General

  • Target

    RootedTheGameSetup.rar

  • Size

    79.9MB

  • Sample

    250701-jsq57atkt7

  • MD5

    431782f14b39aea7eefd0d9a23bc976f

  • SHA1

    0a325d7b1a5c218086563985c422fa37a52c5bd9

  • SHA256

    4114e203c022edd9f170961a9b1e599f2844d87d3f5b7afb2eb81ad75c0b3c5a

  • SHA512

    f4d2556d46c25972879e62aec1d36ffe2d6df40825a901f37fb783b183411618e524fae8b6ef21e2f51abda4bfa3dc23bc880232ea9e1ca1713ad01955432557

  • SSDEEP

    1572864:VEmO8X5SFCbbzBZ39v0CFhHsmJKu7K2XQR1+ylq44J6zjbUxMOmXdg9tO:VNOKKCbZ1NjhHOunX6DlqN66MOmXO9tO

Malware Config

Targets

    • Target

      RootedTheGameSetup/RootedTheGameSetup.exe

    • Size

      80.0MB

    • MD5

      c6bf7a752c037aa9f01aec46fe7293a4

    • SHA1

      3b4aa7099b8c60c4372a4a4a772299c7031ce469

    • SHA256

      7e0be0a55d9df3725a7370acd436af3bfbf51acd171ba48b98b4c6d9a231c6e5

    • SHA512

      bd3c0f6099327675a65b99130bf6343dc93e4e6eb789d9e8006a4ad9457838cc1aa7364c426f26b5a76fbcbca6b23ea995c8fcc1045d34c4bdbb5746cbce47e4

    • SSDEEP

      1572864:WlM+e4h7TL9BHM8ne0LwCXkOaBcSrufGanp7GgAamuzCDKRtSuCqWqknLqr8q5:Wlde4N8BQwCtaBcSruZkpamZKiJqiqD5

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    • Target

      LICENSES.chromium.html

    • Size

      8.8MB

    • MD5

      2675b30d524b6c79b6cee41af86fc619

    • SHA1

      407716c1bb83c211bcb51efbbcb6bf2ef1664e5b

    • SHA256

      6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

    • SHA512

      3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

    • SSDEEP

      24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

    Score
    4/10
    • Target

      RootedTheGameSetup.exe

    • Size

      164.9MB

    • MD5

      24e28cb5f6b0c951790b2607f0d43827

    • SHA1

      0d44f76eda06660e0203f89d475b722902dc702b

    • SHA256

      3f877186a66f5ebf49bac1e41c7ae202d8a7495cdbd958f921f1385a652ec31f

    • SHA512

      9a0ca5d8a72914c79d342cdd8d177f3c90b6757d5484d887ad979d2c7fbf4ea7bde9e487ba26582abee23002d53817d30d7be73408a961bd050cc7ad8066f63a

    • SSDEEP

      1572864:EmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQc:asFWY7ihS4kVPi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      14e00bf1d9d0df65f8b1a31240d474a8

    • SHA1

      f9fe033725b7b1b5c0efce7a14ed7ab223cb32e8

    • SHA256

      9d1eb0c6eb12bfa87e74a65c2fde5d61c4c93e21fb0800bbdccb6559527036a5

    • SHA512

      652724450296a739de802ba8fac482953146f37665718446e448a350295e1e7b09bd460835bcd0ac26b2e54bb9b791624a9eea11e6c96573c7c4aed22450ed14

    • SSDEEP

      49152:IF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ1SCu:IFvSkJXv+tiLAD0+D1S5

    Score
    1/10
    • Target

      libEGL.dll

    • Size

      477KB

    • MD5

      1dcf5ac3cb0dcda9c9679eeb018d01bd

    • SHA1

      bc21697c5665aab5eaaba61f55719d43328f7e7c

    • SHA256

      9cfc3001191e8b3eb9c96ba29e57e5bf9aaab264e83897e47cb968167a8a811b

    • SHA512

      47d8769bf00cc7555479542abf5e0684799e424d9801dad8c6bd199680d9c40cfa2380d969515db7a0753cf6f3a9733b5afb931fe33863fe30a37092d8dc96b1

    • SSDEEP

      6144:o8hd1BSjuMmof2SEXVVfgV8hxN7h2NIIEOg51f0FticyQ:o8DXSjZmof2SEsmN12NIIE7f0FticyQ

    Score
    1/10
    • Target

      libGLESv2.dll

    • Size

      7.3MB

    • MD5

      51378647d290f3a08affa8454a3d59d5

    • SHA1

      32152a6677c82ea9e2e842baa907d708b46a6779

    • SHA256

      80c2ef6ca6d0ff4877bd0c0bc082ff19c3a5002d53648bcf5f54368560f9a411

    • SHA512

      ca90f5131d95fdb1e4a5cb7cb2bbef08676f70367b255270871754f776937994e34258084bf46437b25e1745728c279594d64e0718643eac0ac00cfc43d2c53b

    • SSDEEP

      98304:1aUIRsMRk/yUt1ngliXWeamn0B8LfdAbvZ3gtT7:1anxRk/Pwzedpag1

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js

    • Size

      412B

    • MD5

      0b33e83d33b01a51625a0fdcbef42ce3

    • SHA1

      1c29d999ff7da39426b97f2eb31a3d83db8f5fc7

    • SHA256

      a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2

    • SHA512

      1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c

    Score
    3/10
    • Target

      resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node

    • Size

      137KB

    • MD5

      04bfbfec8db966420fe4c7b85ebb506a

    • SHA1

      939bb742a354a92e1dcd3661a62d69e48030a335

    • SHA256

      da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

    • SHA512

      4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

    • SSDEEP

      3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/iloverte/dist/index.js

    • Size

      412B

    • MD5

      0b33e83d33b01a51625a0fdcbef42ce3

    • SHA1

      1c29d999ff7da39426b97f2eb31a3d83db8f5fc7

    • SHA256

      a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2

    • SHA512

      1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c

    Score
    3/10
    • Target

      resources/app.asar.unpacked/node_modules/iloverte/prebuilds/win32-x64/node.napi.node

    • Size

      137KB

    • MD5

      04bfbfec8db966420fe4c7b85ebb506a

    • SHA1

      939bb742a354a92e1dcd3661a62d69e48030a335

    • SHA256

      da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

    • SHA512

      4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

    • SSDEEP

      3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node

    • Size

      1.8MB

    • MD5

      66a65322c9d362a23cf3d3f7735d5430

    • SHA1

      ed59f3e4b0b16b759b866ef7293d26a1512b952e

    • SHA256

      f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

    • SHA512

      0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

    • SSDEEP

      49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js

    • Size

      224B

    • MD5

      f0a82a6a6043bf87899114337c67df6c

    • SHA1

      a906c146eb0a359742ff85c1d96a095bd0dd95fd

    • SHA256

      5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74

    • SHA512

      d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240

    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discoveryspywarestealer
Score
7/10

behavioral2

discoveryspywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
4/10

behavioral12

discovery
Score
4/10

behavioral13

discoveryspywarestealer
Score
7/10

behavioral14

discoveryspywarestealer
Score
7/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

execution
Score
3/10