ea5904365c78a06003d0c428e68cbe3391c30e7cb2ccace0bc95c3c9d96b36e0

Sharing

Copy URL Twitter E-mail

General

Target
SecretTweaks.zip
Size 28.9MB
Sample261030-2tatpsff95
SHA256 ea5904365c78a06003d0c428e68cbe3391c30e7cb2ccace0bc95c3c9d96b36e0
MD5 61d5b315fb173e3f7edde81b79258c92
SHA1 9dc8f992c8c098f9e8a7f20218af31a9efdd7220
SHA512 9ab78b6eb99318d6aa231ee1e912d41a892b2282d945cc22138c79a4c380ad08342b0aa5a26451eb618144b73946fa6082b0ab88cc24e89c1388e7f05fb1c7ac
SSDEEP 786432:bsiBXaQDdJj66CahbjbLe4XIKmFASZRSwrf6y/w:HaQDZvLI/A2SQhI
TLSH
T170673360FEB35141D829387A143ECF02E35D2AE6E779D382F5960CE6F3D832B6661461
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SecretTweaks.zip
- Size 28.9MB
- SHA256 ea5904365c78a06003d0c428e68cbe3391c30e7cb2ccace0bc95c3c9d96b36e0
- MD5 61d5b315fb173e3f7edde81b79258c92
- SHA1 9dc8f992c8c098f9e8a7f20218af31a9efdd7220
- SHA512 9ab78b6eb99318d6aa231ee1e912d41a892b2282d945cc22138c79a4c380ad08342b0aa5a26451eb618144b73946fa6082b0ab88cc24e89c1388e7f05fb1c7ac
- SSDEEP 786432:bsiBXaQDdJj66CahbjbLe4XIKmFASZRSwrf6y/w:HaQDZvLI/A2SQhI
- TLSH
  T170673360FEB35141D829387A143ECF02E35D2AE6E779D382F5960CE6F3D832B6661461
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SecretTweaks/SecretTweak/BYND-TOOL.exe
- Size 5.0MB
- SHA256 91caa0adcb59c352c723efe886f0aeecf33acee45bde06c4c3e15096ebea2483
- MD5 5643b2dda8c8703e36d3bd1ffbc2bd39
- SHA1 e5c7365ccb4ae6ff478c616883bacb8bb44dd37a
- SHA512 ab5f030de316aed75d749a359c1c91f2e3cedef11c6572262e1531ba37c5356c6dc45998cf266982ff5ce7ab85336df3507f0c22dbeee306bd4271169b243a20
- SSDEEP 49152:8E/QNRt2zSGD+ghwvCQuIncR85nw+ToF/X8N6uCiKNr8H2/V7tW/ts:8iQszSZfVDAsN6uCVr22tw6
- TLSH
  T10436C042E3F8496EE167C2788C02E637D3F67C01932546EFEAC45E5B6A178D84BB9305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral3 behavioral4
- Target
  SecretTweaks/SecretTweak/Bypass.dll
- Size 305KB
- SHA256 1856fc0ec7b6ead5ce1f08e01e61ed4d8da2c99b82013b866467a4450b4ce56a
- MD5 eb73c35936638c7b901feb651da43752
- SHA1 5446295f27d53ec68a4b273a0b9b0777a8750ddf
- SHA512 598d97e74eeb4382eb31c4890da4a4ada7e4f69d9d80beff602725745d66293020510b3bae551678992e1902738d3268908bb88c057b1ddf807d3597beaffda3
- SSDEEP 6144:K2cbQJBrRNthMmruLQ/KOpF3Fimb19PB1w:Oabtqc/9F3FT
- TLSH
  T110646B1AA794107DF177813CCD934D45EBF2785607A1EADF13A046A62F23BE09A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SecretTweaks/SecretTweak/Bypass.log
- Size 315KB
- SHA256 98235b2c01b0bb586b3d8f6852848004abb5a2b6d4eb867d8afad61d253aa59b
- MD5 40eadcb818e1b91d6715309c5f380f82
- SHA1 ccd3454a3f43897e64043d2f7cfe578907c0d7ce
- SHA512 18e1a373c147e004d4394345d50cfdec7e86a270be9d8e563e85972deb9bc463279ecf7bf8f3b779da9945b9245b54e0726baf2bf9fcf7dd3c2b53312a270a56
- SSDEEP 3072:kFmCFJAIjAx6Uqq/RaGpbryRtRwL+3bNQNEhohJxvFUl23Bvvt349k4Vm0QKecKr:j
- TLSH
  T16764E0866FF7AD64607CE27ABE6509CC79D771238E41061BBAAE590AC8BFF04F710411
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
- Size 1.0MB
- SHA256 47dd88032a72ce856522713e3e0ecfe023f133fd43bb7273fdbf48533a309304
- MD5 e83f0a7d6edbfe60a1aaf1211b39c67d
- SHA1 74bdf3ec109440b04d58260c6d4c8f4e41c9167b
- SHA512 0796a79a7eabf7c89024d5a02f9fc41d7ea61ce50455711f0462536211bbf97f0aff64494815020af93042686663cdc4071319ae484910eab5461645a909e9f9
- SSDEEP 12288:M0uXRoDAPnOj43fazF5OMEFepGybspDvlgciDGwaA7Xs/OMjbJS:t46aA7Xs/OMjbJS
- TLSH
  T18935F83A7DAA9926D2C7203E1CDA94047E2A6037410C4E647DDC92C4EF997BCC7F4B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  SecretTweaks/SecretTweak/Proxy.log
- Size 7KB
- SHA256 bea02a8602932608baf8f79506ed2b17cb2c65affe1ec287b59240ef04fc2b3d
- MD5 4ea44c16b2dcfef9de34a8725dcea294
- SHA1 e4e0c0699e7c3637ce2355e1a5f24779e346e5cd
- SHA512 21691ca3241ac3236e2bcebc1dce8a4a1be175a750511cb6330ff8c57d719ae6f8e3b2c96eacc2271f3ba21fc39db7b5d39cbee192a6eba044dcb0ee3eae5441
- SSDEEP 192:8CATmafuMpAiy9LU8m2BcXas+QQ5MviGqtAuk:+24
- TLSH
  T14FF14C6829678A3386C8C2B6F538479551E60F191FB244F15EBFB32368213E2DB74B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral11 behavioral12
- Target
  SecretTweaks/SecretTweak/STKM.sys
- Size 27KB
- SHA256 7a83474024da0840432a52c93545f833d3067b976fdf8fa1670005a2086e3d4d
- MD5 c44f5045d1e11d426ec789b89a604eed
- SHA1 0761f38724be0303176867567da71625079dbfc6
- SHA512 6c822521be718d56e7a9a1946d39eac9316aeb1a9d26c8ded5cc1f17af920de02360c4363d4f40431c5df03cf2168c4cebed695ef39e67467892009968e28582
- SSDEEP 384:A3S+Q7fTKPD5wKaBnB64sa2HId/SzDxoH5HV/auRn+2HX5mkF+5f/DMI8Ir8KPO:sTyTSdJa1JzdaeV/fjLFCMI8cPO
- TLSH
  T1C6C23A1163D615EEE42AC6BDD2BA1437A7B9B404032348EF35A0C8650FA3FD5E9BC749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  SecretTweaks/SecretTweak/SecretTweak.exe
- Size 11.4MB
- SHA256 92a65702c5459eb17d64e89027aed58452d5c2af82b4263416d8d1d0c9707bc7
- MD5 bd976ef6e826044093c2969024b516a2
- SHA1 fee7af9150e6d7e5b2c3bf9cec452292efaed4e5
- SHA512 55e0a4c549d9c26e86d56ac37b2fba872de682928eadebdf5a5ba689bc3b1bbdf543b9aff3bb476a4f51e8afe914e82dd4a4fc10ce6da14eae1672aa57d97c11
- SSDEEP 196608:jxYKmji0bBQVps2n4LEysIFUgCVQ+nfDem5MWqPVAOyMG7Eui/gOR/jbGsI53cx:6thbBQVpRnhygQ+nfDefWqPVA197EuiB
- TLSH
  T1F2C633220361BCBAF08E07B839B7D4F456765E224FBADA1CF1AF05B7464654D8FB6090
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral14 behavioral15
- Target
  SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
- Size 2KB
- SHA256 cbd5ae423da986319d5034010ba9946769beef917d72c21e486ff1eb30836c90
- MD5 b6ed2b941560748d37ae3bb71b67ecd7
- SHA1 40a091b51ee02b3911b7c68e5167beaab19fc562
- SHA512 dfb6fed77784a97007b052e423fffc32d268c0be5ae304285f9e36cf8dcbd5a900f60f928a2609837adca05b49530f8a62e703501d927517aa843d8c2372b4a7
- TLSH
  T11351413545CE127D560064735108BD5EBDAC0CFF2B3B263194A4AF3F79E2466C53CA25
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  SecretTweaks/SecretTweak/SecureEngineSDK64.dll
- Size 28KB
- SHA256 175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
- MD5 6d8722b257230e3f691197715ec2b4b1
- SHA1 bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
- SHA512 b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
- SSDEEP 192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
- TLSH
  T148D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  SecretTweaks/SecretTweak/dbghelp.dll
- Size 2.1MB
- SHA256 b6455531a84ee1ceb101cd14f0e2be7750f4d5f958ec5a9460a09d011f14a3f8
- MD5 08219271a68c50cd39c74305e25d803c
- SHA1 2de9e5659b95686f51e8d0577718e2b7f2f2a0d9
- SHA512 d08763371c4044dd5b86409cc71b93315886be8fce9e3214e77858d2aef2ee58671a073b6d6c990a6a3f9f4ea9336efa6328c406cec97c967c5dde5f9f20b474
