58ec96483bd6cc9b780cb5abd7f20ee265ad3c68774e6875ea87b701662d6dbb

Sharing

Copy URL Twitter E-mail

General

Target
sa-mp-0.3.7-R5-1-install.exe
Size 14.5MB
Sample260627-aqff8sfx71
SHA256 58ec96483bd6cc9b780cb5abd7f20ee265ad3c68774e6875ea87b701662d6dbb
MD5 5a22c6d5753ce67318b50a8e7f22bd2b
SHA1 2db343ecf9df5499581c41086b17c71d0f675e02
SHA512 6eb3b91c113285ed62472947e099ab6e0cd9031b3695e18d9198029cd9eca18e03921ac59abb8e3ca24e0f4869be8997cdaf1987ffb85239ff6dc19260855889
SSDEEP 393216:AMCzmmflaNtY7G8k9YLdFyBV9DVimtbA9yRbABehQtmuGuTwcL:AvaklUt3Ad2VvimtbeGbbhQt7L
TLSH
T1F5E6331C97BDF534FF77CBB42E36678B0CAE79E529C8100C83A660DEAA3169D8D16045
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  sa-mp-0.3.7-R5-1-install.exe
- Size 14.5MB
- SHA256 58ec96483bd6cc9b780cb5abd7f20ee265ad3c68774e6875ea87b701662d6dbb
- MD5 5a22c6d5753ce67318b50a8e7f22bd2b
- SHA1 2db343ecf9df5499581c41086b17c71d0f675e02
- SHA512 6eb3b91c113285ed62472947e099ab6e0cd9031b3695e18d9198029cd9eca18e03921ac59abb8e3ca24e0f4869be8997cdaf1987ffb85239ff6dc19260855889
- SSDEEP 393216:AMCzmmflaNtY7G8k9YLdFyBV9DVimtbA9yRbABehQtmuGuTwcL:AvaklUt3Ad2VvimtbeGbbhQt7L
- TLSH
  T1F5E6331C97BDF534FF77CBB42E36678B0CAE79E529C8100C83A660DEAA3169D8D16045
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  SAMPUninstall.exe
- Size 56KB
- SHA256 d00f8bf2eaa1994b0064d7b14fc987b0aab9b3c440a4177257ee2d3217fe6d3b
- MD5 bffa504cd63305418858b150faa8f408
- SHA1 86886fd2378aa33935cf684f056454859713aed4
- SHA512 6b8958a4ccffce02ba8e4390f66121a02116e2b2ef9c4baa2eea62b8acfe380d0c0dd5e773f83b7062467a34019612d3f8a531e1a4ffcefb769de964cbf02019
- SSDEEP 1536:HLXB65939tY6HBg4sXJOgdLeAyN/dIM6su:HLk395hYXJOceAlMM
- TLSH
  T18943BF0A37C488BBD66A06711AB7D77AF7FAE71123104A376B501F7F2930282DE15297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  bass.dll
- Size 90KB
- SHA256 3f04620d6627abe5c3b4747faf26603ab7a006c81b2021ab4689bdd7033bb4cd
- MD5 8f5b9b73d33e8c99202b5058cb6dce51
- SHA1 102699b1dc7e03c9041115f5e3b178f1dab1a27a
- SHA512 89d830d1ed0c55882d1cc77d1a87b193cbffd8b96010d727fad6cd2668ee94c7acfb565ddb1be5b55c8caf9791947b62e8d87fa4896d98124ca2caae0053c9df
- SSDEEP 1536:fq5gk9BPaPT8yWZv6UXq+BpSAaSv5vfwKaGorBWHiauTXJSJ:fq5r9BCPT8yZfKahrsiauTZo
- TLSH
  T1E69301F0EFB0004FC8691372582257A8643865AD8087CECC4D2D5A7D2EFBAF465B5B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  rcon.exe
- Size 36KB
- SHA256 19f0d6d844f6f14856e3ea88853202b6310edc4726eb0c803710b67f641e596f
- MD5 3f4821cda1de6d7d10654e5537b4df6e
- SHA1 ac682119ac4dc51d8db82fd4a6a0e1f108b74a94
