308c76e9cb03bc69068e946e39dee566c4584801d2f8bed07ca2f1e5bf513364

Sharing

Copy URL Twitter E-mail

General

Target
SDA.1.0.15.zip
Size 3.1MB
Sample260910-wp3e9swvfy
SHA256 308c76e9cb03bc69068e946e39dee566c4584801d2f8bed07ca2f1e5bf513364
MD5 dd4f010cccced51a2712aba6c9f757d1
SHA1 ac510f5f7472b26a19fde65acbc69812ab324b3a
SHA512 48504b63f0dd5110a5ea96cf82459334812c7d1d246042c36256b214c9f8a1904a43f1f4adc251207524637599ac2ea7ff6c46ba40fbe76501b742a1b760571b
SSDEEP 98304:mPjzvqHMMIbx5IxstnxDV+Sl/sRCXZxaJt5i4:+jWUbxWxszDV+Y/gCXZx2t5x
TLSH
T17CE5336C2B57B387B61873783AC2B74BC7469CE1A0B87E0FE131D426829F1191795DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SDA.1.0.15.zip
- Size 3.1MB
- SHA256 308c76e9cb03bc69068e946e39dee566c4584801d2f8bed07ca2f1e5bf513364
- MD5 dd4f010cccced51a2712aba6c9f757d1
- SHA1 ac510f5f7472b26a19fde65acbc69812ab324b3a
- SHA512 48504b63f0dd5110a5ea96cf82459334812c7d1d246042c36256b214c9f8a1904a43f1f4adc251207524637599ac2ea7ff6c46ba40fbe76501b742a1b760571b
- SSDEEP 98304:mPjzvqHMMIbx5IxstnxDV+Sl/sRCXZxaJt5i4:+jWUbxWxszDV+Y/gCXZx2t5x
- TLSH
  T17CE5336C2B57B387B61873783AC2B74BC7469CE1A0B87E0FE131D426829F1191795DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CommandLine.dll
- Size 220KB
- SHA256 8a55501cd1a1590a4bd93a17c6fdd2c01a0ed5bff1aea9036bdc78d98c9a3fad
- MD5 05c71fa3a6fc561d7a1f919437dbddfd
- SHA1 5a8cd6b38ee5d63c60c7747de6b5469ba5d1e6b2
- SHA512 1ab183d67220c8b8999b6ac032ac304f57960faf0e908404ffa3aa37c010d1a063d7734923a1576f18a69f7300b01fbbb395e3dca971e1b125b1b3b67ab858d0
- SSDEEP 3072:6G/MfUAMcCbPpKNQ6acJ8vG+L+ERbE9K/ShQvtpEI1aEvjc94OFS/Gi+XFEbliWb:6G/zAnUPpKO6acJ8n+Ez/5wECkliitf
- TLSH
  T1AF245C4653AD0363C7BF7775E8A0219F87F6E932F894E7DE748898F20D96342984035A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Flurl.Http.dll
- Size 110KB
- SHA256 cb204c6865563bc7f023f4655977cf5263536a75069b0e7e1d72a900a66f1eb5
- MD5 92978ac9a26252968e24b57d8399de0e
- SHA1 1c300ccb5ecec6ce641aea823bc937885fc06cce
- SHA512 2b77da40d5c6ed4fc84d8f83d7e5c0be5d3cf89e0232faccb7edc9babe06a00669989deeb33e57d0a33e4b0beb4583d907df039e87d7ce430875bb93e04346e9
- SSDEEP 3072:wirA/44rGXoYv0pKMOm/LvUvGzrlUVREvb:wzrGYYvcUfarM
- TLSH
  T1CDB32B0863BD8B12C7EF1BBAE0B411178AF6E50BB426F75D9E48A4F9282375165013F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Flurl.dll
- Size 39KB
- SHA256 7ff7965161f6acc809f7154cd3ba1f56e0290974d4fcfc5944bd4c9030996383
- MD5 3dcec6350ac44f5c2368bad9a9b9d933
- SHA1 8c18a7cbe53e4b44d86e363db193ab77f1cd0cb5
- SHA512 44f9ff5c8acd562473f5db127bd4ae1ca4a3502a164a742e78a81f957083a5cc8fef3f256c0841dbbd8a15b2254e117b382a28368e2e645598f426244a8db51a
- SSDEEP 384:mbEJECh61EXALSGbLVRB1HrUFjY9xtA8DDBmncdI9i2bKebWE/nH7lqtQrZiPYHE:mEc6opbp9Uq9xtA8nScq7OWG66
- TLSH
  T107034B2573DCA3D7C7FF06BAB4E568668B70E229B453FB475E8881B5498B3501A103B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Steam Desktop Authenticator.deps.json