- SSDEEP 49152:0N0tGoich4Jm+qbApekXO0hIuxO/rMoE/26esP:0N0Wg4Jm+qbS1XxTcU
- TLSH
  T1BBA58B0757EC00A8D67AE23DD267560BD7F2B4110321A7DF126486AE6F23FE51ABE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  SecretTweaks/SecretTweak/device_settings_backup.json
- Size 4KB
- SHA256 03928d11f273d40b5d1dd07ded7782dfb0415f206dff6013aacf29cf6da153b2
- MD5 c7efe7808fcc99056d9537232d777b23
- SHA1 2fa7732e9ab5bc34c9a351e838c4019b41cb98eb
- SHA512 931ae5ca5afa65f24e018027ba65a5b1fb4dfaf6788e6001c73378b97a69c5c490e31d2098669d137891608690103207c37843e7b9e12a7c9d2f0809eca0e129
- SSDEEP 96:ADpgx2Mop/M3ANUyp3JU5Mpv98pvDKpSGHX3pCa:Epv/p/8Aeypi5Mpl8pbKpxnpCa
- TLSH
  T15E918704E4660D2787CE522564956BC34BECB6535E813DA63BDCAA0D4F0EA1F11B2F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  SecretTweaks/SecretTweak/exit_gamemode.cfg
- Size 39B
- SHA256 2efa610f5f263f299e04887dab880c1728bc1e6b74addd59c3f454f6002150e9
- MD5 cd93399455397c4067976bf511f4bfa9
- SHA1 4d85590d753d035f4debaa7c896fd8bec3bc7d76
- SHA512 7d28fedeba18a4594620fa6618a87ebb6d0e0cfc446393442c40009a0396e11914c05d326989fa5c1e250d1d2c329604be0520624c81e15a5d44f26b7531faab
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  SecretTweaks/SecretTweak/games_priorities.cfg
- Size 153B
- SHA256 341e1b970622f710261fd09468eef4f56148cd1d82bfa2fce3797c3272d089c4
- MD5 df5e3f56a6b11c2b34913fb9733464d9
- SHA1 836bf112dbb077cdb41b4584a72dd44479a02ff5
- SHA512 88f7c8d57b66dda0a9eb871dd7d137cabfb37405b9e541b41e45038e51f6404303bf7a951aa13e50425f099102415df6a3184ba9d85fd55e142b15e73609b8a5
- TLSH
  T115C04C7CF03D0E6D32A807FA617A9E4335895D40873215BB4CD04009E7D8D844645265
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  SecretTweaks/SecretTweak/key.txt
- Size 3B
- SHA256 38816a4bbe78aa3dbff468dc0d08c217df8cc3b4f3c3fd9f139bab84d69dff5c
- MD5 1f73402c644002a7ea3c9532e8ba4139
- SHA1 a6c0ca0de97c7f8764f85b76a9f9819ff61411b1
- SHA512 20beb67b40d06b4d84f961853fab1ec78c9279517ee8b05273ed11066d3a995d3e98b6c86e31d2ed3139769e7227807f7a17dabc28622155ea0d12f0582f4d7e
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral27 behavioral28
- Target
  SecretTweaks/SecretTweak/launchers.cfg
- Size 509B
- SHA256 48fa29da02434fa9134f15534b7e1fda7e95a63b6b390788771778e0ec46e55c
- MD5 b0bf9f565e85615cfdbaab383fba2b75
- SHA1 84da8d2faf146e5f1f4a06c6030350c6677de539
- SHA512 edca41a3b7d49936887949ffa19a3e894ef9af37d51a9f4662120728188dcff2c6d2d8da9dd690404dbf2a85819f43f3b9f6b066c346b5ef887268f70e6fae3a
- TLSH
  T1C4F0C05C4D392471CB81807FE3ACF31E0E8A5D91E90D1F9357E1526718ED9C448507D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  SecretTweaks/SecretTweak/logs/logging.txt
- Size 83KB
- SHA256 52712d1ba8b42954b477d4d5071c7148edd27007f66a8722c8e475a0bbf3b06b
- MD5 403ce5fd0c2e7ba19262be6443956f54
- SHA1 7969de3108a1e0eb0995437c0380b8bf5b67b1a0
- SHA512 37f28564e97f2e4953faf837ea6326894461a7a8f8f7f18c30af38e32df324b2741225bb870aa8ddd41686ef100d7776905c98bb6fd50afca4488a5fcc21dc7b
- SSDEEP 1536:aYndiaW0nxUdSsPJ1RZ0GkVm3zNsfsjs7zRsSs2skscsQzE6Bt4BMp/F5QouhTAx:niTykQXOZVzLmLpUkPJ
- TLSH
  T12C83F04A25EE713F44CB628B930E7FEA2D1170A3C8671592B6DD26CF2B8D9057F83506
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32