r77 | efa19e5908e4063d1b104b810136d3138f4b34d1350c00123ae1543fbc93c012

General

Target

subnautica_v10v20210512_plus_15_trainer.zip
Size

952KB
Sample

241019-lbgarsycnh
MD5

4741d551ee5c14bb692aecb31d588fe7
SHA1

f64737f33dcd63b26f900188b6f4e67809b285a2
SHA256

efa19e5908e4063d1b104b810136d3138f4b34d1350c00123ae1543fbc93c012
SHA512

db6574617e870fb5e8ea354095f5ce0c1ff4bff05a86fcf3a946403f3218d08a119144604617ddb02fb9bad647775718f1d20760e6b7a2a397309679be0e8104
SSDEEP

12288:3YAuudfO1U+AjHM53pypnkL3fFJIU+HD/q++oO7mN2VTPXwgW0bD3hFVRP9uMHUN:3ZfamjHMWk7fgU+Hm+Rk289hFVRPQZN

Score

10^/10

Malware Config

Targets

- Target
  
  Subnautica v1.0-v20210512 Plus 15 Trainer.exe
- Size
  
  1.6MB
- MD5
  
  802562bbcb719682e5239724bbcb66af
- SHA1
  
  26dddeaa207b363225a0bb923177096b753c681e
- SHA256
  
  20c61005893f31e43e1efb523cc80a6267cbaa1d0f878d8b54fca7e2878aa81f
- SHA512
  
  315969abd2052edb5dd53ed5e1e0080320dc948d8c52e13114ff3971d89a59ce4263cdb1be1d7eab85d1368a10ef437541a575727bb373bd4af83e2eeb33a696
- SSDEEP
  
  24576:KHfTuC9i/EAVw5MarrOE8Q78D03McY04WzDSOcxMbJ7:Kqh/9u6aGQgD0ccYKtcxMV7
Score

8^/10

adware defense_evasion discovery evasion persistence privilege_escalation spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1