41b52640a33c92b80fe4c21aff63b1ea84bd3683e8f078d309c2beda8a5dbc2b

Sharing

Copy URL Twitter E-mail

General

Target
EliteCheatsX-2.0.zip
Size 106.2MB
Sample260706-es6tesdv2p
SHA256 41b52640a33c92b80fe4c21aff63b1ea84bd3683e8f078d309c2beda8a5dbc2b
MD5 c83e505ea87bab9cf58710111a60d904
SHA1 827b5763f639d1b8ea381161b22bbb371a4a7d12
SHA512 51dcc704b9c5b951e8715168b72669722b69190ccb972be87385b8893e9bf29e3ea601a1025039dfeb8c5368a5da3b9fea6084da4d16893e1fca2bad3d16e93d
SSDEEP 3145728:n5pNp8zLCtQPeXyEMHuqnRf9n1qK5O3i+hzRk:5pNp1WeMHu61Z+he
TLSH
T1BE38339D1ACBEBC0E1C86027D2FCC1A4EA6D41369CFF5906B5E1229C6AC5D8E360FC55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AppBase/fonts/Settings/dxcompiler.dll
- Size 19.5MB
- SHA256 2b8f2f85788db0d80e1ce40ed414fafb8c8ee889c420192a0e7e6879bc58dfb4
- MD5 ef254abdb4599bf754222ab6894ba6bc
- SHA1 baa537652255d03859d19060e9fa3b23f3101eb2
- SHA512 61082e988b19bbf76cd65a26ab457d1637b8e2e702267cc0c168edd75fdfadede14a15596d84932f72e091f1ba6d3d29cfcbb4830b6c012f89e561579d5f1c60
- SSDEEP 196608:RzU8YRekoCaRyBOriUq2AIAZ3SMW0K+OR2Z+t1gbX8f:RI82ejyguUhZA4MWT+OgZ2ibMf
- TLSH
  T1B7274B032586D4DDC088C879C7678B57CA6C30E72E6BB9AFC1F412152F79EB85B29235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  AppBase/fonts/Settings/include/gmpxx.h
- Size 126KB
- SHA256 0011ae411a0bc1030e07d968b32fdc1343f5ac2a17b7d28f493e7976dde2ac82
- MD5 ea3d21de4bcf7c696799c5c55dd3655b
- SHA1 3e020a13e5ff85d6214ad56ac07395f53efa50d2
- SHA512 5c102c423d0147cc7bfdb4a5fce6863605969cd3a2d914c8485b5db60d33f6efef4729cce6c63d57f81627dbd50e83438c8ab54fb525d119fe02d922ce540d97
- SSDEEP 1536:ljLJi+vitB4/K8YKwUWyomDIgBxf4zj9f8LaqDyOp0e2j4DO4KV4/KX4YKztWcZk:l2xmWxg/M8OVFi2Qm
- TLSH
  T12DC32079208AFC919A93C031D263C5A5F650474133E8CD98B81E2678DFE3C56C7AEAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2 behavioral3
- Target
  AppBase/fonts/Settings/lib/x64/libEGL.dll
- Size 360KB
- SHA256 fbbe65fb7725e6fde8c381c59d170bff153b87fdf99f531d46dcfd2c1e237f98
- MD5 a1cd233bdfb48de54e18a074caad1f5c
- SHA1 dced789ffa957951389482aa03c3da272bde114a
- SHA512 22b7a5c4dae5d5220cf2179201c88371d0d24de3a4fdb709381059548bc238e892423f8dd2d3837706de6b554551651aed956526e8f69a89ddc1088974f8d164
- SSDEEP 6144:y8BSlAEZQH65WlPum8AW7elHtE+pGMYgZwlxE:y8BEjQH0/m8AW7extsB3E
- TLSH
  T157749E40B5C0C072D46E25353A28D37C4ABDAD621F6959CB93B84DFD6F702C26A3726B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  AppBase/fonts/Settings/lib/x64/libaccess_concat_plugin.dll
- Size 45KB
- SHA256 f28831b08aa6969c91f282668cd7fd02311e83a001fd31ad7ac6f1fe49fccdbc
- MD5 486b252a5b4f4c60b70ebba8dc7cbaa3
- SHA1 30e45ff8cfb6d34d6462a11373714c1668083156
- SHA512 5963c7834c6dc17ac1d432564bf4c80b9c0a011de5aaf891933b9594a275763e93c8b1e1ef280ebaa8580c7ce07ab69f46bcc4d60aa8f096aa66e4ef7438ad7b
- SSDEEP 768:7cLsu3hSEwFxXiVdEVOxY/ANxXiVdEVOxJu:oLseDw7yVTxIAjyVTxI
- TLSH
  T110237E679350AC58C91FC571B5ED8737A671B9571A61CAAA0328C2300FA0B85BBFD1BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  AppBase/fonts/Settings/lib/x64/libattachment_plugin.dll
- Size 43KB
- SHA256 37cf9f70a31fa6231e163348aeda9bbfc1eb8bd10efc4a5ca62cae568cbcdaea
- MD5 021917923bb4eba130526a89030c596d
- SHA1 cc8cd0413fb4da4a86944c085fc895f6654d3434
- SHA512 34f8759d6960cc805e38be749b83cafaf5fd27b4ad3f0e25b23742aac9c85e56bdf76deba59e1277651b65dcf5d07084c152d8e8bc150ebb5c0d5853d536591f
- SSDEEP 768:CW2Exuqnbs7wYxXiVdEVOx6ubhxXiVdEVOxtr3y:KEx9kwqyVTxJbvyVTxM
- TLSH
  T167137E67A650AC48C91FC57075EA8A3AAD75B9131EB1C7DB0364D2204FA0B81BBFD17C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  AppBase/fonts/Settings/lib/x64/libbluray-awt-j2se-1.3.2.jar
- Size 68KB
- SHA256 f6c9188634b521b08abb1ea530ab94d222a52f67fa59ca829136422931c1b213
- MD5 22ab31ce5bba1cd7069515e5d9c0d7d2
- SHA1 85dc9099235470cf2ed9b9dd559e6965d8612b17
- SHA512 55baa09d3a04dc72e43cf24ff5d84396e0d3af6f6a55b045e250a52d6fcb10f4c549570b96a57e6ff1247cdcbbd19e2ec35f4dd35e7c6649c84bb9c533fba524
- SSDEEP 1536:NXtczIvxI2imckaqmB+BOY8AujaARNkwCqZ4bwUWiz3t0m6g7Up:xtbI2sBnYwj5RNtbabSKt0mKp
- TLSH
  T1BF63E13218B82077DB5FC173D09606C1351E25F498872D262DE9AED376BADBFCB06520
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  AppBase/fonts/Settings/lib/x64/libbluray-j2se-1.3.2.jar
- Size 752KB
- SHA256 75fd105e4581290801866538270a9e7badeb5a6b9fba7d00b14b8312123c2d22
- MD5 9d76776c432194bb8ae70922eab1feca
- SHA1 5c4df6fdf208dea9d0bb9f7a4f418477981b4131
- SHA512 3b777731409ad23a2950081e7b8a87a53fe070e926ab2c1624669a85be41b95a238165f5d174e77f4c137418797f72fab45f3aee373c4ee177dda56fea896e0b
- SSDEEP 12288:gZ8S4ERL9jxTjxOL6uz9BoaItnvcKSClnb5yelW0lZ/hy+3njEz1Mk:gZ87Ej1xO1A3VvcKSeb5ycWqd0+3mMk
- TLSH
  T138F4CE72E1C42931F5638177A6E38423382E04DDEA867D13A8F66AD7E472C5AEF03715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  AppBase/fonts/Settings/lib/x64/libcdda_plugin.dll
- Size 810KB
- SHA256 7a7d2c190907053f17ce7cdfad9d689cb6bcbcaa9e1e5d55f1071db137ef4e2f
- MD5 28087f663eb9e5516cb788ffed7c6ea7
- SHA1 f6d1b224d443e7064105b7196ae06033dc09ce19
- SHA512 4ec25c5085e547f6751a539df919b2927bb9143283c967be472219e68f9a2e3f0babc8ed27f4620c5184ff630b0446fef91cc6b75c0ef11f3d9d2be6a57ceb87
- SSDEEP 12288:6Vnl/u0/J8DPk9PX7OzfCHhINhaGvuy/12YK5sqcXYobT:6Vhu0KDPk9PKTshIWURRMUT
- TLSH
  T1AB056B5BE6A314ECC26BC13443976733B472F86612707EBF16A4D6303E12E605B6E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  AppBase/fonts/Settings/lib/x64/libdvdnav_plugin.dll
- Size 230KB
- SHA256 e15f2c49db514f7e7f9d51866dfd249c739832c465185c777e0955249c9639cf
- MD5 4a5303dbb632f580a56627d83214227b
- SHA1 4344c6f6d6687bf5c7fd480275c9a4b2a52fcd26
- SHA512 335b8eddaedc57542afde15282e316eb63b22f0e07c68fa644239747aeef0d5d1bf4bad227405dcaff604d9ee61b4b33a217d17ea69e2be200d13518340b0ee4
- SSDEEP 3072:IC7jGpglaVh/Y1D6FgU9GzywQFJmFgH0mVeOurFCoTGrDTnqqqGR:LSg6mefGFomg0geVrFLkXR
- TLSH
  T190344B56B1922CECCA2BC1308397E632F972B8560230FD7E1B64C7751F15E216B6E96C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  AppBase/fonts/Settings/lib/x64/libdvdread_plugin.dll
- Size 164KB
- SHA256 cfb94e3e21ae82f05cf85e9f8be9ee012f6b7baa084c0ecca8c30310442959ef
- MD5 39d641807eab8c8e40d7eccf30960b4e
- SHA1 28413be490300791eb2d340a05b12e1ac2d1d24f
- SHA512 a8740bd4306e6ed495288b8af2fdc668dcfb3cb122d4e67cd79945a4045a4fc07740e7f8f0cf22698564bd2f28513d70d121dfa66fc2944b6b58f19a6ebfd208
- SSDEEP 3072:Bc25hZLo008Zo6BpLFLyfo+thjCpTZqdqsY:qUt0ibL0fZ/jWwY
- TLSH
  T105F34B16F15268ECDA2BC23057A7EA32F97178960330BE7D5B64C3741F25A2077AD86C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  AppBase/fonts/Settings/lib/x64/libhttps_plugin.dll
- Size 154KB
- SHA256 28f15014417c43e316af562b5809a54238a2b333fd048f83827d11c8518d08ba
- MD5 a5d6bd737c9aedac80d6a61a67e2e641
- SHA1 bab498a913367e99dbadc6e4065dc68703cc8ca3
- SHA512 6e1588d801f8dc233dd730684989b69f3bcd9be5797ab94baacddbf0e48e48238ad5cc74c993aa2fc030607111924621a113afdde87ac66b9fa213d975ca9392
- SSDEEP 3072:cjr8WMnJhvs/de6D8eaN7FlNic7bGXzMSl218JHdxCqkqqi:YQvJhvCdeQEFFlj/GjMl18JHDC8
- TLSH
  T14BF34C67E29254FDC65BC13456EA9736F831B8220730EEAE4774D6312E10F507B9E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  AppBase/fonts/Settings/lib/x64/libidummy_plugin.dll
- Size 43KB
- SHA256 2b2bb121de5d434a8fcb9d2bad73e3d4c20fba109417969b4f901a1569364c04
- MD5 3f42f3d4558afdba7fdac85b842cdb42
- SHA1 99bb323d783a15ca60674367cd2167d84a997229
- SHA512 56875b2514b1a2a3b61ba83481dea20666243cd43738ab7c099555de32cefe7092f0e07c4e46eff7e550bcf7ce7442f5b300f695f5afa95c37248e8062c07452
- SSDEEP 768:v26oPk8nqzeeQxXiVdEVOxam9xXiVdEVOxGT8O:v26IktieCyVTx5zyVTxk8O
- TLSH
  T12C138E679714AC49CD0BC57074E9863AE9B5B9521AB0CBEB0364D2704FA0741BBFE1BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  AppBase/fonts/Settings/lib/x64/libimem_plugin.dll
- Size 43KB
- SHA256 200cff43d8b8e7f569dc37df62619f61b78cbcdd6280c3401364e4c9f5ee5619
- MD5 cc2b2704a9565b5d55739c6cfda876aa
- SHA1 f02774528efe749e35bda06e066f4fd718a32e70
