Overview

overview

7

Static

static

5

san-andrea...-7.exe

windows11-21h2-x64

3

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$SYSDIR/d3dx9_25.dll

windows11-21h2-x64

3

SAMPUninstall.exe

windows11-21h2-x64

7

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

bass.dll

windows11-21h2-x64

3

rcon.exe

windows11-21h2-x64

3

samp.dll

windows11-21h2-x64

3

samp.exe

windows11-21h2-x64

5

samp_debug.exe

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    san-andreas-multiplayer-0-3-7.exe

  • Size

    14.8MB

  • Sample

    241005-pdnz6ssglk

  • MD5

    f7874cc8637e5ddb98b07ed40a24de58

  • SHA1

    0a9eac60f516a8661b5b2ae9f1d5d798ee7fecef

  • SHA256

    550321da5b10c472bc719bca2c0df74b240f80eff828079eb5253598fe112ae3

  • SHA512

    c0e2078d8bd1d6aeb8d6cc77ea935e41fb31c271f6503a3625d2bcbebf9a8b142a1d7856816381fb4be79a45e1ea6dbe8cdb8efa027f29c32faf52794c49f2b1

  • SSDEEP

    393216:suNmflaNtY7G8t+LdFyBV9DVimtbA9yRbABehQtAuGuSwcBk:3NklUt3Nd2VvimtbeGbbhQtWBk

Score
7/10
discoveryupx

Malware Config

Targets

    • Target

      san-andreas-multiplayer-0-3-7.exe

    • Size

      14.8MB

    • MD5

      f7874cc8637e5ddb98b07ed40a24de58

    • SHA1

      0a9eac60f516a8661b5b2ae9f1d5d798ee7fecef

    • SHA256

      550321da5b10c472bc719bca2c0df74b240f80eff828079eb5253598fe112ae3

    • SHA512

      c0e2078d8bd1d6aeb8d6cc77ea935e41fb31c271f6503a3625d2bcbebf9a8b142a1d7856816381fb4be79a45e1ea6dbe8cdb8efa027f29c32faf52794c49f2b1

    • SSDEEP

      393216:suNmflaNtY7G8t+LdFyBV9DVimtbA9yRbABehQtAuGuSwcBk:3NklUt3Nd2VvimtbeGbbhQtWBk

    Score
    3/10
    discovery
    behavioral1

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral2

    • Target

      $SYSDIR/d3dx9_25.dll

    • Size

      2.2MB

    • MD5

      5b48fe9d6686f0d54b26a005ace24d1d

    • SHA1

      1c395f6d2aa729a607e69dca73f8205cefd26aa4

    • SHA256

      4c54df27ce84d21b2924e64ff79b13e7876ce85d8e0c9c1d0abd8da73888187a

    • SHA512

      6a4fa549578097ba36495ec210365c27d165065820f0fdad20864a3139949e72da00f9b7c614d07d8950307e596b693ed7a291a5c69cc0f9ba30c5f74d6332f1

    • SSDEEP

      49152:IxfcP6/1/QQ0ANFrbfxdqPeQ6eg+XMD3hP7zfOHXD:IxfcP6/1X0ANFrbfxdqPeQfg+XMD3hPQ

    Score
    3/10
    discovery
    behavioral3

    • Target

      SAMPUninstall.exe

    • Size

      56KB

    • MD5

      bffa504cd63305418858b150faa8f408

    • SHA1

      86886fd2378aa33935cf684f056454859713aed4

    • SHA256

      d00f8bf2eaa1994b0064d7b14fc987b0aab9b3c440a4177257ee2d3217fe6d3b

    • SHA512

      6b8958a4ccffce02ba8e4390f66121a02116e2b2ef9c4baa2eea62b8acfe380d0c0dd5e773f83b7062467a34019612d3f8a531e1a4ffcefb769de964cbf02019

    • SSDEEP

      1536:HLXB65939tY6HBg4sXJOgdLeAyN/dIM6su:HLk395hYXJOceAlMM

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral5

    • Target

      bass.dll

    • Size

      90KB

    • MD5

      8f5b9b73d33e8c99202b5058cb6dce51

    • SHA1

      102699b1dc7e03c9041115f5e3b178f1dab1a27a

    • SHA256

      3f04620d6627abe5c3b4747faf26603ab7a006c81b2021ab4689bdd7033bb4cd

    • SHA512

      89d830d1ed0c55882d1cc77d1a87b193cbffd8b96010d727fad6cd2668ee94c7acfb565ddb1be5b55c8caf9791947b62e8d87fa4896d98124ca2caae0053c9df

    • SSDEEP

      1536:fq5gk9BPaPT8yWZv6UXq+BpSAaSv5vfwKaGorBWHiauTXJSJ:fq5r9BCPT8yZfKahrsiauTZo

    Score
    3/10
    discovery
    behavioral6

    • Target

      rcon.exe

    • Size

      36KB

    • MD5

      3f4821cda1de6d7d10654e5537b4df6e

    • SHA1

      ac682119ac4dc51d8db82fd4a6a0e1f108b74a94

    • SHA256

      19f0d6d844f6f14856e3ea88853202b6310edc4726eb0c803710b67f641e596f

    • SHA512

      0f7f5da6d38a7ad920959363d6edcba3ec9b8645b7ccade0c4590817fbbd7a0415ba492a164c56845a57df643e4d58d83f6f537cc74d55161001704b017a9f7c

    • SSDEEP

      384:ZYblkmoSCITDXSBkCmleSWLJETJBsE9yzd9LzSjvEgKEyokl7V:Obpo8DXv34JE9W0s9LejvRKRoe7

    Score
    3/10
    discovery
    behavioral7

    • Target

      samp.dll

    • Size

      1.1MB

    • MD5

      5ba5f0be7af99dfd03fb39e88a970a2b

    • SHA1

      cfee81e92701580ff63e62dbb38d4035a05cfbab

    • SHA256

      b72b5dbe725f81864ca3f78bc7063bda56cc05fc7188af822fa7a754432553a2

    • SHA512

      a7459e33509f33eb21268d4bd70604953cb5b71555ef217286f848794e71980e0b5541c87d1d935d999fddd79e83e99893d97e9a90b8b570c5daa8fde34288a2

    • SSDEEP

      24576:hZgAAx6bqT+6QbhmCkh+LPQ5M+5BxX1s/elplhAEZOQ+uMPGP:JjuaP9PQ5MarKWJhsz6P

    Score
    3/10
    discovery
    behavioral8

    • Target

      samp.exe

    • Size

      403KB

    • MD5

      724188afa06472872e393c9318027f04

    • SHA1

      2f1794654f9753e1496c1177fc841e807e465f25

    • SHA256

      910227f4b451e3ecd1e0c8565fb2951e1f34164c2f441c6f384ee343b414a1b4

    • SHA512

      51cc952fb847bca30fb817c406d23383cb13f7e8eecc74d7d22f7f43dd88e6ff25b9fe5cee4f471dbf839c539e20f279316e57d209ce894f0002849a81daa8e1

    • SSDEEP

      6144:gljoxXwq08PvxVYBaKWPMA/gP22EXoWqOZDS8xU7+4hI4HmbBO3J4TL2:gl8S8RIWapAoWqOZDSV7JI4GbBO5Y6

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral9

    • Target

      samp_debug.exe

    • Size

      144KB

    • MD5

      2c00c60a5511c3a41a70296fd1879067

    • SHA1

      5a307b11eedf77749de2601318be6c2fff1fde12

    • SHA256

      f64d11680442cea5940614177b5ecff866e1e45c07a95cd5564327a94e8101d3

    • SHA512

      30cdca5e5b9ae89e9ac6d12a361fce3b050e947cf0615ce80e214405bfe82aced2addac759640c39e9772d78f5287532eba9a467418ccb94487e11e41dd611da

    • SSDEEP

      1536:KjKmF6kc7OTzS1s2WlZ8hUg54XgH5BXidKdz4koPxCmIp7Vi13kZa:C6k7shWlZ8hUw55gCRoPx1IVi13I

    Score
    3/10
    discovery
    behavioral10

MITRE ATT&CK Enterprise v15

Tasks