9f9a5e56ec6916835f16fcc51cb0e43ba2dafcf63e483710e27084059cd9a473

Sharing

Copy URL Twitter E-mail

General

Target
SteamActivationTool.zip
Size 1.5MB
Sample260922-kw9blssemb
SHA256 9f9a5e56ec6916835f16fcc51cb0e43ba2dafcf63e483710e27084059cd9a473
MD5 d04e1edc42c32d13ad2231a14494d533
SHA1 76c0e6e3d1e3c7252843382b7eb9dd018136b6b7
SHA512 ee74ede27fee37ade6257aa7fdaed3ea649391110816c85a0b88f40418eb29610cb769a085baa0d505b085b2975e3635ae4208562cbae178ec80de4e7c2c67f3
SSDEEP 24576:qQ3nbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5sgJwR3J:q4nhWtpgM/VDSBYRBkfUKksTb
TLSH
T1F965335D3B110C8EC5A1CEB422D2286FCF7F6C71B166471367807F99A514A92FA8C1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  SteamActivationTool.zip
- Size 1.5MB
- SHA256 9f9a5e56ec6916835f16fcc51cb0e43ba2dafcf63e483710e27084059cd9a473
- MD5 d04e1edc42c32d13ad2231a14494d533
- SHA1 76c0e6e3d1e3c7252843382b7eb9dd018136b6b7
- SHA512 ee74ede27fee37ade6257aa7fdaed3ea649391110816c85a0b88f40418eb29610cb769a085baa0d505b085b2975e3635ae4208562cbae178ec80de4e7c2c67f3
- SSDEEP 24576:qQ3nbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5sgJwR3J:q4nhWtpgM/VDSBYRBkfUKksTb
- TLSH
  T1F965335D3B110C8EC5A1CEB422D2286FCF7F6C71B166471367807F99A514A92FA8C1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SteamActivationTool.exe
- Size 1.5MB
- SHA256 02d8fcb60e9fdf840ebbb723e91e93bd4af7955146ab115f13888ec3e75ef873
- MD5 e2504c283f08297657bccda9b22468f4
- SHA1 c8659feb5972e1aa41855e116937e4732ff6312c
- SHA512 665443461149a9f324a23919347b134efd3dd9d4eea6c342f34bca1d946d098f319417d5884426f3240cd2e8cacd86bed897525bc8d48112c0f5b76ef70ac9fe
- SSDEEP 24576:0Q3nbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5sgJwR3w:04nhWtpgM/VDSBYRBkfUKksTG
- TLSH
  T17C65335D3B110C8EC5A1CEB422D2286FCF7F6C71B166471367807F99A514A92FA8C1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH
  T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 8ddea157da0135a978a475b844f31140e80a7914d3bcaf17dd6f4346e640f7fe
- MD5 f1928d020ebd3bf2c54fb46b3253f2a9
- SHA1 420e69ca73d27306dde5fb79c3421b19bf089f1d
- SHA512 9930cf22d313475a01ec6c9d5c916c1326699e7dd94c55791702b432948aed54dc4100d8e86aaa89549166a6616a49aa47fbba5a646f22f33b08b92ca474c813
- SSDEEP 96:9uEW+fNQVVenO/7oTieu8RGGPv/DFYsP:NZlaVB/7eieu8RGGLd
- TLSH
  T140C2E9AEB933693ECD9911B41164A7FD8B302C5C7A40666E411FF8DD0FF31CA3569852
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
- MD5 3614a4be6b610f1daf6c801574f161fe
- SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
- SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
- SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
- TLSH
  T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- TLSH
  T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
- MD5 f27689c513e7d12c7c974d5f8ef710d6
- SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
- SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
- SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
- TLSH
  T1B1E11A7675C03DF7D08988706C1D3A1B93F4D5312BBA01B08EAB29E675E1AE7E538742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis7zU.dll
- Size 313KB
- SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
- MD5 06a47571ac922f82c098622b2f5f6f63
- SHA1 8a581c33b7f2029c41edaad55d024fc0d2d7c427
- SHA512 04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83
- SSDEEP 6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0
- TLSH
  T196649D22B690C07AC5AF03316D18B7A491FEB6718A34C70BF7D84B5E2E771C29A14B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  app.7z
- Size 1.2MB
- SHA256 0e7293931fa68a052d795015bf7974db31abda38442baf211ec53df94b2974c9
- MD5 cfc881786bfb0b583fce5a1f967906ec
- SHA1 5d624f4249f139154a95fdec1cb4e244a9847237
- SHA512 3e0985f4b0afbb78e9fed783d41ee441e4544fb15a992b6fbb1bb8f5a4098d02cd7fe0e4c1cf8884c1e1f746d4ce1e58a1e06d0a31c43648b60930cbd9f90cb5
