02d5f38b0ec3983997a3dc8e42b3430485c05b2855da18b90239577fb19e7106

Sharing

Copy URL Twitter E-mail

General

Target
PC_PVZ-Fusion-4.0.5.zip
Size 435.4MB
Sample261023-llwhfacf23
SHA256 02d5f38b0ec3983997a3dc8e42b3430485c05b2855da18b90239577fb19e7106
MD5 fc72b3dd264ea21a99ae31bc9ab8bba5
SHA1 0333f489c96d6397868681e055389988fabcfe02
SHA512 78c7bee43e271002dbb00e6eadce8da0d1e06f3535e60c91c0a3b191c097f5373f45968a6203d34e81986846896f30c41bb8719938de481280e88d85473092f9
SSDEEP 12582912:NpWJJ5ikc74jZm/2HLhZQ4NtRNc3Y8B1L1:NprZ4VtLhZVc3dX
TLSH
T1D02933C6D31C88E3886EAC0A58A6D931B640FC15C0D661A587E67B9E117EF0F953CDF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PC_PVZ-Fusion-4.0.5.zip
- Size 435.4MB
- SHA256 02d5f38b0ec3983997a3dc8e42b3430485c05b2855da18b90239577fb19e7106
- MD5 fc72b3dd264ea21a99ae31bc9ab8bba5
- SHA1 0333f489c96d6397868681e055389988fabcfe02
- SHA512 78c7bee43e271002dbb00e6eadce8da0d1e06f3535e60c91c0a3b191c097f5373f45968a6203d34e81986846896f30c41bb8719938de481280e88d85473092f9
- SSDEEP 12582912:NpWJJ5ikc74jZm/2HLhZQ4NtRNc3Y8B1L1:NprZ4VtLhZVc3dX
- TLSH
  T1D02933C6D31C88E3886EAC0A58A6D931B640FC15C0D661A587E67B9E117EF0F953CDF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GameAssembly.dll
- Size 56.5MB
- SHA256 48096b917ee6aaf6e35c95c98e666a4399a9e0c3d5adbab727cee941eccf2d42
- MD5 2c27105ba5323b5c166c7e9fed0a104a
- SHA1 17a85a305fa8c02df8b38a4c5a45d14c65628629
- SHA512 5e2f8f3f6409e82bee017771f51aaff5a21c3830d5446a0f0cd18aeb885f528eef1c48b38de24622b4198b6269c6addae6568d28fbcb428327bf9411d08f15bb
- SSDEEP 393216:r+2qskVpolq7OG4Jl1BnjmP7T23yJ5LCLws8N99KXhx3tmLDZfYYI2k+S6ebPOyB:Tx8SsLDuPHiGxox
- TLSH
  T1FBD7284ABA755448C1AEE1789A13189FDBF138441F206BCB25904A8D1F777DCE8BBB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  PlantsVsZombiesRH.exe
- Size 651KB
- SHA256 d38afabdc98f8d910dba495fc8eb0868965aa0251a96db190ffba3773704f5b1
- MD5 be26f3109da8ae5bc29d39e7a3405c1c
- SHA1 ed7747dd1cf8d4b48af12437d857a17f2100e241
- SHA512 30b897c99e4445fdfbc3eeb248468dd0ee628ded8781ce31d37d8cf667672496cf870300468f601fdcf84ef38b2fec23ddcc84856f9b0661357413ad92bb63da
- SSDEEP 12288:ZH744aOD8n9G/BwO0HZaVw437Uf+OsYJaHK:59aOgGqHcVwF+KJ/
- TLSH
  T1BDE491D375D0F4C2DC11BD7B84E4A2EAC7369EAF9E09251B14213DA539A95380EFC839
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  PlantsVsZombiesRH_Data/Plugins/x86_64/lib_burst_generated.dll
- Size 268KB
- SHA256 8610ecb72d7485f2c10502b22a2c7178fdf40403cd9239b7ab891f428af0162a
- MD5 22cfbce04195be7589de197b3eff1875
- SHA1 3574f1a3d02452db51f7f2617bd83bfcf8882b33
- SHA512 90bbf3f2626f90b15bacf1f6915d471c6ff2957e16f4ecda1657b5732a4696019a80b6160aefe73dc304676ee09042b58095b4d56b367d169519e087c4533388
- SSDEEP 6144:l5h4WbrU+8mv8H/TOSv6LLUzvS5nfB4B2t2EOA3BW0:nJv8fTdafB4cv3BW0
- TLSH
  T166446B7C218668ADC13A8470463EAA67B1A33C0617C448F714E154BA3EF5DD7AF7C92E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  PlantsVsZombiesRH_Data/Resources/unity default resources
- Size 1.5MB
- SHA256 a11e3e24520676183b3750564b4d9f5a90e8f41fd3523cbfb0c49f3989453da2
- MD5 c9730fe286df07729a2811fbe1dfbede
- SHA1 6f5ea5605cb6771e20ab6d75e448b75307e21ec7
- SHA512 387ef73b2ad58786aac05cbf418a211664f0f0dc24aefff3af8acd83cdbbd072c7dfa6154464eb49218f7b03af62536b1a38c42e5df9f50b96d705c0e8f500bf
- SSDEEP 6144:h8g9JxVJ0aYR1CCVX8BAiZahi3YW+/OJ9WqCmKISHCkcCVw:hD8TpQahXvOjdCTBw
- TLSH
  T197755315A2A1153DEC5E053987A31E61E3BDE99C1BEB8B133B1C321CBF617488A77274
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  PlantsVsZombiesRH_Data/RuntimeInitializeOnLoads.json
- Size 2KB
- SHA256 50d15a0f8a5f9467e7187d318ed80e456e291d92eea68719b2062b603adecf92
- MD5 c0bd51cc41e13bd62fe3984b26141a1b
- SHA1 bb2be1d9b8fa15a22eb9920b2ee74f6738f5f714
- SHA512 7d60f9bcb2f1d8edbe12747e4dee5ada8e6dce50510d9a575ec2fc9a14adcff6b6baa041345d2169c19feadd1adc2562495a67f76cc7f255de53acc66b2a6a81
- TLSH
  T16A412A6C37868FBF5F8B83977A7A195C30C40A0F9ACB4D44ECB81E3FD560255594612E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  PlantsVsZombiesRH_Data/ScriptingAssemblies.json
- Size 3KB
- SHA256 7edacaaf7966172773360937faabd35ef938eeb05e514700ddbf32ea1aaad0e4
- MD5 803172fa904601ae858a65487f6c1e41
- SHA1 3794ef5240ea3444eabb3b383c5d687291cb221c
- SHA512 0cb70e5f4bf079c50651a5b6fef3c3d95bb09ec54ff6d335c8d4142320ed8829d2456840ab67c53f7f06bbd863b2a636f911eb60acc57dd6f67a40abb56203b0
- TLSH
  T1FF8113B6C48B26D72ECC5EC38C349CCC39D350A60A6594244EAEA79FA938CD27C0C6D5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  PlantsVsZombiesRH_Data/app.info
- Size 29B
- SHA256 e4b44b2423a81f00e6deac7e4d8f157dcb824a36e82082c8e31fd97f8f3e432c
- MD5 4c9e3a696cc4700e1edd9cecfac4b650
- SHA1 58b3de3b65f52d071347455aaa9814f578ce6488
- SHA512 1c18b6b2705a58180f3d7974c7515d167b40a4b00eb4296eaa71b6c898204db01730cf3eab231f4e040c4d53f03bfdce31e6d2ce7cc76d3bc9b9ee1c7108c975
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  PlantsVsZombiesRH_Data/boot.config
- Size 130B
- SHA256 d899753bdc985d5c30695d07307d78dabed9ab971364e6a93de608b8d3de0c56
- MD5 9517fdf8e19df32d0f8c977a221ca723
- SHA1 9644de90bf0a5c904dfdc1bc839a88aa2e6d3e7b
- SHA512 06a1787f33349893b9365bf3717d4003d5020ddc25f043c9470cef924a4baed7ebc35781b93cc2f59ff8b4a33144a5cdab7887df946039995a2e0287daf78b84
- TLSH
  T166C02B00E6782E4550CCC12683E05AC3E37B8241D45114F465A010D1212600F13830E3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  PlantsVsZombiesRH_Data/data.unity3d
- Size 386.3MB
- SHA256 30094749d8dfbcae49f53cba4844deb8f67ef30882953311dac27799bcb68d03
- MD5 fe90a9e4cfbe2891503e0529e0409cb7
- SHA1 69543346df110b09e3b9cc0d4be964da340187e2
- SHA512 41e1578038f1919d87237b4187f3b99d89a8ac38ab694ca1d41e8d7f249f39c7dedbfad1bffdf6cfc2ea2e0616668bf7107b910b81d81d5c22cb0757a27a20d3
- SSDEEP 6291456:FnmVED6Iqj6pdqW5HL5TwjDhzRU9ZLag/OJ3Ual2ungpqTMFTWcfC96viQft:pmV23jfqWHilq25Uannu75WcK96vh
- TLSH
  T10F192363D788E993D1A4B539C2B3572783BEDE542A335386CD427E1AB8377986723310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Metadata/global-metadata.dat
- Size 13.0MB
- SHA256 1c48fc2de9e53d4c3d00e3b3fcba0ab36f27dff9d7101d72609090d877feae00
- MD5 d8b705f8c1060cb790068f1fd567392c
- SHA1 035e30814afff5c072165960415d5b0c7b69918d
