General

  • Target

    VGMWTRw.rar

  • Size

    190.6MB

  • MD5

    9774214800a4675a34531a0dcda1e419

  • SHA1

    612ef6c0c93ed839342d4c9a73c69f45549554c3

  • SHA256

    b8c5351f1e779861416087381e6c65c2310fd37d8723cd619b4f4d571fcf7b4b

  • SHA512

    aa8e788279ab658286fb5867b07ef6dea9eb1f2e1239c1c33bab328629184e1609813110991b98c1d1b781cbf294782a34817295e8d70f5668f1df6003481049

  • SSDEEP

    3145728:FH1uUo7xJJhdeJ2e8nu2qTx8Xzy0vSC3AdNd6SsOEKIqydC1L5jpGM4ObI0dKMQ:27/JhEJyntqWD6C3e6POonU1zm0U

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • VGMWTRw.rar
    .rar

    Password: 123

  • stuff/blindeye/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    Password: 123

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/blindeye/bps.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    cf0a94720527d5a60599503e9e05019d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/blindeye/injector.bat
  • stuff/info.txt
  • stuff/rudd/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    Password: 123

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/rudd/d2.json
  • stuff/rudd/hookloader.exe
    .exe windows:6 windows x64 arch:x64

    Password: 123

    c6584e67ee10e5180c6ee88085a0a71a


    Headers

    Imports

    Sections

  • stuff/rudd/ruddclient.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    4a94ae371073bcdb52a204fe05697c05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/trackmania/og files/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    Password: 123

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/trackmania/og files/defaultargs.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    67c72e720ec7b2f50278587549df2a77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/trackmania/og files/streaminginstall.ini
  • stuff/trackmania/og files/uplay_install.manifest
  • stuff/trackmania/og files/uplay_install.state
  • stuff/trackmania/tm method.txt
  • stuff/trackmania/trackmania files/defaultargs.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    faaf572e3e207f69e684699c2b17fb4a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • stuff/trackmania/trackmania files/streaminginstall.ini
  • stuff/trackmania/trackmania files/upcTrackmaniaSwap.exe
    .exe windows:6 windows x64 arch:x64

    6dbf27f4c70fe2c8ed3e0122ba75d641


    Headers

    Imports

    Sections

  • stuff/trackmania/trackmania files/uplay_install.manifest
  • stuff/trackmania/trackmania files/uplay_install.state