6685d7118367563913923c0963c4cc406c80c7b9ae50e98dddcf16bfaefae0cd

Sharing

Copy URL Twitter E-mail

General

Target
gamehub-manager-2025-428-441-57.exe
Size 91.6MB
Sample260624-fd62baas2y
SHA256 6685d7118367563913923c0963c4cc406c80c7b9ae50e98dddcf16bfaefae0cd
MD5 26d97373c28f193d89532113630b265d
SHA1 a6338bb7f2eebc1bd67fd8189959f8dbac3f8359
SHA512 d2ddb6caca2932b1bafca552ebecd39359203b12d8ddc1da1e5f061f56c762c7f21bd08964e2c15c3294eaa6d679874059d4194037f1b4c22f125aec1270e9c8
SSDEEP 1572864:ypmoM7UPtpA8632XEGhbFTJ4CFiMX3MC/HPjYOEyy8B1R+IHfnRSrk0Z6p+Wp2/+:ypNGUPzi2XEYxfFiE3MqMOEyy84IHAOH
TLSH
T18C28332271AAFDE2D43651313F72D3D8B7BCFD086520C49AA9E0BC29563E15336B6391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  gamehub-manager-2025-428-441-57.exe
- Size 91.6MB
- SHA256 6685d7118367563913923c0963c4cc406c80c7b9ae50e98dddcf16bfaefae0cd
- MD5 26d97373c28f193d89532113630b265d
- SHA1 a6338bb7f2eebc1bd67fd8189959f8dbac3f8359
- SHA512 d2ddb6caca2932b1bafca552ebecd39359203b12d8ddc1da1e5f061f56c762c7f21bd08964e2c15c3294eaa6d679874059d4194037f1b4c22f125aec1270e9c8
- SSDEEP 1572864:ypmoM7UPtpA8632XEGhbFTJ4CFiMX3MC/HPjYOEyy8B1R+IHfnRSrk0Z6p+Wp2/+:ypNGUPzi2XEYxfFiE3MqMOEyy84IHAOH
- TLSH
  T18C28332271AAFDE2D43651313F72D3D8B7BCFD086520C49AA9E0BC29563E15336B6391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware adware privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Addons/_Redist/VisualCppRedist_AIO_x86_x64.exe
- Size 27.6MB
- SHA256 bfc56a0e6aa6fcaa013fc9bbd0a39f060e8e7ca84e5e16c1b62a99e94d4cc26c
- MD5 0ed3efb716d505769ed181e19c5fe9f5
- SHA1 6499c8109339ae028ab50b347f976ee283abe413
- SHA512 48a6f84bd767ba193a0d41ca0a30d5dc1a9238d574e60526e52cfa79b9e0786c1f4a7685ffe68b0dbe1eadfe83d3d9973d8ceb5f9fb27dcdbd93aa7562fbbcba
- SSDEEP 786432:cCzv71vHpA8632XRXGGhbFTJEvPCFqeGM+1lI3MC/HPo:vtpA8632XEGhbFTJ4CFiMX3MC/HPo
- TLSH
  T13F57330321EEFDE2D83660303B73D7D8FBBDED86A524C59A2DE1190562BD6233695390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Addons/_Redist/windowsdesktop-runtime-8.0.11-win-x64.exe
- Size 55.8MB
- SHA256 7a418127fb8510cfefc6b9db220168b851ef2748f8252829997b3c61510c830a
- MD5 fba1071515dcdf3c4d27d1eb0a7b4769
- SHA1 de8b686327fe59314011c23133ed234f255403f5
- SHA512 fd6f0ac18e77f92b78c41aa2f3e19b9d1de6e63a0e4a517c897e68dafa5131f734d39f0b1dc9ea09a3b0949805d72ef6f82efb1f6a689ab055048705f43cff7b
- SSDEEP 1572864:9YOEyy8B1R+IHfnRSrk0Z6p+Wp2/d7Tp4yIy2To:aOEyy84IHAOQQ2/JTD6
- TLSH
  T1CCD73372B1715267F3BA51B3DD50A21436A8F23C6600899DE3DCEC3D5E270D727BAA60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  XiaoJi.GameHubManager.exe
- Size 10.4MB
- SHA256 3ae4a5269a45f06c121703dd9d5817fb8e7c2fdd974b3823502f8d46ca13219b
- MD5 907b7978f9e507c8d641ddb279050547
- SHA1 11741b1bf63b6155fd71dddfe3a431d864cf6d50
- SHA512 5e2af9eae6e7c63ce7b6f9cf454d57443b589321b3a4946f2d51c06bfe9a584dcc49cf1140b0735121e6d7216da3390c0aa8befc54c80b809b5fc584f014ed89
- SSDEEP 98304:GnGZsPED1LOXuIORcqpzof7qcHkR+L11p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhQ:GnGZ8EDEZ0s7qcERa1HZNkq4pK
- TLSH
  T1B8B617196FF84B26C3A74679BCA0B3F11B255D171101A7460AC9FA1D7C762F08EA12FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XiaoJi.GameTransferTool.exe
- Size 13.2MB
- SHA256 529b3787cfd2e0a49a83785126cf2d3bc971b18a89ac524f08bc7d770f7c1e02
- MD5 3bfb317996de28b323703ea346754e66
- SHA1 a49b7323243965c0cdb03168c42db664e464e713
- SHA512 9a75367f5623cc1981ff6875c2a047834c4aadffc649aaf8d135f268e37f07bf8691babd03341c4f6db9e2f9de24df2075a6992b9a6399203b88301c79225945
- SSDEEP 196608:lnGZ8EDEZFzXcOwTE0ks4X9gz6uea7EcERa1HZNkq4pJ:4TXQ9gghcH1HYq4pJ
- TLSH
  T1D8E649192FF84B26C3A74679BCA0B3F11B755D171101A7460AC9FA1D7C762B08EA12FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  appsettings.json
- Size 462B
- SHA256 816c1d4325f06353bf799fcfddbd3b0542b2c9600f63da21f8d2e79422c50155
- MD5 828c48fe5e03e3510713df92037e9fd3
- SHA1 d6e75e067fd223cf24cf108dd24e6bd3f8f7e080
- SHA512 8cf2656f96a44fdb4527784bf32c3250a41f3a9db24aa7e9e9de59698d375d73d87e33042006b50f7c1e514e704e8b66d999040c8d78fa1f366d1d42dee83604
- TLSH
  T1F9F07D37CA0D0E571A793B719B644302FA24437F0A51500FB4BC391E0F7A4101B80E6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20