- SHA512 94d23b9e10ee9c7246e3072166c7ff105c14938d3b1b5c488dcc975c89dba3c98d1303c5a9ebcf245e1dbe14c2dab1d4bdeeef7814eda0ed4972d2dd651dca25
- SSDEEP 768:+4RVUL5iEmwgxXiVdEVOxzKxXiVdEVOx7FR:+4YQJwyyVTxcyVTx7FR
- TLSH
  T1DE138EA7A650AC89CD0BC57075EA4A36A975B9521A71C7EF0324C2304FA07417BFD1BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  AppBase/fonts/Settings/lib/x64/liblive555_plugin.dll
- Size 586KB
- SHA256 135ab5807ccf7d2af2913a43472df2182607e9daedd073b414cfc46e462a2870
- MD5 d3912ba8aa5657db2fb4df4b3ae6ba0b
- SHA1 e82c998bc6ad9b45810ac7b55929ed690a0df94a
- SHA512 29298b7b88b9fdf368807a85bf514e94486c8aad65e14a9f2e0c3bcc7c81cf049f20369dd61941388167a27967f094d6ebcedf08df9dabb37a92240e81c68b90
- SSDEEP 6144:NXPjRXFwbpefH3OG+k84UG2XPy8Btq3Ayd/ObEpVv7IzJFMy2IUbqG/6JjjAClP4:NXVWdef+b/7L/Bbw1v9y2IUb8YTSG
- TLSH
  T1C2D43A57AF6328FCC627C1708277A731A731F8110228BE6E36A8C7325F59D254F66678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  AppBase/fonts/Settings/lib/x64/libnfs_plugin.dll
- Size 288KB
- SHA256 29b9d3e676964223cd09e8836978a2d3b7c8e2bf5a03f406a4f34b7fd1f8d2ce
- MD5 6a777a460092ec80e33dc7ce8375d16d
- SHA1 46b6cc6c0415f80d642c25089e3ed2c3019262d4
- SHA512 f92a8e934c1faa9766ab0933bf4dab944286ace34cc6663541b344f5d7654390508ee742a756e290c807ec799d50b6862f4896d93b77214e7592433605e66661
- SSDEEP 6144:xuq5iH17IkJ8nDvmZo7Oj9Vwk80vvbaBL:xl5q7F2nrmZVVwk8EvU
- TLSH
  T1A3540A26D69625BCC66F82308257D3327971F864D721BD7F04A5CA382D18C617BBFE28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  AppBase/fonts/Settings/lib/x64/librtp_plugin.dll
- Size 662KB
- SHA256 721e0ba3a3c9bacce1a4516bfcfd8322cb37d3037650b3c36117452537ba9e50
- MD5 71ad272e128d31dc7e9ad4834ca5b5d9
- SHA1 4717698ae2dcd8d633a61ade99516d5028d4a56b
- SHA512 5d2d132bd2cec7bc8c0fa8c58b56bf810eae34f619895e3946a2f7fb7c4f223d26238035576036f3afa679fcbdf39f27f3e966e7631fc195a78cb6bc8ee0379f
- SSDEEP 6144:nYV+A66NDbZ08DXvTfFpbt3DUj3CDfyE80rvNlgLd3x5GUqJXQyDXeOTfYdqbXft:nYMJ6NDbZZpFDU7zE84L8CreoXD
- TLSH
  T1DAE48C57E6A320FCC62BC13183576733B471F82612B06EBF16A4D6302E66F506B5EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  AppBase/fonts/Settings/lib/x64/libscreen_plugin.dll
- Size 50KB
- SHA256 b697e893ec8aa81b12cb84db88a2f18861231af96c5129265a2905c9ed29ebd3
- MD5 c5eeeae5a9425995fdc3ff26f8a9f629
- SHA1 d211c2216e72a28f41ed88714d8e6f4d82cf384d
- SHA512 94ed899f8103359846cf3c128430b9a760eb3c3899976d01aa99b32dd10c39609e4218705644270ca316929eab3e73096c757311686c6a550fa2d962463c07cf
- SSDEEP 768:RrFvSPSFC+qwM2xXiVdEVOxQmTxXiVdEVOxafD:RrFvSPkCfwM0yVTxZlyVTxafD
- TLSH
  T190338DAB92506CCCC84B89B176E95637E971BD221A71CBEB4214C1310F60B907BED6BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32