5e3c17e9899f7f53b75c33f205d2e7bf503e19acee2e01d06d9c4c60da813e44

Sharing

Copy URL Twitter E-mail

General

Target
mode-3d-main.zip
Size 159KB
Sample260905-tc11kavthy
SHA256 5e3c17e9899f7f53b75c33f205d2e7bf503e19acee2e01d06d9c4c60da813e44
MD5 f203e38646ef8d23e0ab64b9d614197e
SHA1 b2d1d292452d88761078321c38e05c8f25c8ec2a
SHA512 f5998e79ba1d245265b265a0b51b2eb7952b90030d004a2fc777e52b1c7f681b911a6c0a813f040983f2269eb26260504b1e6f7722c86d2ab67b3b5f6411b5d1
SSDEEP 3072:TxXtdDexikk68K91Kw+RgIc7GFYtAoszsdhkURfg1QUVdAb6:lddDnr68C8W7GG6YzkUC13Ab6
TLSH
T17BF3F18B063B2D27D44F33BDF35442C7F21AE1C3A64ECB5569B924A0992A5736F1938C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mode-3d-main/Start_MoDe_3D.bat
- Size 1KB
- SHA256 9ca94b44abc3df759bbd8b7c9a506abc6c12f7a249eabfbc0b6f1e89ee82d972
- MD5 e01612d3dec62b49ea3f62a8de222976
- SHA1 f72b7578ad3706c1b70eb0c5c4ab7f03f9010a22
- SHA512 7fbaf784de84ba4eca7bba660d26001ce8ee761e721a963643868798e900e69c254b4b0f07540a12ba21b6b0b969b0c30b46afa3ec138dd398fd6395dd9d6b14
- TLSH
  T1FC119906708A00364635C710A07E529AF11311AB5A66ADECB4AED1640F3D7E5E9FB4C7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  mode-3d-main/blender_extension/moge_splat_studio/__init__.py
- Size 2KB
- SHA256 b047aa29bc07eff3a14b2b9796c9ff45df722cf6f356c77d3ebfc8525acbb637
- MD5 9a328859cbc3d6f7869e7e4d43986d80
- SHA1 0358758aac21e74df8a3e10e04d801a2795281a1
- SHA512 8718a1cb8d92fb11d571d98e98c4e035fca8fcef0debb54b1ce89af9055309948de2b42978d09d60d1c44c3733ebfde3a40cb583f58a3970b547553113de8b37
- TLSH
  T14E418E94C6B2941382A357CC09AAEA0711731913AE6436A4B6FC13516F8C26F657FE1B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  mode-3d-main/blender_extension/moge_splat_studio/cleanup.py
- Size 6KB
- SHA256 2e1fb723416192de4d06774d6c04456ee562397505ad3c3179740a775fa52e4e
- MD5 7a7f2eee9b93b84b7a5535319c45ff59
- SHA1 d86378997964662c25d58566d67b5e93e31952a9
- SHA512 e93176aea20e1fb74fb92b14ce7560d273bea0c0c239c663e48edc060c0d551f916a23e98e2557a8267a88fb064a93b0110a67a82409fff954f36d584747451a
- SSDEEP 96:XpXFCYV6GHKuvSBSAiJWHzL+gEHJzpQJ5Xc8civ:XZvLKuvJHO3+5XqMAv
- TLSH
  T1BAC14308ED311CA6C3C78D6C5966421232396C03A9146974F8FDC29D1F8A5B4D3F9EAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  mode-3d-main/blender_extension/moge_splat_studio/floor.py
- Size 7KB
- SHA256 13e8b49fa19055a2b9082b2cf50dbf1a2eb476c367136b3c24863b5ac779460e
- MD5 bfaddd06e8ed3598145d7ef21237ba10
- SHA1 c5e29bbebf8aa9431fa7df3e7684bf375b5c518e
- SHA512 3d518d367f46a12e475d869fa4481560769f5c44a30ef51cc6ea3c12828b0d08d61acd41a840a48ebf0f3f2bd298a08ee148b39ec922a58c4e0e3c2722097e58
- SSDEEP 192:G2xcvDsYLu3aBIS1XhC11FrFw/4WrkvaqCxkzdYFY4lCqJT3CmQ:9gDsYLu3KFP+rw/4vaq+kGIsuz
- TLSH
  T131F1B613C6863CF96B83849AACA61B131369D5939F9A18177C2C18001F8597FB37EFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  mode-3d-main/blender_extension/moge_splat_studio/network.py
- Size 15KB
- SHA256 ede77d8e8aaff0b7ae057a4b8496ae4fc01a7e516dd471b14e26f453abf47e78
- MD5 c9f160f0153c2c5093a420fe9823e6b9
- SHA1 a28c97d593ef7b4ded86a6b16f4b0ffdc3463a3b
- SHA512 b572253912e91d9db07b3c386de22171667c100fee3ebfc6825e4f398ba4761d33608efea28a4df80ba151a0903c1376cec1e50021d809eff33dfe15a993b191
