fa14e758d5603486ccc312409984fa838f78262976365ae51a379f4b5e6a8bc1

Sharing

Copy URL Twitter E-mail

General

Target
ArkOptimizerFPS+.by.xxgamecoder.zip
Size 14.5MB
Sample260623-pd344acw3l
SHA256 fa14e758d5603486ccc312409984fa838f78262976365ae51a379f4b5e6a8bc1
MD5 f65933f7bc7768aa4fc335597a961ba1
SHA1 08801a003eefb69a889beb4206b427404565b6fc
SHA512 be34257d3e63075a5d161aea1a04c6bf931afdbc78cc8539c03bffa561aca476c56008d85f28a98c39a3dfbcd9c7d9aa5602ec38e42c06aaf3bd37fda2abfeef
SSDEEP 393216:qZsGSyTcyBV2c45ITFKmt1MzxCdg+OlUC6p:qu5yT15KMkGg9lUt
TLSH
T100E6335764B24F81DD2E10BD90EB0B1333692B4E5103E7AB47A1E3AF7FF26B059A4950
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ArkFPS+ by xxgamecoder/7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH
  T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ArkFPS+ by xxgamecoder/AEControllerImpl.dll
- Size 4.9MB
- SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
- MD5 2821718912293886e9b97f75497b91a1
- SHA1 00db15cfc8b947e43ffa9116abfd5552bcac8d69
- SHA512 f3fe52dae9adccedc989734ec834d84cb22154751cbe0d7d8f9f51b00fcab920b8030743b1f81b1b9655b956b1532a69a62272d3b33da7b9a1abe598fb2f9784
- SSDEEP 49152:89QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbAL:y0XTnMmPsUXbPWNPvcYLUw
- TLSH
  T1E8368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ArkFPS+ by xxgamecoder/Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH
  T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ArkFPS+ by xxgamecoder/ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH
  T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ArkFPS+ by xxgamecoder/ArkFPS+.exe
- Size 703.2MB
- SHA256 87c71df593d020ef4df62f33dc429406f9894df8f10c990f6af9c56760042702
- MD5 5054cda4c65838e94c66d04f33048362
- SHA1 7add69caf163bd9127e2b8e2056d3aee53b7cdff
- SHA512 bf4d6b50bff1935fb5d6508f5f0759ef4922657165eeaea6ff26715cffe308e0ff8a3fab47d29435ef48609048602c0f60e852d5625a97e4f3571244147da5f2
- SSDEEP 49152:HyM84m4Lkhjeuor7+SFu8QHtghHqIX8AQ/IcOoFkHlJzsSr783X:HFsoWSFu8QHtgpqIX8AQ/Ic/kHDsSfk
- TLSH
  T185797C07ACA509EAC09AA3318DB39292B735BC541F3127E73E94B3382F766E05D35758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  ArkFPS+ by xxgamecoder/ArwControllerImpl.dll
- Size 5.5MB
- SHA256 ca1f915b6ebf65a1fbaf7b8f917424d9436aec03826830d8ef7867e01d2e9e03
- MD5 7eef30500d42605cbb86900ec94f851d
- SHA1 7ce762e54e014f2467971369cbeb44a11a4b5e1c
- SHA512 406738b664629e9092e0827dd6094a83ee46f70f397795fa56d684b2d3759971c689d9710bdfb29d5c551c611f50566dd47c3a795fe21b4779e97cbd3e3e59a3
- SSDEEP 49152:HjXqdt61P6e9RZe/nZTqOLCIJAq/trSw7BaPR4M0zJP3HNrtlBJ/QBPDY8150GhY:HTqdmPycqMwV7HlcDV5j0Xn5f+KH
- TLSH
  T16E468E1AB6E500A8D8B6C23CCA678513E7B2BC154731DBDF16A462691F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ArkFPS+ by xxgamecoder/arwlib.dll
- Size 7.2MB
- SHA256 3795590a2193fbe872403dabfd4adc73ae2a7b580d0ba65080e7b504912ad489
- MD5 c6205a1401283627f711453acd6fdb3d
- SHA1 b9aa422c283f18749fc704b223fe86089836d06d
- SHA512 4bc37eafc1553e9a989fb6a5b1b7ab2fa2c1173676c152e48970884a0e7fad38ca1ce8dd5f8358a126b7cb775295b9fe21b25a0646ff095e448d80d3ff157aef
- SSDEEP 98304:1dnJpHOsS9AkcfcanXdGzzP1t88ZhE8r0/z4NPawDD:9xOsSK5fcAGzb1t88TEB/zWzDD
- TLSH
  T113769E1AA2D801B9D8F6D238C9678513E7B2BC151332D7CF06A0966A1F73BE1573E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14