- Size 8KB
- SHA256 adf125b94f2a7390226d69f5a4379d16ad734c53ab686ae731832d3121d9af2b
- MD5 927a49f255375dffb0659705aebf252e
- SHA1 fd19bb07abb6d214ca2c8dc768135ca685d4e033
- SHA512 67cb4ab79a39ba2e833f21936639e149e638a54daf33677ce2f96a8596662cbe64bc91caa2c9cc86670f37b34c922d7e4f9d5bc66125ee2ddfd4f67e032721ba
- SSDEEP 96:MDyLWFyM3M67Oya6VPi13nf4s8DeJ7HLcfXfEEXOSCrPuFc6ELyV68B+PtQfOtPJ:MDyLWDcdya8P037Cdlfuj
- TLSH
  T1DB12D916D9A00EB744756FA664394242F72A973B40001D8F78FC688CCF73E9BA1A5F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Steam Desktop Authenticator.dll
- Size 1.3MB
- SHA256 ad0a1fa18b923e4ae0ebbc445a2cb8cac25cff7d1d8309e67455367ec6f901c1
- MD5 39019e11937a2db8d008c2d2866afe88
- SHA1 3e5f5ee193d41d64a2ed7f39079115750fa6b656
- SHA512 6eb02cf2fef42d1d54e5fc23962d5e50f70beb3dc3af6e803c46cd992aea838c181d9a7a9bb384d07d8ed71df45effe8a894efcba45da4cfb020a0463371b8d5
- SSDEEP 6144:ubnApgGRLUPa4V66T6nw10zIf6T6nw10zIf6T6nw10zIf6T6nw10zIf6T6nw10zN:4ng4iJ
- TLSH
  T1C055E71262FEDD53E3E4067AF0D1D7F426613C1BF4A886A7E9903ED834BBE139420652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Steam Desktop Authenticator.dll.config
- Size 855B
- SHA256 09c28c1c49b85c87e7612d630400c28e9db146d2f1859c63c29b584b82839aa0
- MD5 8d5b7b3cf4e05e82c6459e4e762b8963
- SHA1 99ac522c47f09da46e04ba9e8e3b19c98f9c4c66
- SHA512 0696f2df1f6901c0941808bcea011173ee59e32122fc06bd17b59a679748e9e266ff9e7522cbbbfcb6111a82f6360f46ba2e738ee8809a93d63b67322984d0c9
- TLSH
  T18611F12151C47F954F7209637A719815CB7543B33C8C095CF4EE6A978F2298A1203176
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Steam Desktop Authenticator.exe
- Size 211KB
- SHA256 51cc065f531ce8d9c0c9e2741faa15c5a23af1702c9a585a4aba8c00d487d0f5
- MD5 33b7b790a80319bc27f5d4a36b5314e5
- SHA1 f7d2c9ae1713ceab8f561fc4ca4046ffc357f534
- SHA512 8431038c823a4bb8c768e35ac8c2f2069e42e6804cd4ba5e762026726a2829335c8c8b6f54c9eba623a12c0a655a3626c35e30a0b928550f74983d463d1cacca
- SSDEEP 3072:rw0EwbZZGGdKsAf26qIJKHYwlBiSkkNpg2Xhbl2/JqGzT6nwMDM0zdLOu2oUQYA:9LGGdWQIJK3+cmx9zT6nw10zgD
- TLSH
  T16624A11122FECD63E3D11272F9E0DBF55664BC27FAA04197E2807EC97933D839961612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral17 behavioral18
- Target
  Steam Desktop Authenticator.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  SteamAuth.dll
- Size 42KB
- SHA256 bf1effec6cc66ef007d112a48f47228833b1b555a177f4ddb16a390fe5bc43f2
- MD5 6a2badbd7ae1abfdc315948c13be4eba
- SHA1 3713a528c292f68f2a10898df0f4528352f3f1f8
- SHA512 b79f911eefac48ed1f9995db067459670da8da6b5c20abed4b36136adb0963ce1f5faea15fe65be23fb90c57dcb58c851fbe93e0186a24b839ed781cda5992bd
- SSDEEP 768:gTFApkbSxELvhjebCTPA+elUlLgR/rS8GPKQ4jCuZpH:7xyvhp2lYsIP+CuL
- TLSH
