4c58045f9821cb63913f4df08ea86ece3cdda9f9e646154516000fa1547e0c37

Sharing

Copy URL Twitter E-mail

General

Target
dolphin-2606a-x64.7z
Size 18.0MB
Sample260906-2vhwpsthjf
SHA256 4c58045f9821cb63913f4df08ea86ece3cdda9f9e646154516000fa1547e0c37
MD5 4a8cbaf9f6f2f1077721f920829ef8a3
SHA1 3b4e240f6dca2cec7f17b313398a9166400f2c20
SHA512 f265a9ca5580c52c0d9fd6ba7a0fd9258292338338da5a1075f79e6e3a916fb314d00d4b2a9f4f6aec70e946701815619ef4b80c8c30b3c40ec055698674fda1
SSDEEP 393216:3SmCnckpr/3lamsBkPvDMWai1eCPEEpEFOygH1uIecezhFoWPcPq2LUwo:Bopr/kPBknDMWT1eCzP83cezhFzES7
TLSH
T1BB1733503E6F3F69B358904602B603AC6476920BF6B064BEE6485F03CBE87BDE744576
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Dolphin-x64/Qt6Core.dll
- Size 5.7MB
- SHA256 21cc245c29b673e49e7fc7c606510aed4eeb52cd92668288997d89409914825a
- MD5 210eb8868000270a4b6526d029b439fa
- SHA1 882f984e5f4a6019ad999580f71cf1d3dad91bda
- SHA512 326cab5145798483795895372d87a87fb32e0e2b1fc96b725010085b126d462dfaa456871495ef1b6e91c712f109db362ef974d73a0f771b7f60628cec222880
- SSDEEP 98304:pmWItZze/ETd510XKFdu9CwJsv6tSkI/3pVPT:4WItZzoEX12KFdu9CwJsv6tSkI/3pl
- TLSH
  T125568D5362FA0051D8BAC139CA6B9603EBB37C1643219BDF01A4A6156FB3BF5193F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Dolphin-x64/Qt6Gui.dll
- Size 7.2MB
- SHA256 fb3eacd5c99a9de5b51ddb676c9c02675640164cc23432f7c24356d04a2ad108
- MD5 a821ebb82335187a4c14421a29c2ed78
- SHA1 a14b17c24f2c3a05c2c3943d6b584450c6db5f0f
- SHA512 ae1339146dcbf08f2939a30629577a582b206dc3b5c9732472de7077bdb84f09212737af7018cda41652c1e0b1c2d77d8aedbbf237baf04779278e586589b07c
- SSDEEP 98304:b38y4MF3MN0Veq0+xC6lixS0GzXBKqkvhkbpY:L8y4MF3MNdV+c6llkO
- TLSH
  T10D768D57B3E911D8C47BD13D8B9B8517E7B2705503229BDB02A48A593F23BE12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Dolphin-x64/Sys/GameSettings/D43J01.ini
- Size 234B
- SHA256 24da9c5c95f23608e482796426b54820c1cc00bcf4d8f3a2d05cfe3116e9f90c
- MD5 3518d226af5efcd27978dad081bb6e8f
- SHA1 fbd60db86a00dbcca6fa91c3b8cf97c15fa8adcd
- SHA512 477e8d857529c12a96bd868782c3cd1cbb3b1ee73410f35239870ad073254882a8cc4de4a08152c6b4fc2aaa46a5df45833604d45efb7491556269975b0dddfc
- TLSH
  T112D09752F04C48AAF0042A8AD10721042F33B12294933AE01B8AB00232F50F0108C209
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Dolphin-x64/Sys/GameSettings/DPOJ8P.ini
- Size 391B
- SHA256 bb4750837568aa343735d198a1e3b8645a31e0a2d7f450eeba548404d27891a4
- MD5 3e21e08fe706557580e07130a8aa1e92
- SHA1 7195b3445003972b60c78a54ce0440fc400ce00a
- SHA512 275a73eff7e7102693cdfaae6e68c8c7f2c20e04560d5aade98f1fe71b56e771445d455feee45c4b1c641895516247f6bbba33029a9e3916889fe94cd8e6e152
- TLSH
  T1D3E06810B0893A31352E4376EA37A3551F331000CF32BF502D795522137A0E923C4F8D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Dolphin-x64/Sys/GameSettings/G2ME01.ini
- Size 2KB
- SHA256 adef6de5a8f725111870dd76452f04b05b3a872ce970358db50f86c6ace42923
- MD5 29e64b4a9cd60b894f32f03fd7d228e6
- SHA1 1b1242f9a8c632dd4a10af3404953ee6be86a7d4
- SHA512 19be561c40f5f1ee27e9c9a78c5b1ee14cfe18a453b0f3ef5a666f77bc5337db63b980d014efcf86faf67a6d083f39dbff96fbc0c348c0879b9592a0735d815e
- TLSH
  T13C5167065D0748AAF90A1214781F3F074B5FB1A3BDFE7E545E20F605A9FECA05A3A634
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10 behavioral9
- Target
  Dolphin-x64/Sys/GameSettings/G2MP01.ini
- Size 2KB
- SHA256 88c692500d3be161828d961292d24314a9e0aab02d295b3e042121bf66263ebf
- MD5 5f93bf9358d3e80062f6691f3e15ba4e
- SHA1 b8ff831274851a14fe2a2b646f0a9d22bca88a6d
- SHA512 b7d1f7e04a6bb53ad86f9e6c2c46f31f2ded3d36f0448cdf91726d2d093a1d0455c14e0d7cbfc6a80c87dbfc8e7f53b5fb3dd6afcd4a3cd49aceda1a9d6eccb1
- TLSH
  T12151FDC753070C72990A12FC7C263F468B52B2BFBEDF594C92202D11EA664AF574F204
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral11 behavioral12
- Target
  Dolphin-x64/Sys/GameSettings/G2RE52.ini
- Size 1KB
- SHA256 15e3100848c220e82f1c62b818a2dc444161c999889cf8e81a553b509d6885ae
- MD5 27e2ac45416c3e04fe1bcd7ffe5f8812
- SHA1 93b7588a02ec5a9280f68d1b10ee3a285fb74ed7
- SHA512 d83a7967668656926f6ee095c140b1d58573b53ae34cd7afc900bfce9369c46a56951646315071af536599304cf1e207ed2439ccd2a5e7d37e1a5e3fe663f3ec
- TLSH
  T13A41278B529D04E2F8DB098D61C0387C0E7AB1536FCB6329657B574D871D18DAE68E28
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Dolphin-x64/Sys/GameSettings/G2VE08.ini
- Size 304B
- SHA256 a861a27470edc6fa1eaad996e44f8eb1b86eceab415c388a1d0b4fc96cf9bbd4
- MD5 bd955f29b79978edc7703951b64fa576
- SHA1 40fdc624a1758011281d528787b52969071967dc
- SHA512 9ba6aba35b77fb376c3d4f071e9ae5c3cf16ba0c47c0a48ced80985cf4512d16897a129acd36640375f51ffc6c757c0b03ad22ceded0e4d0082ff449fa3bb35f
- TLSH
  T174E0CD61749D2163701406B7EB5651451FB75652CFF23F412E99201562662A61098FE8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Dolphin-x64/Sys/GameSettings/G2VP08.ini
- Size 304B
- SHA256 85a901f08e4b008b385f5afe4a3617a0301c5f51ca476954b2dc0dfd2fb95b88
- MD5 772d94a0d6c4669e95ab4b4e9ba4d19e
- SHA1 5d71ea6dfea32c9aaae3a28405d5a2d7c05b916f
- SHA512 eff22a84ff1cb29761f1abe2e8dd407293a6ca479c220c0ddf467bc59a552fcc09b7adbec6dd55a0b5ba30c2bea33394dbf9b6266e95668ec4c576912f5a2dc9
- TLSH
  T188E07D61708D2563701402B3EB4A50041FB32652CFF13F013ED92001122A2A6009CFE8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral17 behavioral18
- Target
  Dolphin-x64/Sys/GameSettings/G3RP52.ini
- Size 400B
- SHA256 9182f6610609c7cffd150d40b5955ff7f187ede5312caf7b4b8fc6f21ce7eb44
- MD5 c54dadc693d6379cc15edaf4f7af4714
- SHA1 50035c185916a5e4140928330b34258dc2382f58
- SHA512 319a839434943358ca98bc4318ba9386ea257d5f27693337932da735c142a7dbda32aa97e94c5115b7f6e378aca602bfe7fd4d631b01a3d7cd884b85739c69e9
- TLSH
  T1D7E0ABB0709C0663B40E06E3DB4F930C0A72A202CEE23D079C1A105532172AE80C1FA4
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral19 behavioral20
- Target
  Dolphin-x64/Sys/GameSettings/G3YP52.ini
- Size 192B
- SHA256 deaf8c84933c28f44b1f87edc1f478e56bd0fe9a54f5ce4f470813473d032f40
