General
-
Target
45f3b07fe66f65cac16b6765e83dbb1fa8a8370ccd18289a475a12d1997a023b
-
Size
3.5MB
-
Sample
220520-fm1kwsdgbp
-
MD5
d3d1533bc18876734a9129292fddfffd
-
SHA1
6175542967e7ceb68da1d885e3bbcb98d17c87d8
-
SHA256
45f3b07fe66f65cac16b6765e83dbb1fa8a8370ccd18289a475a12d1997a023b
-
SHA512
684c69c4d75c1d7950862f8b8be511e74e5773333a6e7e02dabfefa90d6d7f0185e0a4fd1ed567164aec20eaf8ad6339145b8e55171c2a4ac1ea8c00dc3b72cd
Static task
static1
Behavioral task
behavioral1
Sample
Dota2mode.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Dota2mode.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
dota2descop.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
dota2descop.dll
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
Dota2mode.exe
-
Size
3.4MB
-
MD5
888d36190614310fbfc16548f3568e84
-
SHA1
238d4bc0cdc004c1c2be109058375e85f6342fc8
-
SHA256
d90639401e952a40009d20a954359d899c318c442d03b43f2a81b7b3fc00dd92
-
SHA512
23852fddcbdc526bfeebd7fad33715553e155c3d16a9ae67b314da0f4678ae5fe761c6fa9894be3fe43b84666db29e08f7d77cdce5b27944e33cab3f53ab39f9
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
-
-
Target
dota2descop.dll
-
Size
501KB
-
MD5
e1f41034e6894d9d23a6db2a6e5b0dfc
-
SHA1
4262109ce58a2eaf7fb09073e41aab56d7274235
-
SHA256
526f69142edc80cb1f261acdb7c73ce3db841d21ac26bee6715f604c8a238be1
-
SHA512
8d03a25dfe13a77461abf50e0fadeb7b16408f36e0b206e8a33a5d5f6ecee3560c54e1adaa219598c76161b8e1536bac67fd1f04085f483c791d56d20a36c57a
Score1/10 -