382f01f2c340e782d912f8c3a16fdd0f7242316bc7f72fd186181127908c3184

Sharing

Copy URL Twitter E-mail

General

Target
RJ01102951.zip
Size 711.8MB
Sample261027-ephmesx19m
SHA256 382f01f2c340e782d912f8c3a16fdd0f7242316bc7f72fd186181127908c3184
MD5 34d6a9fddf2eacbaf879d8d4b62a2134
SHA1 6e8f93343079b23352750547152a3fb0af7c4cf9
SHA512 b0b51515f442c9840214a6dd28f13abe1cd8b826b0a603487969bdca61bd94e0ed110db365ecac517c83692fb1a840c2a07661ec7121540f874d7beaf1854cd0
SSDEEP 12582912:5Rc6NngV1WoIjGeVG1BYQ1uf754gga94fwL2/ydfMC0K5:Y6NwooI9VcBYEufygxcw66dfMzK5
TLSH
T1EE7933D3250C6AA3F91FE23728B54A78E1C19197235EB47C2396E7E00A5F6F2D5A13C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  HH QUEST `҂Ɛ̑`ver1.10/Game.exe
- Size 1.5MB
- SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
- MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
- SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
- SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
- SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
- TLSH
  T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/index.html
- Size 1KB
- SHA256 e8e51ad03de1c3dd09202af964af2a2f8fd7770fac888f2f4389ca84632fa25d
- MD5 8a5bbf1beab0f71c8ac05385749b03ed
- SHA1 819f80e0a4f7298a5c0ed096ebc13fb74989849e
- SHA512 e3c5f0162fdef6501f6a9acb6c547555b484801430c64bd11e5d4f642f6a9fff00aa3127ada15892796bd526d47bb5923747f9d96fff3b028ee6f9c40af2c786
- TLSH
  T12D31660E6C86CC54A0344AD6C8B1E859DC48A366D750CDDD72EC55BB6F74BDC0C17AD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/fpsmeter.js
- Size 7KB
- SHA256 fec43a13a522dafe9c28c3d30635a275af350edf3423de0349fb6fb9c01e9450
- MD5 dbc74c0c151150763617ef4f13be90fe
- SHA1 cb47a241412f6e7cd0d16abf997e2775eabea90a
- SHA512 eb4b0e16ea251ca8ca5a6e08725b45ae722fab6b2529d3e3cf58bd5b364cccb0da61252ec21bf18382aefde06715e8d8241b8771ef614af72780148af69115d6
- SSDEEP 192:YBCYwhCev5Ynta17+4G4QyDk0rIPdCMO+OPjr9h:Wpw3vqta17+4GLyD3rMG
- TLSH
  T1EAF1E87DAF617455E713063FA02B0904A73D992ABC832DD8F0B8D4507DA1D9DC7ABE28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/iphone-inline-video.browser.js
- Size 3KB
- SHA256 68d7edfc56c4fc6a21de7d55107fd6a334e1a3ff72eb21c14a2553ab9c92eeba
- MD5 c299ee4e6832d74841cdd6c0f209372f
- SHA1 f99e50a6f24647fb85b123e8c6d247a75ab690de
- SHA512 3028282a03d88102b6d28017a82c0e2aed2e8ab97aa41892c80688d4ceb00b6a433469be610e33acc81303b18ebae6d7e371c576d6cf453142b795d3871e4ff7
- TLSH
  T1EB7166997285FC70D2A6597643DF600A33365FD35CEF96000476E3529D24C2C4699DB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/lz-string.js
- Size 6KB
- SHA256 7acc5ae524455fb67dee09375b4246386241f7dc4708dcdf8af0e78ca8267de7
- MD5 27514c43b1d1828580914df56b3367b3
- SHA1 8c35c2808fdf322bdf055d83b0e65f11ef5d2e28
- SHA512 b11ab95ca5a2b5ded2b00bc18af698166a6c3a18c764b44ed35d6d5437fb5b2bb04c77c5e15665ffeb06e3e4871fac0e65e8d4c64659b2896cbbcd4b3e7a7ebb
- SSDEEP 96:cxaMblF2dwMAc4gmwUH47pfmbMGhAJ3BxyW7shChKN5hChKN4/8ybiJ:c/lF2dJ94RwnOQG6pnynHghbiJ
- TLSH
  T16BD15550A2DA1207C6FAFBE1344B61938EB4AA215E0C4FA7E681D214C75DAC3845FFE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/pixi-picture.js
- Size 22KB
- SHA256 93fd8355e6847e791f363718c400aa7087c153123cea4b3186f325e2b1976075
- MD5 8e332cc3ca42a4e04b539efc010878e1
- SHA1 43c69e3971bc6e338b716f5a16c27c9995499e53
- SHA512 d479e222fac09991502ba66765c94e09e764dac576625d64c29ab0dcf699dcf6f9a9e8e588053b78f62cb3a3cbba80633f597878c86478ddae361dbe3dbd9e95
- SSDEEP 384:Dqby0RdEiP/Pyp37058mqfJUE5zq3sss9RY0I550hKVLM7Sny:DigrIR5M7Sny
- TLSH
  T133A2974ED952A168AC33A32AC79A0901F5B69513C946C10ABF0CE0E91FF546DDB6CFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/pixi-tilemap.js
- Size 42KB
- SHA256 18e1f1d138643392733998fb428d1134eb35a645db57d336baa7fe5e5b996405
- MD5 297a120061d6fb1f65e3ed20b570f043
- SHA1 611fd130142b71087b1df6c694f9c171a0c53d19
- SHA512 58b9090bff925a070290c74a6434494197358e1e65ec0dae1ead8a83e2c1650374a6711ad0b2604020d7ff5e88b0ffbf7b13d1c9e265e46c23c811d427f5e1f2
- SSDEEP 768:p1RK4wmc+SGnnWX7G7PSAa66FEZuvwoSyjNl5/HAi1SO:3dwmdn+QDyEZcwoSyjNl5/Hh
- TLSH
  T12E131E4E9DA86428FD377379DBA94909E56B441F9046C1447E8CB0AA0FF942887ECFF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/libs/pixi.js
- Size 1.3MB
- SHA256 e8c3aba19cbdb6bfdfe7e9e06753329171731d1a05d5c49b750cc6656a31444a
- MD5 78b95aa2bd1dd0fb9795c36e18cf9cdf
- SHA1 79f5cd1999a08399b6b56d14949120fb2d5bb73f
- SHA512 28da7608c90b30150497f3499a8025d966c7f4e0f65d9d1a2f44ee1d82468e645a52ed78cf5c5dda7e17c05009f7ac1077c8d4d237d8c5722d88ab7438c4ead9
- SSDEEP 24576:4/LgmQD9W+WHejWvTkMYhsjc1ceu7G98awBbFgFU0MEpEbagwLWV20M2FF2aW/Dr:4/Ldu9TWHejWvT7Yh91kEpEbagwLWV2j
- TLSH
  T1FF55E88A6ADB71668D333330CF5A5509E736852F8206E1887C9C95B42FF566042BDFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/main.js
- Size 270B
- SHA256 dcab1427f95c4bcedf1ed595b828d0c423d4c8d1767452c9a4e651a9c07a3ab9
- MD5 5c31090a313157499d5a0aa767f364bd
- SHA1 faa53850bdfeb93dbf1fc4c13e20407b11a89d2f
- SHA512 555898d4d32284847af756e248929dd80e2cf5caf4f91cec6b4ee1e00e2fd55d7c163102db3b6538708c74ad25055bc0fd60f3c7d5b72067c509228d88e4336b
- TLSH
  T1BFD09B095EFD3412403D3457BD1B55D5159C411790C189D4401BC12A7E5771BCB4359A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins.js
- Size 96KB
- SHA256 06813e7c2272f1e5a1535806e884b95b5d81a9e108c45f4cd2c298ae07be7dbc
- MD5 5c8cdc1896eaa2d0327bcea700aee0c4
- SHA1 bd02aabaf5ef27826335298b752d22ab10db664d
- SHA512 ecc31f2813bae051c1b0e4e87576ea847e501e566cc90cf25344f568e6cc23f56d7c5b7987cf6077040245a890323b392c20fdadcfb4469c8ce4dbdc2eb6a871
- SSDEEP 384:O1tEMh3eQCiP1QLwyQcIOL7hJnEdYldCgv:6t3R8lJnawCgv
- TLSH
  T1B5A3F4CB4A46ADD5C2D70E5813EB0E3F20F86AE66497147DF3A6FDD40D2FB4A421052A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/AltMenuScreen.js
- Size 3KB
- SHA256 6e103b929c3df10350166db451d650c75f314620b384a0f7564c044cc9540027
- MD5 1975ee0198bb7e87f51651bc4d649b86
- SHA1 568a7f83b06add1b829ed64fb599d9b747908cd8
- SHA512 7636d386d92dc66984e11d0c522fc409c78623d9d2a3b342f9cd4274b9a40f6177bb340da77be9bfa8d5f2813ae265ded850592e1724ffb54ab75909a9dc13d4
- TLSH
  T13E51A988AF79A011D830B1260F2F870CE2F6097F9447918A796C91D89FF178166C8FE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/AltSaveScreen.js
- Size 4KB
- SHA256 5ad4a92a83f288d0215fea645a600d32194da34085c61d4154168449689ca9bd
- MD5 7b88d1754130a26f37a7de3f996415bb
- SHA1 83d1f4e6dde9fd00dab7d0cf30652c1bebb1198f
- SHA512 3a23d647b2027dca085b52b68b625d7da5096e448357ecda954dee72ef39d558e5057d0ef996276c233acb76772d51f9e002643b66476d801f0de3377627f74c
- SSDEEP 96:cjlaIlZ8aBjYGRkZKYAqDEtQCgcoIKSFQY7iBw6pqn0R8UgwC:BIPvtuiRq1S13
- TLSH
  T16B91AA899BB52021C83173A54E5B8B09E762853F990382483F5CE1D4AFF538649D8FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/ApngPicture.js
- Size 37KB
- SHA256 b36de984ca961bd9a32807feb046e0c7d6eb92ecf831dff49f67565f000f888d
- MD5 1ce0ad9508bf6ef3ae0946f60a06421f
- SHA1 e07efbc03164c8fda8370fefaca41cff3e71e0c3
- SHA512 e911c22b66c5883f9a612cee34501c1a27f8ba9c5c8e55cb221b7b8439b257e9b6eadd318f62b4b536ddbdd85821c2cf6fd87ddcd9b48710c1c1c69ced6dc371
- SSDEEP 384:+pk0sgW4mtzo9bIRuMEqKooam0ZJ2H10LqqKXk3uSSE9dMVh+uuBWxvYklBHmfVm:S046ybIwTB10LqqKgBhucHyBHmfVJ6ea
- TLSH
  T1A003546C7FAEA044406271B85EDF6A85F630891FF807A54838DDE2F49F542ACC52AF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/CBR_eroStatus_1.js
- Size 133KB
- SHA256 73a65fc93313671e472fe3e723e216e36ddbf06a4cbe26831bdc41c045b85225
- MD5 0679d5cafb5735bf4c7b0d80e0742544
- SHA1 236240e0b832c84c239c14511f6cd8331cd1670b
- SHA512 d331bbfb89d9be162d3d4f9fed58cdbfacb5285eabf2c04e1c48a38cc3e62f8ba22e17c93ecada93d81dbd921c49c35df1b67a4b612007ae3bcf1ec4186eb27c
- SSDEEP 384:NEURHJ1lpHRDJX9QsNzpX3NTdFYlHtz941jDNj9/dTtndlXN7l/VLt3nVv0g9eOH:NEqKiAM33UbuKQ7
- TLSH
  T1DBD3C23A3F9EF3110379A1B13381AC9176415F29FE0B78B458A87D8B29591E9AF10339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/CBR_eroStatus_3.js
- Size 133KB
- SHA256 73a65fc93313671e472fe3e723e216e36ddbf06a4cbe26831bdc41c045b85225
- MD5 0679d5cafb5735bf4c7b0d80e0742544
- SHA1 236240e0b832c84c239c14511f6cd8331cd1670b
- SHA512 d331bbfb89d9be162d3d4f9fed58cdbfacb5285eabf2c04e1c48a38cc3e62f8ba22e17c93ecada93d81dbd921c49c35df1b67a4b612007ae3bcf1ec4186eb27c
- SSDEEP 384:NEURHJ1lpHRDJX9QsNzpX3NTdFYlHtz941jDNj9/dTtndlXN7l/VLt3nVv0g9eOH:NEqKiAM33UbuKQ7
- TLSH
  T1DBD3C23A3F9EF3110379A1B13381AC9176415F29FE0B78B458A87D8B29591E9AF10339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  HH QUEST `҂Ɛ̑`ver1.10/www/js/plugins/CBR_eroStatus_main.js
- Size 20KB
- SHA256 b153d421af1827a80692c383d293863ba83a4a12bbae3e4ea72710cc0a0f8826
- MD5 dfbcf9f8f060caf68af9f36dd9e38d48
- SHA1 e4cf27e20a799262d93fbab102daaf30feeb2c58
- SHA512 c0a1a4edc06db37eb41e3bae1ce55da874cc4654c41aafff9b2f8d58857e73d608a6edcdf753fa2f4c1723e37d8e7f9643afa9f57fe16f081b861f07f41a9353
- SSDEEP 384:N54Qo6bnNvAM2eADAgLIClHWTbA8zP3uYPnUyJAZW6xnEj5mo0qRfta:N5bbnqM2eZClS0s39xSnomoJRM
- TLSH
  T17492749C775FA059CBD010A1083D9E80DD7DDC7EEC4396A1B02DE098B4F1596CBB9AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32