Analysis
- max time kernel
899s - max time network
438s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/04/2026, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
900 seconds
General
- Target Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe
- Size 18.7MB
- Sample260428-eqjacagv6q
- SHA256 dce5c60d3863865c13f62eb27f92eb152dd47ee24d7150e3a6469fbbce517b1d
- MD5 e825f74ba7a5b332ca4622b7bffbb9b6
- SHA1 8c1bfd0e57ea04929de78dbf04242d74ada1889c
- SHA512 47c039d226ca6664ef117c133645aff9a2faa56bbc02030d3d363c17369f2d1d8f9e52e84f63961fe2d9823c6aa779955341d3d0623b2039e344615529bde344
- SSDEEP 393216:45hSWautxD624I9p0ayJsv6tWKFdu9C2:45hSStxDwIz0al
- TLSH T15B175B47B14390ABC26AC07087568E31BA357C954B74AADF2154BBA53E31BE02F3DF16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 3 raw.githubusercontent.com 15 raw.githubusercontent.com - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2272 Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe"C:\Users\Admin\AppData\Local\Temp\Assassin's Creed Odyssey Trainer (+62) [1.5.3-1.5.6] {hex}.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\hex\Trainers\Data\Public\ACOD\Config.ini
- Size 1KB
- SHA256 e6e0b7bf70682181be82f27b9b0c1503e25b11eb522d4c9d8c629abb51167279
- MD5 cd1cd42687d4bf3ae60a57f5815ec63e
- SHA1 2a3755fb89c1267f4a5d0e8784fc154bd98b1446
- SHA512 efb88ebea14e5b23f490aea7803109e81e77e0d7c3efbf4bba14e5978d8ff99740c1fa5c928d7b7863aadb908e3f0413367ad2b07cf620b6302b04a51aa2ceb2
- TLSH T108311203768C7D10E9C5AF1210A43914FA58AD0C788276C964A08EDE8D6BC6EFF36C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\hex\Trainers\Data\Public\ACOD\Config.ini
- Size 1KB
- SHA256 1b71ae79958bae94147716968debe430328b2dcef2604a72c1797a0f9890a69c
- MD5 c052247828c45e50ccd773ffdd5a4589
- SHA1 bdd37650cac4f60d189660d97174cc26ad4f460d
- SHA512 cea66248aba24b3bed0f148db8f851f83e085d6548a66e524c24e67cecec217f8fe3bac60d25c03661d115f0ffc7452c42bbb53cc00641f4f40fe27aa97e15ab
- TLSH T194216C17768C7D15E5D52E1210A43910FA584D4C78823AC968608EEECC6BD6EFF35D27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\hex\Trainers\Settings.ini
- Size 405B
- SHA256 f2bdb371475ca1651e3b381085b2afa7864c18a8703ad41c76167d5d18004e2c
- MD5 94cf47d0eadee735b0d279bc3540cf13
- SHA1 ca627d5b10c8ac5c89370dcaee7bac1a86be4db9
- SHA512 400ca0003303234b4d9f4e0c7dbd2aba9078bb5747889c80e2a10b3570ec05e71459320087f6bd1f099aa19862c642054a8b2cb51e128af4042a54006450d430
- TLSH T1D4E0EDC5350432389411A37AECDFEC436E20ADAE6806BA38E14638AD8517E8513A6C33
- MD5 SHA1 SHA512 TLSH