5265a91dd57279e8907724c88dae23935453ed33641b2b42015dd492f1b5d96d

Sharing

Copy URL Twitter E-mail

General

Target
arc_raiders_fps_booster.zip
Size 6.4MB
Sample260623-pd344acw3k
SHA256 5265a91dd57279e8907724c88dae23935453ed33641b2b42015dd492f1b5d96d
MD5 204ff66ca0fa27af32dbae65a19c27ee
SHA1 a60f810147f0e1f00fc6d15ed4adef08e6faac49
SHA512 31b24da76066163273451e9909794eab1fb26029c4b1ddeb71d20bf6d6de5e4b1b4f6814a6ba13111e8c573091da8fba314601d43a539f664a8c73acc10180da
SSDEEP 196608:ypetMjo0uSmQu+zw/CDzMifOO4rZpeGb0mJr28xZk:yDDNmQuSDzfGZZV0SFxm
TLSH
T12E6633715B5C9252EF235E7EA54D2FCCFA7B0F00A85AB402094F6ADDB616DDA3C34821
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  arc_raiders_fps_booster/System.Xml.XPath.XDocument.dll
- Size 30KB
- SHA256 04a8496c042d14910836e66653cf12dc72b2087690c0b8c72df03b62f72cb0fc
- MD5 7f164c5078fbd6a56c5547c904c14b30
- SHA1 6cbc3ddc8a932053ca8df8835f38d0ef6f1242ca
- SHA512 2d620a3fe6ff44af39fcd328c338635cb4b564c345339b08782979656eb62f5c4bb9fbe9defbdb2d899c2041816b6286a1a1d24734b2124176941d61dc5e2d66
- SSDEEP 192:jW07eWeb6Qw1KvVXgwxfISZWQhFJtvUmmnoHnhWgN7agWe+HTeQZNiBX01k9z3Ab:jW07eWk9w8uu9/hljHRN7RQq/R9zZmZ
- TLSH
  T174D26CA297AC4703ED672E30A2E8E6437E3CABC6694197671685F1881D537C1DF3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  arc_raiders_fps_booster/WebView2Loader.dll
- Size 161KB
- SHA256 1970ae5e398666304483203dae64f8bc3327811114ae38bb3484ecbce1386b41
- MD5 075e4272f2815b3b6bc7caf0ebcc65ae
- SHA1 6ba407862fedc14fde92d4f4093249d2ba371ea6
- SHA512 6481605b96e4eb61443ae4bf0b51f4a9dc7c792742385e15418c9d06f136247fb2e81f632d30357cd0cde988a64c264a1bb8384cdf4a7d1fb94b78990636b692
- SSDEEP 3072:Wz49om6TlTRTEAzThTNTmA9r6b3oohrjmx9kAiACZ5AalK9TIjEtJ5/a3k:WswTlTRTEAzThTNTmAETRnmx9kAFCHEz
- TLSH
  T120F35B5772E9007BE16A8274C9A34A12E777741107509BEF03A4477A1F23BD8EE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  arc_raiders_fps_booster/WinRT.Runtime.dll
- Size 516KB
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH
  T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  arc_raiders_fps_booster/WindowsBase.dll
- Size 16KB
- SHA256 f3ee1332184c3db1dca1521ba473006243509dd195e9333f532f505e476d5f04
- MD5 170dff014ed917ec163bbc1fedfe526a
- SHA1 f431dff22a9700c2ec18a349c4031f2ecf6cd013
- SHA512 673019a10a61a14b2b6ea5983220c949d978c2e690a4cffc21c2cbe96a2a046f1228e53b86de5eefc48f4be0bcb4e8b4f2729d2eebfb1c3695d9bea64ee19045
- SSDEEP 384:0HasFWQsMEWVxcWR/hljHRN7rvR9zQrdD3R:XCsUnDjrp9z+1B
- TLSH
  T1E1725B97E76C4253ECAB5FB0A6FAD9833C7D63C66950C02A0691FA051C53381DB35B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  arc_raiders_fps_booster/arc raiders fps booster.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8
- Target
  arc_raiders_fps_booster/mpclient.dll
- Size 3.2MB
- SHA256 81f627f5f5a6e9dbcf3f0ed03b805f8efa8772ad0d736a1ba7f144f5eee035ad
- MD5 80bc47b0285b8ecc6f6ae98e137f957a
- SHA1 39a94e0d8ce228d6175b6fbf800ba97e9a62ea46
- SHA512 e099030ff930e8f4d48a08fd6632bc41715f8ea717661e1118a50546390c05711fa65234e3fe41f0c4754ef08d1da9a03ad088f373ab1ad8ee23917d6e270602
- SSDEEP 49152:26oga53hRuyebySBcZ0fO+0zW8zdgcpqQn4WGxc:2PaxOUcZ0Wpy8zdgcpXyxc
- TLSH
  T11DF57C03AFE108B9C456533185A666913B3DBC440B3617EBAEA027B62F363D4BD73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer credential_access
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  arc_raiders_fps_booster/scripts/System.IO.Compression.FileSystem.dll
- Size 15KB
- SHA256 2143a57f05a7276ba1e5bfb6d7d0b2566c8d956c68a39047d24b0d28104d68b4
- MD5 1a16b3ca9091f78f3374266637a0ac44
- SHA1 650751ca52b9170ae61e58fad2ecea293b95b6e9
- SHA512 a8e622a0f9c2eb38805fd06e3863995e43a218195b72445ebe4e6e57ec20260a9357c05735bffbdd972f4a86d14a3aa5fbfda70f186bb4e2d6e27e963963d964
- SSDEEP 384:gfV0CaWuDmWOz/hljHRN7AP3U0R9zenQo8:CV0CmGzDjd49zto8
- TLSH
  T157624AA287B88243ED6B6E70D6B8D9873E7C77D22E40952A15C2F5442C53381EF31A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  arc_raiders_fps_booster/scripts/System.IO.Compression.Native.dll
- Size 916KB
- SHA256 2b6cf109556baf738c1d1a3edbd6cd42ec88615013c79c7713d00d434fe5b864
- MD5 265cceeaaf0e7596334d9dcdf1510f53
- SHA1 050b22843180cd7618708ed670e2f5dd37fe802c
- SHA512 17e5abbc6e9797680b9f625e78c56edae7d99799155a2c2aeb3e09fb7bf3fe0d53e816c9113ad95af567ce2fab9cb00d74024f7ea6c8c082283c174036e3661c
- SSDEEP 12288:CM9debqLD+fn54nfLmbdHLpf8PXTw05nmZfRxAHhlyF8V8t:BOf5uf6pO0AmZfRxA6
- TLSH
  T164159E4BD8B3533ACC27C079C9A71336E736716853108997A25CE9353B43A541BBB3AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  arc_raiders_fps_booster/scripts/System.IO.Compression.ZipFile.dll
- Size 98KB
- SHA256 450a0f0523eb35bf196cc49978c46dc82e6dfbaf1a2792faaf2c01d8f0424402
- MD5 08ccc825d08ccb5c1ec4e435d2bee6d0
- SHA1 83ea3ff8750c916a2c41e1cce6b2b08abbaea806
- SHA512 ca503dfa75839f276ae7088181223658de198be23b17a26a4f0cf4c6419e89032e07abaf15a75c95de3ae130e2f87b4f4c564907bb22e9feb72ef7764c4be473
- SSDEEP 1536:5ie/oMVc2XHvK7QOVcgxL7ewiybYtoHxH5Po+uUhqLzeC:8egahXHvK7QOq+hxbYSRZPoTUaaC
- TLSH
  T16CA34A0477C84607E55B8DB9863A9D87C63AF3C6670AE3CF448CD84C3EA27C196751AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  arc_raiders_fps_booster/scripts/System.IO.FileSystem.AccessControl.dll
- Size 102KB
- SHA256 4c68845b83a91299a53d05281c4624453cb09eeb033159886de2fe0311bc4354
- MD5 01622d9886a946eca4df05edadbeec06
- SHA1 60ec462e84dd55b260fd9b5a3a51dc7242aa0cfa
- SHA512 9ec25443b7353e212cff4ccf4b247efb8d2959b1fbf2bafeb14092224855962a8843fd54803a3d3fda19286211551cff50f3d5c5f9aaed2bf0d43ee343b846c5
- SSDEEP 1536:UiArY+T5ylb2ykTvKEqxvJz3VGGfUaavgPXazxj:UNYQbSDAGRPqdj
- TLSH
  T198A34909B7D84226EABF827885738C05E53CF187DB01A2DF04C6954D3F93BC58772AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  arc_raiders_fps_booster/scripts/System.IO.FileSystem.DriveInfo.dll
- Size 54KB
- SHA256 55f8208c0ac09d95383f79f07a244e2d66b4dc55332a2d681ff3aca8bdc3c74e
- MD5 ce33e3e72a89c26fbfb2e07014954ae5
- SHA1 9f5ebb18ba73d51bcee81150d866e2b3a7c0a4c4
- SHA512 bd3e14310ec10e2e379ff011c7d8917655063bd4566d959b4092e8200fcb8d6963deb963e42065130fd88a0ab38cc2e0a1518c3f262edce31cd93990de03ff96
- SSDEEP 384:OWU/yWH/8e1aHVCHWl2Yd5zwNJsrG7dGJ/63+FEg64HwvUDw4iN6D2wO5tl42wLx:8j8eef4t7PsE0HauD2w4+o1Qe9zu
- TLSH
  T122434B2997D8890EFABB46304A73D6409B70F6D60722F9DF42C1D10D6F673C99B3126A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  arc_raiders_fps_booster/scripts/System.IO.FileSystem.Primitives.dll
- Size 15KB
- SHA256 991b9b87f4c8b01a93d2085e9a7ccbee09ac2c130b46a0fcf985c5d51b2e1ace
- MD5 6a222d31bc9f18c481a89af00ac8e8b1
- SHA1 c0502f203c48f70a1b30a3c46cb6b3817148c674
- SHA512 97c9f40d4f2ee44404c6f51bc3b2c8d999b68e5ad82a76811ddbe56b36fe85447c8dc9ca8d5d0c93c0c1500e55afce41efe579de434deb72f69ae8563050e4db
- SSDEEP 384:n1bJ6R/NjW/XqWDfPDHRN772cDR9zMq9Wy:n1bQRFwLT9zM/y
- TLSH
  T13B624B95C76C8243EEBB5E7097B8D9433E3867D65D508AAE1195F6480C93385EB3032E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  arc_raiders_fps_booster/scripts/System.IO.FileSystem.Watcher.dll
- Size 86KB
- SHA256 e5e80fda551e724f4a0356edf146a0d6e4e8b53545cb1513e6878125a958c195
- MD5 6b9a8d58ae431b74fbdc9039c2717ed9
- SHA1 b77b370493a822222d5e0a7c0f8e50be48bfdc98
- SHA512 48288c6fe8400910c87042c4e73b5223b84e5624ed6d562ba08b4f2be85ae891f3b60d92459edeff76caae25c80397187a75bf2415aa8b9a10bb2df14c60434f
- SSDEEP 1536:Q2OUtSQPB+pPDikCtkzh3+izezOhgLC9vJZcGC8TANezWo:QpUtJ8pPDgi+izLgLC9RZTlRT
- TLSH
  T11A838D5273C89626DF794738CA638946AA71F2F62302D6DF8678D10E1F837C09772366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  arc_raiders_fps_booster/scripts/System.IO.FileSystem.dll
- Size 15KB
- SHA256 4911951d970fb2ea19b4e134cd50aa5310064a65ad09a279e2e1fb7c39e8dcdf
- MD5 9b521e39c89624a3aede011296fd9800
- SHA1 5be4215402f79fe71c7bcac8853f8e4d0a7b42c1
- SHA512 a473b2cffad7b6b5ebfbc9e117a119e1518e141cc271d51ac211b24b80c10da2e44bac2ebcc1b17e6c8ff397f6c301b3bd71b12f3b450a27fbdcc88da614095b
- SSDEEP 384:Fb1eFR/qJxWyD2WX/hljHRN7SG/sGR9zoCrl:FboFRyJXfDjf/r9z7
- TLSH
  T1FB724BA19BAC8243DDA75E3056FAE5833D3D63D71950E62F01C2F6882C63384EB35769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  arc_raiders_fps_booster/scripts/System.IO.IsolatedStorage.dll
- Size 86KB
- SHA256 bda5602b38f1e56e9f4ebbd817f6e77b12fcc37629ea4d3d1fad7e07e0f5e645
- MD5 c1f285080529f22712206939bc3f4501
- SHA1 b2812856289c3365164a291bb87911adb131ecdd
- SHA512 779935034da7629b9e830b712d3408f6492f55b097292c72bdd290b13afbf664f7f2ffdc81f38c025768c859dc4aea0a3ee4f35510475236c8cc6dd0d8aab122
- SSDEEP 768:LzeMpMmfxMXCfNFM4qm7KeII79QSbzncunHM3DiZezXARXWlxdgcFDjrUuQU9zZx:LzeMpMLXevWe4Sbznc4B+XAc2mrUAzFN
- TLSH
  T152836C59B3E84536EABA8AB8A5F38845C934F2C75311C2CF0846D44D3F937D983B166B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  arc_raiders_fps_booster/scripts/System.IO.MemoryMappedFiles.dll
- Size 82KB
- SHA256 88a238291e4a458627b38a268089e0b3ce675c876fc3aa44c5edc427ff330d43
- MD5 5953c367231f864ce56f6c5eb397b070
- SHA1 8078b2d630172b16679ebc9d70063340bd132ddd
- SHA512 8f0e0bbc7db14d14554ebfd0c92f03ab8a5c691b091a9bc0c5a69c302c8cd9fe47f7319101326a59081469059e1fadc67a731a44754dcf4f0b9414ede9099fa5
- SSDEEP 768:GCZSKuKwoGfPsA2Zw+mTZhxoLtMqP2L7O5GEqVzwB3BX/QEwocaO+jw2uDmgH9sX:GCZOKgsA229IHGEqVz4FQEXcagmgYYzQ
- TLSH
  T1E3836C00A7F8011AEABF4B7C59769605D538F4D25702E6CF8081D81E2FCBBC6D77265A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  arc_raiders_fps_booster/scripts/System.IO.Pipelines.dll
- Size 186KB
- SHA256 c841eef45f5a7440a9bbdf583e19ef9c8498c6a3f75e64c46aa1ffcd1051d332
- MD5 ce6ec3081503003637986a33a27d665b
- SHA1 4724ed7626c6c9d569a8b11c39b6c6392ad6c2a6
- SHA512 61da4ad40c20390b51d19845014ce114c55e9115b28988cf8a35f54c7504b60b6a7e36b99625986842bf1e57c7915d155aa06333011eff04518091902ec4c691
- SSDEEP 3072:wko6V3s7BcIAjkOsjak205yX4bgN0xmRBewipNzh/ivlxW2xAfK48rFS:qMs7BjACadVewajcxW2xgK48ZS
- TLSH
  T192146C1B839C4613DA5F85B8C1A3624297F394625703F6CB098EE8942F977C1FF3A166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateProcessExOtherParentProcess

Badlisted process makes network request

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32