- SSDEEP 24576:SnbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5su:SnhWtpgM/VDSBYRBkfUKksu
- TLSH
  T17945338E3F621D8C8625EAE532C2244BCD7B30B3E55A4325BBC5BD6552046A6B7CC0F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/nod64.dll
- Size 48B
- SHA256 39d3bab12c1ce54dbd5e870386978517ca52c97e5727ff30e3d8dba706d4bea6
- MD5 fc86ef1e123742d24d74b0cb7b924a7f
- SHA1 5e8d2aa134bc5f4776a96a11f2bef54cad44a3a2
- SHA512 d6ac18616e3381b4343f7721161c371fe58ff9688567a0c4c6e0e8995200d855aba784876f167bb7229fcf6bbfb1c181538ec053cb7c6cf98e1251ed560172b5
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  consCn
- Size 128B
- SHA256 96737e13f3826cfb834940e9a3c73151e48174bd97daf8f5209b904dafdd17f7
- MD5 691f52e60bae6e165bbdec1986498cdf
- SHA1 eb5d11002b6ec238b7ef2a7fd6b476cb5d8c386a
- SHA512 c64239297c48f0881114b04adb95d66f26492da84d774e8679dfbf5ce1d6c2db3b382c921f930b4041c2295c7509e71a55f404bb33a6e07198be8fa7f4ab2fd7
- TLSH
  T179B02B1840C873C0A016052CC163D80C000D088F504C46B6104CFD450174850074C0D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  consEn
- Size 128B
- SHA256 96737e13f3826cfb834940e9a3c73151e48174bd97daf8f5209b904dafdd17f7
- MD5 691f52e60bae6e165bbdec1986498cdf
- SHA1 eb5d11002b6ec238b7ef2a7fd6b476cb5d8c386a
- SHA512 c64239297c48f0881114b04adb95d66f26492da84d774e8679dfbf5ce1d6c2db3b382c921f930b4041c2295c7509e71a55f404bb33a6e07198be8fa7f4ab2fd7
- TLSH
  T179B02B1840C873C0A016052CC163D80C000D088F504C46B6104CFD450174850074C0D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  core.dll
- Size 2.8MB
- SHA256 c8cde71450b6f21651489c11d7cddaf5a076aa2b5c93f0770df0bf86bfe3030a
- MD5 1b51dbba622efa07e9e9eadd6f26f23b
- SHA1 97aa109c6d27399cbf3bc5dd8a433bc9f7688a84
- SHA512 b2a4da682e59e141432177ccd62a15bb18dfc83f7a6092d8721e40070cae770792a7710ccfb6fc7bfb276d4c11dff48428d0c32a941dcafa6ae2224727a84dee
- SSDEEP 49152:snaEC6Ybl7rbJfdJ3CFL819dXlqiKYgczm0BLEaLk0OB5fy:sYZre8G/czxM
- TLSH
  T19AD59E16A26840ACD87BC1BCCE575607EBB27C0507609BDF17A0A76A2F73BE5163E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  dwmapi.dll
- Size 104KB
- SHA256 874ea6c0b448ccd86de9046fbce4239a03cea599ba5795790608e05fd8d7d9f9
- MD5 bde1bebbe4c514cd7d4e0d943e01db90
- SHA1 304676191ec3f07806aaeae2deac99eb4033a7eb
- SHA512 c9c78f2d5b1821d0935355c0d82ca3de1e9b86279f3722b1163db2dfe29aa23c40f219f635610901d05f93c220839140009d432a9b16919152de12fb0fc6c7e6
- SSDEEP 1536:Z4rCGnpYpx/hfYv1uEdETHbSMGnb8uLop94Nr9EYsW9ydZ9dl6ayq1t:ZQSbAfdY7ne8uL1Nr9vYRcqf
- TLSH
  T134A34A5777E500BBE1778A78C8A31E059772F8160B509BEF43A0465E2F633E14E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  hid.dll
- Size 156KB
- SHA256 335799bac6fa8fdc391da594444a50e4dbf5494f79e51b038011d9af64a9ef76
- MD5 d0279d81b9f8428f710b2d0e3c3c684e
- SHA1 e5059aef07e96a3975eccd74ce41cc8487b3f621
- SHA512 0731d38897e0ba1b359d72a52ce0eb1ef0dde4f67e32912cc2292c1a77cd304b2b03c29e9bf01603fa52f3aa7491b3d57a5bf7d19a445ccd98f407420890baac
- SSDEEP 1536:GI9dwVtYxK8J8Ujkfc4lrt2LZIidk8GVu1F8TH4SM/BC/RMgnEwUUsWzdX9dlEUY:5HwOr2lPKdkozwYrZC/RHEEXV2LdGS
- TLSH
  T116F36B07B3B544BBF1B7823489A30647E772781217609BDF03A4467A1F273E5AD3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  versions.dll
- Size 693KB
- SHA256 7ed7cc50f9f8375aa71039a89c83adc50ecaa937062696eccc41c4b645f362f3
- MD5 d0a5f3edca57cadc58f2d2a8d77ea670
- SHA1 e17e921ca519d040f69c1714aee8f4d21fb2030a
- SHA512 6c5b88d92e70ae1e39351d7798a4bf9c54b44b7ba1ec9e9f19b9356eeb97bec747a4f55b3bd781a460391387cf22b4957d2a8753ff29fc21a38ea5f87c1e9fbc
- SSDEEP 6144:913g7/uovpRH50+Ic5xCzLqwabPzuTp0gCGNOmX6epRPtUhAUEaGaZxjC8/mJc93:PL+HxT7zuh5OapRPtsA4fYZJxV/cERe
- TLSH
  T125E46D26AB9401BCE0B6C179CE578D52FB71780903B1AADF07D04AA69F277E44E3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32