  T184132B05A3AC8677E7AF0EFDF83042170A76B26ABC02EB5E4D2CB4DD25167414E117A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  SteamKit2.dll
- Size 6.1MB
- SHA256 62968817d202b089d28e26178b0a353e01e41102986b96f615070e26bf0e2113
- MD5 e07865096339f3bedb3bdd1bc061fc63
- SHA1 1da4b568dd6bc9446647f1c3a9cc6221d5934ae1
- SHA512 cfb22cc676efa34a159888b772d081c637984b6426d5f2c99d86784711d237e04e601f0c43b5a00d46340ea76b37f2861fea57a82a48100e31cc1be8261e898f
- SSDEEP 98304:VOD+bvJACPxonNQshBl8Q8QY0OXNkXTlx:cD+bvJAQon7eQ8QY
- TLSH
  T14D56E71567D7CA3DDACF8134E070967D0270CA857720C766AD0CD66A2CE5B49BFE22A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  System.CodeDom.dll
- Size 179KB
- SHA256 79e53505a9e9ceafcae4149c303cd1e45e65ca831e07b1e76447ee2df579f242
- MD5 d7742993fcd9ead7c036f1656ed3af2e
- SHA1 d1f84da3c6dfac053c35acfdfa7f9029fec9ca63
- SHA512 0cb2bcbe575a91accc1d2e5166a85b52dc0b57f61a90ea70204e68b566fc7f0ea10f69d5a769768dc625e019a4e347253aff467373f60de185b732dd24a258fd
- SSDEEP 3072:6MKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+ltZh1cjdGfl:mLBk0szhebCSKfOA9
- TLSH
  T12C042B6437FC8376E7AE6674F028092146FCE44E7283DB5A8D8951F55E23740EE20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  System.IO.Hashing.dll
- Size 53KB
- SHA256 022d1366f82a0d216d136c5e664dfd4cb0b674506c5b778a343e32943a21c414
- MD5 b18ff6d3bfc61fe850e27906580c4224
- SHA1 bc09bbd122c7da2217ef3e1cb4cc2ce361f8b4cb
- SHA512 bf03b65207606538bd6243af6159ca256d7cadf426974568a07df7a9b1dc547c23a714909547231b13a1b8739e0d564a25b399dc71478c04fee3edd8f42b4823
- SSDEEP 768:7IK8f7JwG9PHZxqyu2E+qDAE0I3Eshpn/139lUWHKigFdv8WJdu49z0:7IBqQroAb6EypyWHYdv8WJJz0
- TLSH
  T134338D465BE8873BDD6E7D72D0305155463EC6AB2913FB8770EC64B418433CA8A263EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  System.Management.dll
- Size 305KB
- SHA256 1fd6733ec97240f987485d288941069d20d41142fbf0df40f9ae9dc9fe0cf12a
- MD5 9949c691a3dd78725b81d8b136b6d8f5
- SHA1 311ee678ede69289726e3f6a3a1f2f197bfd3ee7
- SHA512 1c0f66828f02d76001c508c6f95478d051141e156a08531ac930488753d72ae173d51e281fcf27a23fc9d716706551e426b1582a41cae309e688bd89cd784343
- SSDEEP 6144:syj+butGieusJEYE1SF7c39iwjwmppwbHV/ZqPJkobp04SxptV4:s4+butGieusJE31Shd/k9sxp0
- TLSH
  T15B64062023F88A44E8BF5FB5A0702060CFB5775B2A6EDB9C4D917CED19B2740856732B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  protobuf-net.Core.dll
- Size 293KB
- SHA256 223274eabaded7c56eb137cbe783fbc9bda2ff98b9fd754e951f2b1231c4eb05
- MD5 37379d336e63f737992667598e7a5683
- SHA1 50cc1d5e179c4a7800f176339a4266a92968f20e
- SHA512 f35068b1eb537d5f625a5047028ff488b4859dc4bb16e0a453e9272109d2dc7f788dd7a0f1e2baf7c6f75edfaf078655f4ed9fefd70d152bfabb259fc42ca4fe
- SSDEEP 6144:UWXn29oH0OjEYpPcTFLMBlfiXk7alcBMRU1h4J:B3RcSfWO+U1h4J
- TLSH
  T115544A2417ED8936C6FE5A78F87048CD167ADF02D4FAEB99506853B9E8C33C48B04669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32