General
-
Target
Hypnotic Idol v1.014 - SteamGG.net.zip
-
Size
408.8MB
-
Sample
240831-akmclavand
-
MD5
57b1793dc85315d95e91d33587857a3f
-
SHA1
a69a4ef9c8ade07b536e0a17c043bc2a2a953005
-
SHA256
9bf4cc19f23e05dce60fa4c0cb8616edd69ad71b32cc2005c5112aa13f54762c
-
SHA512
354cdae9f0b3afec679455437955be61b2e00d54d470aef4acf80334fd775572e0353765369074710d8b20f5878c1b00cef0ba05809d012e42567908ad84222b
-
SSDEEP
12582912:klQ/EV15Ztmyknarz5HkvK/nUAuEPe032KPFfGu6bspCeddxKqESUmmW32Srk73:p/EVLZOna+vK/rPX3LPou6opCeddxKq+
Malware Config
Targets
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/install_all.bat
-
Size
1KB
-
MD5
eb55aae630088c91b88d2bfae4115ea0
-
SHA1
1495c69946edca474fe30c2b713aacb9f03bbf3a
-
SHA256
492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
-
SHA512
48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/oalinst.exe
-
Size
790KB
-
MD5
694f54bd227916b89fc3eb1db53f0685
-
SHA1
21fdc367291bbef14dac27925cae698d3928eead
-
SHA256
b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
-
SHA512
55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
-
SSDEEP
12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2008_x64.exe
-
Size
5.0MB
-
MD5
e2ada570911edaaae7d1b3c979345fce
-
SHA1
a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
-
SHA256
b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
-
SHA512
b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
-
SSDEEP
98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2008_x86.exe
-
Size
4.3MB
-
MD5
35da2bf2befd998980a495b6f4f55e60
-
SHA1
470640aa4bb7db8e69196b5edb0010933569e98d
-
SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
-
SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
-
SSDEEP
98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2010_x64.exe
-
Size
9.8MB
-
MD5
c9d9eebccef20d637f193490cec05e79
-
SHA1
15d032d669078aa6f0f7fd1cbf4115a070bd034d
-
SHA256
cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
-
SHA512
24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
-
SSDEEP
196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2010_x86.exe
-
Size
8.6MB
-
MD5
1801436936e64598bab5b87b37dc7f87
-
SHA1
28c54491be70c38c97849c3d8cfbfdd0d3c515cb
-
SHA256
67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
-
SHA512
0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
-
SSDEEP
196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2012_x64.exe
-
Size
6.9MB
-
MD5
3c03562b5af9ed347614053d459d7778
-
SHA1
1a5d93dddbc431ab27b1da711cd3370891542797
-
SHA256
681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
-
SHA512
6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
-
SSDEEP
98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2012_x86.exe
-
Size
6.3MB
-
MD5
7f52a19ecaf7db3c163dd164be3e592e
-
SHA1
96b377a27ac5445328cbaae210fc4f0aaa750d3f
-
SHA256
b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
-
SHA512
60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
-
SSDEEP
196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2013_x64.exe
-
Size
6.9MB
-
MD5
49b1164f8e95ec6409ea83cdb352d8da
-
SHA1
1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
-
SHA256
a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
-
SHA512
29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
-
SSDEEP
196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2013_x86.exe
-
Size
6.2MB
-
MD5
38a1b890ce847167d16567cf7b7a5642
-
SHA1
0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
-
SHA256
53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
-
SHA512
907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
-
SSDEEP
196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2015_2017_2019_2022_x64.exe
-
Size
24.2MB
-
MD5
a8a68bcc74b5022467f12587baf1ef93
-
SHA1
046f00c519900fcbf2e6e955fc155b11156a733b
-
SHA256
1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073
-
SHA512
70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2
-
SSDEEP
393216:Dwlp+dkBSuF2SfUfn6+eDl2ugjMoA+hxV33wsBH+Jh+5l+BvlOchteAHYhx9vy:DMp+Ty2SfUfnxk/kpsjlOchcEu2
Score4/10 -
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist2015_2017_2019_2022_x86.exe
-
Size
13.2MB
-
MD5
9882a328c8414274555845fa6b542d1e
-
SHA1
ab4a97610b127d68c45311deabfbcd8aa7066f4b
-
SHA256
510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79
-
SHA512
c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2
-
SSDEEP
196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE
Score4/10 -
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist_2015-2019_x64.exe
-
Size
14.3MB
-
MD5
f0248d477e74687c5619ae16498b13d4
-
SHA1
9ed4b091148c9b53f66b3f2c69be7e60e74c486a
-
SHA256
b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
-
SHA512
0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
-
SSDEEP
393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
Hypnotic Idol v1.014 - SteamGG.net/_Redist/vcredist_2015-2019_x86.exe
-
Size
13.7MB
-
MD5
de34b1c517e0463602624bbc8294c08d
-
SHA1
5ce7923ffea712468c05e7ac376dd9c29ea9f6be
-
SHA256
ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
-
SHA512
114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
-
SSDEEP
393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1