Overview
overview
6Static
static
3AottgRC x ....3.zip
windows7-x64
1AottgRC x ....3.zip
windows10-2004-x64
1Accessing ...de.txt
windows7-x64
1Accessing ...de.txt
windows10-2004-x64
1Assembly-CSharp.dll
windows7-x64
1Assembly-CSharp.dll
windows10-2004-x64
1Command Li...od.txt
windows7-x64
1Command Li...od.txt
windows10-2004-x64
1Custom Map....3.txt
windows7-x64
1Custom Map....3.txt
windows10-2004-x64
1CustomMaps...nity3d
windows7-x64
3CustomMaps...nity3d
windows10-2004-x64
3StreamingA...2).wav
windows7-x64
1StreamingA...2).wav
windows10-2004-x64
6StreamingA...d).wav
windows7-x64
1StreamingA...d).wav
windows10-2004-x64
6StreamingA...bg.wav
windows7-x64
1StreamingA...bg.wav
windows10-2004-x64
6StreamingA...bg.wav
windows7-x64
1StreamingA...bg.wav
windows10-2004-x64
6StreamingA...im.wav
windows7-x64
1StreamingA...im.wav
windows10-2004-x64
6StreamingA...ad.wav
windows7-x64
1StreamingA...ad.wav
windows10-2004-x64
6StreamingA...ad.wav
windows7-x64
1StreamingA...ad.wav
windows10-2004-x64
6StreamingA...se.wav
windows7-x64
1StreamingA...se.wav
windows10-2004-x64
6StreamingA...ad.wav
windows7-x64
1StreamingA...ad.wav
windows10-2004-x64
6StreamingA...ad.wav
windows7-x64
1StreamingA...ad.wav
windows10-2004-x64
6Static task
static1
Behavioral task
behavioral1
Sample
AottgRC x Prolonpo v.3.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
AottgRC x Prolonpo v.3.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Accessing the new gamemode.txt
Resource
win7-20230824-en
Behavioral task
behavioral4
Sample
Accessing the new gamemode.txt
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Assembly-CSharp.dll
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Assembly-CSharp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Command Lists for V.3 Prolonpo Mod.txt
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Command Lists for V.3 Prolonpo Mod.txt
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Custom Map Script for V.3.txt
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Custom Map Script for V.3.txt
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
CustomMapsProlonpo.unity3d
Resource
win7-20230824-en
Behavioral task
behavioral12
Sample
CustomMapsProlonpo.unity3d
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg (old2).wav
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg (old2).wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg(old).wav
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg(old).wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg.wav
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_win_bg.wav
Resource
win7-20230824-en
Behavioral task
behavioral20
Sample
StreamingAssets/CustomAudio/BG_Music/audio_mission_win_bg.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
StreamingAssets/CustomAudio/audio_ahss_aim.wav
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
StreamingAssets/CustomAudio/audio_ahss_aim.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
StreamingAssets/CustomAudio/audio_ahss_air_reload.wav
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
StreamingAssets/CustomAudio/audio_ahss_air_reload.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
StreamingAssets/CustomAudio/audio_ahss_ground_reload.wav
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
StreamingAssets/CustomAudio/audio_ahss_ground_reload.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
StreamingAssets/CustomAudio/audio_air_release.wav
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
StreamingAssets/CustomAudio/audio_air_release.wav
Resource
win10v2004-20230824-en
Behavioral task
behavioral29
Sample
StreamingAssets/CustomAudio/audio_blade_air_reload.wav
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
StreamingAssets/CustomAudio/audio_blade_air_reload.wav
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
StreamingAssets/CustomAudio/audio_blade_ground_reload.wav
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
StreamingAssets/CustomAudio/audio_blade_ground_reload.wav
Resource
win10v2004-20230703-en
General
-
Target
AottgRC x Prolonpo v.3.zip
-
Size
286.0MB
-
MD5
136c22d78794c3576aefa19e80da8e58
-
SHA1
dc1f810e87906cd16b9a9517f64e854bb362d6a9
-
SHA256
5bfaa3043afbc21b153b6cd0d5bd35129c61dcdb2fc97a545912c3c06c159b82
-
SHA512
4ed6166e9495bc07d683704b1f06363a9b4e7b05e77c729be08a951f4d9383d402cd9f1995df9aec7188345339a5007cfa6b0edabd68d4fd2d379d8ddc19bf49
-
SSDEEP
6291456:ZcD43fCv0mRsF/AaNHd0pL2rmxQmRsF/AaNOItWVdBKSSJ+B:WU3M0mRaTHEL2oQmRaTOI+dBme
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Assembly-CSharp.dll
Files
-
AottgRC x Prolonpo v.3.zip.zip
-
Accessing the new gamemode.txt
-
Assembly-CSharp.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Command Lists for V.3 Prolonpo Mod.txt
-
Custom Map Script for V.3.txt
-
CustomMapsProlonpo.unity3d
-
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg (old2).wav
-
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg(old).wav
-
StreamingAssets/CustomAudio/BG_Music/audio_mission_start_bg.wav
-
StreamingAssets/CustomAudio/BG_Music/audio_mission_win_bg.wav
-
StreamingAssets/CustomAudio/audio_ahss_aim.wav
-
StreamingAssets/CustomAudio/audio_ahss_air_reload.wav
-
StreamingAssets/CustomAudio/audio_ahss_ground_reload.wav
-
StreamingAssets/CustomAudio/audio_air_release.wav
-
StreamingAssets/CustomAudio/audio_blade_air_reload.wav
-
StreamingAssets/CustomAudio/audio_blade_ground_reload.wav
-
StreamingAssets/CustomAudio/audio_dodge.wav
-
StreamingAssets/CustomAudio/audio_flare_shot.wav
-
StreamingAssets/CustomAudio/audio_gas.wav
-
StreamingAssets/CustomAudio/audio_gas_burst.wav
-
StreamingAssets/CustomAudio/audio_gas_from_others.wav
-
StreamingAssets/CustomAudio/audio_gate_open.wav
-
StreamingAssets/CustomAudio/audio_horse_gallop.wav
-
StreamingAssets/CustomAudio/audio_jump.wav
-
StreamingAssets/CustomAudio/audio_land.wav
-
StreamingAssets/CustomAudio/audio_player_footsteps_1.wav
-
StreamingAssets/CustomAudio/audio_player_footsteps_2.wav
-
StreamingAssets/CustomAudio/audio_reel.wav
-
StreamingAssets/CustomAudio/audio_reel_out.wav
-
StreamingAssets/CustomAudio/audio_refill.wav
-
StreamingAssets/CustomAudio/audio_refill_kneel.wav
-
StreamingAssets/CustomAudio/audio_revive.wav
-
StreamingAssets/CustomAudio/audio_rope.wav
-
StreamingAssets/CustomAudio/audio_rope_hit.wav
-
StreamingAssets/CustomAudio/audio_rope_returned.wav
-
StreamingAssets/CustomAudio/audio_slide.wav
-
StreamingAssets/CustomAudio/audio_sword_swing.mp3
-
StreamingAssets/CustomAudio/audio_titan_die_1.wav
-
StreamingAssets/CustomAudio/audio_titan_die_2.wav
-
StreamingAssets/CustomAudio/audio_titan_die_3.wav
-
StreamingAssets/CustomAudio/audio_titan_die_fell.wav
-
StreamingAssets/CustomAudio/audio_titan_grabbed_soldier.wav
-
StreamingAssets/CustomAudio/audio_titan_grunt_1.wav
-
StreamingAssets/CustomAudio/audio_titan_grunt_2.wav
-
StreamingAssets/CustomAudio/audio_titan_grunt_3.wav
-
StreamingAssets/CustomAudio/audio_titan_hit_eye.wav
-
StreamingAssets/CustomAudio/audio_titan_jump_groan.wav
-
StreamingAssets/CustomAudio/audio_titan_slap.wav
-
Titan Spawner Logic Code.txt