Overview

overview

9

Static

static

7

GGKILLER/GGKiller.exe

windows11-21h2-x64

9

GGKILLER/GGKiller.exe

windows11-21h2-x64

9

install_al...ll.bat

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

4

install_al...86.exe

windows11-21h2-x64

4

install_al...64.exe

windows11-21h2-x64

7

install_al...86.exe

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

7

install_al...86.exe

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

7

install_al...86.exe

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

7

install_al...86.exe

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

7

install_al...86.exe

windows11-21h2-x64

7

install_al...64.exe

windows11-21h2-x64

4

install_al...86.exe

windows11-21h2-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Downloads.rar

  • Size

    463.9MB

  • Sample

    240608-vvze5aee82

  • MD5

    24354bf0dc9212b9baac9e73aee44a40

  • SHA1

    55e4dd66df0d01db561f47ee562d8a42a6616bc7

  • SHA256

    fdd2551696ea2f0d3ee85b0087e43056cc976055be13977c9ece574a11704cfe

  • SHA512

    34f727bc8b194dc27d8c0095fcdc97e51d8fb1749be7a615c2b8200f1c30d8644b98723b85645cbf4e3c38f5e428473e0a545829795f505f5e7b3b437fb12080

  • SSDEEP

    12582912:YrZDOPZja7DfAkM3jtT07C3W39VXwheWT+DPPQ7:MDfDfAkew+G94eWCDPPQ7

Score
9/10
discoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      GGKILLER/GGKiller.dll

    • Size

      14KB

    • MD5

      2ca91f1d9e77883f013382e6480b989a

    • SHA1

      b38bff58f25f7209c7138347c31eabc56f6a82ad

    • SHA256

      c66ae606927d3513e32d6ac3b949829b9bdaec33e0a6095df6dc32ab00c05b05

    • SHA512

      c837b41ba60765999e9b1ef5006e12b73c2771265ef4c61110457f7abb35f07e8c2283a455d6e2168514bc7c4bb25e2237a48fe06accd6b55d56562b93bca811

    • SSDEEP

      192:NGEerh4v1pPaVRlfT62UHjAUyKQZErPc7h3xlFnVo/:NGdiv1pATr62UHjAmQZwc7h3Q

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

    • Target

      GGKILLER/GGKiller.exe

    • Size

      3.5MB

    • MD5

      820a9e561d9dfc4d1f87c6996568ab90

    • SHA1

      b43f4d8bdcedbbdf48ff1fe395bdb2f03f8b7e9e

    • SHA256

      b92ef426190f6feea9714198585be1f0f969a2a1295fdad1c467ebcd64d9c9d4

    • SHA512

      9a6dc6cdb3556d0a43e6494b3572f5e869e18bc814e77791a121f46877fe59c558bb275883da37684d12ed057e23607b979c4af62efd1326952768ec8c823e99

    • SSDEEP

      98304:9EKje4CSWnsuTtOk8hJj9gW7RJF26E0et3nkHPFg2Zqw4Z/Y:9EKWvnsW4ksgWNJFn3et3kHTZq5VY

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

    • Target

      install_all/A_install_all.bat

    • Size

      1KB

    • MD5

      d5de025e7d1c08bafee7b4e94c37892f

    • SHA1

      1ff84400533df049c884827902dbbdb561c1e84f

    • SHA256

      ca46a6cdf6982597a4356de9ac9d93add4205081c791c3dbd30db6875033b795

    • SHA512

      cd72b8d6ce58a08a217bdca788b1f16f298410bb9d0d927b8560477c49061d0f1cec5acbd5519984854b11688ae2aa9cf0ea9d163fa2a020295ec28199c561da

    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral3

    • Target

      install_all/dotnet-sdk-6.0.422-win-x64.exe

    • Size

      192.1MB

    • MD5

      bdb1f0bc231a5db9313d31d55076a77d

    • SHA1

      97ff04aa38fc5726aa53ec611724b1725e9e37c0

    • SHA256

      898ec516835af06e04b6652ab1e8d1337bb1e560a16484baa6b5441e64b778a1

    • SHA512

      9ef9f83eaff52145d91d48b4326bfd7926eb20b25e069461ff4f132fbe5d534e7271c719a848b5766635cdc31d0f67a4820d60438e9db5f384d1ca82a627f315

    • SSDEEP

      3145728:H5QtBju8PhY6aFizFjsHnrxIB53tm1ozlCi6OSMW9SwArZXUYcnxe02DIU:K7n1aAjsHraBFtsogtFRSBXlDx

    Score
    4/10
    discovery
    behavioral4

    • Target

      install_all/dotnet-sdk-6.0.422-win-x86.exe

    • Size

      180.4MB

    • MD5

      68ba679487efcb78d37ed2e7c52af792

    • SHA1

      a00fc102f990160127a85ffd765377b3a224e92b

    • SHA256

      16f9285f7e75b034c50be458f6125f7c7d31ff53cedcaf992ff17daf6176b3ca

    • SHA512

      fe6071783482f49ab544d988faa2264603e2d70ab24430fb7ce1a73ded222caed6e869826ae23da5f2b3bf2df12791399236961aad7ca1be2ec07d9ca610102a

    • SSDEEP

      3145728:7QVpHVmRJBTYl1f2OLWUkit1onlRTSQjfgGz3vNJpWgfTjCRj5D1xKg:7q9VAH61f2OqUkciRTT75haRj5D1sg

    Score
    4/10
    discovery
    behavioral5

    • Target

      install_all/vcredist2005_x64.exe

    • Size

      3.0MB

    • MD5

      56eaf4e1237c974f6984edc93972c123

    • SHA1

      ee916012783024dac67fc606457377932c826f05

    • SHA256

      0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0

    • SHA512

      f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736

    • SSDEEP

      49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN

    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral6

    • Target

      install_all/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      ce2922f83fb4b170affce0ea448b107b

    • SHA1

      b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847

    • SHA256

      4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29

    • SHA512

      e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0

    • SSDEEP

      49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau

    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7

    • Target

      install_all/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral8

    • Target

      install_all/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral9

    • Target

      install_all/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10

    • Target

      install_all/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11

    • Target

      install_all/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral12

    • Target

      install_all/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral13

    • Target

      install_all/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral14

    • Target

      install_all/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral15

    • Target

      install_all/vcredist2015_2017_2019_2022_x64.exe

    • Size

      24.2MB

    • MD5

      a8a68bcc74b5022467f12587baf1ef93

    • SHA1

      046f00c519900fcbf2e6e955fc155b11156a733b

    • SHA256

      1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073

    • SHA512

      70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2

    • SSDEEP

      393216:Dwlp+dkBSuF2SfUfn6+eDl2ugjMoA+hxV33wsBH+Jh+5l+BvlOchteAHYhx9vy:DMp+Ty2SfUfnxk/kpsjlOchcEu2

    Score
    4/10
    discovery
    behavioral16

    • Target

      install_all/vcredist2015_2017_2019_2022_x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral17

MITRE ATT&CK Enterprise v15

Tasks