General

  • Target

    VGMWTRw.zip

  • Size

    192.0MB

  • MD5

    499aa1cb2469ad26a293213339002a3e

  • SHA1

    6fbe721a359a4005392390a83149aa02e3b18423

  • SHA256

    fef00c19948450e5fa5540c42871c468f6ac5a59d7b65f112389888e93519933

  • SHA512

    ce18e0d2dfe29c836192a676057911ee6841cc5e5b95c3faa9a1d7ce978e49e961b145f04af1fc675cb3184d844af525fc1569f4cd845d1f78542867ee0d8bea

  • SSDEEP

    3145728:4Lpe36Ym5dvEc5HcUBZ8sR/h4ZOjdGRAjrfDQbsjtZ8pLpe36Ym5dvEc5HcUBZs0:4VE6Y8F1cUT8S54QjMufD+CtaVE6Y8Ft

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • VGMWTRw.zip
    .zip
  • VGMWTRw/stuff/blindeye/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/blindeye/bps.dll
    .dll windows:6 windows x64 arch:x64

    cf0a94720527d5a60599503e9e05019d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/blindeye/injector.bat
  • VGMWTRw/stuff/info.txt
  • VGMWTRw/stuff/rudd/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/rudd/d2.json
  • VGMWTRw/stuff/rudd/hookloader.exe
    .exe windows:6 windows x64 arch:x64

    c6584e67ee10e5180c6ee88085a0a71a


    Headers

    Imports

    Sections

  • VGMWTRw/stuff/rudd/ruddclient.dll
    .dll windows:6 windows x64 arch:x64

    4a94ae371073bcdb52a204fe05697c05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/trackmania/og files/RainbowSix.exe
    .exe windows:6 windows x64 arch:x64

    a095f80cfd209527e4687d0bdf9c9575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/trackmania/og files/defaultargs.dll
    .dll windows:6 windows x64 arch:x64

    67c72e720ec7b2f50278587549df2a77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/trackmania/og files/streaminginstall.ini
  • VGMWTRw/stuff/trackmania/og files/uplay_install.manifest
  • VGMWTRw/stuff/trackmania/og files/uplay_install.state
  • VGMWTRw/stuff/trackmania/tm method.txt
  • VGMWTRw/stuff/trackmania/trackmania files/defaultargs.dll
    .dll windows:6 windows x64 arch:x64

    faaf572e3e207f69e684699c2b17fb4a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • VGMWTRw/stuff/trackmania/trackmania files/streaminginstall.ini
  • VGMWTRw/stuff/trackmania/trackmania files/upcTrackmaniaSwap.exe
    .exe windows:6 windows x64 arch:x64

    6dbf27f4c70fe2c8ed3e0122ba75d641


    Headers

    Imports

    Sections

  • VGMWTRw/stuff/trackmania/trackmania files/uplay_install.manifest
  • VGMWTRw/stuff/trackmania/trackmania files/uplay_install.state