Overview

overview

8

Static

static

8

announce.exe

windows10-2004-x64

1

filterscri...se.vbs

windows10-2004-x64

1

filterscri...ip.vbs

windows10-2004-x64

1

filterscri...as.vbs

windows10-2004-x64

1

filterscri...el.vbs

windows10-2004-x64

1

filterscri...ug.vbs

windows10-2004-x64

1

filterscri...rn.vbs

windows10-2004-x64

1

filterscri...s1.vbs

windows10-2004-x64

1

filterscri...de.vbs

windows10-2004-x64

1

filterscri...or.vbs

windows10-2004-x64

1

filterscri...ll.vbs

windows10-2004-x64

1

filterscri...ls.vbs

windows10-2004-x64

1

filterscri...go.vbs

windows10-2004-x64

1

filterscri...er.vbs

windows10-2004-x64

1

filterscri...ip.vbs

windows10-2004-x64

1

filterscri...ed.vbs

windows10-2004-x64

1

filterscri...g1.vbs

windows10-2004-x64

1

filterscri...ch.vbs

windows10-2004-x64

1

filterscri...ds.vbs

windows10-2004-x64

1

gamemodes/...ll.vbs

windows10-2004-x64

1

pawno/incl...ts.vbs

windows10-2004-x64

1

pawno/libpawnc.dll

windows10-2004-x64

1

pawno/pawnc.dll

windows10-2004-x64

1

pawno/pawncc.exe

windows10-2004-x64

1

pawno/pawno.exe

windows10-2004-x64

8

samp-npc.exe

windows10-2004-x64

1

samp-server.exe

windows10-2004-x64

1

Resubmissions

29-12-2022 21:53

221229-1rvknaec49 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    samp037_svr_R2-1-1_win32.zip

  • Size

    2.0MB

  • Sample

    221229-1rvknaec49

  • MD5

    0084b401f2516b98ebedeea5e09262cf

  • SHA1

    41cb1c9ce6c152d581945032f8b89135b29b3aae

  • SHA256

    e12e7483d4df0349f52e2c5f47d6afd3f782acbc2bbb19fa61adced3bfff2d90

  • SHA512

    4189c94ca8612c87872e62371be53d650194761652960f043afb66fd85014bf12d249b80007a098a29d5326917f6db23b68d8c5af71b1b7c3fe28016c90ad2e4

  • SSDEEP

    49152:v1SOsdYXgd3L2CBN56ohoOtn1DE1vliQvLFHM:v1mdrb7PPN8TFHM

Score
8/10
upx

Malware Config

Targets

    • Target

      announce.exe

    • Size

      40KB

    • MD5

      b4fcc1c57c10b87427fa1ae3e02b70c6

    • SHA1

      46f4c41bf2f6aa2e7e9871e733f632b4aa73213b

    • SHA256

      2a0270ee3766ff09dfcb2aa70316c4076c6c713154784c9b324509d66c019a26

    • SHA512

      f769a656a69ab6b5ba2313c60949aaaedc33a4934b821102a584d85942d096267cb01abc8b0f1abd898c5b5f2d199559c669df4f430e93a42bb47a92ac4626e9

    • SSDEEP

      384:VzIa1qY2wCLK5LkyAZAhmjaJ5iXwCI6RUbiBkOTeZpPxyjO9viZAeouqEolmoLJ9:ya1qGZIyiZjaflAkOCpwjWviZKB7JD6

    Score
    1/10
    behavioral1

    • Target

      filterscripts/a51_base.pwn

    • Size

      14KB

    • MD5

      ef0c54aa3df6892cfe37a3cfaa5d4017

    • SHA1

      83b2a8e59ed673279c56403a6a8fb508287faac4

    • SHA256

      fd3d2544184277e39eb34b62197745bff6724789a0db612468bd3ee344bbfe1e

    • SHA512

      56b3a73821ba87aeae41976969345a71ad1d7f370cfd23c13dbc8a57e391bd287afcdf0c48a0139ca8e8d97ec052aaa12cffda48fd724b4c133d4403348e657a

    • SSDEEP

      384:0AKIAwrp667MLQtqVDcRf3fRMxMh+ObgdwLPb73S713L7JQN7QV:0AKILrp66MLQtqVDzxMRbgdwLP/3y13X

    Score
    1/10
    behavioral2

    • Target

      filterscripts/cargoship.pwn

    • Size

      6KB

    • MD5

      c4727f3d4070b55ab8501a45f2d29b1d

    • SHA1

      70416d9bc02b12b9347b046cf397d9fb4a23b95c

    • SHA256

      154561cde86e3ed4b1ab572ab208e4a808f0cf5abbecfd861ff83d180346e6ff

    • SHA512

      69a1423cc08b042574ec796d89b6e93dc40cfd7c2f6c172aa66971de249f2fcfd3bcbcbf5957301d9364473b8efc489c780b1fcf0dca7ff84becac6e80e12bb5

    • SSDEEP

      96:yV8U6Rnb2v9jtO1WoXQt6ml/CfJwukmZBmrXwTaZPF3MT3d:M8U4b8PO/I6BkmujwTaZPxMbd

    Score
    1/10
    behavioral3

    • Target

      filterscripts/dillimore_gas.pwn

    • Size

      5KB

    • MD5

      f3defd470beaefac01ea5027aca20a12

    • SHA1

      fc8d9aa43e905aeb17e75b753704242c566c50a4

    • SHA256

      50ec84777c8e71c3d61dbedc285d9b2a2beecb4e2d89919820bcc62d39854f4e

    • SHA512

      448b559c21a87f9dc7136f8a9cfff82abab2ecc9398391c2f178f955b73217c042afd590a5f4b215eb5661b5b8c61498768108e76af1dc57201ab6060352d742

    • SSDEEP

      48:0oJ/1D2dlOcJSWgoZFf6CDC7jmyygBSpBkkLvpBnKIdObnTRhNiuwHpb8112d+En:00Ny7O9WgovfM7SpcCBKRf/t0aQdtnrf

    Score
    1/10
    behavioral4

    • Target

      filterscripts/ferriswheel.pwn

    • Size

      3KB

    • MD5

      f75e83948d617ad550c888966437d918

    • SHA1

      36b0ef12402d084f526488462a1913d3bd630421

    • SHA256

      47f5284d95fe337c2c3fd1240f51892f936e8035212a8f950ae7ec4a11004bdc

    • SHA512

      fb4a0ac9a80f01bcdddf021c5a7a0d349d8cfafb1367a226dea153dd97819c108a190e15904c13c84251db962f29b1d0df8146cdf9ba4a233e38db00403b4ef3

    Score
    1/10
    behavioral5

    • Target

      filterscripts/fsdebug.pwn

    • Size

      57KB

    • MD5

      fae6616d7dbabfed4f396403a3f78f35

    • SHA1

      b48b4f17fabad7274658f112f4505e175886d1f2

    • SHA256

      549456be6806e8d7d6fb6bf77bf3475d579d29d93dc6ef8042b460584f1ec1cf

    • SHA512

      ff6ae35a2056380fb01392e6110da011c1f437c9d2e8f0ef04d7e5b5a278d206d5555691cc7d669449d60f066866044b11eb8d5da5357e12396ee76ebafe1e08

    • SSDEEP

      768:Zsh0jQGpqzSx8fi/70XPtmbVCeLQYFv1rL:yh3zc8fkYk4+L

    Score
    1/10
    behavioral6

    • Target

      filterscripts/kylies_barn.pwn

    • Size

      4KB

    • MD5

      7189f041a74efd922a55b9765e9f4e50

    • SHA1

      1bd12fff7667d84f29eab340ab3d618985e7ace4

    • SHA256

      22ea39e3c524fd29e2614d73031d46f8a5b2856c2a9f8c72c869a5b776311921

    • SHA512

      31ebe7031c2737144eaed27581ad3a1cc6d5665167643618007921736f31d1158a2f122a456125e9924c1b13f5d1e466e16000ed42b705da758564eed2cdf44b

    • SSDEEP

      96:0WO1TgOYIgolDu7Dphil6KRZVPNe1fqdpVpf:0WcTmIgCy7Dphi9RPFesd/pf

    Score
    1/10
    behavioral7

    • Target

      filterscripts/ls_apartments1.pwn

    • Size

      24KB

    • MD5

      90cd00b542ea71937b75aadeb723eb5d

    • SHA1

      43b3e6c41084f6e2aac4197d96099b3f8c58db13

    • SHA256

      576964e8e703de0cc76c0da8fd6243e309812713683b9e3f4e73a247671deb0e

    • SHA512

      0c8a558d0ecfae476c663a4f1928e319cf37549925880759995032b3a61450a2d6d468da46fb78639d9094fb8c4e28a2ee011b62f77a23a62ba488fcd13d2314

    • SSDEEP

      768:2pS98jurSlmutNhrJUBzSJB5W/T0v6h+MyxcFb/mguhNrae+/qn6IEbR7Z6:N8juiNh24W/TY6h+MyxcFb/mguhNraHO

    Score
    1/10
    behavioral8

    • Target

      filterscripts/ls_beachside.pwn

    • Size

      23KB

    • MD5

      5162ca23a306f9f8d89da86f5649bdc6

    • SHA1

      1d69546a4123e1580afff658bdbb1ddb77b95bad

    • SHA256

      3d039a36fd49abca7b6d4c58484b0eb7a3878f346e640332ebaea55760650541

    • SHA512

      0da94455775f0ab1bb4c96e40931e58542781fa1792123f7e00d3dd47cb7c17806323aa54f1edb87508cfe0e9f3d7cfd492ee170cddf4323cb6f86fc0d45b368

    • SSDEEP

      384:25SeS9qQGHugiNG3yCc7Jp8jckpFWqJ0eM6h+MyxcFb/mZ9Y77v7Ge+e8Bqe7QMo:2NS9pGO1NOyhJpickFWqJ0v6h+MyxcFR

    Score
    1/10
    behavioral9

    • Target

      filterscripts/ls_elevator.pwn

    • Size

      14KB

    • MD5

      58dca3a70494602f3ee067e9e4259991

    • SHA1

      6b4505386e8d9860a1da7b9662be4a0b0e24d164

    • SHA256

      e1df2fba86b16a4cbe724acfb0c4c6030d3128eafb9edf186c109161b95457f7

    • SHA512

      edbb49669927f38fa25ea6f17c02bec6fb2f002a5b4ee51ff327a39e32de3dda770158cbf7c354ff571f32db70cb2742035693c84e229ab4b8354bab8d8d31d8

    • SSDEEP

      192:1yZ/uK9dpI6XCNZ7+x/u30aC6YaRvGgC30vdegYTQpgBWqT+gPjmCJOgP5gqYeth:4duK9dpI6XCNZ7+x/u30aCYgIgSqT

    Score
    1/10
    behavioral10

    • Target

      filterscripts/ls_mall.pwn

    • Size

      15KB

    • MD5

      dd1202ca654dedb93edcf45a5128f19c

    • SHA1

      2142af3c2d34655717e41a73c711356a17f68c82

    • SHA256

      03905c8f259abd754a01c00149be177e5625e65e2ab06ba02d5109d76be46bd4

    • SHA512

      68bc9eae457f0c2d0e565e1b5d845714afe8ec2b574bf69f6541a465321f0c3a810ddc9aa116899889af675ba81f71c6b23b639632bd885261bd168fe3fc673e

    • SSDEEP

      192:GmWWLnbYLw3pRqHK1CxesqfaDeWn58Grke:Geb9C4TrUh

    Score
    1/10
    behavioral11

    • Target

      filterscripts/ls_prisonwalls.pwn

    • Size

      14KB

    • MD5

      983fa5f8591f7c47d11eb83821718a1a

    • SHA1

      9af1cd998f9fe356e32f76b3f1bbd55786fbc0cc

    • SHA256

      ab4a1412b5165f33bb6b09e04730d434e72b33099774a5bcde4efeb51bfe6f3b

    • SHA512

      3f39e9779ec4eb1b84c0b40e64ff832cca9f0fee309a4a03753ef8d1e41cf39f29689073abdec87390537becbca86cc3746e7eb5b8fbca5777abba27037d7a53

    • SSDEEP

      384:0ckv68oY3n78nB7bZf/fEAFOStMlI7L5i7Hi74DdY/BfrW7j7r6zu7CAgs+:0Lv68oY378nFeAFBMlI7L4HC4DdY/Bfj

    Score
    1/10
    behavioral12

    • Target

      filterscripts/ls_wellsfargo.pwn

    • Size

      4KB

    • MD5

      c25fe30437fa0117f27091b3218c9989

    • SHA1

      960d18d572ae973be8609f017cb3c7d88c8b5a30

    • SHA256

      739cb04586b177836b05ca4a717f756677d36f463ee80860aa29f2d1a0b3bc01

    • SHA512

      c061333ce18592e48feb0711d85e96cf747bada795b857918df2da45cbb9eba0b837c2a0305b7b6dc8dfb1604c76087e67d0da94348f8dc8384cf63c20d45c23

    • SSDEEP

      96:0fTkzcOL2BgoazxfCf7ZpLZ/k6KRz/tf1Hkvqdj4f:0gzx2Bg5zZi7ZpLZMvRzFfZKqdj4f

    Score
    1/10
    behavioral13

    • Target

      filterscripts/ospawner.pwn

    • Size

      14KB

    • MD5

      ac56cf896cf138d10fd47a2bbe7c15ba

    • SHA1

      4eaf4275f7bfbeba08c96b73256897199768fb5f

    • SHA256

      4a4940eb1c5fc9f1c73ecc3cb561b7e0fa399846ff8c460be6f79ed5cf96b7db

    • SHA512

      06638f388076473c0bf6dbdd68de019a32579cbe0cc95dd378abf1382c1b3cb8a1ff202d2edfca9b9761920b1e8ced4b4118326756600fce615d1ae0694178d0

    • SSDEEP

      192:ceSZ66dLAN2LQdLSwyqc0z31z3vEor0nYyX1fpaYSnHAoP:cey/TmQUJF

    Score
    1/10
    behavioral14

    • Target

      filterscripts/pirateship.pwn

    • Size

      6KB

    • MD5

      8f49b4690eb5d82074d8814ae7dfaaed

    • SHA1

      4a300f7ddba1f32243c97a8252b52408f451cdb3

    • SHA256

      cc06766df6fbb944a20e54ff6c9a6c3b54207135c3af46c0e3a9bc0f2afb2a71

    • SHA512

      9fb7f3e961659412b51b1d1ea5f031622414fc7dff7a288a9f98e2b76e1ab21608f106050a1ab428dc452aa780eb9340fad93a8f23044d929c1644161c2f2cb3

    • SSDEEP

      48:Vq4gmHy8D3cvhQVZ6hfEv8+DTTGwF/7zBVkqCzyuSstHIUQ9UkRZlKHocVklzyqL:VcqL6CxThF//WtHIUQWkRZgClXwU7

    Score
    1/10
    behavioral15

    • Target

      filterscripts/safe_animated.pwn

    • Size

      6KB

    • MD5

      7e29d49426f30836009d402464978b2e

    • SHA1

      56bd08c4fedf051a814466d8333780734926be84

    • SHA256

      82641a059f172899486cf137f6c8c284b65c632b8f5e953b74c64885a3770e1a

    • SHA512

      2a1e64afabcd3ce80206c4d33ac71dd51da5ff147550416c665ad8abdde5f0785c8cf7965fee537696506da229a6ec854fa803b179905635053d7e5c6bb6d6ef

    • SSDEEP

      192:0fsEFUn7AL7sTX7Ihf7s7t7UMpqzRAEiK4f:0fsnn7Q7O7wf7G7ZqzqlL

    Score
    1/10
    behavioral16

    • Target

      filterscripts/sf_building1.pwn

    • Size

      5KB

    • MD5

      8d81978d589d5d6dca6a880405c92f08

    • SHA1

      e97a0db17b220479571da62fc8a5066660012250

    • SHA256

      41f998e18bd9deafb696f69cedaaf176e514332c79a8707cc08cfc62d4e27f44

    • SHA512

      4d63864dca839283e03b06dacde3259da4b6d72e46c7ef104b3bca43ee0ab7ada957ee3deadc49bb7454f5ba6f450f28de0d62aad7c76b2783ebb437e67b30ce

    • SSDEEP

      96:0dIcOyXObgovfZ4m4H4Qg7Rp6rD4ur4x840KRk/tDM94ca4l4/y4b4m94Dd0Zif:0ywXObgyfj7Rp6rV8RRkFgPO9Ad0Uf

    Score
    1/10
    behavioral17

    • Target

      filterscripts/sf_zombotech.pwn

    • Size

      20KB

    • MD5

      1805a52103643984e95cfb686361e083

    • SHA1

      817431f585deed7b51e78e9d53afe24c5362def9

    • SHA256

      90495f05f8270b34f45d5ef382e287170e3c54ef759f6056f4a424160c6d6d05

    • SHA512

      4e9d46747e34a2c8911db881e7c3c563478370aecb0259d827151d3139f1a435c728aebe71947bce098b60471e54f120c145e3edab81f767c5a521b7469330a5

    • SSDEEP

      384:079RyzGapBmPuiv3b37qU2HzKFZto3giZaKyly3WH2R1vvi3IceI/lUNjJfnlQM:0ZQzfpBmuiPbLqU2TKFZtMgiZaKyly3j

    Score
    1/10
    behavioral18

    • Target

      filterscripts/test_cmds.pwn

    • Size

      62KB

    • MD5

      bfa07c082ea47bad6bd424b12f33bd35

    • SHA1

      3cc6ac07fc4a1e5876f97a4de2cccc0aa3b1b65c

    • SHA256

      d8adcbb4fa59f73f4d82e76be41c93dbfb35adc66d9dc7ec206ca4dd595a136c

    • SHA512

      9fc57575bd04680ce56aa4807cd8f13788c957411f85dd23b31d2c4c97bca883e77b16a4213f016149692369075bc361425dc9f8f64355081e80c3ed4a6e9911

    • SSDEEP

      1536:GTKhHtUuGH54a6ew+3gwdl3l6aRTNAo7HRN8:90gwdr8

    Score
    1/10
    behavioral19

    • Target

      gamemodes/rivershell.pwn

    • Size

      23KB

    • MD5

      03a50b880d24d143f2e526627bb9b3be

    • SHA1

      f240b4f267a6a97680616dc2b91dae337a9d6743

    • SHA256

      bcffe73056735d5cec557a2b1614718a5aedfe6c69004dd76d528a3b61a3774a

    • SHA512

      462458f82d78c79e3320a3857efb177299641ed80f89945a0b3368b1b8fcfd97114d80ff73e4ce766877dc1a604c5685d287de3caf9f0055b535010678ecf044

    • SSDEEP

      384:OGrTxmtaemPzllasymSa6T28Br0Sn9Nh6NLuE/EAu+Oo:OGrTxmtaemPzllasymSa6T28Br0hNLug

    Score
    1/10
    behavioral20

    • Target

      pawno/include/a_objects.inc

    • Size

      4KB

    • MD5

      0e3e6228ed73b6f5f08d1b0afff3f837

    • SHA1

      e4b34a27ebe52cfb6550908c4ddefc8c1c58f758

    • SHA256

      4ed8d7ef6e1fdb2aa393eeb2861ba730f3e87c1c219c30df314d2acdcece96f3

    • SHA512

      086697422a9c4dcbd0d97d51e13dc6bb0f4f51dd955c4bd2bdd1f0ab4fb2caff31e8db94a297b3b0167af3a9cb3d97c342c3cef7035c4c0d60a7fb92cf7f65c3

    • SSDEEP

      48:I4LaUQaUFxaMSNBczpFBxILLIBdfX2Y4FNi1FNiMp:I4mU3UFcIpTmLLIHfaF01F0g

    Score
    1/10
    behavioral21

    • Target

      pawno/libpawnc.dll

    • Size

      275KB

    • MD5

      1f3b35dc739f9e6d843cfaa595f320b2

    • SHA1

      ac37a03427b356e3e4c1c1fe9d1f10f4a6d97f9c

    • SHA256

      b7a6d406aaad6c6dc6621889a3e5c006755a16e577a46a806df2a85203813b56

    • SHA512

      549c8b7ee2c4e59220e74053ef0147d35fdf6cb923726956e882c3e5640483e0108c3ccaca96934ce94ee3d387a16f022df86f38dbb6692c6b688ec8fc0734d7

