5a360ec46517577996f180604165b49b851587641c9ff30506e67deb25cfa955

Sharing

Copy URL Twitter E-mail

General

Target
Path of Exile Custom.7z
Size 319.4MB
Sample260912-qlt2tsce22
SHA256 5a360ec46517577996f180604165b49b851587641c9ff30506e67deb25cfa955
MD5 a2c15dd93ce2e59a95c7f59d13dbb5a4
SHA1 a309677803d6367833005f8c391e6ef057b6265f
SHA512 461d51f6c53a6b40e3deb186b60d42cadeae3117ef9bcd809b84724c3a53bb01ed456e55252ff637e700ce68aa1ab10ed3a40d5eb6ea2757c4533b639669cc6a
SSDEEP 6291456:8MfJxR4lnrYYUU7I0O74ZOlHBkWPXFklp7aVk0YKqRz38OtsbjNJ:82JYrbUUEq0h/PXFnKhNMOtsb3
TLSH
T136F8339876D03D7FF4F92BA5DF38D7BA40CF66E263B4139041AAE4EE5091084F19A847
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Path of Exile Custom.7z
- Size 319.4MB
- SHA256 5a360ec46517577996f180604165b49b851587641c9ff30506e67deb25cfa955
- MD5 a2c15dd93ce2e59a95c7f59d13dbb5a4
- SHA1 a309677803d6367833005f8c391e6ef057b6265f
- SHA512 461d51f6c53a6b40e3deb186b60d42cadeae3117ef9bcd809b84724c3a53bb01ed456e55252ff637e700ce68aa1ab10ed3a40d5eb6ea2757c4533b639669cc6a
- SSDEEP 6291456:8MfJxR4lnrYYUU7I0O74ZOlHBkWPXFklp7aVk0YKqRz38OtsbjNJ:82JYrbUUEq0h/PXFnKhNMOtsb3
- TLSH
  T136F8339876D03D7FF4F92BA5DF38D7BA40CF66E263B4139041AAE4EE5091084F19A847
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AutoHotkey_1.1.37.02_setup.exe
- Size 3.3MB
- SHA256 49a48e879f7480238d2fe17520ac19afe83685aac0b886719f9e1eac818b75cc
- MD5 c2e8062052bb2b25d4951b78ba9a5e73
- SHA1 947dbf6343d632fc622cc2920d0ad303c32fcc80
- SHA512 c9a5ea57842f69223bd32a9b9e4aaad44d422f56e362469299f56d8b34b5e8bbf2b51d4e64d2bebe6c95d6d8545a8a88e6107b9b0a813e469f613e1353aad7a4
- SSDEEP 98304:m7EROaI2yEbVidvdahm6QAxuE4iLqmzLdtte96g:m4FyMVq4og4iLqmNqMg
- TLSH
  T13EF53304E106A5D2F5F072305DA1A7D08C2ED6A26ED26D772F6FD8AAF53F0213D52788
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral3 behavioral4
- Target
  Exile-UI/Exile UI.ahk
- Size 59KB
- SHA256 0597329c1fc6af054628773704d19909b3e49557b942a8e872f6d7685efce3f8
- MD5 097c37ed72431ccdfcba92c5e1dad359
- SHA1 6301fdd841ac74d9bc82e3540dfb740545214317
- SHA512 f1e20ae5bd0437b747c3faa29c92c25d2d267f5134dfd0e44ef4b3f3c30ee3bbefcda4f5bea7bf11e22cb2a1cdcbe2c5f011c861a0440517d9ee0384a5e6632c
- SSDEEP 768:R03lFH5wlNrwKwPi9UmvRDLs6vWnmf1lF3TKrRCWd0/zRoqSA4aFMSwSknm040hq:RSlxGNrvTvlLs6v9f1zTXWqRvku6q
- TLSH
  T1E043A61FE92F047F0C9115ADFC1C46C56B78D8B05610A1BE29ACB1EDA44A1EF13BBB94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Exile-UI/build-detector-preview.txt
- Size 3KB
- SHA256 ccda3d1b966744ba1d929d857995de45bb234b0c52b569e5cb394af3cc268ae4
- MD5 ea3c4ce26f9d3a6de9f94c95ae6e18db
- SHA1 6caf8e3bb9c1903d9d5f5e94c6182b31b7d86444
- SHA512 271dbd273f25381c3a69a5c68a7c680ec8dab07f6988b2b0b15e192a4beb72d492af19104534ee9c2e4f9594e331e20934a27174c1df23cda3de3d44238ab34e
- TLSH
  T1C77195AD3F01107368B988EF3141361672B69584E1AB07F1BCCE409C73402A7E1E99FD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[01] a.png
- Size 11KB
- SHA256 83002fedc709dcce71534d67bff053583ac56ad9bd48326384a51414a56cf380
- MD5 d5a8efda9a5f2f5ed73363e74b8fad09
- SHA1 945f72f634cc5c079eb07e3197afa77a065ac0ea
