e9963e994f757e80d1a1091a92bf4528fb31de3c5b4c51de109f6b9d123544c3

Sharing

Copy URL Twitter E-mail

General

Target
SprocketColdWarExpansionPack-v0.1.0.zip
Size 6.1MB
Sample261006-vc8wvaff46
SHA256 e9963e994f757e80d1a1091a92bf4528fb31de3c5b4c51de109f6b9d123544c3
MD5 f72006732786a35957b5393a7faf3278
SHA1 e0559bdc8143d7b475979c0dc70c5ec665f68ee3
SHA512 d3327c9f0b753072295a169228e1d3f077d7f4c9af6d785090f3291df33a6df70970a263ce248d57e70bb4392889000f31ee9dd8e69e9dc74b2f81292fb127b0
SSDEEP 98304:u6RV6xG8MxahvGcXHQKa5eWF+QmdtUfheMWy8xzpMW/Oy1hwzecwtuW2QqknP2Sz:9RBQ39WF4aMMWd971izel2QnuS4RAEA
TLSH
T16C5633BDED33CB62FE7308F44909BEA4F4942AB289251CAE9E352301C47F651E1516BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  Install-Pack.ps1
- Size 4KB
- SHA256 635b9d52835a551d384bb3f6a6c9fdf8b207c19a3740ac4e9ec0284e711a8b57
- MD5 b84c37d4e2f1faae5f7f7b863ed8702a
- SHA1 9851a2f57289bbfb31e0dd5968b871ba078b02fd
- SHA512 b53621f0a0f973ba0cf76d62196ae3cad3024948bd1c8b2fc6f3c7d0a2a5ce59b2141b5b1cd254f3d570d57ebde6c0f8d4e285f65ac706cae02a62a280a28411
- SSDEEP 96:t51eGph/55JTe2EEuw2pA4TGizfN3IVq9z6iCF:tre082EENw13tO
- TLSH
  T17891A629A2BC2DE612E41391585277B06E2D40DE52721310DE9CF3C6E9E3B3F0B5D2C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Merge-HeavyEra.ps1
- Size 2KB
- SHA256 8ddf0399483fffec7a3e8b6554c7c4fb5106d7536e925f0ecc67bbb95b8c4326
- MD5 b84a326b5e29dc62e9e5662528335001
- SHA1 0de3405ee0efc0c43435127c1246d84be9a9440d
- SHA512 cc7d7729dd2ab37524d1688e7bdc1de606cbecfa41e76ae1ecbe8140fb56f6d7ef558e05a1e178b04636e20c50cbfbb18775eec53597320f5460b15b1926eb8f
- TLSH
  T1EC4130A4993A25D953FD45B5902732207F1900ED53619240DBDCB2E578E3B2D07193E7
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Payload/BepInEx/plugins/SprocketCarouselAutoloader.dll
- Size 3.7MB
- SHA256 331b3e170fa26b071b5568b17d0e43cd211b6eef4d9f787c26c0aecf8571fbfd
- MD5 44f0f52caa10b61e441404ea695cc344
- SHA1 f15ff6cbd27af9a9de094726d73375fe5b31cf2a
- SHA512 b5a3f70b6765cdac1b8b3370047b29b5dadbf8f471f0a242f579e2c14ad83410397cc6acfd0e7535e138aac1300915874af4f82dea03fc4a634d206010c1bf02
- SSDEEP 98304:sXOb3ra3upEGr18Gjgqld0zBHE4YZpEdl2oLa8aSR8V:seb3r9mi18MgVN/9pak
- TLSH
  T13206D053DD538501E996AABDACB5688C1E92746DFFA6B60F30885C62C073BC067DC3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Payload/BepInEx/plugins/SprocketColdWarExpansionPack/SprocketColdWarExpansionPack.dll
- Size 13KB
- SHA256 082b1023d27e12a79686ca3bb521a48f9392e8a74a80262ae7d3420b2b16adf6
- MD5 bcb855bcdfe3d45bcf2e2d9e23a17164
