f2b006d2af4f96b15103da4ec5d92707e54a910e10bec49e37564887bcc28d78

Sharing

Copy URL Twitter E-mail

General

Target
yougey-main.zip
Size 5.0MB
Sample260624-l18fjsbv4m
SHA256 f2b006d2af4f96b15103da4ec5d92707e54a910e10bec49e37564887bcc28d78
MD5 240303abed01d7f26a84f9b3255ce0bf
SHA1 13e8e396332127ecd5d8b57084c0bbb311c5501e
SHA512 c9ab0102985ba0b66e9e1fb20cdddcbce368ab4b93aff38fbe83b70ed68156e84164359b279a3062e785692ad94c8fddf209f7a7e719007c53fde7b16b06df34
SSDEEP 98304:W/WrCjCIyWfDR4DGOPv6teOoq4T/zgSB5dJXQORtTS68y8m987:sQCjCxm4V1/zgSTdJXrulRm987
TLSH
T14E362329C61E3E31C06227F7B4432913A854B480E150EE49095B1EB16C776BA7F67BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  yougey-main.zip
- Size 5.0MB
- SHA256 f2b006d2af4f96b15103da4ec5d92707e54a910e10bec49e37564887bcc28d78
- MD5 240303abed01d7f26a84f9b3255ce0bf
- SHA1 13e8e396332127ecd5d8b57084c0bbb311c5501e
- SHA512 c9ab0102985ba0b66e9e1fb20cdddcbce368ab4b93aff38fbe83b70ed68156e84164359b279a3062e785692ad94c8fddf209f7a7e719007c53fde7b16b06df34
- SSDEEP 98304:W/WrCjCIyWfDR4DGOPv6teOoq4T/zgSB5dJXQORtTS68y8m987:sQCjCxm4V1/zgSTdJXrulRm987
- TLSH
  T14E362329C61E3E31C06227F7B4432913A854B480E150EE49095B1EB16C776BA7F67BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  yougey-main/yougey/src/cheat/features/misc/reveal_equipment.h
- Size 3KB
- SHA256 904bed9f72e5844511e61654d8e0a7a9580286e8d20f9481057c5052c77608f3
- MD5 b2eaf9d557d3b01ab0c330e33b1bfed3
- SHA1 189afe3bc5c0da6de5d4158a17a77458a6a17d65
- SHA512 4c07224b25f4e591590638623ae2cc8f1dde2f2cf4426c175963cbfde98d036bfe5a7fb82ebf00348550176c661ca80c005cd0d92be58a1e9ebef89b01f7e303
- TLSH
  T12761B0C2A5FB7E93C4A2A5D6DB960D42312170C3B384DFD0BA6F46D82FA71815678272
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  yougey-main/yougey/src/cheat/features/movement/movement.cpp
- Size 34KB
- SHA256 d43c4d9e0a8dc5cc5035d274d76375595d999b67e57bd048261dd0b99caa0859
- MD5 3c60283d915d3bb27c7893fcc8155490
- SHA1 4e1486edad7e4f6831149502aae14d869f1c362b
- SHA512 1668898adfba69d47a97955c4823a35bcd96f0fdab040d5d8dbf132d86dc29677b78f9a741a47728718bccf6e7366c662d4f40189786c8372e83e2ae1d6b27a4
- SSDEEP 768:/GqswWkcXBD/B/EAXKWRPtLlVnGDOMuQAQ:/GTkqBDFKWRPtxVnGDOMudQ
- TLSH
  T1DEF296C8B36D5E171A2036F54C02887934F8A8E22D95BDA15FAD846C23C85ED92BF4D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  yougey-main/yougey/src/cheat/features/movement/movement.h
- Size 1KB
- SHA256 f1eb11a9b0ff62155be17ec0c6d84ca678f1d2d4d228560320d7f816b7769aa7
- MD5 0d9ca2a09dacf807067bf667e9b0d217
- SHA1 f2b2c7d7df2a4de20ebcdca8de32a21ddb8bce39
- SHA512 1f1d39437ee5553f6f389d25886caa0796728c5921b7965cb40d795c4ff88618ab06d4548c7bc03ceee3474342b5f3366f35aa97ee1256b1d58af94973667d67
- TLSH
  T1FC11D089F234C635103480BAC8397C74556C38403CEB1C96D697C2DAC1F4CD4C2FAAB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  yougey-main/yougey/src/cheat/features/penetration/autowall.cpp
- Size 6KB
- SHA256 34ce7d4b3a74e013104c58e6f2b1cbe87753e3e66b86f219bfbc25239ca8d750
- MD5 d199af01cc3840399048b156b9c982f7
- SHA1 581c828a602b4207d335d2da734768f9d1db73a9
- SHA512 93ef5b4f76bd1baf5f31474f6cc02bc0444fd827f006c73ee216eb54189662ffd844cb74e105690c077973d2ed6eed12d0103e441138ba5aba06cd2c7fe822af
- SSDEEP 96:bj2/DPyikFC/eBcXAf8JHg/nQamYSbRrAgUJx+kCXbD9JFbrbA4RrwZRbjGDTGGt:bmD9JHg/nQamlFhJBbAccWtnd
- TLSH
  T150D182C42AD7819F21A379A2B7C2444096D4B0A7E0D3B9A7365D0820DFC71CEE1FA5E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  yougey-main/yougey/src/cheat/features/penetration/autowall.h
- Size 1KB
- SHA256 82bf1f7c4c98569a1767dd90e7828b24a7bb3649455f9f5271283226397390c8
- MD5 d7f29fe6978a5a321ab79656c16da979
- SHA1 7822ab56580580269b3cf4d82d4332da021bf9c4
- SHA512 aea31096f50968190ccfb395e078868a97d53c1454f3a951d9633a4f4efa4899900e7cd66e7b265c99da387dd77e0f84c8cd35b5b841375e693fd0ac817c656f
- TLSH
  T1F041E99137BD81E351A9F273AE84880E646874C49ACF2ED7B76D1C3821C5181F2E66E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  yougey-main/yougey/src/cheat/features/ragebot/ragebot.cpp
- Size 39KB
- SHA256 56791d6d4692e7207892e518f09aa20c987f742198477dff805c6cddbe7bb208
- MD5 fe287317f7f1afd0d45117a925c73360
- SHA1 bea8dc91902f48273bfc1ba3acdd5bcdb419c226
- SHA512 a6d5636e65a3d68b2a248009dab4b6ecbb4ffde7434052f99a59103e68ec999fbf84fdb7cfe2bab955a3d3cde73574fdbbd1e67fbb79b9b4d74eb22f75a0b80a
- SSDEEP 768:CRFRUcYzc/v48dFy+4fC14ws2o96crb7zl1Mk3pCli:CRFRUct/v48dH4ws/3k4F
- TLSH
  T14003E7C477AE14ABA69138549D0047AEA47DB8E2149F1C63FEFC416430C5ADFE2FAC91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  yougey-main/yougey/src/cheat/features/ragebot/ragebot.h
- Size 2KB
- SHA256 50af806ba2ff3a2394dd49c71cc50b6b62bd334534560ba93e1bddc951398228
- MD5 379ad8bec91d95cdc74f8c8a37e17ff9
- SHA1 85862b10a9e6a7f97c0b014e6efafcf843340c0e
- SHA512 509af3618bb20e5720c5065096982d45625796f410af0285b5116d0cfdba106674f4173dfac40cbc65fb5da130a4d506f362e5cb3956dabb4ca55440cc653a28
- TLSH
  T19F5144F6B36C45B092B3906BED11A315B82A74C0729F0CA5B65D94A8E0C46C6F3EF590
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  yougey-main/yougey/src/cheat/features/ragebot/shotlogger.cpp
- Size 8KB
- SHA256 2bf241875e298f396e8e9ac73ea36646f4a2c7a21d1858598e83313a158d1aa0
- MD5 a81826df8fcd36aa347aee0470682ba0
- SHA1 571e20edadadb0cd309886881588bf83cceb5053
- SHA512 8e85135c19ecaaaba80a9e2832a204c4d70a26518c956e86a57949bef143b830020cbcc28e170e978269c9c5411cdf4dd5a91609daa6f1e223b72ed1e6ea8297
- SSDEEP 192:gmJ5WYXzEPihXlWY0YUYnhF7lZu6et3e6Ci1HfYvBlXl307YIgve7c0I7hTe3FC:gmJzXphhUdtulSgf1wYsMw3s
- TLSH
  T1EA1293C89F8C364B068631989D12158DA77CA8EEC4F41CEAEE9D9C44B4E51CEC3E7497
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  yougey-main/yougey/src/cheat/features/ragebot/shotlogger.h
- Size 1KB
- SHA256 a98109574c563ac6f7d44f5cce98312047ae09bf0ebaa37941fc72e9e6c065ea
- MD5 73a682d3b3830c5c988eb70289369c17
- SHA1 c0732bb8ebd71226a48a52ea19f714c61a00e08f
- SHA512 dc36b3adeba0aa4c21f550f8cec45c8093111ff3bb25fb1fb93035c6050f69a2d751415b67d8e747312c526fa40a2db4cfa8c4bffe0d3bb6ad39f84f70f78f37
- TLSH
  T1D921BEC6FF6C5542682E922AEF7112422A3834C5ABA61D15ED052CFE53D014DD7B7943
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  yougey-main/yougey/src/cheat/features/skins/skins.cpp
- Size 27KB
- SHA256 f4edc8cc6600cd0ae8245a1fbda05d303e1ee032d23b404c9542ba816a1a9163
- MD5 af0559bde7f1c9329cde0ed0c1bfb3ec
- SHA1 f4df433e062ea7065c05f576202e19ed160bd098
- SHA512 81834239d7325661080e2dc2295a72c5276673cf5c1f75d5f9d3070f8676aed21f23690a58b132965a16deea44248d2b18ed0a8bee86b64e9234e57cd0cb9329
- SSDEEP 384:JYQkEboqZ0PRCGfMqPcXhGG/xOknec3LhyyqJ/m2AQQ94r2JfLkDtkJiszml:JXkEbxJGUz8knec3ju/m2pQSr2JfutpT
- TLSH
  T1AAC2A5C100AB2D771563B2FA2F9B8920B1499643F1C5CD60BE6D46D49F808DC87F9AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  yougey-main/yougey/src/cheat/features/skins/skins.h
- Size 4KB
- SHA256 3c8bda193e03219fdcb658ed55760eabe99a4cead24f85e630365d4199dddc0b
- MD5 7aa25f42b94fdfb60f164138293b0fd7
- SHA1 8a628ad5d0b16ff6a52d0ae900f7167bf5af410e
- SHA512 db75bf342a0f995e396f0999312b9ea023db97fa8f762c3c781068d2be176c09fa8e5a5cd334dbc9823a7821d56e45cc5f1a7a155def08ae9a29425c17890441
- SSDEEP 96:rM31ulBHeDew3OK58X6QOaOFEWQOaOFE8mO8OAzjdaNlOOMONfWQtaO:rmaHeCweS8X6v1FEWv1FE8hbAzJaNl57
- TLSH
  T1F4818C809CBBFDF18102A316577FC64654862C4BE209CDA5F9AEC0516F6D800EAF35EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  yougey-main/yougey/src/cheat/features/threadpool/thread_pool.h
- Size 15KB
- SHA256 8d8752a788369babc148a482c4f4343e9698cd3d8791e31ccc21f7abb7a842a4
- MD5 0b70788722913c50bed9d69cf15b479e
- SHA1 f1686693bdf257ebab59338aa2d8b44d24b56ca8
- SHA512 a3bf47a56e34c67c2fc1e8014a1b2ddf7d594186faa6b53a4bfa5340b74877c6eec87d2eaf1a870b9513b9d33a4a6fd5cb79bdd36d4db69502e3693c0f236117
- SSDEEP 192:sMCO4jx6/15yQfM0UrdbCWe8hgVUCVQug8hhiyMNAjDCJwglhmsy46p8PzJrlbWD:j4dC1XfMRhmWjuBIs+JrlbWgd/FW
- TLSH
  T19572249809BE5458A492BC3C9BCBA0121263F003E368DF25FF5FC254DFC54B859A5FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  yougey-main/yougey/src/cheat/features/visuals/chams.cpp
- Size 19KB
- SHA256 3185f2e10d7675e5703e49726ce95a600e450c7d8d05a32b18035ea792c96cdc
- MD5 7b92ae72c29cb9c8eb197059ee7fef8f
- SHA1 dd3ba98dcd8858f304bff82d9160c3fd1552b1fd
- SHA512 cad4e1bb8f2837f0b4bd0cf1812b83fd86d9c246f8db8ec4390855dd395885e8106a0d55a8a8339aade51ce30c97bc2b51ef561f07586b4db22e78ad18279f29
- SSDEEP 192:Ilp0YU9L5WmFhFUV2/2cOcVK/noYV3lYk9bC6e4vs984aswUZGd:IlWYulTeV2/hJWo07uLPZGd
- TLSH
  T1DF9285C0DB0C210F19E160546A44008AB91CF17B596696E5BFE8A12CD1C76DFDB2EFAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  yougey-main/yougey/src/cheat/features/visuals/chams.h
- Size 1KB
- SHA256 7dc4419880820e7ea56f47cde91083619fa52612deb8e209190506b11d0ce76e
- MD5 67c01abc0544f71b92ba2b424e8c99fa
- SHA1 eb12d228d25898953902d41461d714ecf61aa7b7
- SHA512 f447ed99e6475ab1dfdb4d132463264bd673a947330c48bf27d4f75c64bf8773b408862ccde4d34ab43765121cd510c9f932e5330d35a4f60a52ccf88e0ed068
- TLSH
  T1F231E2458D6EA15D4892E136E2558843D860B6031B2DA5A8F3CEC4BCEF82144E97ABDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  yougey-main/yougey/src/cheat/features/visuals/dropped_weapons.cpp
- Size 6KB
- SHA256 ae734a240f2639716725ae3f78cd4ab5bc3fbd718da68ca6377346fb3412d5fd
- MD5 0217a036b7de5d9aad80cd3c2cbe6ab0
- SHA1 68201f758c7c0ca957642f7bb8dee58ea1102785
- SHA512 3f6a0a733e49e42eb850ea80da1454e07f77f39efd478e210a34ad861aeb5b7234243d7aeb144212edd100a1f0edaf736d3a28e032d9cce68385b10303047d6a
- SSDEEP 96:qRzMEu651no67NGOFmkoQ4gun/9Qqd55LEbA5x+L8r6i6YJll7FE10:cu651o67NGdlQALKKxHr6i6YJT26
- TLSH
  T13DD173C8D7AD71079EE230FC7902095EB54EE572AE101CA36FBC71A430E159EA26D7E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32