Overview

overview

10

Static

static

10

gatogame.exe

windows7-x64

7

gatogame.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gatogame.exe

  • Size

    84.7MB

  • Sample

    250221-adlgqayldq

  • MD5

    83d1532600fc89ea788c8181ffcce74f

  • SHA1

    ad57046ca6b22a405ee5dc45973ab70e787b4dc6

  • SHA256

    b1889f6e1fa96603eb0ec84eb1e6478b0e8f8b0fade3b8acfc8a013883782bfd

  • SHA512

    cc30b544a053cbf0ccce844efba67535db4668ac750df37ce857da2f922acae3c1ba00a61536ff99709c0b1e04a3a00b91543b51806082d32caab36df450af6a

  • SSDEEP

    1572864:rVjlVWU69RqnOkiqOv8im2ARxE7TlhpBB8iYweyJulZUdgP752hlcvRZH1O3:Bb0/qnOknOv8i3K4LpnNpur74hlwrO3

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      gatogame.exe

    • Size

      84.7MB

    • MD5

      83d1532600fc89ea788c8181ffcce74f

    • SHA1

      ad57046ca6b22a405ee5dc45973ab70e787b4dc6

    • SHA256

      b1889f6e1fa96603eb0ec84eb1e6478b0e8f8b0fade3b8acfc8a013883782bfd

    • SHA512

      cc30b544a053cbf0ccce844efba67535db4668ac750df37ce857da2f922acae3c1ba00a61536ff99709c0b1e04a3a00b91543b51806082d32caab36df450af6a

    • SSDEEP

      1572864:rVjlVWU69RqnOkiqOv8im2ARxE7TlhpBB8iYweyJulZUdgP752hlcvRZH1O3:Bb0/qnOknOv8i3K4LpnNpur74hlwrO3

    Score
    9/10
    upxdefense_evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks