aad0ac0723899b3b490ef6d23c084a50d365a652b694c17a9e4c83c1ca4cc1ef

Sharing

Copy URL Twitter E-mail

General

Target
undercover agent reverse train otome unsafe.zip
Size 418.4MB
Sample260910-czpsdawxbs
SHA256 aad0ac0723899b3b490ef6d23c084a50d365a652b694c17a9e4c83c1ca4cc1ef
MD5 1cce6ef3124acd645bec33ff0ac20e89
SHA1 69fb4071c7c1579d3b40c02635053d8676da52ca
SHA512 e07593f819e2c0130bc92b087df8ef23bcbcdf1855fdf46e9de57fb2292204cfd21dd96b5e6456bd0802b9ac442b000734d5cdc53752f3be94ede37f3199e9a2
SSDEEP 12582912:Cdnc8MbbJ0aqvHLOHqDBmkEeS7Jl4GdMgPL0I/Yu:Cmfe97rSlCg4u
TLSH
T131293315709B7511C8B8737B90276149B7881DFB6281FE3878CE1326919FAB33A9DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Targets

- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/OnnaSennyuSousakanNoHentaiChiiku.exe
- Size 30.6MB
- SHA256 6b5ec621e8c4c936db96095fe4db0bd86252a622aebe11c16fc6d56a0f88e74f
- MD5 a106af1eb770ed449fe9ecb41a944be9
- SHA1 80cc4cb2303f9e9ff36a09df3da0b9c913b91423
- SHA512 9b94d03e23112179b01596f03de68f1b6d71105e4d827611acbbb663bdf81a33f06556bb15a51d5511b18e27d7cf5638bc043678013ff7f093f539d8bdbb0ad7
- SSDEEP 393216:01kxxSuBrWEsnK4s4QcOlmoi5/5WfRz5D/u1kaI7V1327xlZIP32Mh54WBvJQQc0:0kxxSiehF+m/5Q5DEE7atLIphMikqV
- TLSH
  T1FB6733266ED604D2EF37817D4A08B6376531B310079CF7B7F19426697BEBE063868923
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/OnnaSennyuSousakanNoHentaiChiiku.exe
- Size 3.5MB
- SHA256 979284334df40967f81ef87922aab9e4e1115602f1cd9f86bd2f221074357503
- MD5 ed9c07af4b632d2504d85e2877033494
- SHA1 d202da02ca64543843876e1e16e1b78ed2e2b549
- SHA512 d46ad872d9f4c12d73f37f3d9907ebcc5d662967f068950712ee7e8b106cd137306297efd002fd00ac8c32dbf67155a7a70db1a276349a221a9c2442d9b7c67c
- SSDEEP 49152:PJ9tsbXdqfp/vJHZuj+IDZVSdvFVSSiZHJbsQEag538F/bttriA4N/wA/jlyIKGJ:GVLLwlHTLcaHuGV9nH
- TLSH
  T17AF57D13FA90C037C45313B05C7AEA66603D7EFCAA14944737EC1F8E6AB1B906A5235B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/OnnaSennyuSousakanNoHentaiChiiku.exe.bak
- Size 3.4MB
- SHA256 11ca3cb058e135493dfaef2a5029b9af93d77edcccd2346cefe87d095fe5ffe1
- MD5 002bc8db6272f4cccbfadbabbfb701d3
- SHA1 650460f933f032acff86b9f13a78eb56e591659e
- SHA512 b6ecaa1b8afdf2194fbe0b0ee18391171d68f59995811b453a107e75b1aff3ad30be3b328a2735cb3f117312778e95d64e1b4f6728e9c0fce3b94f3417aee307
- SSDEEP 98304:06gvm+F9GxgEnHgj7X/GWHhiaN4y9LBd91W9r4c:0jmkGxnnHgjb/xHpNn9wh4c
- TLSH
