Monster.Hunter.World.v20200109-v20201001.Plus.67.Trainer-FLiNG.zip
- SHA256 ff0db33d91832b82c11d6c8d931dffc91d4714db7375037376f646a64f618fe5
Behavioral task
behavioral1
Sample
14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Monster.Hunter.World.v20200109-v20201001.Plus.67.Trainer-FLiNG.zip
- Size 2.0MB
- Sample240310-l1gb3aaa45
- SHA256 ff0db33d91832b82c11d6c8d931dffc91d4714db7375037376f646a64f618fe5
- MD5 b40d541671ad18a068e73f824ade0844
- SHA1 0abf27fa9d82ba819f4f12100a3e8dd1568adfc4
- SHA512 7e44e34d462cef351b8ca218764514af095651c6f30cd75f1ff6ae4bab33de252626e0f50e51ee3266b2cfd49de68e6d31e6645710a7e3f0637afce533f39e75
- SSDEEP 49152:9EIunRjCgR+DkaRZT5sKuhlVXw+UlCCn4M/zwn:9CROUaRZtsKgX9yCCnt/+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- R77 family
- r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe r77_payload static1/unpack001/67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe r77_payload - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe unpack001/67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
File Explorer
-
Monster.Hunter.World.v20200109-v20201001.Plus.67.Trainer-FLiNG.zip.zip 2.0MB
-
14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe.exe 1.8MB
-
67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe.exe 1.6MB
-
67 options, mod required/readme.txt1KB
14 options, standalone version/Monster Hunter World v20200109-v20201001 Plus 14 Trainer.exe
- IMPHASH 4048d738ded1c82c336c66ca8ccbb888
- SHA256 00d1647eb26f25c998c9356f979fec37e016e3f6ed091573d2c8a9df3bd3e722
- MD5 2ecdaccc687965ff9ab98716aa6a1018
- SHA1 0f25b0e2c7ff2e39342c2e55ce77d03f557075cb
- SHA512 43c32e90f0bc8c7f7f604335d20c901cfffde866727d28055941a498c94394a19e337c438c3e8d8836fbbba956f4e63d62df261ed4adeef7ec43f4a898c08f68
- SSDEEP 24576:a6PAhmaafRqOlMGnp9Oi+u/g8Z9OjWYOzRFg7qaPECkDtGQjnEd6vVfacoDS0:a80OlDpv+u1ujWBzgR/kwonPvtacM
- MD5 SHA1 SHA512 SSDEEP
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
207668
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
ReadFile
WritePrivateProfileStringW
WriteFile
CreateFileW
GetModuleHandleA
GetPrivateProfileStringW
GetLastError
LoadLibraryA
WaitNamedPipeW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
GetCurrentProcess
IsWow64Process
SetLastError
WaitForSingleObject
ResumeThread
CreateDirectoryW
GetTempPathW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LocalFree
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetStdHandle
SetFilePointerEx
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
mscoree
CLRCreateInstance
CorBindToRuntime
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
winmm
PlaySoundW
Name
.text
Size
480KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=260, version=28117,
count=9, id=259, version=28117,
count=147, id=261, version=28117,
count=15, id=257, version=26715,
count=180, id=1, productName=Unmarked objects,
count=16, id=265, version=28314,
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,
67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
- IMPHASH a629facff1f65715d94567eb48725eef
- SHA256 56da7d8eac549241b6945c213eda978c340e80b15a1dd2f353010868d6a2b6aa
- MD5 7e7c37abc136770d72f401aa79958bea
- SHA1 83fed3e1cca9cdcabee891953edb0e83bd06dc24
- SHA512 83db97d27068cc350c715ead5bba0d2e88fe0891330a11783e647cceddddfe162ffa4b61dcfa8f49e46aaf28ad8e4e93c3984d72623656325f6cba108c67ca81
- SSDEEP 24576:mQNQoxsvHM5QR7iv5Drj4LMlCl8ubKropFOGaPECkDtGQjnEdpDSyhi7b:mQXEHfcva38uAGYZ/kwon2ho
- MD5 SHA1 SHA512 SSDEEP
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
221380
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
ReadFile
WritePrivateProfileStringW
WriteFile
CreateFileW
GetModuleHandleA
GetPrivateProfileStringW
GetLastError
LoadLibraryA
WaitNamedPipeW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
GetCurrentProcess
WinExec
IsWow64Process
SetLastError
WaitForSingleObject
ResumeThread
CreateDirectoryW
GetTempPathW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LocalFree
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetStdHandle
SetFilePointerEx
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
mscoree
CLRCreateInstance
CorBindToRuntime
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
winmm
PlaySoundW
Name
.text
Size
496KB
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
887KB
Virtual Size
886KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=260, version=28117,
count=9, id=259, version=28117,
count=147, id=261, version=28117,
count=15, id=257, version=26715,
count=181, id=1, productName=Unmarked objects,
count=16, id=265, version=28314,
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,
67 options, mod required/readme.txt
- SHA256 45f00cd69e76014db7ab0f72eff44d4d225cfa9545a6022a4f3244597b5ef3ac
- MD5 ee4c09b501ca5a63b55b4a4907a41c85
- SHA1 17ffc0bbed1bc0a48843c71ab24d7fade6e008a1
- SHA512 b1387d6022ed8d42e2bfac3be0855712ef218ca5255b130f338e6bb22c823caecf24d8195429cc2c8ff2e162489c2bd2a38de9a96128babf400daf5965fed0a1
- MD5 SHA1 SHA512