- SHA1 4fedab64838eafa00d3b9fb189bbae526cef5e54
- SHA512 fd17a6f6ff85cd5a2ba64913dd4c3250c0aeb75d546ce7466a11c531cbb7ce225ff7011865fc009f28a9d74fb2ba3bee3064721491efcac2b6a21c1a6da2515c
- SSDEEP 192:0XPduLTCa+7DIe06dVCe5HNDiwhqfOL81tl3NhbwRmvikD7EgeCktorFvdI:4luLTC/h02R1xP8ZbwAvDDGyu
- TLSH
  T168529614BBF44216FAFB1FB06CB60A621A7ABE86EB31C74C4544104F5C32B45AB61B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Payload/BepInEx/plugins/SprocketHydropneumatic/SprocketHydropneumatic.dll
- Size 60KB
- SHA256 3cdd1a3bf0da03e7a0979086d87ffa0e598d79bdf2cc0a852ed44c6ceb64b3ba
- MD5 3aea76210de56e88a4930957ec65167f
- SHA1 3e296a366e20d9bd3c9d33dd4a7c4465a7ea970c
- SHA512 c7aad9f15b7e9a39fdd0b5001cdb4e629046b5889451bee304fca1614b4e18ff6c447f8e5b6171d4a8e62cc13d2c5f4579d8cf7aa28845ee763d524111a8f510
- SSDEEP 1536:TgsROxfPVBH12IN9aflN/BFMJu0q1PEY:TR8fPkIwN/B4/q1Pl
- TLSH
  T172530820B3F88726E1FF5F79B43500250A7AEA0A3972D79D8E4234DE1A737914A117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Payload/BepInEx/plugins/SprocketHydropneumatic/assets/hydropneumatic-icon.png
- Size 1.0MB
- SHA256 73a639c2ce1c1aa5d5e7fd2bdb4aea10e20dea4c69e3472d099bc64bb14b7993
- MD5 6368d58ca136dcbf83b609e6734c6fc9
- SHA1 7968dc3e7d5dd4bce7e334563da8e2ab2039ab5e
- SHA512 325ae566550fb2c641f25b3f50666f95b4c28878fe66278874b5df1e31ee5a11cd113d9cc050fe33fac67f5e9c0a1eaf6ea077eb074419aa2969fd31001878af
- SSDEEP 24576:JK/9w+hYQs96FexdGKqmU9eWpQHeLPv0Zp+Rm66TXo2965Vs8N:C9vYQs96uGLLIWpQHmv0p66TXN9aV7N
- TLSH
  T1123523C2F4C1F42CE45AE37176BE20CA27A973B471D60464B01856DCEAC2AA17ED1DED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Payload/BepInEx/plugins/SprocketKeybinds/SprocketKeybinds.dll
- Size 58KB
- SHA256 ba64393739a7b4c037216d7c792ea7be688334fdc42da3ee49f983ce808cdc52
- MD5 1d3f8cbe47856142a6218aba9ceffa72
- SHA1 b93c74794907ebc460e3109a8cabb137b8144aeb
- SHA512 47cbe5d47fbe561ac518fccccd2e3c379e0e1666e5ad980d03c89f52a3e2399c15b1570dc99e89e447e4c91a01691c231c636a524ebba1ebf1bff8ef33ad5cc3
- SSDEEP 768:Ydng0xTwaiEQZEMepQVPr27gWKJBS9F7IgsuCjCsq4H:Ym0xdiXZipQxr8ghSjIgszjCsq4H
- TLSH
  T18843492032F84B6AD3FE6FBAB864106506F2F557B221C79C6E86A0ED19337C145513B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Payload/BepInEx/plugins/SprocketMaterialSelector.dll
- Size 64KB
- SHA256 cf8a78020360c2df8eff99a6b76364bfd8dccbdbf231405ae0709eaebca1f69b
- MD5 ec9bfd7abe45e0c65773379f41e52dcc
- SHA1 5cf307368aad6455f641133ce69de7a402c1ff36
- SHA512 637c2818421475aae656eefa8b1dc4990687437cf0e2995ddb50a5fb3418ccf92b5fc02325b8f1c9b08e8da8ecb18e7a0936b1ca5876569335750b12c33f30f6
- SSDEEP 1536:oENiAJNbb4BCRcG/6sYwjigN9PCvY71cev+ePE4InUpNzdbIu:oENiAJNbb4BCRxisbjigN37Rvb84s6dP
- TLSH
  T1A553E755B3FC460AE6FF4B78A87540144ABAB95F6E31E7AD8E4220DF19737408920B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Payload/BepInEx/plugins/SprocketShellSelector.dll
- Size 632KB
- SHA256 c358ced0ef20e5aac96316db85755ddc7750c143444b7dc644da35c48ab9fa59
- MD5 1ac56eaacb6e6111afc8b90e852ae099
- SHA1 1b7768255f0a5ecfedbe34cb6804939a8ed1b779
- SHA512 97e573c3e8bb437d5668a19ddacaf65c2328093681a80aace6915deceb2fd14019eaa3d833d9c77c53ac8f30dd0c73ae5beb3112a65f9aaedb15c6de88aa245f
- SSDEEP 12288:iSnIfVL4n6XoCfHlmnnmyOaf3/9SICpXGXVT:tnUekofnmyLip2FT
- TLSH
  T1D1D4AE12F3E58611D2BF8B35DC31181046B6B90BFE66D75E6E84B4DD2EB33819610BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Payload/BepInEx/plugins/SprocketSmokeLaunchers/SprocketSmokeLaunchers.dll
- Size 37KB
- SHA256 e5867fa800cf3cbf22ec333eee501e19903c608ed8fe646d235856555052b10a
- MD5 69b62436c14dd717de75fdece761eeb9
- SHA1 9469500a55c6bc724db76726fbc0895ef6372871
- SHA512 a681b1b48d8f368e0f3922ef1ed624b042bc0c09e31e9e8a71ad9caead86fc95686d45e193ce66bf5a82d5a020285a60076beb40efdd2a4fd717e1de41205376
- SSDEEP 768:qwcXhuW39TakBmwmceNenGZgkplZNO4ZekU4ZNItMKQtONWzO:qwqUW3trZLlnGZrpJekbNSFCO
- TLSH
  T1E5033918B7F88A29F6FF2FB568B210141671FA4AA932D39D0D80B0CD5D67BC44B157A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Payload/BepInEx/plugins/SprocketTelescopicMast/SprocketTelescopicMast.dll
- Size 31KB
- SHA256 1db7454e44f1fc6f8fccba539a1b0d72cb9851ce8a10aed80db931918801efbb
- MD5 263a58691f93ac9735ad4c3b3e8e10dd
- SHA1 979cb16651c7f44baffa54f95925a9756770446e
- SHA512 e980f004c40dda098b24facef65a63bfe9d63e527b784dd48085876e0d6491a6b51f11270ca0e664f7f0dfa07a1d5c1a31999c03eb998f509d7ddc4df87ce87a
- SSDEEP 768:NIj3N8Dw9kH7JiZk5GeKhOyYl4Uqz9LiaiaSBTJ6P8Xp:qjN7peKktqz9LfI
- TLSH
  T174E2E66473F8C615E1FF5F74A9B510654A72FA1A9931EA4E1E94A0CD0C33A80AF35B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Payload/BepInEx/plugins/SprocketTelescopicMast/assets/telescope-base-icon.png
- Size 429KB
- SHA256 bc4c70464559f99009d66795903cfa2ed91b37705c7963c2ca1a4dbfa728f2df
- MD5 387aed266458d854adbcf51866341ba3
- SHA1 f847631e4e5ffeac0fc36d2f1291a6a82dc8889b
- SHA512 c1ebce973bb1d9d693245b2e8eba5547d91795d066e09f6138f8d5f03a3181ce6e4074eede13e6b70b178748cc6c077244bd18eb7208afdf6d06fe5a67cbd1db
