78f865fe1a9da8aef155d2eeb3fa345eae590a790581dce33ab96ab52c0d85bd

Sharing

Copy URL Twitter E-mail

General

Target
Assetto_Corsa_Career_Hub_1.5.4.rar
Size 50.3MB
Sample260906-3ag94shr2z
SHA256 78f865fe1a9da8aef155d2eeb3fa345eae590a790581dce33ab96ab52c0d85bd
MD5 84c8a0ea839e7e00f726a16fe3d8a78d
SHA1 099ec795679cb71ab9024d1991af32ad0a20ce52
SHA512 80f3f0e72db2bad114121b94c126514fe5945a892416928a199b251103391ca00923e76e35338c83b779f5d118c9251daee740dd0175c6f62b2f18e111e4650e
SSDEEP 1572864:lDndRFL8DZ/mzRXH84lREr62W0ZReXLRWc:cNA
TLSH
T114C733D6B3BBD5FBA7111EAD315C7A509823324421E8BB3767388DCBC316354D3A29A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Assetto_Corsa_Career_Hub_1.5.4.rar
- Size 50.3MB
- SHA256 78f865fe1a9da8aef155d2eeb3fa345eae590a790581dce33ab96ab52c0d85bd
- MD5 84c8a0ea839e7e00f726a16fe3d8a78d
- SHA1 099ec795679cb71ab9024d1991af32ad0a20ce52
- SHA512 80f3f0e72db2bad114121b94c126514fe5945a892416928a199b251103391ca00923e76e35338c83b779f5d118c9251daee740dd0175c6f62b2f18e111e4650e
- SSDEEP 1572864:lDndRFL8DZ/mzRXH84lREr62W0ZReXLRWc:cNA
- TLSH
  T114C733D6B3BBD5FBA7111EAD315C7A509823324421E8BB3767388DCBC316354D3A29A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/_socket.pyd
- Size 81KB
- SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
- MD5 899380b2d48df53414b974e11bb711e3
- SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
- SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
- SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
- TLSH
  T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/ascii.enc
- Size 1KB
- SHA256 fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd
- MD5 9e3a454fa480e9a99d2d5acdaa775233
- SHA1 493637bb570a5c96bb62f998bd0391fb59afc5f0
- SHA512 edfcb2bb6ab052d28d5cebd08ad57f36d3a4cb83d557b1359b0ade1266e24d8f3ce87b8240881396a5ba4fb45f8b74014784e8885cdb86680d98977cc0d130f0
- TLSH
  T1FD11FF2005258CD8FA4F21E530ED7B3005BF39E3D2C8935023B88318E781E9C0C851CC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/big5.enc
- Size 92KB
- SHA256 ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61
- MD5 41a874778111cc218bd421cf9c795ec2
- SHA1 80857d106f71199ce187833d38db091a819a520c
- SHA512 4244624124f86a3efab4c70b115a46c8adf02d708860fa5f327cdbfa24bc3f9efad0c6ee58de96b0b6bbc4cf6d99b322bb8657129007c86d6482f41c1503aad4
- SSDEEP 768:UAHU3LIkZlmXrd/uQ0ao98zgKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fd:UVduBGf94gFMT6q95GDRBfd
- TLSH
  T1F3936F60435BCEC0EB0424DBA0AF779239BE7D72A7C5E51152FA8786493744CB88FAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cns11643.enc
- Size 96KB
- SHA256 8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610
- MD5 b6a7c59e6a48d91cc2dbcb2bba7e4510
- SHA1 16a9338f18202b26981f2028bea412dd03bb0ff2
- SHA512 3d644cf394a528a8699be3679f787a4e1dad657c04b810580a4c520f2c043471640fbe080ac46dfd3924c47a73bee12a6ac69d291d09eb791ad0d64a73750b43
- SSDEEP 768:MPFOsOKqBLPf62X4lgQeLHj6RHUn0TQb8G47Ianrd28gr:MPAsknjX4OQe7aoMMarAFr
- TLSH
  T12AA394A0425A8ED0EB0024CBA4AB37D339FE7D7297C5E41152FAD7861E3745CA48FAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1250.enc
- Size 1KB
- SHA256 e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626
- MD5 9568ede60d3f917f1671f5a625a801c4
- SHA1 4f5b3308fe7f6845b46779decf9b395e47ac7396
- SHA512 9c32be3e25fc2211ce91f7b9ae1f9eba20071272be2bbba63a8b6e3cd6543c4c32cd62c4c4d153c94f5be212e974a61eefd70ddc005f1688d09d9d56e8e298a8
- TLSH
  T106212724013648C9F74F30E168ECBB70493B35E3D2CE61903B788654EBC5F8D5C89588
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1251.enc
- Size 1KB
- SHA256 0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc
- MD5 83daf47fd1f87b7b1e9e086f14c39e5b
- SHA1 77ae330512ebfef430a02213644bd1cfce174298
- SHA512 d7ce2f44edfe1da6d3e07e9a41bb08ad42430baafadd09fd217f4b524323a01a1f4913b640c552d38aaebff75b0d50ed7a813a2a57c4019311158890c0162df9
- TLSH
  T16D21C060352648D4EB5F61F6A2EDB734472B39E7CECE170022784308E741E982D84988
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH
  T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1253.enc
- Size 1KB
- SHA256 5b8d47451f847c1bde12caca3739ca29860553c0b6399ee990d51b26f9a69722
- MD5 441b86a0de77f25c91df1cd4685f651d
- SHA1 d1e429916bc9423f55eec8f17941521e9fe9d32b
- SHA512 35df342dda4e8790c6d53762465df8b93b49b7b7e211d7a5753078ef559c9c9383eff7285a90ff5c0020fbb16af380ee3c8643f4ceb1e41917e72021079d722f
- TLSH
  T14F21D6540A6958D8EA4FB2E520ECF7B1053B3AE3DAC8625437785A09E751E8C3C8968D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1254.enc
- Size 1KB
- SHA256 31639ca96a4d3602d59bd012540fe179917e0561cb11a0d0b61f1b950eb76911
- MD5 5fa9162bec5a4dea97b5ea2840cfb065
- SHA1 f26858e3d2fb928f39ca87cbb8446af099570cad
- SHA512 3ce7beabbe1a0cb946149d263d3317a8b791f6d72c49dec4621e27f50cc359d8fa3ee97c03ff05d44e47daa59db87f219386467614b8b3ff8cc21ab3e3bed5e6
- TLSH
  T1AC214F2402A58CD8FA8F30D520ECFB74453B35F3D2CA629027B88344E785E8D0C897D9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1255.enc
- Size 1KB
- SHA256 47576cae321c80e69c7f35205639680bf28010111e86e228ed191b084fac6b91
- MD5 6dea4179969d6c81c66c3b0f91b39769
- SHA1 7e2722576bffabc3258c5edb2d99fa2468d6a4b0
- SHA512 91cc626b6454517f06fb3616e9ed623d1a2a4bfe74afa9885f00f6aec835d8825a5587091b9d9ab0e5abda291fa3fe7ce87e2618e21eb2974d9118ae27b8a2ff
- TLSH
  T189210A200629CDD9FA6F31D520ECF770157B35E3D2C9625036BC8248EB96E8A1DC8ADD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Career Builder/tcl/encoding/cp1256.enc
- Size 1KB
- SHA256 29340ea8e5ad3532bf67fa77cc852f055081b1238925cb109908aa72804ccc04
- MD5 d50dfafee5c605c5c00a25a9eee4d4cf
- SHA1 7d51bc17931d3d809716c06e7f07c6011286a144
- SHA512 d0a9b422a1061d6239e442767069b987e33239fcba9bace677923888f5f8bd1dcaabc71b83a985a0a86a15dcc44316781665bbfbf24558fcb94fda6783285bcb
- TLSH
  T169216D2012664ED8F65F36E465FCBB70013E36FBD1C9134427788748EB86E9C1E891C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Pre-1.4 Progression Repair/tk/listbox.tcl
- Size 14KB
- SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
- MD5 804e6dce549b2e541986c0ce9e75e2d1
- SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
- SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
- SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
- TLSH
  T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Pre-1.4 Progression Repair/tk/megawidget.tcl
- Size 9KB
- SHA256 848258b946c002e2696ca3815a1589c8120af5cc41fbc11bbd9a3f5754cc21af
- MD5 d83ed6ac2912900040530528a0237ab3
- SHA1 2d18e42a8b96c3d71c1c6701010fdf75c1e6d5d8
- SHA512 00b4cd0d58029fc37820c163a4ae1dead22fb5c767bdc118659eace26d449c362189611dfb3fab1ac129fabfec2ce853ea2c10d418fae5aeb91ddc9330ff782d
- SSDEEP 192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
- TLSH
  T1B1123201638A436F37B763B580FAA154D534C1BF9DEB582C3C9EC3D43B308A286A66D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Pre-1.4 Progression Repair/tk/menu.tcl
- Size 38KB
- SHA256 312af944a276cdbf1ee00757ef141595670984f7f13e19922c25643a040f5339
- MD5 b7daa21c1c192b8cb5b86cbd7b2ce068
- SHA1 ae8abf9017f37ccdf5d0d15de66bb124a7482ba0
- SHA512 b619e3b8be5ec4545e97b7a7a7f7fecc2aafa58438f9ca3819f644720cf5ff5c44da12ac25988570e595d97cad799f87d93c24d5e67a7a953b9f5312952fbeb6
- SSDEEP 768:NKJsO8O4IzOQjJwxzire5pKVjriecYyq4CpKgnP:NKJsO8iOQizire54lriecYf40
- TLSH
  T1CC0386906E09E3375233D3A583B79054FF3A92F31346509C745D92AC37B58260AFEAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  Assetto_Corsa_Career_Hub_1.5.4/Pre-1.4 Progression Repair/tk/mkpsenc.tcl
- Size 30KB
- SHA256 c5bdca3aba671f03dc4624ab5fd260490f5002491d6c619142ccf5a1a744528a
- MD5 983c7b78f1a0ebacab8006d391a01fcd
- SHA1 7ea37474ea039ed7a37bfdd7d76eae673e666283
- SHA512 a006ef9b7213e572f6fc540d1512a52c52fec44e3a07846de09662ae32b7191c5cf639798531847b39e4076bf9dd6314b6f5373065c04f4fef221185b39c3117
- SSDEEP 768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
- TLSH
  T131D2F91C97858E6E745222624E3744EEE02DE09E6B694534F9DCCF1D372093C4EBFAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32