e51e1a24d1b5bc78e9cd9309fefd1d3b4649451f7be6736346d5ad6a6423bddb

Sharing

Copy URL Twitter E-mail

General

Target
Castle Crashers (2012) by (Hemerson Soares).zip
Size 162.0MB
Sample261107-padp2abv31
SHA256 e51e1a24d1b5bc78e9cd9309fefd1d3b4649451f7be6736346d5ad6a6423bddb
MD5 f74c343e41bc801ac15151756d85fb95
SHA1 855f610085e6c821a38b03718f1515da4928874a
SHA512 fe01ae893eee7950ffdd7ea761c90fc34ca32afed4efb4eb1ebec99acdb3992edcd74bb6c09eaf551814875e02a7045385fead0527d344573a1b20e60be1e559
SSDEEP 3145728:ysOpPPaE5qKMp48dn+FRIhqcbhU4oPGQKe/nt/qjHW6IbJUxHxyEUa9L5xd:ysyHA/dSRIkchU4oPGfe/Jqj2JUxHx11
TLSH
T17E8833E3E260F9485EFA1D320000AB9D5DDB6DAD2CDDD9E1F2A4A744AA543CF2435D8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Castle Crashers (2012) by (Hemerson Soares).zip
- Size 162.0MB
- SHA256 e51e1a24d1b5bc78e9cd9309fefd1d3b4649451f7be6736346d5ad6a6423bddb
- MD5 f74c343e41bc801ac15151756d85fb95
- SHA1 855f610085e6c821a38b03718f1515da4928874a
- SHA512 fe01ae893eee7950ffdd7ea761c90fc34ca32afed4efb4eb1ebec99acdb3992edcd74bb6c09eaf551814875e02a7045385fead0527d344573a1b20e60be1e559
- SSDEEP 3145728:ysOpPPaE5qKMp48dn+FRIhqcbhU4oPGQKe/nt/qjHW6IbJUxHxyEUa9L5xd:ysyHA/dSRIkchU4oPGfe/Jqj2JUxHx11
- TLSH
  T17E8833E3E260F9485EFA1D320000AB9D5DDB6DAD2CDDD9E1F2A4A744AA543CF2435D8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Castle Crashers (2012) by (Hemerson Soares)/autorun.inf
- Size 65B
- SHA256 6ca55464bc1c6784c9433c439667078a5cd264f3ca3fb98c06d3b3878f18256a
- MD5 a6a1aac8ed0574b1df329c0c771697d7
- SHA1 865b3b89f41fd3f2272b71822ccbe93588c0360d
- SHA512 728e31930581d5705d8735c19e8dda56e0e73353319e2246127d47e10e97107fdce977d834c5c31f82574fc07222108ae6e706d14a39175856686f274dbb8186
- TLSH
  T180A02200CC0C000A3B0830E00C0E0830C08B22CA88020330838A0C08033028C0F00C00
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Castle Crashers (2012) by (Hemerson Soares)/fan-cacr.nfo
- Size 2KB
- SHA256 30b8c3961c0e601c3d2549a6ad416480584071e0da0c8d2afc1b2e76a59e4141
- MD5 02480e97cff291e44c9ab54018a72e7b
- SHA1 02317f5844067e10de853b1230a2ac45d7b2d061
- SHA512 1b71bc0e701cee0d287d7a966af2591bb8d5739bdbbacef17ed4c482555cfeb962026972dcfd38de04bdf862818fb48302193178cf7908a62cd5fc141b80ef13
- TLSH
  T13641224973D2240E6B12D214D496B4C091481F8621232AD8768CB7DC6B7D7C4F3D6AFF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Castle Crashers (2012) by (Hemerson Soares)/icon.ico
- Size 344KB
- SHA256 557d3e3db41d5b8523a56c57ceb97c76e97d5ab46e24ec1bc2bc6ff28c8b9132
- MD5 263fdef1b4d4c82c034964370163e5ed
- SHA1 ffe01563bb70af59a261798b8296b2d7c61db933
- SHA512 e331699fcd97714ae1ac3cf028cd2a785de86e0cd6ffaa0713d4efb84377a6de3864adf191b5ab64997577e5426a71d112dedc81e603d01d2ffc6352d0b61e78
- SSDEEP 768:lmk9dtos6x5pWQjVdNDKR6Y5pHT2jZBx1vpXRetUlV1zogT8qlZBL2iwb7ZTtOrs:5Ws6LEQBdNwIx1xXbLzUZiIBTTJUA
- TLSH
  T1FB745F9A2F8AC915D669627DC815F3FD8231ED943BA1CE0B22D5BE3F31355D9D8A0803
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Castle Crashers (2012) by (Hemerson Soares)/setup-1.bin
- Size 161.6MB
- SHA256 2428225ac5e40ce0979678e782ccb6683e15fc57106acdf56df62fa391362694
- MD5 17a0b3ddb33dd025002a0e3eb4c265c9
- SHA1 c79f720b8b7bd0826abab3fdf541766be08fe110
- SHA512 7e95ad5ff9813f9dfd390bd766979e0c7421f45186d51753129faac6d22d2af79f98896050fb66cba4a083d3680923dae8778e3610c2e89dee055249aab7252d
- SSDEEP 3145728:XsOpPPaE5qKMp48dn+FRIhqcbhU4oPGQKe/nt/qjHW6IbJUxHxyEUa9L5xf:XsyHA/dSRIkchU4oPGfe/Jqj2JUxHx1H
- TLSH
  T1968833E3E260F9486EFA1D320000AB9D5DD76DAD3CDDD9A1F2A56744AA503CF2439D8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Castle Crashers (2012) by (Hemerson Soares)/setup.exe
- Size 801KB
- SHA256 c2bd5d32232abf4d0306a7a99ee3698b7f10608f20f8c2c451b758c81a5c841d
- MD5 d17484380927c0b10bcfd076fd4f3c37
- SHA1 b5086faeef22c7d7de27fe91d920e0a55c3a17ad
- SHA512 73dd93122461bf3d419c92670cf6dbbeffe6ad36e8b87025e3a56f8106739a355ba5bb0c460e5f3a805e8187574d26d0b1d6651d3a5c4d409d7318a91622962e
- SSDEEP 12288:xnvpnBT7vHn2Zht1YCULmY5/Mk7XOJlEyPYq0TDaEce1yBsL:xnvRBT7uvt8zQl1PYq03yeRL
- TLSH
  T1D8057B696B8AC525C651A5B9C402F7FC8B31DC542A71CB0F23E4BE3F3D362D8A991583
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral11 behavioral12