- MD5 5b052cc81e338f687913968b458e0b03
- SHA1 1072d210a24f635febfba96ef9bb0468f0a63840
- SHA512 68b28f539c93b7387f93f29e64c8589e14d8e0fad0dbbc6247d15f0d5df08e95c6b7e6c8a76676ce7df58b9bc1a0b8dc8f0a6083787e60217b721bc07129d5fa
- TLSH
  T1C5C0129B38DD1172F40949C7DDD5A0060531977DCAE934027EAB30D1A497747626EA60
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral21 behavioral22
- Target
  Dolphin-x64/Sys/GameSettings/G4AEE9.ini
- Size 189B
- SHA256 8cd2db8e1428b7f678a390570390da50f10e0f81871412fc2d9b68beae588d2b
- MD5 195503bf1e5eb88e2830b3be2c972255
- SHA1 4876c49845a358e69c3914e0ae366246005a4739
- SHA512 2b74db13728b2a730c9a441aeec74c8013086f8b10961669da600cd33548250f18c285c3fcdf469477866567ef3f754581ae3d1454b801eb0c290b5ab3c5cdf6
- TLSH
  T182C022439920200C700360074D9A8D834A348AF88B240DC028C63A0262FBAC0BFC5006
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral23 behavioral24
- Target
  Dolphin-x64/Sys/GameSettings/G4ME69.ini
- Size 318B
- SHA256 26cd847cdc360e3306892a55b10cc32d44675af1f06e3559853741a72067ddb5
- MD5 534e187f629eaa2c439afa4c881b4ca2
- SHA1 a6a02ba947f3b4c11bb743da2799df87433b0e71
- SHA512 afbe78fa3e9863ff9a7fd072dc1fbe28800ae537b31d47c2ed7bd7c85761671ee1b8020eaf1d73f76baf527f449c0270d1f86f1453d9fef234a53bda50e7b6e5
- TLSH
  T19FE0CD61F44E2163F01806F7E79A95541FB35652CFE17E413D6E201661252AA1898EE8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral25 behavioral26
- Target
  Dolphin-x64/Sys/GameSettings/G5SE7D.ini
- Size 980B
- SHA256 feacbff206ffc02c318f80f137fc6bf7fbbe36d3c0c710fa506222952a462a21
- MD5 bb86e44b3208b77c5f60e13814ac4a0b
- SHA1 df6955d2ab40e220902c4b8408cf849b09a1297c
- SHA512 68f85da418b7810972d674a7e9ddc3a05e4ff2b30f635486f7f7e9db1dfdc8375f2095e6ccc8edcf75b5ecbd83ad0b24e1ec8d9593e2041e06d0f6d3727edddb
- TLSH
  T15411ED2671D97800F10EC045098AB42E0CBF32A7ADEA35901F6B3310B9DFEC2B602858
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral27 behavioral28
- Target
  Dolphin-x64/Sys/GameSettings/G5SP7D.ini
- Size 885B
- SHA256 2f73586e8c815df7ec506d1d88ced2cc61386b6b230a7e0d1c727d09cca0938e
- MD5 506ba5d61d37871a95baa978b48b2afd
- SHA1 60d332fe724d3d17c5b2c18724e8e4592c1383ce
- SHA512 d5d643be8be57a1dd1e138fa7aedae71087af451b5ab52679573dca20b767e4584d45d317e9c702314747936f27ba687367c2c6c463c7d99ddf070f99057e4eb
- TLSH
  T1E21126B1E89845F1F15F94816A62F48E0C3B7A838DF93CC44D5B2214981E5DD7AF2A5C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Dolphin-x64/Sys/GameSettings/G8ME01.ini
- Size 1KB
- SHA256 ca9cd448fe8f1a5439a73504685dde828b1e48e25427bdd890569fc4935dc6e1
- MD5 367814b999db7e6709ac66e12e30bcd6
- SHA1 c9b7093b5ed43ac30179765d912a2efb8dd3561c
- SHA512 0e8c4c8fe429402bdde817f6f8e650177d2ee4788fb4323315759146fd2b96521614c0f0fa5799e4cb35739b26b4d0944ecdcfc55649bb23f3245a4fc6f7c084
- TLSH
  T12B31BC506282A571F05F985FC118700AA1A8F8B7AFC3296114A82217E2D98CBFD5A611
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32