Overview

overview

8

Static

static

8

Login/Gr2D_DX8.dll

windows7-x64

1

Login/Gr2D_DX8.dll

windows10-2004-x64

1

Login/KiKi.dll

windows7-x64

1

Login/KiKi.dll

windows10-2004-x64

1

Login/Shape2D.dll

windows7-x64

1

Login/Shape2D.dll

windows10-2004-x64

1

Login/Sound_DX8.dll

windows7-x64

1

Login/Sound_DX8.dll

windows10-2004-x64

1

Login/WzMss.dll

windows7-x64

1

Login/WzMss.dll

windows10-2004-x64

1

Login/ijl15.dll

windows7-x64

1

Login/ijl15.dll

windows10-2004-x64

1

Login/loca...ow.exe

windows7-x64

7

Login/loca...ow.exe

windows10-2004-x64

7

Login/啟....exe

windows7-x64

8

Login/啟....exe

windows10-2004-x64

8

Login/錯....bat

windows7-x64

7

Login/錯....bat

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d00507564757cbf36eb7edb12fc2a782c044d0b447403a71634a6a526c7268fc

  • Size

    4.4MB

  • Sample

    221127-p6ks8adc3y

  • MD5

    fc64ebd9e91afeff2bffb5a9ec8e3525

  • SHA1

    517db2120ae4926600e855c9a748c7fb3ee3614c

  • SHA256

    d00507564757cbf36eb7edb12fc2a782c044d0b447403a71634a6a526c7268fc

  • SHA512

    665a3e296b950e5c084bdb4a9098d5ae9322c5842a3ae54f87039f2d5b57a5cc2753d94fc78baa1a6b5837f287c6b305060316fedda22db9d636bc2d07f9db68

  • SSDEEP

    98304:eki48vxV9bpj6E9MO5/LV5RE2yP5xJcaawtkr4+IeSiUIko2fZ:eki40Vpj6gMGLFyPJc0ks1XFIEZ

Score
8/10
themidavmprotect

Malware Config

Targets

    • Target

      Login/Gr2D_DX8.dll

    • Size

      248KB

    • MD5

      ea10742e32ad2b9c8a5c9ccaf9b40001

    • SHA1

      ed77494637dc1d4e1f40f914a2379f59dfad6605

    • SHA256

      a464599bd3fbea220b3d18afd793f6c14cbb75525d452be1067057310099b5f6

    • SHA512

      eb7df560fcc25aa3a5e832003ccabb45f30d88a11bc50c6ea6c10686284123299436d0465974a06cda877cdadb09cc0ba43d0c7fae459cf2b560bb8137545c2f

    • SSDEEP

      6144:SKOqOkEoUrHl7beJEkQeewQeeAQeesQeeO9QeefQeeH72VqUm7a/h8nMuV+s+:bOqEzrdbe772UUm1T

    Score
    1/10
    behavioral1behavioral2

    • Target

      Login/KiKi.dll

    • Size

      14KB

    • MD5

      3364dc32878568f2a2fd59083f642380

    • SHA1

      2973656182403b5622356441e1208d5391b9bdc7

    • SHA256

      b142cb61954bd4254cb9c640baec16ae6a135847a344473361a065ffeeaeff09

    • SHA512

      38c75efee3c0cd38ffcb026c69c69e9be19c7211b1ecf2f5a1893be91b8eb9976078a5eb3dcc07f51a49b42b531655b4775270909a727e848471b1843f0b11b7

    • SSDEEP

      192:Ps18e1945p1yoegeAWTikZ82qtPJoRxLWoNRN6g2ZhauGlOBVx2vugR3X+0qX0vn:0P9452geFTiYq9JiW4emuu8

    Score
    1/10
    behavioral3behavioral4

    • Target

      Login/Shape2D.dll

    • Size

      84KB

    • MD5

      fefe6bd24940b605ce33c12532c6de31

    • SHA1

      17c3fc1803c5246fc0fca448516c37cc5cf151a4

    • SHA256

      2a294b2bd0b1d13c3d75cac475e4f0e7c55788a272ad351b31b538948510d5e3

    • SHA512

      4a90a0ac3e741be6b30815d1500f80ec28bbf579b414a4dcaff18ae1694829f1e0af996de3d52b296f82955e367e39825db2b938a9861e15be4138bf4a6529ae

    • SSDEEP

      1536:ofURoJ+rHS4oyNlB/9qbPhYl2i4ogmU7:uFZyLBlQYl2/ogmU7

    Score
    1/10
    behavioral5behavioral6

    • Target

      Login/Sound_DX8.dll

    • Size

      144KB

    • MD5

      4fc1e324933fd2eb33d764c8bd7aaae4

    • SHA1

      ca93fb6ea825ae9810c78186a8a44746aa9b4d7d

    • SHA256

      acd9b6c282fea06f42cac970e43bcd604ee5af27851a22161c8c91a173b1135f

    • SHA512

      fa3ddec08c48042567676bd595b9d714242ad89065325466ba34d2c168806951af45bb7fc8565508c7b44cf82fea6a8962de380376ba38a4c94c24a05851dde0

    • SSDEEP

      1536:4BtzElrTpSJH9JJO+TnR8y/NlwCaouUs4pFi0d6EMZqis8SCK4oaUxAL7z:47zEhyn6eMC99pFv8EEsJCXoaUxAL7z

    Score
    1/10
    behavioral7behavioral8

    • Target

      Login/WzMss.dll

    • Size

      172KB

    • MD5

      f0c0781ec46ce9973e628c1e724eaec8

    • SHA1

      31ae01938deefdbb28be75c3a69c0b1cef535728

    • SHA256

      61cd79c5d4b2caddf2a9d3b54046c02704226861510fb1ff4d0f010afc6179c1

    • SHA512

      e02f73784c0d8bb3cb9092db87d474dd0e277d44597284c1ccf49483af1b26153fb5cb7c05bdf495f31e71c1cedd0559a04e2fe02a1056bb1e97e704d444f552

    • SSDEEP

      3072:tBPm5XqJGtCiP9pGvKQWVLY5cZGhZUoIDqVKdPQA+Rl3/DAs:zPm5GGtz9WUIUoIuVK2z/DA

    Score
    1/10
    behavioral10behavioral9

    • Target

      Login/ijl15.dll

    • Size

      344KB

    • MD5

      4fc074c3c6cf290bb2c11e5c31c97b27

    • SHA1

      95a0ea2ecb46ff8424d76d2f3bb9878794f57ae9

    • SHA256

      41d37bfb0a39017497e0aa373dc01f71ac9c5046c75f7cd269bee52112a5f3a1

    • SHA512

      7b83e498db19b63b4942e916b4b1f5fa0e27ef67f2ae5740ea84b2b96c5274a060f432ee7fd6567e7ecce038131fdb66be60f8e75c0711d505faee1189eb4bed

    • SSDEEP

      6144:zh0coAvGoHWX3ANhkWKOh/FwM02EasEJP4+2mfIqYYFYto2Dz+bxiFtDDdoInMDQ:GcoPoHWX3ANhkWKOh/FwM02Ea0+2mQqG

    Score
    1/10
    behavioral11behavioral12

    • Target

      Login/localhost062nodmgcap_window.exe

    • Size

      7.5MB

    • MD5

      10393cfe77a79aad0aebf06055179dd4

    • SHA1

      9c78f94f32a13de3cacc41204bc42e7b0c68dcc0

    • SHA256

      57d413d35436cab41e8465503d720293cec2cfd57683af3f8dd194f1768e16bd

    • SHA512

      4887f307ba0488d112dae2f087722ea3517bdc18e198d8c653e6da040efac4e709776b383da9b01a17c2f0b7692eb1ba69d259bd94159297cbd521c695c01ab1

    • SSDEEP

      98304:5Qttsbu/VhoxNCsLYrlwLEhbyjU1ydefA0cKPm9vfVPJrDP6C:5utVVhqC5mEhp16xrz6

    Score
    7/10
    themida

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida
    behavioral13behavioral14

    • Target

      Login/啟動遊戲.exe

    • Size

      88KB

    • MD5

      04be8ae451c7f0be6eeffb164d74ba21

    • SHA1

      fbd1c3641c5a6ab52f3eded3c3fe43b4649a19a3

    • SHA256

      c9afa926badf9cf4284239a71236f6b1785803b9e844d38a95e2679bb3f818b0

    • SHA512

      792ba94b56d4d1c9a6297215a9347ed974dcfe0778499117dc671c7072515c423826e825784d23ff0c11a4143263bb7bc43246efe8306491d1317951c130af94

    • SSDEEP

      1536:ay0YDLoMant4o3eEIV4EMVxZbeMdJvffxMWGrs6tKraMFlsC:ay0YD8ztdk4EcUMDqprNW/

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral15behavioral16

    • Target

      Login/錯誤檢測.bat

    • Size

      59B

    • MD5

      bfd97c887a898de651b113543a531967

    • SHA1

      8e9369a64e573f9b9229863cfc8dad17b62c030f

    • SHA256

      e27c907679df6d95162333f2a23888b728b321e9ede5babf20cc6acb283fa799

    • SHA512

      608107ee4958dab4d7aa5b140a7fbb7ecacc8deeec171ff0189d3be3ca004eeacc8a148272ca84445f9ab3ac6df42851f19f318de7d0ed60c9949bd51f15c0fe

    Score
    7/10
    themida

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida
    behavioral17behavioral18

MITRE ATT&CK Matrix

Tasks