961d700df5d81abf0f4ed893776f904377dbddd78d313164a5b73db74877b6be

Sharing

Copy URL Twitter E-mail

General

Target
uniCODE-PC-2.2 (2).zip
Size 437.4MB
Sample260908-e5lzsa1hma
SHA256 961d700df5d81abf0f4ed893776f904377dbddd78d313164a5b73db74877b6be
MD5 5ecfa15c993b7acde079953154583895
SHA1 5803b6c8447f46bd7e30a91f5be4322afd018c11
SHA512 d13ff1f0286e2a65cb6cc92a395b642083514d4b0eaba07d4a153dec32cf29e070bce8d072331eabb001094ba078a2345d0300da9767a37115aeada3a8795f29
SSDEEP 12582912:VFBrLfP6DUnNkOkPk/8bFkHsO4FjugDHTnIUa:3xH6DUnOOkP6WFkBmqgDHva
TLSH
T1E8293333D8ED7833CE2FE27F100981054A9F85508D61F51DAE5513CA79BE7C2A663BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  uniCODE-PC-2.2/GeodeUninstaller.exe
- Size 159KB
- SHA256 797e5a43d5f32b127e441a74adad5ceb94a9356ec044555d0bf90f702d4f6a10
- MD5 e35d37eafda32c967953900154a48860
- SHA1 004533e26846bf9b49f8f65be34614da650e34c7
- SHA512 dbd307dd11bdc66b7a5bcb2f171d6371d73800cee05a1de2c15c422f3651519bbda2691c426764c2e1c1a0ffb5fc31cede01b5f7f59aad1ad9f9e92493a68a68
- SSDEEP 3072:Qrv+LsMjvFsOTb98xQT+5U5qwqlyXvBGYVGzdwEXTo1BZ:UWLsKB0IqIvBGeGNXTo1BZ
- TLSH
  T1D9F38E1CBB768FF6D83189305697F6AB4F21BC75895A9B0BEB111633DC33554FA0A201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  uniCODE-PC-2.2/geode/unzipped/alphalaneous.alphas_geode_utils/alphalaneous.alphas_geode_utils.dll
- Size 174KB
- SHA256 aeace43ad1758dcc3deaa2077d032cefa27506fdfab189f8aeac8552929ad4a1
- MD5 4a0b5db4c3ee5cb35566030013cd81bc
- SHA1 5a4acfe551cd3be2dcb81f18f59d700a794f70e9
- SHA512 076190965351e9b7860b3b3c991b8ecdcb472066258a6c59e8d917589da20d06346b489c4411d625a0d02d8ab399546e0d436566389be1afee8a8379741c91e2
- SSDEEP 3072:Zzwwi7ArOJ9BqedFX1dDKu4dOkUtFi8cT0RGAMs:ZzwwEFhFDkUtFi8Va
- TLSH
  T130042A13BA46A4AEC54AC834864749527E71B4C24F62FADB67809B7D2F74BF92F3C404
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  uniCODE-PC-2.2/geode/unzipped/alphalaneous.editortab_api/alphalaneous.editortab_api.dll
- Size 473KB
- SHA256 2f761f7bfd2fb4156b3ce3da296c8a438b40f665919f1f2e23e153ae8f366ff3
- MD5 da2ea60a94481e0b9605d93c5e36e986
- SHA1 9da14b628f1764dd90dfc71e0e7c9ba9aab348a3
- SHA512 09ced04f9f4ce864f651bb20e3e5ce9ee525aa373639f5ec44589e4ab4c62db5cc1e6ebc36b5515598174bf1dc2ed6dddf7a933d438c8b2d91b72b77dab5f11e
- SSDEEP 6144:8g9AGxqYhEhnz9phfw4lUWIDdV2JFtWdy/ZgHFDtcjKeCHo8NA:8g9AGxq2iztfwH+2o8NA
- TLSH
  T1C0A42917F30AA4EED08BE2B4129F54037B30B8C61F26BAE765C4E2593FA57D85B36510
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  uniCODE-PC-2.2/geode/unzipped/bunchuq1122.show-song-info-on-levellist/bunchuq1122.show-song-info-on-levellist.dll
- Size 68KB
- SHA256 46a5af7eb716d3d6318acfd3428f502bf654814e67f3634f7775585a8ae83d37
- MD5 2af9f524d07b5686d9791016fa1039e5
- SHA1 239a77f796c69880683288b768b9c5e489e6ebe5
- SHA512 55b68a8216d83e830146d171b4c07496cd5a98ea293f8c8f5c96114793804c1c481a638660b469173e93b03ecb8437c2b1b2797a3a47536b9b9c889f5bb07ddb
- SSDEEP 768:Xn24CezUGFjuE5IcTSqKah+6lbLYZY25ZiniK/:3b9juuZPKRZiii
- TLSH
  T1B063D716AE06A03EC24ACC74C14749169E21B8C65FB2BADF97818EFE1D74BF49F39540
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  uniCODE-PC-2.2/geode/unzipped/cgytrus.menu-shaders/cgytrus.menu-shaders.dll
- Size 329KB
- SHA256 bb2963de2c1b443756200d5af3a60ceeadcd1fad37dfb0166dd2f7f02cc55997
- MD5 4fdd05be4881004612d23226c7eca15c
- SHA1 85da0a918599e2f0d076b710d5732695570ca900
- SHA512 868cd600913b09a9fe5fc07a45f981c1afc47c58892903d87efd12c17a0b0ebc5893240054ee45b4951c2789f49f603c198cd0870045b027b8aca3b1f7f86124
- SSDEEP 3072:maMRKdj3WpZTK3mvHupnQ1Sn1QpFGEARr+REHnczPQmEtFhoHe8siy784U6hpm9B:maMR+Ua9/WInUuaekF4U6hcE
- TLSH
  T198642A15BA0A6CBED54BC8B8424788512E7134CA0F72FDEB47C595393EB6AF42F39244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  uniCODE-PC-2.2/geode/unzipped/cvolton.level-id-api/cvolton.level-id-api.dll
- Size 322KB
- SHA256 c445cbe79e864c306d0b059d053fad1d180ad3b82ee62a44dec1998c0f823113
- MD5 9dfdd3695c8a5698aaf563ac7d7ea689
- SHA1 0a26b598e149eb90c0390eb5d8db1fd2d5c689e7
- SHA512 66a6be3a90126f37cee2f3cb3888b2a535139bdcde58218877af4134b4f2fb7f6e653f3882084145eaecfbca8add2726a4c82b0db092f438eca7b02d424ed74d
- SSDEEP 6144:5/r/wVwqmXkklVcRoFWEm8tLNX+s7VZ/O8QmlrOYsa:5/Np3Xs
- TLSH
  T1A4642A23BA067CAED84AC5B5924B85523B31B4C60F61FADB16C5D73C2E766F86F39100
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  uniCODE-PC-2.2/geode/unzipped/fleym.nongd/fleym.nongd.dll
- Size 3.0MB
- SHA256 9c7ba0804fffa836911a49e89ab1d58f436db30513c6131601bda70dcbfedb38
- MD5 64053e37ef880a8e227a6f8325a64cbe
- SHA1 5b685ef6a9364c05f3340382ccc2307b95c15c5e
- SHA512 94045ed3d18e587ac4e5a9bbbb9cf87cc995ca66315b2c0955d9b7361db9524bb1c530e569b2c20ab319812fc257d3424164e5a33682e1e681e66beb0d1fe5e3
- SSDEEP 24576:ohCTHKKeHZMyMvhx8cnNEcQB8UCKYcOGXLEHraSbdduzc8Hyl01:PTHve5M1xLNEcQB8BKnUraSJduY8S
- TLSH
  T1B7E5281EBE0E85EDCCCAC0B0895B455A696271CE0B60B7EF0186963C7E717F55F3A818
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  uniCODE-PC-2.2/geode/unzipped/gdutilsdevs.gdutils/gdutilsdevs.gdutils.dll
- Size 1.7MB
- SHA256 dd3865c6bd5d0a5439c3b6a57075bcec3f33899c50b739b4dd641d82e45f8176
- MD5 52ee4945a849d84c333bc69feb88ae28
- SHA1 b3fe2fa2c6a3874b33c23a48873b4560493a7e4b
- SHA512 d3d64d5996901df7696af08df23ffd54d82a2d3b6092a922df2621d9cd0bfa6100caf98a02f6d6ae363a3118979faa986111ef5e98ad00dc967e4cc13529d392
- SSDEEP 12288:csn8Kuemt88xjaFUKY8UA9vQCF0EWim7JA86iGAUFWGu8D8W8/i6w+S1KJeCwsPC:p9FUHr5VlU1KJeCwsPQOI4OsDP0HH
- TLSH
  T1AD856D07B70664BEC48AC1B8D29B491A6A31B5CB0F21B9EF05C199783FA67F81F3D550
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  uniCODE-PC-2.2/geode/unzipped/geode.node-ids/geode.node-ids.dll
- Size 1.5MB
- SHA256 47c67302162f2984f03f6b8109a8dee8480a1c6f8e2b87fb905035491d9a9224
- MD5 7c1cb7b497ebaf164839c4f559927735
- SHA1 5b264c41a8639ef1c269b33b07f313639baf53f3
- SHA512 ae5bbddac765c9efd0e2074f539557325def6dd07e30cf7b07518c52e7fc83069cfc0821faf9b22eb108fbaeafcc976a720657e98853881059df952f0cc45b78
- SSDEEP 12288:dS+m0wAcRnUVVe3Wno/OoILxpoiC0lqLdx8ulxVJitKyEN52i4yAO:dS+epGnoZIpoiC0lKSyAO
- TLSH
  T1E1750816BA0AA8BEC54AC8B0924745521E5030CB0F76FDEF45C4E63D3EBA7F91B39614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  uniCODE-PC-2.2/geode/unzipped/geode.texture-loader/geode.texture-loader.dll
- Size 505KB
- SHA256 9b21dd7a4419c3051c7286c4bdb8409a3dd64b351b608031d1b9f3b9480975ac
- MD5 86f23af707e01b28e4423f8f5b0380b2
- SHA1 f32e2694a290d1f24f92748bbd6c43d98ac694f2
- SHA512 640563de5d4388aedd18aad10c9761888dd05f6a25028ff5b69e74873beb2ab3c397fd3e167c73c2ab3132593fa5cb04d05c3b7ad76b7233a072b248c989617e
- SSDEEP 6144:SiT4NBofjNf+zdnuUebzpYdBPSeZYCuU5VZVBjfqSEr9+EWa:SG4NBofjIbWudBS0KW
- TLSH
  T159B41915BA076CBDD486C8B4824B89522D2174CA0F62FDEB42C5E2393EB97F56F39344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  uniCODE-PC-2.2/geode/unzipped/hjfod.betteredit/hjfod.betteredit.dll
- Size 3.0MB
- SHA256 308561a94b33344da294e1927a9b3203fcf8997cd47485c06e104d3ef47cb3b2
- MD5 a147a245884ac20344425dfb910ec295
- SHA1 64b29ef22e553b89938ca596dc3fd2190f556d1e
- SHA512 4ad784cdcae14b63f0bcf23d136336ce78e638b19584a52f569ba1bcd833ded640896496c682010a4e127d8abb5c457a247824c9775bcd327675d000e51a03db
- SSDEEP 49152:REzio7vHh8uZFqpnlHamzSgpoCcULqxPqvygYGoNxl:Fp1NHpoCDmsagPA
- TLSH
  T1BCE54B16B64768ADC44EC4B4434B96626E2030CA0B35FEEF85C1D6393EB9BF46B3D614
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  uniCODE-PC-2.2/geode/unzipped/hjfod.betteredit/resources/hjfod.betteredit/CreateCircle.mjs
- Size 1KB
- SHA256 ccb641b01422b417e3b9e16f30447ab5714546d00b0bd31e5811dcb36080fae4
- MD5 d32f95dd0c47af3d8268ff1339d2c1f9
- SHA1 3b32eca913ed1c42bfc89430f1cc1a3f9c6f160d
- SHA512 d4f564290715c02d6a95302646078ed9dbdc6b50a0cd8656a7e7106a6d9e5f378a1a26f890393f7daa9ec222416cf6ba10fad47738a71ae982aaefabc396f946
- TLSH
  T1D1213721B8955977485F27D4D46D4227C4B1163BF3ECA5A0BADCCA8443A38A0F58266B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  uniCODE-PC-2.2/geode/unzipped/hjfod.betteredit/resources/hjfod.betteredit/DeselectRandom.js
- Size 323B
- SHA256 39392cf9b05da01a4e7f415ea983c41ba307a7411047f57b7a4be0fc464ec923
- MD5 5e5686bcd12abbb767331a2afb63e190
- SHA1 a4d7eeac06e54ba0b2bae1e7d8a0c1e8156f25ad
- SHA512 5236bcf6ae37dd211a44928d3bdaf14b2460360b03380ed19406f24ceff14534946178c2512eaf5bf86ce8bc9463ee36d9880ac7839afa60f71cf7f45c72e36d
- TLSH
  T1E8E07D1821800174093F22E3BEC20090CEA3621B7563B944B8DCCC9ACF72818E042D63
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  uniCODE-PC-2.2/geode/unzipped/syzzi.click_between_frames/syzzi.click_between_frames.dll
- Size 266KB
- SHA256 2499a09abde9afcda2072df6bdfc5ea1536104690493e0d92dfc71700a07f914
- MD5 e620ae47f8610004573d31a9260ea791
- SHA1 56e78849e08bbccab82f2957d680a98711d35cd3
- SHA512 42f40d43e5ae2ab0cbd7ba55b1675280e5f81f270a4a995c8221cc153dbc5735319a225eb4030ba92ed216ab8dfcf39d0e65ac91f0719117c3c0fd7223df1cbe
- SSDEEP 3072:YenP9sCVMPtLXihf7YoeMnnVdo7h8hYqOq+7OcC0LWNSmxV7kUjktLv8:Hn8bg7BnVdoV8m5cMWNlxV7kUjktLv8
- TLSH
  T1D9441A167B066CAED886C8B4824B45126F3174C64F21FAEB97C1D63D2EB67F86F39104
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  uniCODE-PC-2.2/geode/unzipped/uproxide.happy_textures/uproxide.happy_textures.dll
- Size 1.5MB
- SHA256 c1e3491ab9b93b4f9f865a12612ad424c1f7925398829061857a9f949cf0292c
- MD5 a329bd1d16e02b5ee35fe2f809f32703
- SHA1 1b5f528b5a08eee2ed028eb0796164c137abb140
- SHA512 f0c9c1c1cc8722bd7a3f7be26ef2cfa39f8eb2ed123d4667785e13756da754c9494b2218dcae0e2e0056afab647cca31b938d3fe752848f473fc25a7325b3ed0
- SSDEEP 12288:zUqegt2TDSH/OE8GYSvqgYWtC8h/Eb21+RPT22wVJZngZTk8EIZfjyhhhhhhhhhU:kSlxYQh/p+Lgtg/f6jsz
- TLSH
  T173653B17760A54BEC58AC4B4928B59671A2070CB1B72BCEF43C596393FBA7F84F39604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  uniCODE-PC-2.2/glew32.dll
- Size 492KB
- SHA256 842a3f20177eb44ac0413116c66430f9508bf88a05fcdab14284a566d5d0774f
- MD5 0a3e7e9bcc0471f9f9d47dbe631e7c52
- SHA1 94f7a7e5ab3cba29ca0bf9e39f99cbbd4016036f
- SHA512 bf2a3e213b589e2e7a0f35d8258ea59b837c3044665d2cc78e9106f801b18a0d64e5f91ffec5a8829c39a69bd37ade5a871ad6c67d23f02397aa224a526d3099
- SSDEEP 6144:EkI4/e2zcb5gJ0rNxITpz0km2AiSu0GW05TiZ3VyfJt4QqU4qoZU8rnzMoL3BhQm:BJzcnkz0PZvDnzR/FJxl
- TLSH
  T11AB4A1AAB45F4B92F503703159529F9BC239E444B02EA39BB047344B3FDE79173683A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32