Overview
overview
9Static
static
7gasai.rar
windows10-1703-x64
3gasai/Gasai.exe
windows10-1703-x64
7Gasai.pyc
windows10-1703-x64
3gasai/config.json
windows10-1703-x64
3gasai/crack.dll
windows10-1703-x64
9gasai/devi...t.json
windows10-1703-x64
3gasai/launcher.exe
windows10-1703-x64
7gasai/login.txt
windows10-1703-x64
1gasai/misc...0.html
windows10-1703-x64
gasai/misc...e.mmdb
windows10-1703-x64
3gasai/misc/bans.txt
windows10-1703-x64
1gasai/misc...og.txt
windows10-1703-x64
1gasai/misc...ds.txt
windows10-1703-x64
1gasai/misc...ot.png
windows10-1703-x64
3gasai/misc/img.jpg
windows10-1703-x64
3gasai/misc...og.txt
windows10-1703-x64
1gasai/misc...og.txt
windows10-1703-x64
1gasai/misc...s.json
windows10-1703-x64
3gasai/misc/tags.json
windows10-1703-x64
3gasai/misc/yuno.ico
windows10-1703-x64
3gasai/noti...s.json
windows10-1703-x64
3gasai/over...s.json
windows10-1703-x64
3gasai/over...s.json
windows10-1703-x64
3gasai/over...a.json
windows10-1703-x64
3gasai/over...t.json
windows10-1703-x64
3gasai/over...s.json
windows10-1703-x64
3gasai/over...h.json
windows10-1703-x64
3gasai/over...s.json
windows10-1703-x64
3gasai/over...g.json
windows10-1703-x64
3gasai/over...s.json
windows10-1703-x64
3gasai/them...e.json
windows10-1703-x64
3Analysis
-
max time kernel
1790s -
max time network
1587s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
24-08-2024 22:47
Behavioral task
behavioral1
Sample
gasai.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
gasai/Gasai.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Gasai.pyc
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
gasai/config.json
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
gasai/crack.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
gasai/device_whitelist.json
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
gasai/launcher.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
gasai/login.txt
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
gasai/misc/Direct Message with robio.xyz#0.html
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
gasai/misc/Geolilte.mmdb
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
gasai/misc/bans.txt
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
gasai/misc/debug_log.txt
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
gasai/misc/friends.txt
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
gasai/misc/gasaiselfbot.png
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
gasai/misc/img.jpg
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
gasai/misc/mention_delete_log.txt
Resource
win10-20240611-en
Behavioral task
behavioral17
Sample
gasai/misc/selfbot_detection_log.txt
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
gasai/misc/spoofed_profiles.json
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
gasai/misc/tags.json
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
gasai/misc/yuno.ico
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
gasai/notifications.json
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
gasai/overseer/aliases.json
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
gasai/overseer/giveaways.json
Resource
win10-20240611-en
Behavioral task
behavioral24
Sample
gasai/overseer/mimic_data.json
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
gasai/overseer/server_blacklist.json
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
gasai/overseer/servers.json
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
gasai/overseer/ssh.json
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
gasai/overseer/users.json
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
gasai/overseer/watching.json
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
gasai/overseer/webhooks.json
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
gasai/themes/default_theme.json
Resource
win10-20240404-en
General
-
Target
gasai/crack.dll
-
Size
2.9MB
-
MD5
e42615c8afc31caeddcc6080933fe10e
-
SHA1
30f545b60fe0eec20f00304c16cfdfd8860513f9
-
SHA256
37d493e23a12be12f02d3663348b1992d31f4a717637324922b1bab082ab7935
-
SHA512
62d0eea5c31cf83e8b6e14a51405161d88ad9b514485b33bf31863c15318b5fb18383eb1812ea13b117254fff245e5d034d4943822367ab25fd84219f6298de4
-
SSDEEP
49152:Vv58YPYu3ui4i8lHWXXh7R+2IeVYP8w4U5nVkHNgQOmC6yxI9BNVEpcBpa6YM:JPPnei4i8lMXh7RQeSkW5VCgEC6W0Bzm
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
resource yara_rule behavioral5/memory/2400-3-0x00007FFB5E5E0000-0x00007FFB5EE1B000-memory.dmp themida behavioral5/memory/2400-4-0x00007FFB5E5E0000-0x00007FFB5EE1B000-memory.dmp themida behavioral5/memory/2400-16-0x00007FFB5E5E0000-0x00007FFB5EE1B000-memory.dmp themida behavioral5/memory/2400-33-0x00007FFB5E5E0000-0x00007FFB5EE1B000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe