6ad1847cd509e4ee124d74fb60653af9e3a7ab9e69f544f8b892d90310fc67e6

Sharing

Copy URL Twitter E-mail

General

Target
Gunfire Reborn Update from Build 20506329 to Build 22432082.7z
Size 842.1MB
Sample260623-vbml8aev9z
SHA256 6ad1847cd509e4ee124d74fb60653af9e3a7ab9e69f544f8b892d90310fc67e6
MD5 2855957951360af50e217e2240f8ac4f
SHA1 1f908073f0e391dd86a014fef456d4d5ae1fd610
SHA512 b97890beb34a5222bb7b27e226b5fa1c3a70bf796fbbd26d2c2dbae3ef3b97dbcf2b729f080fe1370c57c4c31626e09854a6e3b170259c149d90e887ce46ace6
SSDEEP 25165824:6zAWGZSzV4WjN1qOkiNPGVQ5iiKGboqRrS3qnxh/:IfGw9pSiNOQcilb7RrcqnL
TLSH
T1799933970668B0B8C620A1380DBAA31ACE453BB175364B557C76F60FFE313D75AB0978
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GameOverlayRenderer.dll
- Size 87KB
- SHA256 f8c705a7cfea624eb6a848ce343e5e202cfd0dc090a01fd8abae4ba13ef0d9fa
- MD5 15d7d39d2e893de5bad5062bd906c8b2
- SHA1 22b2348a2cb72d794e8107d96f9fdc40dfc974bf
- SHA512 8bfcd65a2f3f6464a497dbb6fdda42e7baed11f2931737916068b0d31a9370b043649f97f53f82d8b0043dabcb70cc107a714eb10c432434d19059ca0ef23d4b
- SSDEEP 1536:EFbClWCFyaBmq49qzL57NkGIuK8SEibdFsWcxcdyuWcJ5in5uEqp:EFqJFyaB6qzfr+kAyuWcJ5in5I
- TLSH
  T12693390077D1B071E5BEDA315B74F661DF3DB910CEE09D6B2B5A0A2A4F302C0DA25E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  GameOverlayRenderer64.dll
- Size 111KB
- SHA256 a3f77f29eae3a480609cc021759e0778b8ec551a441ec105e652ece980c9e112
- MD5 1a09910aa3dbb3d6851c05c12df7124c
- SHA1 f1325afe785927ee4366d42c4e2b04f5aeb6eee3
- SHA512 5e08c2f4cfc1e4f30942f9b7fe6d1d3fdd61ffaf60edfae7d8ef2b0df6ee7065dd6971448a8f3a5eb6ea44b612a1dc3774d8b38fa3ef49c745f0551856b651f1
- SSDEEP 3072:Unlpy8p5bL5p3FKhvXL14v7QoKw4n8Vwbb2gEMj5hf:cfy8ppL3FKd082vMb
- TLSH
  T1E7B3291B72E970ABE1A6C274CB737E05D772B85107549BAF03A4464A1F23391CD3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Gunfire Reborn_Data/Plugins/steam_api64.dll
- Size 282KB
- SHA256 f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
- MD5 2bca4e2c047ec969cb3cff277e7fc184
- SHA1 c4b5b00b605e59c6fdcb6731f2e53069506e287a
- SHA512 3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
- SSDEEP 6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x
- TLSH
  T1B7542879A2350CF4D5B2C239CD814D4BEB71384B23159EEF2BA413365F536C26E3A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Launcher.exe
- Size 324KB
- SHA256 4ee987d574c23507523f06ec0c3e6d8213a54c7ef972d92111b520cfebd0a441
- MD5 26acf51018fcd9236cb8fb9f289abc07
- SHA1 db433f5b0698b82f6523b23030885de615d3f83f
- SHA512 b53b7f256976706de1c20ce4335629747db5a990ce0b440682250fda6f0860e757ef540d7cc495b6b092d0f9d66738400b395820d3530bdc47be819b0d33789b
- SSDEEP 6144:ugwkUqft22YCReurvB1C3vQA9UO9I3lSBmRtnWvGV:rD12NCRtvB1CoA9PaOc
- TLSH
  T14E645C5AF3A814F8E9B7923CCD464906E6B77C160721DADF13A0465A3F236D09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  steamclient.dll
- Size 14.3MB
- SHA256 55b6523d3e31819770bfc2a58d6a037c14c38c23eb2039e799d68ab008bc5011
- MD5 d13380b7d1a01adee821ec031e294140
- SHA1 187e7a40d7d6d395ff9251b4a35795311aed0f9c
- SHA512 3dc795467ea0b2d329f599a238e6961a73efcb831145eb0ff841875b4c66d45e2e4ee47ee4dfea9a2cddaf52519fb77344cc0feb5b9aef1ce371e692a2e4919f
- SSDEEP 196608:3Glq9KBFBNQaX0zhK5Ehr84hdR7wciZgA72D8UEAj:P9KnAK5p4hXwcIgA72IAj
- TLSH
  T1F8E6BF01F641D125FBBB01F28AFA477A5B3C9A70171147E7B2C4B6198E26AD1FD32623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  steamclient64.dll
- Size 15.8MB
- SHA256 11b095f5ec87b7bcd33d785a18f9770eb5f46aa4541a61975238f59b2d9cadae
- MD5 818ddd5e649df4ddd893a139243f3636
- SHA1 0162ebb7a49b1a72e849972874c0b34b46fa3cad