  T1D4F533ADA3383A66F9FC08B4B820D94661E47EBD64DAD71064CDB44EF600BC819D79F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/krflash.dll
- Size 445KB
- SHA256 fbee495f9ab5112df469df79695dbd6e5e599cea6330276852ae1911dec0d3fd
- MD5 a1751dee83e79e1ebeacc2fe42553bb0
- SHA1 de52028f5f91d77042d33483d3b05808e3abc3ab
- SHA512 350c6f4d61555c5456a21b34a3b9778fb556d1468c26ce94790e5e77d921470cff31ef6e5b6bc3af68e22df9eabb002c595b240f2643fbfec32ca19eec2f23e8
- SSDEEP 12288:NE1PKiQPExitsh8o4ObJlR91t+h2IzX1j7W7j7+Ho:NkKNgO09Il7W7j7go
- TLSH
  T17CA49D22B7F08437C0130A745C6FBBB5E47EBF101926594B67E4A94C2F757813A2A2E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/krmovie.dll
- Size 272KB
- SHA256 238ac5f0bf8dd20343ddef5a942a535debefa7c905f542f10fbb6bccdf31283f
- MD5 b396fd30a8133fb756f8bfc798abd2bb
- SHA1 1932aae28586f7218d8f8e664d5af4e442d7ee51
- SHA512 2baae0587ace16cb256e85ce745ac0b3c2f531c060026cf507339d607ad91cc0191cab6f4da16100860a05406faf43e5dd6042f6975ee0afb2e0c3a725c208e5
- SSDEEP 3072:uq7y7yrtB8jy56vnC8+y3NB+QPshG0HBXQWOw9fbbDWPFbplWJHZa96H6bG1gU0r:jAb4ycQWOw97WPN8ZDH6bG1C97HZ
- TLSH
  T1B7445B113BE181B7EEE741B1893BA70D47B7FB823B6681CBA789114F5D222D12C35396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/LayerExAreaAverage.dll
- Size 82KB
- SHA256 52cce8558f130682637bcf385c2a64c329b1839c72abba85165504acc554894e
- MD5 4d86ed5d66e2ae0f913722b478efa741
- SHA1 f624a720a58b1b408dc7a4d7d32d12c39255452b
- SHA512 cae4b615f2ff37fcdc249fda9cb1e41c32632e1f6f13c84d7e43e1faa00b8713d364ad795229398470985c126b4d1b340b4d1c98754ffb65248e8f1f38233bc2
- SSDEEP 768:J0IRR0/50ixvLJElq8sz2aQ/WGdfBKcbFWrB9mDAPQFWggKSmwgSvpFKr+nYvfks:JnXq5PC4uzfpDVlgKsmr+Y/JSLPIf
- TLSH
  T138837D10B490C033C49B557A84BADA609B5EB52067A4B4CBBFAC1BBE5F306D07B75347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/addFont.dll
- Size 80KB
- SHA256 66dcecbeb7980746a877670f64deb0201f0bf78cc97d70b190e077927d0be0e0
- MD5 4d97908c2fc841d3896996a44453ee5f
- SHA1 516d74f2696188a92ad4ce18f740ffe7591ba6e2
- SHA512 4fe898b40828cc098894c2464ecc1278186f0a4bfa3f20d0a6c4c1421f8b8ebb8b73c5e15e8de71cc4cf7698c01d58952bfd21a1545520922dc0659ec1a5d9fb
- SSDEEP 768:dh7PqlGTkYTxcQLSWwMlZuqDhQqGm222Y3abY9RQEox9riebskDf/Azw5mYkuwh:VZTLLSWL9Wm4Y2Y96EMskF5mYku
- TLSH
  T14D836B107E938073E009083686C297C12FBE7A437FE7A4EFFF9907595AA01C41AB56B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/agg.dll
- Size 308KB
- SHA256 38315a5d2f92bb4d8ddc9a5d8fc8dbf81a755dc5cf1e585b26b1d5b45078fc62
- MD5 4907c95eed6e3cf3b8d67cb851fd797a
- SHA1 4851f45d5eb31dcdb81ae773018d5b998b731135
- SHA512 cb4df9415f59b03befadf52d028b28f1a88520711615a7e937d1622aef7565027d08bc351c23be46dab8f19304dd3e1ef9ad2356e5fce050bc675886cbaa87f0
- SSDEEP 6144:x96x9hJdrMBqNl04kpieFoSyZNSd1C59+CjAp5AXi4:n6x9hJdrMBqZk/FoSyqdY9+Cwqi4
- TLSH
  T13F648C92F583C0FAD889183C616B7B37EF786B520127CA87D710ED6A4D33161B61E35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/clipboardEx.dll
- Size 124KB
- SHA256 2e070a92cf6f87fc18e5a80579c8ae2c2c41933d21cb05536f301eafdad8ef29
- MD5 9f3b4d4c4d5cbed3c0300987fba221f7
- SHA1 f3636a9b4f11ec18001ecfcea5de915209a6bdd8
- SHA512 b4eae579acc353bfc44d7bf1108ffeb9464ca281c2db18ddfca7e03c5f44ee8837321332c121842e0e75fe983c2dd6d9ce8e9121837823df9ddbd2487a1d94e5
- SSDEEP 3072:z35A178MTr+2BIK0jIX2rDAZLuHaCbtWUrizfd:zyt8MTr+SINciQLuHIrZ
- TLSH
  T1E8C37C0137E68033D04E193A80A55BC4A7BFB853FFD569CBDF680B8A1E601D05A756EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/csvParser.dll
- Size 84KB
- SHA256 125dc3ce7d521df1b9543bd3fd964897b7755eed460a0ba56df08d24cdab0080
- MD5 5ccdcec2f1266f7c63e8fa569e67e080
- SHA1 a51548ef737c9fbb3b1ca9ff16c2cda4f2b12bbe
- SHA512 bc0154380bdc12a725f90702e06120082608105323b451ae915d7c18a6a09cf825fa540ce84c26f02c1e7dfc02c22a5c35d204245501a209a917512c8aeb082e
- SSDEEP 1536:YcEbuVQN/Ut11G+p8QOGNvvRTL5dimStVG:IimNU3pP5d6
- TLSH
  T1F9837D1539D380B3E04E4C39829297C06BBF79137FEA95DFEF6A0B994A901C406752F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/dirlist.dll
- Size 62KB
- SHA256 73356dd5e9f58c25f387ea40255aedc1a897ca12430a1c500efeb469dbd3f40a
- MD5 5e4df0c4cf4a8974e6d045abc7704bb1
- SHA1 bac1f1f0dd8de786c4c86ca5b5a2ae388432e956
- SHA512 46bab96fce9e07861560217cbeba440e6b42c3b77c0fff083e8f0931cc8b1f0197712792bb4b2a641cd9b18fed4db07745cdf407a0f9f1be1952f78c55ee413e
- SSDEEP 1536:ffuetZwVss3TNBcK0VQcNsH1krSb5BZFCGcGZmm4V:7yss3j0VQcStBZc
- TLSH
  T192536C12B8D0C136E01481F49D3DAA73EABF766807A1915B5354EBAD8FB6140FE0B367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/expat.dll
- Size 196KB
- SHA256 def6ea760ea8c9586094289f1291afa767fc7fcd08b0cadaeca778570daf13a9
- MD5 001e52826ef100b379900200ff446790
- SHA1 73dda16b65db88390c795ae921ab10d3eafaa92b
- SHA512 a918ad60d8a147a0e783ff020bd0fb4860e061c42e6d80d1ddae6f2eb50de9c85985e4cb81cb93f7e6d555be191c440809dbddfbda4b9dc3bb5fe228b3717fdf
- SSDEEP 3072:TAoMLeuXTszIJJBDVzrj1U8fQtq8+kdOOoPwL5EjRNvE1L585R+ZnohA1q:TTcDc6JFg8+gPwLCXER585hz
- TLSH
  T1BE146D55B5C3C0FFE6D6203A60B627379F7C2B9252EBD697DF00E96E4823201AD19319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/extrans.dll
- Size 232KB
- SHA256 9c1890f29c96a1f99bb77ec845421d171c47bd16de478ede5b93c4e9a793afa6
- MD5 ab0dde6ca7361e75fec300f44dae976d
- SHA1 99a52a03c5a93fac8d5e7ff5a656ad88a61930dd
- SHA512 ed98484d1d4cd2c4e82fbb38a4eb8959a030139c2b9def73120803c01f397d448d5a2691fc3ade68b84b4edc5ce8538e6d1086a49c1f5a3294c185e047da949a
- SSDEEP 1536:6zn3q0tg22Ip2TnUDVoi2pip9yzwnnnnacAc3q61F7oK386uYlxu+W25aUNkdIuH:67H+22IpC0lyz4AJ9PmhLdoAAKO
- TLSH
  T12234F7037B50F5A6C2A41332847BCF55A37BF235AE5257773EACAB6E1CC62006D67248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/fftgraph.dll
- Size 96KB
- SHA256 72534628bd9e43c22876f6417b8b7e86da369bf397995fc65c25cef3b2228a81
- MD5 4df58ce2ff4af9a0e5b9ac33bc82c5f7
- SHA1 22d4a94f1f508240db8b35f61f9247c49d5984c0
- SHA512 57331d0783d4285f34ccc455362a469b5f21d8bb9fddcec6cec65341a30738740cc1cfd66a5c4a1c1d339c4b1f38d134237a3d6021dacb8b1d448905e5d36f3e
- SSDEEP 1536:MCzqTcARRF/bYSYb24Watg1dV/CQSTk7oSr42rkp9duworRPrPrv:Mt1Yb24Wa20Q1foduwot
- TLSH
  T1DCA36B62B4D60071F19F4A7844922BBFDA2A2F604BF88547EF74BEE45D70D904A3A709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/flashPlayer.dll
- Size 261KB
- SHA256 324255927e06f016db5dc07fe2a853d5e72d6820197257a6f0bb367d559f13a4
- MD5 3d2ac1cb1de5d967f951def6bb9ff144
- SHA1 576c6c2512fa629d43063e87b5fab7a9bc44223f
- SHA512 eb9ba5bb4338c516a9e77900da94fafb023487df4c3a1ca1f22e883a4980ecfff136c8a40c0054a21d3a2eb0378a7f478808789035cb3fb0df29c368816d100d
- SSDEEP 3072:VNJsEZjW5+IcuvTEx8leAkAEvE4Q3Nc/+Cvo+a+:VYEZcWx8IFvEMQ
- TLSH
  T1CF442A107680C53AEDEF04BA8A7D865D145CF9600759D4CBFACCEB9ECA229D36E30257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴育/data/plugin/fstat.dll
- Size 144KB
- SHA256 3f657a1e1922fdb95272a20d8f0b6dd59138f1da7397381c5bc3e6e0918bdf35
- MD5 11a153685284b7f6e625b04267caf134
- SHA1 879a5868b9a9ab707ad11e33a30a97d13bdec766
- SHA512 6f756303778f298143a64f3cd3836e975ca5d235fde2a058f1f487a2082a908868dcab3ecf51a4d530529c7d4a5ca58287f359b18e23a8666e23981bec5bfff4
- SSDEEP 1536:F45u8WU51OQyU2g2m/1MPUU9K/tYKsaUu2IqCNYmPbG98QJMQl9fuYYh:F45LWUMm1MSmaieQWQlZAh
- TLSH
  T151E32A113AB29033E2090E7A845697B8A33FB412BFEC6DD7CF142F5559650E06C7D2AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32