265bb3bc6e0a8f0e1c9ad1130d763f35377917ad0b60507dd99a6d0629626e6e

Sharing

Copy URL Twitter E-mail

General

Target
IdleOS.zip
Size 127.9MB
Sample261110-ramdaaax2l
SHA256 265bb3bc6e0a8f0e1c9ad1130d763f35377917ad0b60507dd99a6d0629626e6e
MD5 394364cf19a2d58c4e9731066fe4b703
SHA1 281659a7c97a65971b28f25860cf0ef4fbc80ce4
SHA512 510408786ecac1eb9fe260972c4b176d4fcb07c10a41dca26bccf530a90d0c92e10b40ab6f86b58af5e88f672dbc6e4e6e34602ab80921bdc917d42d3674223f
SSDEEP 3145728:1r7DYweuHtqyyUuMIjBvxsQfBBt3RtPDTkjpV:1rYweuHAzUuMIl5d1R8b
TLSH
T10B5833D8A1FF5565B0E03A67136197848BA0B8E035EED8B7668D31930F550F6E7EC08E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IdleOS/HOW TO RUN GAME!!.txt
- Size 280B
- SHA256 c45b2246157b7c26c5fbc29fcf72f9282d100f60291d0c55e2ae7245a515519f
- MD5 5c7774e0343fd309525564e9a89bf5bc
- SHA1 3f363d96aff15217c40a8f32176f37e2fa1c9eff
- SHA512 93bf51594fd4328d2362f8283df8cf80a0dc2861c4a4a3198c045c068a60fd6fd458d2f38d1fe6a59fec7683c4e80de31674541dfef8e6045613a98c1e386958
- TLSH
  T144D02BAEEC822BA22A9081D2265D2E96731CC41D72350554BC7BC7B98306B74C034DE8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1
- Target
  IdleOS/IdleOS/IdleOS.exe
- Size 92.9MB
- SHA256 18ef43866bed04a46d97f0e5fe81e762beac9f2e6848b3256b231ba121a89a8c
- MD5 a2be127d848f34022203e90bcfa51e91
- SHA1 74fba62559ebddef0f610f41ddd5bddcfe52cd84
- SHA512 15210b3d73a6725c64b4cb7d014013422d35fc1739781e6c15d0bfa4cd1da9d27e4d67641357f4f4ebb20657a69fc30c68da0164bfdf4f11551e9add2c087c68
- SSDEEP 786432:99iIoXnNrE37dZfPAqEmgSvba9tFNlXd:/unNre7dZWmvOtFHN
- TLSH
  T137283B13E2A370DCD5ABF1309F7BA672BA71B80911386D6A5692CB303F21E10577DB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  IdleOS/IdleOS/IdleOS.pck
- Size 38.3MB
- SHA256 139434de91a36058a8986bfe8e752005e515c426c885f38e45b78f19fec67b27
- MD5 6bb08b21a49373895ec3a87fe1e9e6ce
- SHA1 bc4c98b6fe14dc11f261a8feff03c88be04f296b
- SHA512 184276838f797bddecbb78c4cf301effde1e177d86c01430998bef16c0f47b93dc1934ba800c426d588fc3fd023035262c6ec64ba2243f0ef13d2c232deca8e7
- SSDEEP 786432:XtTGf7zZz5NfrRTzmEeZXLn3K6gNfdP95W/LMsld:Xta3ZbhiXj6nfdF5Wzr
- TLSH
  T1E2972353EAB18C23E06222379EF9824055303E52DA507B5AF5CCB36C1BBB7E565B724C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  IdleOS/IdleOS/libgodotsteam.windows.template_release.x86_64.dll
- Size 3.8MB
- SHA256 6535af56d325af0fff52dbb5de3703d110bb430fdef4e3026d7ece617270e530
- MD5 83dde23fe8b025e039a5a90bdbd12eef
- SHA1 790cd34d8c63b5c478670f760f601938c1222d2b
- SHA512 4d0b1abb9c07d376d0cdd2cdc7fe141acfcfcecafc91dbb7151679c4c502b5ac7fe7e6a3c1480d7e2f75d0b7b4347263b772d46e70bb9048712eaf0360418f7e
- SSDEEP 49152:VIyc6CrxUoG1d+JSsHpKrTFRcbJhS1Tts1LI3oCmwTT3DUD1QRB1SgvEm/QRLfkT:YFHyoRQv8LfkyM1tuKq38Hqk
- TLSH
  T1C1062807E2A351ADC46FC376826F6236B970B8556178BD6F2854CB242F71F60072EF98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  IdleOS/IdleOS/steam_api64.dll
- Size 10.7MB
- SHA256 1bc8731a3a9e9d1a68ee14a815c2525be713141c8e6abb7d40d9ac1dabc79fc9
- MD5 553c4d5c47253e13dc1e2c9df839cce0
- SHA1 989de27468efc2be0ad26832701cfe803be0f99f
- SHA512 d5c58ed10fa587fc4d5ad5f926c8833c525ea27b627f81f8f191dcf6ace73a66ab422bcea2771a9a6dc0e4ca7eb03c404147c1d3258863a7afbaf9e716dc05d0
- SSDEEP 98304:HhHTZ4Xod+k6uLfQZnt5oxxrSYlqdWMtojwNkZAPg7PdB:HhHTctOqdHojwNkZQUz
- TLSH
  T1FCB6F717E7BA01E4D5BAD1789563623FFDB13495833097DB9A805A0B1B32BE4E93E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  IdleOS/IdleOS/steam_settings/configs.user.ini
- Size 50B
- SHA256 d6caa4c039b8ecfb65d057bc74c5b458dec8975a7a192c9a851f769f4c8c476c
- MD5 918740a514479845970385f08627dd65
- SHA1 501603e95c850c10efcce7e82c1e3b386ceb6da4
- SHA512 32f00d1ef3b190af062f814c8e32f45e410a73fbda51a89c0ed63bcc2bbbddf6ca4e6013c37d0ab4e94b9d7039d90c46dcc8a4fecda0767a478d0c2f03357c57
- TLSH
  T122900221085050665CB1142270833D09039551F560066D590280350651A5A210855691
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral6
- Target
  IdleOS/IdleOS/steam_settings/steam_appid.txt
- Size 7B
- SHA256 fe027560ed85906a60cff751db8ed795d6c8d41065a4d74313b949675c6d4b94
- MD5 3944df6f034cf551b53f9e5693c49bfd
- SHA1 fae664f3c8d6c542b7c8d1691b4fd27d8d2412a2
- SHA512 26ad0c05cf5252aa7ba789be2d1e8500ce054625da058509879f495b1668faf7ccb48ebee8bb3f9ff2fd665eaae9bd718e99daeea954a1ec6a9d0bce3bcabfde
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral7
- Target
  IdleOS/IdleOS/steam_settings/steam_interfaces.txt
- Size 1KB
- SHA256 35054399b18acfd3864978aebda9d8928e937becac74f097899da581b62aee07
- MD5 819b5bb0b32cb2029cc583e504ec3340
- SHA1 d3b25e7e133ea05b13e6d1989611c8def1d14a9a
- SHA512 41ee76bdf091ca551ddece000646cc43dd532bc5be3721e73e96a5326378be0e2c1ffbbba19d616156e3f11e44045f82e7b5af6f66f73692bc4b6b32af42d093
- TLSH
  T1E331342D51313DB8AA2C64E22D917A1F724C22932180ACFDDE42D9E204DCECB1F7F915
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral8
- Target
  IdleOS/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size 52B
- SHA256 72f4d3e137db5ae8cde66c1b8d000488f16e2ab27a761fe287647010034887cd
- MD5 e2e460fae8682d83a0f080dc3fc6ea99
- SHA1 1f3347c00b7a83709406e7f67659741fffecc48e
- SHA512 a741b7f3c34b46206a6146c34bd01fb71b06de856dc1271ddf13a19e9e1adc85e23aaf3cf690fa17dace117b7db25167916d38383fb50bab1b0ea5bebe81fc03
- TLSH
  T1EA900256451AD0599316084C851195579842219949AAC464D241DB1C588B15485A4708
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion
- Uses Rundll32 to proxy-execute a payload
  Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.
  defense_evasion
behavioral9
- Target
  IdleOS/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10
- Target
  IdleOS/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral11
- Target
  IdleOS/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral12
- Target
  IdleOS/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13
- Target
  IdleOS/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral14
- Target
  IdleOS/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral15
- Target
  IdleOS/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral16
- Target
  IdleOS/_Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral17