca7b61d5df34d6787
- SHA1 0d5bfa6840bd4d129809fc360d7f57699655e1a7
- SHA512 ff9b6f109e0e66786b85fabf754cc5666c2e02138d1cdef2da7346886e3ec80e9e4887f273e60400de0dc2353982777e0807f674e05a4e4dadf540c203f424ee
- SSDEEP 24576:L648KSFlivsW/hp4St1qVqRgXGpm+SAtZwP4W:L18KS6sW/VOwgWpm+NUPN
- TLSH
  T16C05230348C7FA40F39925049D55426B83155BF78DAB2CBA7AEC23C69AD81CD6370BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  LOLSkinChanger/data/resource_0.sdat
- Size 50.0MB
- SHA256 0dbdbc72a6f2308df3f2ba2df2dbc2662f4b166bca0377e6be09cb48e92d6aec
- MD5 9db3a9d84c5f35c6a69901d8a0163595
- SHA1 1defe95ae0966c6a57048b0d5a65924f1857fe47
- SHA512 d3ad0652b83fcbbc7597c885ad1d13976d1610f3a6ca85adb663798da19b8764669ef984eaf2e530c4eedd67813e8ab014b52609f42961788a0032687c82442d
- SSDEEP 786432:UNpux5eRzqnCsWi85QpfwYN46SNxMusa2Jswa+EiAVl0Qz0NbwR9H0Tj8CfVNlM:Px5eRWCIoQ5wmeLMuZ2JsTYC0yDefO
- TLSH
  T155B733696ACF4773F3E0996C7EDC7E02D9AC0457A39BC21D5331F96629C6B58EE28004
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  LOLSkinChanger/libavcodec-62.dll
- Size 7.1MB
- SHA256 861d200b4a35bad9a2eaac069c8fd9711d2296e36287308f927c247c86135bcd
- MD5 14cc0194f70845dc4f410e2120cf83a7
- SHA1 579b8f04346334021df80126f6eceb5bf0eae30f
- SHA512 748bdb86b40b6b334203e88f90710fbba717b7c5f6a717661041be980936e260a07df1d72bdf290c81c0047762cb7f3a9e4dd34edb619e122575ed0c60912ed6
- SSDEEP 49152:L05rexkQJ13WzkZb6W8Vt4wYVrKHaRAXNlkVpai+TYEDyellDQdT6CrLHCQ5OHnB:LHN+u1EWsLt2U++legnh
- TLSH
  T1F576AF9AF3A222F8D53BC478856E994BF668341E432057FB1AE485642F33BD0573EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  LOLSkinChanger/libavformat-62.dll
- Size 2.2MB
- SHA256 066926450a6cf4993d283e845074f8a3d137e00f813e5f2ff15214c0d8baa3d9
- MD5 7544a23a54a5f8603f849d57f1bcaabc
- SHA1 df42d8b11d238f8cdcad82f605468f77695f1f9d
- SHA512 2702348594cba4d64929f626425c9a371de932344e425bddda62bc35d494c63ac91faf1d63e6620a44740c921cac4f17d6979e61072a9868c97ebbe1111f421c
- SSDEEP 24576:dL7Oo6WAozsD/0pRzXFHMjZpl+rTCAMNm4aCaeN/uC4kF5GsnThUnIlNy:dL7g/D/0pxXFHkpcrH4shQ5nnTq
- TLSH
  T148B59D5673B81199D6BBC23D86874B57EBB1B4040720ABEF059486B92F23FE51A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  LOLSkinChanger/libavif-16.dll
- Size 882KB
- SHA256 858624061d7cb14c2801ec64af698537a1bf16ba337e2dd989f235c50b9745ba
- MD5 3ebe3fda3a4fed5a3dbf56c58ca9dfa0
- SHA1 bedbe1779c65b0816d468b386b6a9100a22c4174
- SHA512 4ed87d92d0bc32f48d8f48dd933995507c57abd2c69338451404815ad07b6b627aaec114f1b1316df834e08b9cc99c501708d968dd4b242b975db4a103e0abd2
- SSDEEP 12288:8w7Knpp3rU1Wqw8RBpUDj+lmjSrLEV2gKJoQT:8D/7U1Wf8RrUDHmrLEVbKJoc
- TLSH
  T123159E6267EC12DAD0B7D13DC6978B5AEAB1781447209BCB02D482A53F23BE45B3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14