Overview

overview

9

Static

static

8

三国魂�...00.exe

windows7-x64

1

三国魂�...00.exe

windows10-2004-x64

1

三国魂�...ar.dll

windows7-x64

3

三国魂�...ar.dll

windows10-2004-x64

3

三国魂�...te.exe

windows7-x64

8

三国魂�...te.exe

windows10-2004-x64

8

三国魂�....2.exe

windows7-x64

6

三国魂�....2.exe

windows10-2004-x64

6

三国魂�...��.exe

windows7-x64

8

三国魂�...��.exe

windows10-2004-x64

9

三国魂�...ml.url

windows7-x64

1

三国魂�...ml.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56c46d532f0c3e73c64d73cf15f89500d50e9142b8a91cf940432f2fb27d6065

  • Size

    7.5MB

  • Sample

    221126-gyde6sge24

  • MD5

    43d64b28ffdfc3b34f920abbdd515cb3

  • SHA1

    e1c42dab107337c21d624304438497207f1ec97b

  • SHA256

    56c46d532f0c3e73c64d73cf15f89500d50e9142b8a91cf940432f2fb27d6065

  • SHA512

    febc5975b627b77ad82a257d8b00b423b3af64e3bded426a30714dd56d393fea79d3397eb509498dad9d1acc6c5c74c6426960184b9d4543bf84ab69a7aaec6a

  • SSDEEP

    196608:TWJsaI+QUz155hJZId/arfpQ84xPmCjh88wVR3:TWJsgz1LBIhEG8ePEt3

Score
9/10
evasiontrojanupxvmprotect

Malware Config

Targets

    • Target

      三国魂战魂/basedb/查ID所在的文件000.exe

    • Size

      568KB

    • MD5

      998256969af808db93c4827a4d93bc51

    • SHA1

      dc8abd8ddc122a18fc20eb4da181aa0c1df8bc22

    • SHA256

      c706451afce4091a6e879e39e7cc9890df64465e0050ac3b605b9ec4bf037fc3

    • SHA512

      1be89974f526f235a96050cd1a48c31e94346d2e51ddf135aee7828ea6c0d738e08a75f296d4e10e7126208ca40480fa8bc7cafcfdc22f6fa4ed870dcc8e0de9

    • SSDEEP

      6144:HPbRbOnjwJf8PuxF55HtxmS2DkHzLeQ0b4WNYiHcScT1lS3xfJkC7g49BzN9DBrB:H1bOUfjxz5HtxN2Qv5v3jS3XJTxF

    Score
    1/10
    behavioral1behavioral2

    • Target

      三国魂战魂/unrar.dll

    • Size

      81KB

    • MD5

      5ffcd122278699aadf24308c843fa969

    • SHA1

      f9ddd27acfd3df56d1d1de6577f2bf2db71e475e

    • SHA256

      c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811

    • SHA512

      56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0

    • SSDEEP

      1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

    Score
    3/10
    behavioral3behavioral4

    • Target

      三国魂战魂/update.exe

    • Size

      1.3MB

    • MD5

      5555945c3f82b5db004034aecc956414

    • SHA1

      a39ab33ade7345156a63848bb520c254b2fce48c

    • SHA256

      43094d5d7d6335e32eaecc3a90dabe0ee627a61bf0cc840e82e2a007ce9b9652

    • SHA512

      632721a2ceee73dce0fca0ff2ec5033b3d9bd2c4157f85ade344125e07ba561708aa5fd266dec96349353f680e8c52dc93f3d673820ef41024c99f4d19e3017a

    • SSDEEP

      24576:yWdd5mgZjweiCgeSzbVEOWrzB5AI5DhK3IDj1aDykEbkZvWez5AWZzqQYntkXta8:Bdd5mgZwrbeSzREOWZB5Dkaj1aDy4tH5

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral5behavioral6

    • Target

      三国魂战魂/三国魂_战魂_V 1.7.2.EXE

    • Size

      2.6MB

    • MD5

      8e9adaf3c9849b4d2ae15b1bd7334194

    • SHA1

      28f4e369c903ba8ee9cb40c91478d23a582604cd

    • SHA256

      8884c82c93e70d9c281bf8460d0696a67ccfa56069fa7430ab96c5309ed0cd10

    • SHA512

      4327130471f7df00b3a74b272b8d686936e9d692b9721cfe4261ad948bce6d6e7d8700c33356fb5310b0355f2a2e2b3b8f002025162fde943feeaafeb5757600

    • SSDEEP

      49152:9+Gb1ErpUMLwVqrOFNM3JQ8R5eUt/PQPN3HXq3MpHnPVsGYbOz4E0YFF91SuSxcq:pFnPrn+uSxHiI3caF

    Score
    6/10
    evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8

    • Target

      三国魂战魂/主控台.exe

    • Size

      2.7MB

    • MD5

      bbaa354b0de6d6168e09a8a49b25bbf5

    • SHA1

      b44422d49a992b8caff25dddfd0d8fdad56fc596

    • SHA256

      e61a5b44008c8f4fd0d02b7ac6e8bcd055f0144fa8d253b20b602a89960a5557

    • SHA512

      3dc4640c7da488996c64c426eeb8e9364404e3c78d31d445c8fddaa899394cb8a88ed74e1a9b1426f35defa2b58b729a56749e866d55acc64b08fa1a4445a7d7

    • SSDEEP

      49152:LDGb1EspZ38TVtrLuNMQJ38YUtUwgwvP+3kX/KXpMZMP6Rja9hTFrgfE4kTsJNL6:CCZFjEofoIfN/dBAKaZ/pJrP

    Score
    9/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9

    • Target

      三国魂战魂/会员卡密购买.html.url

    • Size

      231B

    • MD5

      45e24f30175087a6626ba6281d7515b0

    • SHA1

      5ec1cc5d5a7bac5f622147bf045d656cb3e83dc8

    • SHA256

      15434dd79ced6059bcc6f4f3d8207e3a66c6330e5b036281feb870629a4167de

    • SHA512

      8640214c54af417118bc2941d01228019db6b75dd072d05f6a2e136ed225dca664efb99a200b2b0577f08ccfa5f76c693c9bf73f379e57bf6a40e4c04b0ad9bf

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks