Overview

overview

10

Static

static

10

RDR2CHEAT/...er.exe

windows7-x64

10

RDR2CHEAT/...er.exe

windows10-2004-x64

10

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...op.dll

windows7-x64

1

RDR2CHEAT/...op.dll

windows10-2004-x64

1

RDR2CHEAT/...te.dll

windows7-x64

1

RDR2CHEAT/...te.dll

windows10-2004-x64

1

RDR2CHEAT/...te.dll

windows7-x64

1

RDR2CHEAT/...te.dll

windows10-2004-x64

1

RDR2CHEAT/...te.dll

windows7-x64

1

RDR2CHEAT/...te.dll

windows10-2004-x64

1

RDR2CHEAT/...te.dll

windows7-x64

1

RDR2CHEAT/...te.dll

windows10-2004-x64

1

RDR2CHEAT/...te.dll

windows7-x64

1

RDR2CHEAT/...te.dll

windows10-2004-x64

1

Resubmissions

11/10/2023, 00:51 UTC

231011-a7gevsbe37 10

11/10/2023, 00:50 UTC

231011-a652tshd41 10

31/01/2023, 09:06 UTC

230131-k21xeshe3z 7

Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 00:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RDR2CHEAT/build/net40/x64/SQLite.Interop.dll

  • Size

    1.6MB

  • MD5

    99ba1cc59ac3cf71236445774c782a5b

  • SHA1

    0c57880bd2d1d4585667789ed4497550c30c3255

  • SHA256

    656c25b53c13ec6aa605eca0ca196794dad57f601f169d39d3f5fb7510046846

  • SHA512

    4daa80fa210c823beebde191706dad6c2735e16495c0018f7294d3dd8d7316d0814cf45605749709becdd8aafd1686be15e36d846c4efb3087d46f5ed06a7db9

  • SSDEEP

    24576:zgUzpL7YiiFYSNSHZxPCw1NllcvMgQ4AkEzAKD9xTPnf:n7Ow3PCw13lcEVP

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\RDR2CHEAT\build\net40\x64\SQLite.Interop.dll,#1
    1⤵
      PID:4356

    Network

    • flag-us
      DNS
      136.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      136.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      54.120.234.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      54.120.234.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      146.78.124.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.78.124.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      38.148.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      38.148.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      112.208.253.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      112.208.253.8.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      208.194.73.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      208.194.73.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      84.65.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      84.65.42.20.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      136.32.126.40.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      136.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      158.240.127.40.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      158.240.127.40.in-addr.arpa

    • 8.8.8.8:53
      54.120.234.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      54.120.234.20.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      146.78.124.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      146.78.124.51.in-addr.arpa

    • 8.8.8.8:53
      38.148.119.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      38.148.119.40.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      112.208.253.8.in-addr.arpa
      dns
      72 B
       126 B
       1
      1

      DNS Request

      112.208.253.8.in-addr.arpa

    • 8.8.8.8:53
      208.194.73.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      208.194.73.20.in-addr.arpa

    • 8.8.8.8:53
      84.65.42.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      84.65.42.20.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.