Overview

overview

9

Static

static

8

三国魂�...00.exe

windows7-x64

1

三国魂�...00.exe

windows10-2004-x64

三国魂�...ar.dll

windows7-x64

3

三国魂�...ar.dll

windows10-2004-x64

3

三国魂�...te.exe

windows7-x64

8

三国魂�...te.exe

windows10-2004-x64

8

三国魂�....3.exe

windows7-x64

6

三国魂�....3.exe

windows10-2004-x64

三国魂�...��.exe

windows7-x64

8

三国魂�...��.exe

windows10-2004-x64

9

三国魂�...ml.url

windows7-x64

1

三国魂�...ml.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d4c10c35d912c28e341479228551e1f175730f7233da8ae223f65534a204951

  • Size

    7.5MB

  • Sample

    221126-gtb2jsgb23

  • MD5

    d813d28ee339efd78a07f261e34b4427

  • SHA1

    873fb3d9f9f383da06cc1c038778dacde6ea0173

  • SHA256

    6d4c10c35d912c28e341479228551e1f175730f7233da8ae223f65534a204951

  • SHA512

    f0fe63f5ce97259a9c09f1119e681031dd7796003040c3d4c01de17483d1b6cae7cc87ca9ebee33781ca66410c3184c94675ce100ba9157af46ae2c6840a7167

  • SSDEEP

    196608:eWJsaI+QUz1555foDuZVQG6SISHfpQ84xPmCjh88wVsC:eWJsgz1LRoYmY/G8ePEoC

Score
9/10
evasiontrojanupxvmprotect

Malware Config

Targets

    • Target

      三国魂战魂/basedb/查ID所在的文件000.exe

    • Size

      568KB

    • MD5

      998256969af808db93c4827a4d93bc51

    • SHA1

      dc8abd8ddc122a18fc20eb4da181aa0c1df8bc22

    • SHA256

      c706451afce4091a6e879e39e7cc9890df64465e0050ac3b605b9ec4bf037fc3

    • SHA512

      1be89974f526f235a96050cd1a48c31e94346d2e51ddf135aee7828ea6c0d738e08a75f296d4e10e7126208ca40480fa8bc7cafcfdc22f6fa4ed870dcc8e0de9

    • SSDEEP

      6144:HPbRbOnjwJf8PuxF55HtxmS2DkHzLeQ0b4WNYiHcScT1lS3xfJkC7g49BzN9DBrB:H1bOUfjxz5HtxN2Qv5v3jS3XJTxF

    Score
    1/10
    behavioral1behavioral2

    • Target

      三国魂战魂/unrar.dll

    • Size

      81KB

    • MD5

      5ffcd122278699aadf24308c843fa969

    • SHA1

      f9ddd27acfd3df56d1d1de6577f2bf2db71e475e

    • SHA256

      c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811

    • SHA512

      56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0

    • SSDEEP

      1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

    Score
    3/10
    behavioral3behavioral4

    • Target

      三国魂战魂/update.exe

    • Size

      1.3MB

    • MD5

      5555945c3f82b5db004034aecc956414

    • SHA1

      a39ab33ade7345156a63848bb520c254b2fce48c

    • SHA256

      43094d5d7d6335e32eaecc3a90dabe0ee627a61bf0cc840e82e2a007ce9b9652

    • SHA512

      632721a2ceee73dce0fca0ff2ec5033b3d9bd2c4157f85ade344125e07ba561708aa5fd266dec96349353f680e8c52dc93f3d673820ef41024c99f4d19e3017a

    • SSDEEP

      24576:yWdd5mgZjweiCgeSzbVEOWrzB5AI5DhK3IDj1aDykEbkZvWez5AWZzqQYntkXta8:Bdd5mgZwrbeSzREOWZB5Dkaj1aDy4tH5

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral5behavioral6

    • Target

      三国魂战魂/三国魂_战魂_V 1.7.3.EXE

    • Size

      2.6MB

    • MD5

      765d894c60fbff7aa536d7f0ecb6e030

    • SHA1

      f04e905804df6f7f985d62480b7f749a2d5a8d67

    • SHA256

      697b62c15f7596f22f228cbaea8d71649bbe1b1701d5577e2202ddd0580a6b78

    • SHA512

      5dbce52405d3447b07a042448eb6884b3646a3b930f5d4041a3658d4d6cab4fccbe4cf07661a3a5bc4b9c180e37f0cac1f1cfd906a8e161b8e3b590f5e21152f

    • SSDEEP

      49152:duGb1EbpEc7AV6r+VNMnJA8BpuU9v/APd3XX6n8pQ/+NXEXA76xT1HhNI5vKzHo5:Ze/MUQ76N1Hs5vXN3MwbLm9TePDVr

    Score
    6/10
    evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8

    • Target

      三国魂战魂/主控台.exe

    • Size

      2.7MB

    • MD5

      bbaa354b0de6d6168e09a8a49b25bbf5

    • SHA1

      b44422d49a992b8caff25dddfd0d8fdad56fc596

    • SHA256

      e61a5b44008c8f4fd0d02b7ac6e8bcd055f0144fa8d253b20b602a89960a5557

    • SHA512

      3dc4640c7da488996c64c426eeb8e9364404e3c78d31d445c8fddaa899394cb8a88ed74e1a9b1426f35defa2b58b729a56749e866d55acc64b08fa1a4445a7d7

    • SSDEEP

      49152:LDGb1EspZ38TVtrLuNMQJ38YUtUwgwvP+3kX/KXpMZMP6Rja9hTFrgfE4kTsJNL6:CCZFjEofoIfN/dBAKaZ/pJrP

    Score
    9/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9

    • Target

      三国魂战魂/会员卡密购买.html.url

    • Size

      231B

    • MD5

      9694ceabe2539bfa1a6534056ee1ca8b

    • SHA1

      5d2b4b7e2718ca6bb06023aa81a8fe101c1e0ab2

    • SHA256

      ddfd7c61a13ffae3d90334584f48793f92b818d915dc633648b8d956781bf276

    • SHA512

      deddad8f4b5e20a79416a667d56de2292c2a58ad1c7acff1337162207a9c9b653d772d4ed266a60811664d826f787d0b9bed7ce34f3e66b1fcebd367fc54e900

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks