fdd2551696ea2f0d3ee85b0087e43056cc976055be13977c9ece574a11704cfe

Sharing

Copy URL Twitter E-mail

General

Target
Downloads.rar
Size 463.9MB
Sample240608-vvze5aee82
SHA256 fdd2551696ea2f0d3ee85b0087e43056cc976055be13977c9ece574a11704cfe
MD5 24354bf0dc9212b9baac9e73aee44a40
SHA1 55e4dd66df0d01db561f47ee562d8a42a6616bc7
SHA512 34f727bc8b194dc27d8c0095fcdc97e51d8fb1749be7a615c2b8200f1c30d8644b98723b85645cbf4e3c38f5e428473e0a545829795f505f5e7b3b437fb12080
SSDEEP 12582912:YrZDOPZja7DfAkM3jtT07C3W39VXwheWT+DPPQ7:MDfDfAkew+G94eWCDPPQ7
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  GGKILLER/GGKiller.dll
- Size 14KB
- SHA256 c66ae606927d3513e32d6ac3b949829b9bdaec33e0a6095df6dc32ab00c05b05
- MD5 2ca91f1d9e77883f013382e6480b989a
- SHA1 b38bff58f25f7209c7138347c31eabc56f6a82ad
- SHA512 c837b41ba60765999e9b1ef5006e12b73c2771265ef4c61110457f7abb35f07e8c2283a455d6e2168514bc7c4bb25e2237a48fe06accd6b55d56562b93bca811
- SSDEEP 192:NGEerh4v1pPaVRlfT62UHjAUyKQZErPc7h3xlFnVo/:NGdiv1pATr62UHjAmQZwc7h3Q
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  GGKILLER/GGKiller.exe
- Size 3.5MB
- SHA256 b92ef426190f6feea9714198585be1f0f969a2a1295fdad1c467ebcd64d9c9d4
- MD5 820a9e561d9dfc4d1f87c6996568ab90
- SHA1 b43f4d8bdcedbbdf48ff1fe395bdb2f03f8b7e9e
- SHA512 9a6dc6cdb3556d0a43e6494b3572f5e869e18bc814e77791a121f46877fe59c558bb275883da37684d12ed057e23607b979c4af62efd1326952768ec8c823e99
- SSDEEP 98304:9EKje4CSWnsuTtOk8hJj9gW7RJF26E0et3nkHPFg2Zqw4Z/Y:9EKWvnsW4ksgWNJFn3et3kHTZq5VY
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  install_all/A_install_all.bat
- Size 1KB
- SHA256 ca46a6cdf6982597a4356de9ac9d93add4205081c791c3dbd30db6875033b795
- MD5 d5de025e7d1c08bafee7b4e94c37892f
- SHA1 1ff84400533df049c884827902dbbdb561c1e84f
- SHA512 cd72b8d6ce58a08a217bdca788b1f16f298410bb9d0d927b8560477c49061d0f1cec5acbd5519984854b11688ae2aa9cf0ea9d163fa2a020295ec28199c561da
- MD5 SHA1 SHA512
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3
- Target
  install_all/dotnet-sdk-6.0.422-win-x64.exe
- Size 192.1MB
- SHA256 898ec516835af06e04b6652ab1e8d1337bb1e560a16484baa6b5441e64b778a1
- MD5 bdb1f0bc231a5db9313d31d55076a77d
- SHA1 97ff04aa38fc5726aa53ec611724b1725e9e37c0
- SHA512 9ef9f83eaff52145d91d48b4326bfd7926eb20b25e069461ff4f132fbe5d534e7271c719a848b5766635cdc31d0f67a4820d60438e9db5f384d1ca82a627f315
- SSDEEP 3145728:H5QtBju8PhY6aFizFjsHnrxIB53tm1ozlCi6OSMW9SwArZXUYcnxe02DIU:K7n1aAjsHraBFtsogtFRSBXlDx
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral4
- Target
  install_all/dotnet-sdk-6.0.422-win-x86.exe
- Size 180.4MB
- SHA256 16f9285f7e75b034c50be458f6125f7c7d31ff53cedcaf992ff17daf6176b3ca
- MD5 68ba679487efcb78d37ed2e7c52af792
- SHA1 a00fc102f990160127a85ffd765377b3a224e92b
- SHA512 fe6071783482f49ab544d988faa2264603e2d70ab24430fb7ce1a73ded222caed6e869826ae23da5f2b3bf2df12791399236961aad7ca1be2ec07d9ca610102a
- SSDEEP 3145728:7QVpHVmRJBTYl1f2OLWUkit1onlRTSQjfgGz3vNJpWgfTjCRj5D1xKg:7q9VAH61f2OqUkciRTT75haRj5D1sg
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral5
- Target
  install_all/vcredist2005_x64.exe
- Size 3.0MB
- SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- MD5 56eaf4e1237c974f6984edc93972c123
- SHA1 ee916012783024dac67fc606457377932c826f05
- SHA512 f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP 49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  install_all/vcredist2005_x86.exe
- Size 2.6MB
- SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- MD5 ce2922f83fb4b170affce0ea448b107b
- SHA1 b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA512 e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP 49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  install_all/vcredist2008_x64.exe
- Size 5.0MB
- SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- MD5 e2ada570911edaaae7d1b3c979345fce
- SHA1 a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA512 b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP 98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral8
- Target
  install_all/vcredist2008_x86.exe
- Size 4.3MB
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral9
- Target
  install_all/vcredist2010_x64.exe
- Size 9.8MB
- SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- MD5 c9d9eebccef20d637f193490cec05e79
- SHA1 15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA512 24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP 196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral10
- Target
  install_all/vcredist2010_x86.exe
- Size 8.6MB
- SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- MD5 1801436936e64598bab5b87b37dc7f87
- SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP 196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral11
- Target
  install_all/vcredist2012_x64.exe
- Size 6.9MB
- SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- MD5 3c03562b5af9ed347614053d459d7778
- SHA1 1a5d93dddbc431ab27b1da711cd3370891542797
- SHA512 6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP 98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral12
- Target
  install_all/vcredist2012_x86.exe
- Size 6.3MB
- SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- MD5 7f52a19ecaf7db3c163dd164be3e592e
- SHA1 96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA512 60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP 196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral13
- Target
  install_all/vcredist2013_x64.exe
- Size 6.9MB
- SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- MD5 49b1164f8e95ec6409ea83cdb352d8da
- SHA1 1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA512 29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP 196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral14
- Target
  install_all/vcredist2013_x86.exe
- Size 6.2MB
- SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- MD5 38a1b890ce847167d16567cf7b7a5642
- SHA1 0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA512 907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP 196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral15
- Target
  install_all/vcredist2015_2017_2019_2022_x64.exe
- Size 24.2MB
- SHA256 1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073
- MD5 a8a68bcc74b5022467f12587baf1ef93
- SHA1 046f00c519900fcbf2e6e955fc155b11156a733b
- SHA512 70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2
- SSDEEP 393216:Dwlp+dkBSuF2SfUfn6+eDl2ugjMoA+hxV33wsBH+Jh+5l+BvlOchteAHYhx9vy:DMp+Ty2SfUfnxk/kpsjlOchcEu2
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral16
- Target
  install_all/vcredist2015_2017_2019_2022_x86.exe
- Size 13.2MB
- SHA256 510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79
- MD5 9882a328c8414274555845fa6b542d1e
- SHA1 ab4a97610b127d68c45311deabfbcd8aa7066f4b
- SHA512 c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2
- SSDEEP 196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral17

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17