8fabbb51cf3abe7a7e9a7fd6faab4b091127c859b9251d3d1b668570ae6d35de

Sharing

Copy URL

Twitter E-mail

General

Target

Everloop.v1.0.7.zip
Size

759.6MB
Sample

240406-ap8fmafh97
MD5

75262ea1a21518792df94da83daa83c2
SHA1

31fba61aaa0cfa6ec3b795781a5619612ff7380c
SHA256

8fabbb51cf3abe7a7e9a7fd6faab4b091127c859b9251d3d1b668570ae6d35de
SHA512

f6a01fda9b10c48c21fd1653643414642b5c067a79575e008c78c692592a8269a9a8c7264dc1f9a373550af8dac6b88bde7bd27a4f929d08f9915f1448508c10
SSDEEP

12582912:7fmfWDXe5dgjJ/3bW+oz/e+RSzEmb8r+vVK7MQrqwRRBOq8fHVSQD7tbdpCvw341:7faSXySJ/3q+oDe+RqEmb8KvMHrhP98Y

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/Everloop.exe
- Size
  
  651KB
- MD5
  
  c5ab5e8b8e9d8d5fb8bc6d7b5b84672c
- SHA1
  
  41a2df37fb05c71a474aed929ecd48f2ce95f644
- SHA256
  
  74d60fcebc1ba454559fb85baa1d096e5b730e32f08159560e83cec7fad89bb0
- SHA512
  
  4403177c9bdd519ffc36882967dc4c9d034de04327fb309b2cd069a37fe4ffe7ed392b1ff4dcd88e85519c953b7f388bbbfec3f10ae4212bba8eb6ab9aa2d888
- SSDEEP
  
  3072:zQJ/VdFgIW9mYucJ/OD8JlsI9QTIHTskncKH:4/7FG9mpcJ/OD8BHTldH
Score

1^/10
behavioral1 behavioral2
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/Everloop_Data/Plugins/x86_64/lib_burst_generated.dll
- Size
  
  124KB
- MD5
  
  2613add05135ecec69caa1a6bf93908b
- SHA1
  
  dcb2294c9488794984a9e3cd3ed38f9d00d71eb3
- SHA256
  
  e2e7af44a126968424344a150b843d1032058129261bc3431958c30422e06d1b
- SHA512
  
  d1baf2981ecf6d49e573a8eaa8530fe21dd78cb510208dd7602dd1c6856781c68e3ca050b5be9924cced5cff3f287a0a46b8649479a971ffe0fa7f6b639f2606
- SSDEEP
  
  1536:PttYENOt2S3BwIPJkP5HiGbC4Z9MjDz98MTozWPSM5Z9KY3NWkizHPPPPPHeV63c:PM6OtPKIPKQ3g9WDOMUQLKY3NWkNL
Score

1^/10
behavioral3 behavioral4
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/Everloop_Data/Plugins/x86_64/steam_api64.dll
- Size
  
  1.7MB
- MD5
  
  0ba88538056381b85697db71b1e188c6
- SHA1
  
  5a0dfd5be585a7f1b6ac00b00ba6dc396b17846b
- SHA256
  
  51da33b7d9a8f64606e48565089cd1b034e95e8262960334f31e5bb339ce7f9a
- SHA512
  
  cc97c7991a5c36c2cd188dc55953b8b2b4ec584c90e0d91a41cb20a43ddf75fd8a635255a8871045af96431e57817f7f5982706cf9bfa39ab02a5aa42aa70437
- SSDEEP
  
  49152:1hiiih1XT0nAfCk73O8qK2J6NA5BJeP6x:41VOA2J/h+
Score

1^/10
behavioral5 behavioral6
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/GameAssembly.dll
- Size
  
  41.4MB
- MD5
  
  9f658c6273892bf2bdc6bd1f3d2bfb5f
- SHA1
  
  b35f44545b1c122d404b40cc9e156c61508d3af6
- SHA256
  
  f94aa5b89413282bfdd699b309c01eb86e08aa7d80c02a011c38a085be87e497
- SHA512
  
  665b41b692b2fe0a3c4eb54d73f014fcb85921bfe6e482ac15738054c054a8f9d4e25840edbcc1ff7f824aaac33a6e73fb43bfeeefde0f92c3fc8188114319f6
- SSDEEP
  
  393216:7n0JMyeyPrqfL7iaPfbL6k5LH6/KA+qfiX8fNp32opGvvjEYOoyZATY/jmP4lFOD:XLyRmOD8Ypdr5RO
Score

1^/10
behavioral7 behavioral8
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/UnityCrashHandler64.exe
- Size
  
  1.1MB
- MD5
  
  609e9dbb65e1390bca74d402f0ac2f96
- SHA1
  
  bba15a4f0f7e423f2101e2fe78a509f7318c4c94
- SHA256
  
  c62cb2ca0388ae7cb538efe33d49baae6bd4be9b1aff2ac0c2947935bc3feed7
- SHA512
  
  0cbd0e606e994ac48f1eb687e113ec5c9bc2bd332ba3fe6f8fa0c54e2b7aeb08b38c39f3378f2fcc4b96b4e4e2bf3274da3a9f707b326e01a6890d4868cc6a67
- SSDEEP
  