- SHA512 78fb9c88aadd13249a65008bf9722852b09afa8ca0b099ff4a8554eaeb430810d97a674f2e8a4b7188fe8bbebff396a2b97f98412c05f1baf292f8d0e79c7f78
- SSDEEP 98304:8qGJ4l084GJVSPeT6A3ImuYqlw2rd71y+4AxYZgAE6EZDi7QZabAViVvg:94YCK/uZl37wciZgA72D8UPVx
- TLSH
  T168F66B47E6BB11E5DAB6C13896F36227FA717499433097E7A6C0560A4F62BE0DD3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Custom.dll
- Size 11.8MB
- SHA256 39fe552f295f2da36baa82dc206d512533acf97160551a28cbe9c0545751464b
- MD5 04be96e4bf498a9ba906bc7d15726aa6
- SHA1 a5ddfdceec714ffded066090d92bada2d58ae772
- SHA512 312487a715a948de75d9ba173e0ddab68692ef03fec3576e2aea44f10f7ba7b005509898a5e62e1a48f00b44fcf22230cee505f9495d112f191db4e06883d234
- SSDEEP 196608:Y5T9bmNkpxsPBu80bAGucZjpZ7JLarUOEOpkLuWY0lm+vgbWY:wXw0bDTZ9Z7JLaQ5gy
- TLSH
  T1B8C6128564D5C2FCC8058974E6481EFDF0D978898CBD852B7FC688227A71DA8C8F6B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  Gunfire Reborn_Data/Plugins/steam_api64.dll
- Size 282KB
- SHA256 f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
- MD5 2bca4e2c047ec969cb3cff277e7fc184
- SHA1 c4b5b00b605e59c6fdcb6731f2e53069506e287a
- SHA512 3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
- SSDEEP 6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x
- TLSH
  T1B7542879A2350CF4D5B2C239CD814D4BEB71384B23159EEF2BA413365F536C26E3A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral17 behavioral18
- Target
  OnlineFix64.dll
- Size 11.4MB
- SHA256 54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
- MD5 485fa45f1886c44a1f2dbf7b8c132971
- SHA1 3833e8c37c6181ff148e0ca19f28145f9b80a8a9
- SHA512 e1e77f0f710abfa92261305d893597093177250d57630ce459bd657c09fc05773b1fbbf0387c1ca854650e52a8071a0c152b9011cdb197d97149990943e75e5b
- SSDEEP 196608:NlMHThZSFtSb3v19yOO10Xx9OYRNJsV1aUIu:AHTTSFt8N/O+u
- TLSH
  T131C622ED55D062B4D1D38640B18B539931C1A14D81FD0D193ECB2D412FAACBF6A8EAFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  SteamOverlay64.dll
- Size 114KB
- SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
- MD5 0a5429b888c75f6525e1100e32dd2b69
- SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
- SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
- SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
- TLSH
  T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  winmm.dll
- Size 494KB
- SHA256 cb8baaa2054a11628b96e474e1428a430c95321f8ac3b89764255cbd6628a9d6
- MD5 67c049e74d242975ffd0dcab9bc3b041
- SHA1 1f5b8e6dfa8e2132264a7dd1f66948a0948fe4c4
- SHA512 f98d04258d3f77362a023278713a30c3cd4f8013adfcea5a26a548a6f95d0786da080a8fbffde40579bd783d818fd9c4f4714decbdc34f84bb1b10e5fbd0fe28
- SSDEEP 6144:0lHx0Al1TCgUfptsdNqB9G03mKt/SI+vnYvvooI7IreqdDp8:0hx0AlYsOdKJYvvooI7uzdt8
- TLSH
  T1BEB48E19E66842B9F56BE138C9530A07E7B17849536097CF03E09BBA2F27BE0573E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Gunfire Reborn Update from Build 20506329 to Build 22432082/Update/Gunfire Reborn Update to Build 22432082.exe
- Size 656KB
- SHA256 aa4f18643152e4e8b7604e8d179cf6350fc27558be2e0359f167eebaff75a594
- MD5 294317ae25293bd6f93b65859e024814
- SHA1 61756f216447c1bf086a565152053632a831b986
- SHA512 f9a30df170786ce734dcffdca24044b9515d8aecb9936f67d9d86f1201417e8fc3820c29487d9982658410cbfa7eb1f3cc287637879cf4b15126311291ec8e6a
- SSDEEP 12288:uaHc64b888888888888W88888888888Unwj4lbT69DjxiZl8zAeONQ9uZsnDmi3v:F86V/5T6N91BoQ9uZUR+zZdQ
- TLSH
  T165E47903A28A02F0F621C93584E79A106F962A6799F1536E2EF8D21F3E757737C71B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Contacts third-party web service commonly abused for C2

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26