- SHA512 14d8d4efbfc8945e717938493fb64d6e80ac1177f1548830a68dd63d698c8491f0bc1ae18dc7ea9a29e498f9640cdc63b787102bf48d44582174420e540febf6
- SSDEEP 98304:3VGlRrxaMzOI6vqB4S3TtJMJbKJ03R3lZ8CN:3g9RV3ZJMJlZD
- TLSH
  T18BD6F8A37D78CA6FC53521B6898482F45B306E891E00C737BB54B7BFB8719A45E03AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Resources/0Harmony.dll-resources.dat
- Size 551B
- SHA256 c17d55aa2abf41a63668a3d212c55578c2dd6f17a2f1006f9a24251623bffc4d
- MD5 9ec46b8461233ecdaf02d909b03532bf
- SHA1 4d8bf20f27c0a60782606a8746cb9cd7dbd5de49
- SHA512 7fd1e5d5ce95dc5ab7026ea3e639526fb8b9641b8b656c089657603c94d5a6277298c85705928a44bc4b22e6c5b1ab24ea99c11c46aad06d272ac271933a26c6
- TLSH
  T110F01D706861E4694DA046641092278A32EF068D4FBCC76CB52D227FE95C84BCF160A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Resources/Newtonsoft.Json.dll-resources.dat
- Size 900B
- SHA256 531de49e73ddea25554c9f656f54da2a665946f3fec57048e0cfe3b9e49b03f8
- MD5 f1fbe4ec4c9abb5693bb0144c50d9f5e
- SHA1 34bf3f1b87e3d7c6686d2aa1a6cc006fd9c55873
- SHA512 064ed35f91e58d3dfddff3ac8995d38c5a5c379f1f46502653b218bf0c46a531cb4c49bd746d1befa8a9d75ad1097db986e8c6188a229a374a7613b0318207f9
- TLSH
  T1501176762B806FBF8F01206B1D2EB2D0B7328DB8259C36C63171203BA780B2012727E4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Resources/System.Data.dll-resources.dat
- Size 91KB
- SHA256 98a7950ec6de3242c2e190dfa630188dfa32511a125542b94baa952d1c757d49
- MD5 4860ddd4350579f8fcacb1881582335a
- SHA1 493c03e9cfef6f72a00f92023cdb88527dfdf72c
- SHA512 51421a1e79914cb6d828305103c5f7cdb020d98107586abd7e04614f65bae8004101e5567a873f52fe2daa3a7984bf4f7a4930e628cc5f86e709e3a37f812a95
- SSDEEP 1536:lgFLFsFLFac1cWcvFMF+F1cIFaFnF0FBFdFzF+FUF8FvFOFvFNciFEFvFxF5FHFj:lgFLFsFLFac1cWcvFMF+F1cIFaFnF0FI
- TLSH
  T1C693567CA75073DEDD4A3052064B2807766CC276E15A80F6BE9C4004EBBBD7626BBD6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Resources/System.Drawing.dll-resources.dat
- Size 24KB
- SHA256 7c33aa707bc3fdc83991b81a97d6fc622b140762a767300f08f616c2c0a91255
- MD5 be7be6458aead12c07a04f26e260c3d1
- SHA1 34d46d957520cb1a525ea9eab36cc40d57a3715a
- SHA512 554a6b2983fdd055bab56b7f210340521b7e7b480f38aa6368691ea9e38fbaa5eb93aab0137e6c9d7f3b58feb0780753d48eac951a83ea8db67a91df1db0ced6
- SSDEEP 384:P7zRaGwlR7QlkaaVaaazEZnbkPHLuecbAEYURxMX:DzRaGwlR74kaaVaaaYnbGsAEjSX
- TLSH
  T1A8B28345A900F0AECC590279DC6AC6FC35412ED8D591AB2B20F6FE8B7EF51920D0F667
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  PlantsVsZombiesRH_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
- Size 329KB
- SHA256 c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
- MD5 21d06dbc8af6432b2b49536ed30609af
- SHA1 11a1c0e2ab2f8c06fe4507535ed47e0dd279a60d
- SHA512 2971f54eaa14c3ce6e2352e5a1aea5b044f0894bf4eac92de8cd92515b6473b5ca56ebfcad4369a9d4935cbefea2540a83f332fd4d832c37768310e8776ceb5e
- SSDEEP 3072:c5j+evAPQ48RhHkXKSmLZsumnWpevI1kMqXkD3by+BEL:crvS8rHXSmJmnjvXkSr
- TLSH
  T1F7746CD8B5728E76FE57A9BCE85E928D43D9C1E2C182523B3D75C2E04D52386181EE3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32