- SHA512 0f7f5da6d38a7ad920959363d6edcba3ec9b8645b7ccade0c4590817fbbd7a0415ba492a164c56845a57df643e4d58d83f6f537cc74d55161001704b017a9f7c
- SSDEEP 384:ZYblkmoSCITDXSBkCmleSWLJETJBsE9yzd9LzSjvEgKEyokl7V:Obpo8DXv34JE9W0s9LejvRKRoe7
- TLSH
  T102F26D337DE08037D88596B125BB5F56AF3B522102E950C3DB18ED6C2DB26D07E3E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  samp.dll
- Size 1.1MB
- SHA256 b72b5dbe725f81864ca3f78bc7063bda56cc05fc7188af822fa7a754432553a2
- MD5 5ba5f0be7af99dfd03fb39e88a970a2b
- SHA1 cfee81e92701580ff63e62dbb38d4035a05cfbab
- SHA512 a7459e33509f33eb21268d4bd70604953cb5b71555ef217286f848794e71980e0b5541c87d1d935d999fddd79e83e99893d97e9a90b8b570c5daa8fde34288a2
- SSDEEP 24576:hZgAAx6bqT+6QbhmCkh+LPQ5M+5BxX1s/elplhAEZOQ+uMPGP:JjuaP9PQ5MarKWJhsz6P
- TLSH
  T14645AD52F686D0F0EC4936F9496F7B2F83A8DA484B2545D3E3D03D6999313D2683A2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  samp.exe
- Size 403KB
- SHA256 910227f4b451e3ecd1e0c8565fb2951e1f34164c2f441c6f384ee343b414a1b4
- MD5 724188afa06472872e393c9318027f04
- SHA1 2f1794654f9753e1496c1177fc841e807e465f25
- SHA512 51cc952fb847bca30fb817c406d23383cb13f7e8eecc74d7d22f7f43dd88e6ff25b9fe5cee4f471dbf839c539e20f279316e57d209ce894f0002849a81daa8e1
- SSDEEP 6144:gljoxXwq08PvxVYBaKWPMA/gP22EXoWqOZDS8xU7+4hI4HmbBO3J4TL2:gl8S8RIWapAoWqOZDSV7JI4GbBO5Y6
- TLSH
  T1C49423228ACC1F1EEAD01DB282CD26B5DF49D6E0D71DCD859365570B8C93A01EEA372D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  samp_debug.exe
- Size 144KB
- SHA256 f64d11680442cea5940614177b5ecff866e1e45c07a95cd5564327a94e8101d3
- MD5 2c00c60a5511c3a41a70296fd1879067
- SHA1 5a307b11eedf77749de2601318be6c2fff1fde12
- SHA512 30cdca5e5b9ae89e9ac6d12a361fce3b050e947cf0615ce80e214405bfe82aced2addac759640c39e9772d78f5287532eba9a467418ccb94487e11e41dd611da
- SSDEEP 1536:KjKmF6kc7OTzS1s2WlZ8hUg54XgH5BXidKdz4koPxCmIp7Vi13kZa:C6k7shWlZ8hUw55gCRoPx1IVi13I
- TLSH
  T1A2E35B2272DCCBF1E3E2013249BDBB6A92B5FC314B328AD75390966E1D356854939363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  version.dll
- Size 2.5MB
- SHA256 aaa041f33ce385d319dac759cb4936bd91fbcf0ba119c85e4765dfe1f38b6c85
- MD5 bc41311de24d6351810c37663f872523
- SHA1 4cc7816736b9173d103b2e539d3c982a1e795e9f
- SHA512 43c24b06b5a92488a3e64bdd2232b01b40f20b91f6aea4c97c7100fb535baffd33b46aa478fb3cbc1089854b85fc45cd767265302d5b9cb03f3cc980d585cbb4
- SSDEEP 49152:DzoqeZcQF/yYhtw9yPnlTrWv54O6gk4n+xx7q5lp:/oqe+ElTI
- TLSH
  T156C53A20EB419019F9EB02B749FE299C917CB9B147D844C3A2C569EE873A7F17E31253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18