- SHA512 b09338946aa3fb2c08c9638030f577b9808a108c0373bd5e144643292acb6697dc13022fe510db97c3b950f7c12fb781e8c86a73bc616280e7a9ef64f2849e0b
- SSDEEP 192:BgmEshh/B+hJLQFU9Nt8LQZlA5a7cDsaqCCp1jEXLPV9ljIJwl50BnFdpLkgXx:6Kb/BsJsmHflCXzV92wlknFXYgXx
- TLSH
  T1B842CFB2584FD7F9DB681AA144C7911F25B896805EB1254DBF3CBEC73A410D2BD7C022
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[03] c.png
- Size 5KB
- SHA256 ab69aa708319b18e18be489f0b2cdac0564718a211ea9e92a96ae28dc0935874
- MD5 0cd3eb51a268409ddac0cff2d22d3ae3
- SHA1 1898a5cc15e3bc0c4a60046419cbeaa47c08e872
- SHA512 710e79000c415c6a43ff78b9bac0580b7cbe27642c8d9460788a1f7d7066b060e8b51745d36cb28e83dd86fbf9f088ecab85e42646492fec2bb2d8e9b9454d3b
- SSDEEP 96:QZhS+ZBZfmbGxXWZWy+ObLFVCKE3im6lHHrA2aMyRKr5kExoDC1:wS+1fOGd0WvCLFEKEymsr1MKlJiDW
- TLSH
  T168B16DBA83561F46DA3784F0F265CC54FF627AE66E460A9CE21C79E70922B174C870D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[06] f.png
- Size 5KB
- SHA256 44f890dbb9b5cd6d68098bc9b50f9eb9e84e7e368c112e2ef4fed5507e8ea88b
- MD5 4866699cd680eebf5dbec186891afa92
- SHA1 26bfeb897226d6a2189f609c634b5e5324deba02
- SHA512 3c09bac03539f39e3b1848297e7274b05a1eef520842505e6d8e8d37894c343dae81a94331e7972961c39ecb26490ee9257de217d75bab19e5e222af5ab14dae
- SSDEEP 96:1Wd2omyHzb6EjNBnQTUlNfEbA0sH3JrHUxnMBAm6iXEG:1W4omezuwBkJAxHZrHUBMBd6iXEG
- TLSH
  T1DEB18DB49FD3BB89D5D112353B63DAB0FEE0D40B112140C922443A2F37E90466E6EA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[14] n.png
- Size 3KB
- SHA256 170efc1d6dd04258f3a7884cf232eef62d29a01b78065ddd05500b3a7cc98292
- MD5 8a5e768404e5ada1692cc795df75bed1
- SHA1 1d5ab2001ad823aad9cac95530cb4e4e7aa038e6
- SHA512 77118c24fffa80ae32ec6430eb8a36c3c25599aea771877c3f43005fbdc0aed445f0ef53669ab16e2643657ef771554806cfba6a6105fc22aa4d4ae59da844f1
- TLSH
  T186614CCA07D76ADCD26A916EF1674231EC7075597B1B86518059247208086F48FB9385
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[18] r.png
- Size 3KB
- SHA256 94d26f5e0b42279c19e8bfe1f256e60ccb6735f29f0d1e14da8dfc22d8795297
- MD5 d7a405021fc67cf984cecc971c5909d5
- SHA1 008e7ffcd8256dc8c28d4854cb24bafcb44e3c09
- SHA512 3327b14c28e05ba082691dc704b259c188af3f2d286e8725454ffca30cdfa5824b68730c2b49437faf7fdd1a4eda8120e2115bc0bc04d9953fe05edc5706bb42
- TLSH
  T15C815DA34CE98E46CA86817791F8F55150E321203F8DC1BF2BAED35776B09651ECE249
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[20] t.png
- Size 4KB
- SHA256 d84b31e45cfc1fe46d9c894ac7c3d21cd9b3e0eb65164ad5fa2d6f91cda3228f
- MD5 24d5a7dd6e08705c1f82d480acd00fe0
- SHA1 c5bbb7dffbf5a28a4fb0e38ec9867a41768a0dc4
- SHA512 b3d16e47414344fe1808725d1e4de7c8a389b59b473c5f7962de30c8c95ef95dd5fbca6cc9cdb6dd100c18019892f5741dc9197de56f3dbca68e4874a5001628
- SSDEEP 96:nlsvcgOdePTZGxgct2Hf2XgxosAvgquPplUPg2CwHV:lH7uZo3tYuXkmvpuP7UlCEV
- TLSH
  T19C917E7291A98FF1D9D0A8BA5DC38E814D3242126890E78A52ACDE4EA4527F1F945720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/[23] w.png
- Size 6KB
- SHA256 dece25aba68dd4688de96d19764c3015dc400db9e1e197883ff6b8742a0e87ca
- MD5 5d0578827c73c437da90dd6e45e10e38
- SHA1 1a01c33ecdc31acb40fbfcd0e6b32752fc03cbc7