- SSDEEP 12288:bVIbTP5JeYqCetTYQ2mxukqdgC+4as2K7c+0E2EagJNBB:+PLqCetTjTq1aHK7ZJ/B
- TLSH
  T13B9412C11FF9DBCAF99B85BD17E2094B9750F8F2C86768F476358220F95D280A50728E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Payload/BepInEx/plugins/SprocketTelescopicMast/assets/telescope-part-icon.png
- Size 488KB
- SHA256 55f10e984a9c5f84e3aea3465d6081297ab6772e96545ccc8fe1b8a1077f1f68
- MD5 3f6f4fee0a3d38412dd6a94d0fa2f90f
- SHA1 6547c068e906ab8e6a508bb6864bb80a31e8d4ec
- SHA512 efc233a333eb691d5a014d8a6f7fef2379b82931bcf7fa924016ca7462b6aae0797d7988c98c0e1f45e130296bfe84b0b614087b64cf866a12291d1536db1531
- SSDEEP 12288:qHMEgGeaPg5wxgcsCvn/oKv1QXc8zjLT5XYNtF4ppu0nTJhf4:GMDGsKgcHV16c8zjL+Spg0nT3f4
- TLSH
  T1ECB4128C9A76C591E800B1396FC24DC8DF11B7D9511C80B6B6261193EDB6FAB22B5F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Payload/BepInEx/plugins/SprocketThermalSight/SprocketThermalSight.dll
- Size 55KB
- SHA256 bb42fcf3c99f4b8581c330e3776e4630ab508cebfb153f50367e7727fbd60733
- MD5 2a8d434f36c415c26fb5cbe08291e674
- SHA1 357bf3c697c2edf6e65db54ea56f5c27481320f8
- SHA512 1ed559dc7a4711c1df79e63d9e574226767ee77677d60669339278d9364255f6f3b21ccd8991b5cbe487a8fde5312ca647b796d578bf92653ac8aacbb046d381
- SSDEEP 1536:TlWNM1KEyu0QdoN7+zO7unAamMgPtXTvU+Hc:TcAf30QdoN7+zOSnAa6tXTvUoc
- TLSH
  T13943081077FC861AF2BF5F79F87121160AB2F68A6922E64D1E8630DE1D37BC14911B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Payload/BepInEx/plugins/SprocketThermalSight/assets/thermal-sight-icon.png
- Size 1.3MB
- SHA256 bade8bb0f7615430ff8064f7656c154dab44768ac2bbefc732be5a66c6848980
- MD5 aead6abb1efee95f4b09fe3f9fa852df
- SHA1 ccefe5e2c6e1af54bedcb66c78bd832f0b411d46
- SHA512 ed7b9a686cf371a4178b3a7ac16e2d8933efd3d66d284cc6ae54e418326514b7e7218acbd9a5e3dc409add8bd55d324b8e073142bae79dee2aa11aba89d24c0f
- SSDEEP 24576:49Sg1eeks2YfeQeA7ymbMIjnZiicNHV7ru9Z0d9kANpfc33faNPy0BdWe5lQVElY:oSgQZtYpeATPnIi0V+Edl7f+sPNJ5O6Y
- TLSH
  T1A95533FDDF33E997DF7F1E3A41A9AC112D202791541105BC4238746CDAA429072EBA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Verify-Pack.ps1
- Size 1KB
- SHA256 37e01c6d49224000f7f1b3f13807e45c6daccbbecca248e9ba12117af4dc3489
- MD5 72c85cac3ccb3a5f75288c2b26e798c0
- SHA1 85e9ea40a7503b32a667d08a6d6246c7af764ead
- SHA512 02c5d0217e938e8ae24665937a38c0ba83565970b8b1a68a37c44d33a06f5b7fff5f78c527cfb7e50522e4f27e197eb4f728055a788415c3619d0a78ef9ffd83
- TLSH
  T1C9313174D970469638EC7395647092709E4750CF28F22310274CB74AE99BF662DDC6E6
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32