    • SSDEEP

      6144:DQUATh1kDLdQRUOi6XqXOKcB5B5jriaCvWwApMtye6cEIfUGmpkRQBfcqlu4V2lr:DQUATh1k3dQRUOi6XqXO9/B5jriaCe/E

    Score
    1/10
    behavioral22

    • Target

      pawno/pawnc.dll

    • Size

      160KB

    • MD5

      127ce048627abc0c6e599b16334a6f24

    • SHA1

      ddc099b88460379e0d6dc85b73966b6019b30d8c

    • SHA256

      62fde5039bd5be38e244900f5ae81567cf1e4d628bf0e9d0e0a6ad675853581c

    • SHA512

      55f03242c83cf4573d5da3d10112bb6b1ad717bbb02dc8b9f2477cf453c30baa180a5684d2c608dd145715dcc8534675c6f4cc4e4fe2c2a05d079d4c88c2983b

    • SSDEEP

      3072:OP/bQiOGbQ1PUMA4LK3zIAO6uiDMy4RL89IkkF8xgEhuM:OP/Vt2NLKvnuqMywkk/Eh

    Score
    1/10
    behavioral23

    • Target

      pawno/pawncc.exe

    • Size

      15KB

    • MD5

      5b8766d335b25f1a180af10cb736b6ba

    • SHA1

      83f081d683840f9e9cfb161801d13edbcfd50646

    • SHA256

      e086cbaeee177c5e56cc3cf124a014f3496297c8d8de0fe17d49468584a9fb3f

    • SHA512

      25bf21940a7399fbe5709997d5327142d706e5023cd14560b29d65eb1e1dc3526a3432c94b0d711f2affedbfdcb6f3be84af6549a742d0d62832530558f58d2d

    • SSDEEP

      192:1m58SVl+4smhjTMW6vrkTGeTDT//BWLGeTkGeTGOvs7HlFMMafc:1m58SV04lt6MGevTnYLGeQGeyVHlSMak

    Score
    1/10
    behavioral24

    • Target

      pawno/pawno.exe

    • Size

      297KB

    • MD5

      325558d389c149c420a2753e0d163d09

    • SHA1

      3d1ac2fafe3ce5f5348a77c891074551a51e8fda

    • SHA256

      796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

    • SHA512

      182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

    • SSDEEP

      6144:8qV54oUeSsMY3j0cI8rdYEylF2EHJ8Sj6vzHrh8wDVU3wMs9ZFW:8qV5dU7oTWKYEEF5J87vzLh8aVJS

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25

    • Target

      samp-npc.exe

    • Size

      276KB

    • MD5

      27f10be9a4ed09e4b102952bc5652f3e

    • SHA1

      5babd0e71d20a32c658ef29478f67e128f683ab1

    • SHA256

      a6d912e93d0b3569bd228106e678c46227c90faf360b6fee24b9027b021605e7

    • SHA512

      44e1d33c9bb959bdab24e8aafdc172ef53c08a49d5e661703ab584264528f81b4cfe419e0be88156e87dc756cb011b335707593f82e42cb1a38c57c1688614f7

    • SSDEEP

      6144:0MDcW16ZwIJssQ8Uy4UcYZVTc2rPzjJOHAOgxqqDLu2:0MDV1EEd+4UcUVTjPEHRqnu

    Score
    1/10
    behavioral26

    • Target

      samp-server.exe

    • Size

      928KB

    • MD5

      b33733969f7dc7572e154ab70011767f

    • SHA1

      efe84d962896a174e7e698c6f856d3e03cdc68d5

    • SHA256

      61ce119262e8c23b0a99f3c56110d8033c2c3ac9b4ef8284f6997fb100db099e

    • SHA512

      07627d8dc8e521ee0de1755281612e9ab9a027f032e67cdd17af89568ba5792b8d9268476de90392835a3b7db43903541895d7a46c364d1845df2325209de0ca

    • SSDEEP

      24576:qw5CxuTguYyjlG1qzosYD/mYsMg7/k/8LWB+u:kFyjPW+Ys9xWA

    Score
    1/10
    behavioral27

MITRE ATT&CK Enterprise v6

Tasks