  12288:K0enpyI9qQIT20dkXepg517sB0I5NTBpoEfHfgeo/YoK/HOe0hLQfz2fzAw:K0oYiqpTng1700IAiXB/Skz+zAw
Score

1^/10
behavioral10 behavioral9
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/UnityPlayer.dll
- Size
  
  29.4MB
- MD5
  
  58084d59e376f6d8d12c7156fdefb5b8
- SHA1
  
  b994cd24f3da8ce382f5d83641602bde36785e5b
- SHA256
  
  925e99b1b0b9fdb22c1ff59b28516a91087f70ed7cd07790e3aaa41456927505
- SHA512
  
  345ce08c0d6d701e883cebb22fe4443789a737e4670fb13859fc0c79424477d19efdff107e9524fa0f458a84c67006db9684eb6f655a8fe2c698c2a251a1e044
- SSDEEP
  
  393216:Z63Xun255JOnjXKVXWRIrDi96+i9S9rmBFNzrq6/vynTDUHit:ZyqSFNv/aTwy
Score

1^/10
behavioral11 behavioral12
- Target
  
  Everloop.v1.0.7/Everloop.v1.0.7/baselib.dll
- Size
  
  409KB
- MD5
  
  90c13f30c3668a39642387f9ce84ce17
- SHA1
  
  659324475bbdf6343f2cb067eb73b46592db94d1
- SHA256
  
  55d20432d967602aab77f19ab8bfc9e8f11f6d73e114529f3067c81093586f35
- SHA512
  
  b7ad1fe560e9447b603a14bff2e43555d3d70478d274c8860441568cd753c2cdf28451966ac24d9a8f3bc86fdb0e0b6e10939caba43968eb0a39c91eb0778eae
- SSDEEP
  
  6144:XuInkY6mJtoLpzxkzt0R60Htptb+REDqDY92q31YM9Ci4DTF+9GCXTnDM:+InZ6mXWM0NptoDY92qFn9f7DM
Score

1^/10
behavioral13 behavioral14
- Target
  
  Everloop.v1.0.7/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size
  
  52B
- MD5
  
  92672216743fd0ad8799d25ec99e5096
- SHA1
  
  68103be0fa83db8a4a2efac6bb6169ce959a0290
- SHA256
  
  677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db
- SHA512
  
  1ca286141902e64c4cac05fabc1ce0ef4d910582e720c8b38f3cf2799cadaab7cbc9d8fc925eff17e0d3280d5d074ebd856dc75d6cadbd95872cae14eddb7719
Score

1^/10
behavioral15 behavioral16
- Target
  
  Everloop.v1.0.7/_Redist/dotNetFx40_Full_setup.exe
- Size
  
  868KB
- MD5
  
  53406e9988306cbd4537677c5336aba4
- SHA1
  
  06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA256
  
  fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- SHA512
  
  4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP
  
  24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  
  Everloop.v1.0.7/_Redist/dxwebsetup.exe
- Size
  
  281KB
- MD5
  
  fd6057b33e15a553ddc5d9873723ce8f
- SHA1
  
  f90efb623b5abea70af63c470daa8674444fb1df
- SHA256
  
  111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- SHA512
  
  d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP
  
  6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  
  Everloop.v1.0.7/_Redist/oalinst.exe
- Size
  
  790KB
- MD5
  
  694f54bd227916b89fc3eb1db53f0685
- SHA1
  
  21fdc367291bbef14dac27925cae698d3928eead
- SHA256
  
  b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- SHA512
  
  55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP
  
  12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  
  Everloop.v1.0.7/_Redist/vcredist_2015-2019_x64.exe
- Size
  
  14.3MB
- MD5
  
  f0248d477e74687c5619ae16498b13d4
- SHA1
  
  9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA256
  
  b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- SHA512
  
  0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP
  
  393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral23 behavioral24
- Target
  
  Everloop.v1.0.7/_Redist/vcredist_2015-2019_x86.exe
- Size
  
  13.7MB
- MD5
  
  de34b1c517e0463602624bbc8294c08d
- SHA1
  
  5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA256
  
  ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- SHA512
  
  114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP
  
  393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral25 behavioral26
- Target
  
  Everloop.v1.0.7/_Redist/vcredist_x64.exe
- Size
  
  5.5MB
- MD5
  
  630d75210b325a280c3352f879297ed5
- SHA1
  
  b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA256
  
  b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- SHA512
  
  b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP
  
  98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral27 behavioral28
- Target
  
  Everloop.v1.0.7/_Redist/vcredist_x86.exe
- Size
  
  4.8MB
- MD5
  
  b88228d5fef4b6dc019d69d4471f23ec
- SHA1
  
  372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA256
  
  8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- SHA512
  
  cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP
  
  98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30
- Target
  
  Everloop.v1.0.7/_Redist/xnafx40_redist.msi
- Size
  
  6.7MB
- MD5
  
  97c2eebb30c5a88c68c8f24f37183f1d
- SHA1
  
  49efdc29f65fc8263c196338552c7009fc96c5de
- SHA256
  
  e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- SHA512
  
  c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP
  
  98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
Score

6^/10
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32