- SHA512 a2e1b5eaf3377c7315ddb2d510e3cde176146fb6f3e98ba4272a267d0f7bec6c97a9fc0b475a202062c8e34ca6a67a1f2bfaac17e1d8dfbf03a84b2f309fb8d6
- SSDEEP 96:z7JK4WsrERqdC8XDB2jZOOr5UzdZLSDWweUpSYesOFzX9yt0vvOtVKlws2:ztK4WlRYXDww7zLSDWwPpHNOdi22
- TLSH
  T11BE18E2604CB78ECE1143676DC958DA171CA229A89CBC6357616BE7F6AF1A316C04A70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Exile-UI/cheat-sheets 2/[sample] expedition rumors/info.ini
- Size 538B
- SHA256 9a7c859fbfc0ef941f73f594bd8da453d6912eee29f20f025798277ddc920292
- MD5 05ab617a66901d23087d8805d24573f9
- SHA1 04b7aa687e39442f0cceec2d552609a3f911d45a
- SHA512 730c8839eac9500dffe9d5cafe0bf0cc667e542ebda7672e51fe07163111dea516ee1fe81b43eb4dd40847ac5f7d4cde0cc4d4468e70f942b706d25b4fbbb471
- TLSH
  T143F07F4613EC9169F2F37E48A9B919301E267C9D9C3CC66C2685084D45F1D90ECF2BA7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Exile-UI/data/External Functions.ahk
- Size 416KB
- SHA256 3e16f4e2db7772a0a04d030aa4938462993415023943a00beed61eb6903682b5
- MD5 89495054493c0c72e8a714e504235e31
- SHA1 c534db751ab0f4418efd3a7f719d90db8b780789
- SHA512 0deeff9030bb7dc7fee528b10524dfaeedafcb6116a539873d947f879a5b2288abadf4ed8c167cea75b3761efa618d9ffe4bf1664cc5e5ab81b5349f7cfad011
- SSDEEP 6144:5oxALtVk4is47kqovUOkQIZBP7ITeKpbFP0I47UOoQb7ddLMpzeXYh1bw6K6oRcg:Xyg0XL6oncMbjR
- TLSH
  T1A8940A112E03561287338361FF6A9809E618AC675EFB040D358C94EC0F7EB65D5BAFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Exile-UI/data/JSON.ahk
- Size 12KB
- SHA256 a4c765d6297e9374d9fdb1edba1e6d2349073cfc0c350023e47a022d9bf636f8
- MD5 d4453615826fe8b251f4907dfb4348db
- SHA1 0480133fde08ae9adb4b7c98dfc2f048a6251f9a
- SHA512 f4e82a98c27778b5f5b72d9112de4416837bced9ebc823ea5755e631c6024ae8a3db8ca136c145fc1a42a4f49983759bfee668d475835d7a025b09b8c0992d34
- SSDEEP 192:zbRf7ieJZsHu5LbP/3HnnH3KAbGnFFzL5xZSxRAcxFyhDf1dTu9vDsTZCyYMdJ4D:5zibqvKb0xoNf1ZZCyYMliax55CIJU
- TLSH
  T175427081FF4D9B1E4605A1ACA8A454D8CEBC4578812052EEF8BC89E93719C3B077DD79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Exile-UI/data/announcements.json
- Size 728B
- SHA256 ef779bafb063fcfca1d92e40ba4939676e94fbae98efe34bcb749f8059f9639e
- MD5 e04fa4fc0f52805f21b94a01ea2fec53
- SHA1 7ea2520b55e933c19cde460a8330efb3b8f047cd
- SHA512 9cd9f98e3a11666fb89e602ba3f27da4414e67b9dd2908a3a749945033a9d9a785e9ed06dc799cc8cd57199b2d7a6f903a3d976223795b59543b2798019d486f
- TLSH
  T1D201C006C2354923665320B0A409D792CB9DF0CB1E933501BB8CA64A3F2D05F087F78D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Exile-UI/data/english/Betrayal.json
- Size 7KB
- SHA256 93e6158ac1804d4051f324db15b74ad2f26f58bd2b9d5ebca395d5e4425dad72
- MD5 ffe560678db3f8bec5482dddee8c6a54
- SHA1 7982bec515cfae21c77fbbc540fc86905234f009
- SHA512 dd369bed30b452a8a12bee0b5dc57b32a3146eb9ac40b53dad34783a168d00edcdfcd97a2fcb064955423338fb4cb969b0dff48aa9f8f6f6fc604491f36df98f
- SSDEEP 96:ESgwl6uQtJlMZ+l07rVqItlK8lluqGleanlqTFbl0OWl8G5lZ3lPoJvClrU/lFzk:EUgVDTeKoKe2wz6823QJArUNPDoZWQGK
- TLSH
  T1B8F1E977FA5E1D5A02B2A33EEAA54521F169426723828C173DBC811C1F3E9379787B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32