- SSDEEP 384:PDCq3IQWuZ25y+Ofv+M+9H0xHf9xFh/wTFW4+n:PWoIluZ2Q+OeHH0xHFxFOw4I
- TLSH
  T10F626504FC66A9A3C7E3869CC8A6D40263257D0356402438FDEC67A53FC85BAE1F1ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  mode-3d-main/blender_extension/moge_splat_studio/nodes.py
- Size 19KB
- SHA256 9496009393bf9e0ef8cfd21747a9662fa45a1d5a607b48db8ff016ce046a47cd
- MD5 5a71f8d22acc8527b4c5869271489753
- SHA1 17357e923d67314d2cd56f2a45da672052fd34be
- SHA512 e719129758ea9d6eebd248c8fa1e18a58625fa3f5ed67bf9a8d06906f5ee8ec1fdd3685d74aefe299f0ac2321c2287e30ae3d92d4945565f7f977fd8d28ed3dc
- SSDEEP 384:DZ+K4Fgv9FgFzuQ9fFgYCsfv/vkqPj0hfKJ9hNMSFrv2rXk8PR:V+zFgv9FgFzuQ9fFgYCsfv/vkAj0pO9a
- TLSH
  T1909284271051A8C6DBE369991CE548003F357907A4052431BDAD893BBFA5B39F3F2B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  mode-3d-main/blender_extension/moge_splat_studio/operators.py
- Size 36KB
- SHA256 9e1ede73067cc55273f30920d049dbe698c5bac295ce1f1c3e35f163e3886331
- MD5 790460debb91f61b3d7e81ab84d8c64e
- SHA1 bc6a4cd9713c46a3db33155d13e2080d9446a618
- SHA512 e37a0f115f3f9e628a99dca1347deaaa96f326884d16cd81b76fe77aaf0b6c5964538410ba639027312d275a60dcde7ce7c7ff9255d479614b1216a1072fb1f3
- SSDEEP 768:+Bs8+K+tv7K6Jgjlx2SIUxc0KjuIy7pq/+ZLm+3knEVcuu:+Bs8NIsIUxL8+ZC+3knSru
- TLSH
  T166F2F721A9255CA78353DD085897D642337EA5434A051930BDECA39CBFC8437D2FABDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  mode-3d-main/blender_extension/moge_splat_studio/preferences.py
- Size 2KB
- SHA256 66483675001a7bc0d2970db32a1246da42199e9e72436e77a5e57a4b453b461b
- MD5 6d208151ab42c353c9da406358b3a497
- SHA1 d6b78c7f6813f3c557e03981ee109b59c061bb74
- SHA512 c9e9006a72c1d3c701d7f6887a98cf3bad59353115a793f89232f7d6cfd4287ad04b16e00ff16c3b0ef26682d8f7dc35a684c2a062002d85bd401061cc09e923
- TLSH
  T1BF51641077758DA083C3B26948A33A035A61056B6D357024FBACB7641FCC6B7C2E6ABD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  mode-3d-main/blender_extension/moge_splat_studio/properties.py
- Size 10KB
- SHA256 d4df26b99b5dc3bbdd3a2c05a2688d8268280b914dd27296ba95d6083a067173
- MD5 77127c1a4eeff03a5f19f1a09e390488
- SHA1 ba6bcf33b0b00c45d6c5ed161571e91db4931c77
- SHA512 8cff08569376abc7e7014b71958fb774544ff25499310b979fb97430fc7956fa6ae04afd1f65021fd9b56b835b63a12c0b8baba51a4db3a575464b795cb84ceb
- SSDEEP 192:BvQN+F/APE33pVaXFYUBYSxpogZKKPVedbCsFnti6fy:Bv2+F/APcpVaXFYUBtvZBeddFnti6fy
- TLSH
  T11922C9129B201C0752C396323D1A720366385A0F5D35B94AFBCD62A42F4D5AFC5F2BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  mode-3d-main/blender_extension/moge_splat_studio/ui.py
- Size 7KB
- SHA256 10b2cbdc83053bb364da875f4707b175d8a657a83721e415173a9ce970f2fcf9
- MD5 e37f9b085a3e93c7868bed66202cc16e
- SHA1 8abd6368edbf15cb2021e99f9fb647ce4584eb63
- SHA512 3bcc4735cb8ade9aef640aa1aecceaebc1ad999d07edd0204f57545a99ddd015346b388ea49a9287d591138061dda184ac841ca3a830337be4ebf1a522a94224
- SSDEEP 96:X6OB5elfs6RuT9D9elj6A/18lLs0dlFC08wMN+oCOi:X6OB16IT9e6g8Vs0dlFC0VKbu
- TLSH
  T15FF1AC28FEB44E9C8357F31AD0922A02E4F2056B5482A56AFB0F57E57F586B242CE51C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  mode-3d-main/daemon/launch_daemon.bat
- Size 1KB
- SHA256 bff1461ec75f9bb9e2239df4ba3e5d0227e5b663fad5ef9afebd889a510b0e2e
- MD5 7bcdf6db51451662de0bc633378481a3
- SHA1 3f57109462f0bb5bfaa0a64363b75f937c48c5e0
- SHA512 20296c72f148adf5593f22f249538aea3d94a86074c1e50b3db9e09d4ac1902b56b5f415821465c8d9e0ce0581e6e18ef64a50c802d3cd1db1c6b5a8f749691a
- TLSH
  T1B4116600F192F2E31370467B2A1D0288D1978963472D91AE3DB8DA290FFC98C8AF5E61
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  mode-3d-main/daemon/moge_daemon.py
- Size 16KB
- SHA256 da44fb22dad1d155fca653480719b3dc674060e785c1fc7c5802d90b85726613
- MD5 c84a5805b761dbb7427b57dfb6088b53
- SHA1 02543e5bbf6ab4fb1c34320a8563395a0b1447fa
- SHA512 ad45ada8ecfe8a2bf9414ce432e053b7ef5bae679a1df9ca7c3c4af1672500fe9f418ed4214bfee046672fd2d7206a1cf2a60b9a270cb43230a2813d16863da8
- SSDEEP 384:Ax5cl0ndEicsT9lfPHllYl1dxeYcB1FfoKV6OQG1YFU2G:g5cl0ndJcsT7fol1TcB1Fg0YFPG
- TLSH
  T1F572C8512C263C2BC357955C5D9A9212237EAD435E923934B9DD0B682F8C23FD2B8B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  mode-3d-main/docs/index.html
- Size 77KB
- SHA256 1dd503e93d14aed96ecc993aedd091d0cae241bc08570a0cea2412ec062cc0a7
- MD5 79db065481ef2d084438c141545beabf
- SHA1 11735eb2957f07b48f018a48d0070be42d7af08f
- SHA512 202e27e6334cfb3ceb1b3d9fb988546e8903dd347a7cca7d1ce7483a73096b201be2ab4378485106132197a4ceaad0903e967c4d7e8f817384f5e1d3a4484f6b
- SSDEEP 768:QS4XP2ppgJcaYzLoDT07khZFfl9UUulurWbd0uC4RM+4t8yWicH+hopAj/cX:9wcayyg+PfTWMWbd0sRM+4t8ylceMO6
- TLSH
  T1B573192622F1223E13938372F36B6766E7799147D50BD92C70AD81A42F86C64CABF344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  mode-3d-main/shared/exif.py
- Size 1KB
- SHA256 26afe6f3d4d91dc2bf776a7d685767d5205a349b1f856dcf8cf6577b59331485
- MD5 6deb3fd81f64c7609bfeb7193c233b5e
- SHA1 5ae465b45f48a69d16488d5674a25d17eefa6172
- SHA512 401c186e00ea8cbe04deb0fdeb0044d3fd92f91589465d3b29401fa2da4013fee1a4eae66af07725cd4cdc2ebe1daa2b3dc1ca82592a2f1f2911cb631fdcc246
- TLSH
  T18521CC5AA843E1F287A2C5A929C6D165F31BBD0B6E1E6231FE8C52507F80139D0B27DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  mode-3d-main/shared/floor.py
- Size 7KB
- SHA256 13e8b49fa19055a2b9082b2cf50dbf1a2eb476c367136b3c24863b5ac779460e
- MD5 bfaddd06e8ed3598145d7ef21237ba10
- SHA1 c5e29bbebf8aa9431fa7df3e7684bf375b5c518e
- SHA512 3d518d367f46a12e475d869fa4481560769f5c44a30ef51cc6ea3c12828b0d08d61acd41a840a48ebf0f3f2bd298a08ee148b39ec922a58c4e0e3c2722097e58
- SSDEEP 192:G2xcvDsYLu3aBIS1XhC11FrFw/4WrkvaqCxkzdYFY4lCqJT3CmQ:9gDsYLu3KFP+rw/4vaq+kGIsuz
- TLSH
  T131F1B613C6863CF96B83849AACA61B131369D5939F9A18177C2C18001F8597FB37EFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  mode-3d-main/shared/meta.py
- Size 1KB
- SHA256 6ea3c190ffd7904dbee1c0c916e8b6b1ef28ebc40c9c7c467839dd173cdfabe9
- MD5 dafebefc35600b7273b5a6221bc805ac
- SHA1 a6edcc7a35bcd60042cf5cce23fff572241c66de
- SHA512 7c8711c1dd5b70e24a8554368a2a1fb3cd3f36d28e2cfb2d1079d1a46b6acbdf68116f4542574ec8454397807a72519dcadb711f8d0ccbbf3501f346eb14828b
- TLSH
  T10A31CA709ABA785FD14A286F5146B2C1532AA3C380015529BF9F27682F3C023997894D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32