LordsBot-Release.zip
- SHA256 5d23bb56ae025619efa102acbaf07801ceb76f457ca12edd3cbc89151e4339d0
Overview
overview
7Static
static
10LordsBot-Release.zip
windows10-2004-x64
3GameAssets...ct.txt
windows10-2004-x64
1GameAssets...st.txt
windows10-2004-x64
1GameAssets...ct.txt
windows10-2004-x64
1GameAssets...er.txt
windows10-2004-x64
1GameAssets...my.txt
windows10-2004-x64
1GameAssets/TDHero.txt
windows10-2004-x64
1GameAssets...st.txt
windows10-2004-x64
1GameAssets...ge.txt
windows10-2004-x64
1GameAssets/Table.crc
windows10-2004-x64
3GameAssets/Talent.txt
windows10-2004-x64
1GameAssets...Lv.txt
windows10-2004-x64
1GameAssets...ee.txt
windows10-2004-x64
1GameAssets/Tech.txt
windows10-2004-x64
1GameAssets...nd.txt
windows10-2004-x64
1GameAssets...SP.txt
windows10-2004-x64
1GameAssets...P2.txt
windows10-2004-x64
1GameAssets/TechLv.txt
windows10-2004-x64
1GameAssets...SP.txt
windows10-2004-x64
1GameAssets...P2.txt
windows10-2004-x64
1GameAssets...on.txt
windows10-2004-x64
1GameAssets/TechSP.txt
windows10-2004-x64
1GameAssets...ee.txt
windows10-2004-x64
1GameAssets...SP.txt
windows10-2004-x64
1GameAssets...06.txt
windows10-2004-x64
1GameAssets...01.txt
windows10-2004-x64
1InstallNet6.bat
windows10-2004-x64
7Lords Monitor.exe
windows10-2004-x64
7LordsMobileBot.exe
windows10-2004-x64
7MSVCP120.dll
windows10-2004-x64
1MSVCR120.dll
windows10-2004-x64
1Updater.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
LordsBot-Release.zip
Resource
win10v2004-20231215-es
Behavioral task
behavioral2
Sample
GameAssets/Subscriptioneffect.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral3
Sample
GameAssets/TDCardCost.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral4
Sample
GameAssets/TDCardEffect.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral5
Sample
GameAssets/TDChapter.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral6
Sample
GameAssets/TDEnemy.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral7
Sample
GameAssets/TDHero.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral8
Sample
GameAssets/TDHeroPlaylist.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral9
Sample
GameAssets/TDStage.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral10
Sample
GameAssets/Table.crc
Resource
win10v2004-20231215-es
Behavioral task
behavioral11
Sample
GameAssets/Talent.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral12
Sample
GameAssets/TalentLv.txt
Resource
win10v2004-20231222-es
Behavioral task
behavioral13
Sample
GameAssets/TalentTree.txt
Resource
win10v2004-20231222-es
Behavioral task
behavioral14
Sample
GameAssets/Tech.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral15
Sample
GameAssets/TechKind.txt
Resource
win10v2004-20231222-es
Behavioral task
behavioral16
Sample
GameAssets/TechKindSP.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral17
Sample
GameAssets/TechKindSP2.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral18
Sample
GameAssets/TechLv.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral19
Sample
GameAssets/TechLvSP.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral20
Sample
GameAssets/TechLvSP2.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral21
Sample
GameAssets/TechRecommendation.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral22
Sample
GameAssets/TechSP.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral23
Sample
GameAssets/TechTree.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral24
Sample
GameAssets/TechTreeSP.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral25
Sample
GameAssets/TileMapEx_006.txt
Resource
win10v2004-20231222-es
Behavioral task
behavioral26
Sample
GameAssets/TileMapEx_101.txt
Resource
win10v2004-20231215-es
Behavioral task
behavioral27
Sample
InstallNet6.bat
Resource
win10v2004-20231222-es
Behavioral task
behavioral28
Sample
Lords Monitor.exe
Resource
win10v2004-20231215-es
Behavioral task
behavioral29
Sample
LordsMobileBot.exe
Resource
win10v2004-20231215-es
Behavioral task
behavioral30
Sample
MSVCP120.dll
Resource
win10v2004-20231215-es
Behavioral task
behavioral31
Sample
MSVCR120.dll
Resource
win10v2004-20231215-es
Behavioral task
behavioral32
Sample
Updater.exe
Resource
win10v2004-20231222-es
| resource | yara_rule |
|---|---|
| static1/unpack001/LordsMobileBot.exe | asyncrat |
| resource | yara_rule |
|---|---|
| static1/unpack001/LordsMobileBot.exe | ducktail_3rd_stage |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/BattleSimDll.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=136, id=224, version=20806,
count=12, id=223, version=20806,
count=55, id=225, version=20806,
count=5, id=203, version=65501,
count=84, id=1, productName=Unmarked objects,
count=16, id=229, version=21005,
count=1, id=220, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
May 10, 2023
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Async RAT payload
Detect Ducktail Third Stage Payload
Jan 6, 2024
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30152,
count=1, id=258, version=30152,
Dec 4, 2017
SERIALNUMBER=91310114MA1GT9FP6N,CN=Shanghai Changzhi Network Technology Co.\, Ltd.,OU=IT,O=Shanghai Changzhi Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a696164696e67,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Dec 4, 2017
SERIALNUMBER=91310114MA1GT9FP6N,CN=Shanghai Changzhi Network Technology Co.\, Ltd.,OU=IT,O=Shanghai Changzhi Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a696164696e67,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=203, version=65501,
count=222, id=1, productName=Unmarked objects,
count=3, id=221, version=20806,
count=1, id=199, version=41118,
count=1, id=223, version=20806,
count=51, id=225, version=20806,
count=77, id=224, version=20806,
count=6, id=229, version=20806,
count=1, id=220, version=20806,
count=1, id=219, version=20806,
count=1, id=222, version=20806,
Dec 4, 2017
SERIALNUMBER=91310114MA1GT9FP6N,CN=Shanghai Changzhi Network Technology Co.\, Ltd.,OU=IT,O=Shanghai Changzhi Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a696164696e67,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Dec 4, 2017
SERIALNUMBER=91310114MA1GT9FP6N,CN=Shanghai Changzhi Network Technology Co.\, Ltd.,OU=IT,O=Shanghai Changzhi Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074a696164696e67,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=3, id=203, version=65501,
count=180, id=1, productName=Unmarked objects,
count=701, id=224, version=20806,
count=49, id=223, version=20806,
count=54, id=229, version=20806,
count=185, id=225, version=20806,
count=1, id=220, version=20806,
count=1, id=219, version=20806,
count=1, id=222, version=20806,
May 10, 2023
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=641 688 744,CN=JDN Tech Pty Ltd,O=JDN Tech Pty Ltd,L=Tea Tree Gully,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US