d0acaaa2476444fe96390e88af54747f1968b8546d95c6344e3e4e3e386ce1f5

Sharing

Copy URL Twitter E-mail

General

Target
gmod11_4001_43.7z
Size 75.2MB
Sample260707-grt5caa16x
SHA256 d0acaaa2476444fe96390e88af54747f1968b8546d95c6344e3e4e3e386ce1f5
MD5 50c031a67223264ff5809fb4135df159
SHA1 2749fc2a121a659f12cdef2ff253d8b9e3cf82d3
SHA512 b5d729599e037c366c1ea27ea88761f2c6dd797584133bfd31a31a90f1df0e48802982556089b211ecdf924ff4fd238b4e366f4dcb54c61639d08fcba1f11739
SSDEEP 1572864:gQIhIblNjISvXJxgQbBQ5VD24njLykYcLvGYJtZN:8IbcSv5iQm5VDZnvYcL+YvZN
TLSH
T1FA0833C1FE880E4E9F43FD6EB84B045D44DD75C59BA29A9D8C95CBF340EFA99249E020
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  garrysmod/addons/derma/lua/derma/derma_utils.lua
- Size 6KB
- SHA256 2069b2ed985771565d37ca1b1c0123a5c82f059448ac52a722ae9e50bdde4a0a
- MD5 23de72fe9624ac79a41eb27a4782e9b6
- SHA1 16df79dcc583177ceb3a43ad61c4d1b2e9225d69
- SHA512 c46eae278c26eb51678348ebc86800fdd49e6acd8d1f7d6f3134a0d905046fe24f541b370dd9e8ac6eb41a219c90cc999ad945cf41252bf75e5f963498c24791
- SSDEEP 96:uxniOUeRQSUGFIjMwQ2xZyxdLVq/fhCyCNDpZjmzBaWXCHy4:kQSnF12vyniCyCNDpZjmzBaWXCHy4
- TLSH
  T1A7E112D1F54A6561CEF33760B9776C00BF268038A1753D74380E65CAAEE984E10E7BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  garrysmod/addons/derma/lua/derma/init.lua
- Size 2KB
- SHA256 7e357129db2827406a16b52af174cde9ecd88584ea3ec8976f39013161be525c
- MD5 4ed445e06cb62ac041fa82bd3358065f
- SHA1 bd6b152244839edc2fb7853391244fa084c9a2cf
- SHA512 c57a61d67a16e0285561190e608c957ddbf84bf1ce52fb5f1bd8bbcd71e43f17c2448febfacc3c167b51c162af36a90d9f1e10460fbd4d26779fbe9ec787c5c4
- TLSH
  T1F84180B939954261552312F44D7F981ABABC6372827B09E47868E8D0E0E1B9C80FFF5D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  garrysmod/addons/derma/lua/skins/default.lua
- Size 24KB
- SHA256 46557ea30d2e010b982592c6a3ca908cdfbf09939f2af9a83d6240caba091c63
- MD5 5029251ad2238ccaa9e20451d1aa8180
- SHA1 a417cde1d7f3fb788c1dc4617e19ee3733109f9c
- SHA512 1807f0b6ad31a97e097296c85097fc7ffe75f0db6dc6e50ccafdd2af1b53e9793cd6eb38fc485012b50295f2287e995157b85dfb26893d2b249e98f6afc9befd
- SSDEEP 192:CbFRJ5Robga2TR35wCQaoUu5Nqz+vs3k6q:i/J5asa2Fh2UJz/9q
- TLSH
  T104B20D26BCCBE0DE8953E75859BA8C04EF8654D1112B125A3D0F69E371849DF20BDFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  garrysmod/addons/derma/lua/vgui/DButton.lua
- Size 4KB
- SHA256 103df972ec1f725eebc9ba799ee20c06e8ddf9c8bb15f5d35f5d232ab13b6ff6
- MD5 24b31afc9afb27b4bec64fdc30e59414
- SHA1 8110640d1d11d36c5de2947b01d7738f0a6f4f0f
- SHA512 1d9cbb1695be9a59c28df1b233ead4227055ee821869e79650f685242befba7fb0f85fa524b76d3cdb9848dc624c9ce9852a4cafdc808c4a5c2cb8d4b671e191
- SSDEEP 48:ocAw6a3l7gEadU8GTtjeN1DvGYllZRXQchacG3A0hV+mT5MLnURacecypwXaKzAh:ug77kDu5Hi0hImTuLNxG14
- TLSH
  T11DA1525B3DCB90325163F3609BBB1011FB546129822D46A47CAD45CE2B3A9FC42DDFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  garrysmod/addons/derma/lua/vgui/DCheckBox.lua
- Size 5KB
- SHA256 bf78af7dacbefa368db718188c7997e06f19dcc3358380fe07129b3e5ce97453
- MD5 8f418ce7fd5b6b912f9364c5a8c84da7
- SHA1 9686e5d6fc8375f3ffc44a0f3a25482cd08438f5
- SHA512 43b561a3792a3e6ac97b7e015d070a9a56d8d2de15b430e499cfd8b4060c382b76af688345cc074e247113923eb1026ad5c803278b2096f62e6fdfa10bdb8cc5
- SSDEEP 48:ocACGHJxQykbHFO/j3I4vgcf6rLLa+z8kDQrHx5slHnETHYHhHjdLqFs4hVwJ/aS:uNJSOL3BYVVkVw1916VdwNpbXxi8
- TLSH
  T129C1D1AB7DC79012A6B2E3B46A3A1500EF5241A94B3956587CACD4C25F74DEC40CEFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  garrysmod/addons/derma/lua/vgui/DColorMixer.lua
- Size 5KB
- SHA256 8d1abdee2611b07b18a10a008e82ead9e656ca77a75a692214f00af5cd34d2c6
- MD5 7e8c8fc0fab7e5bbb1ec72c6f002cc73
- SHA1 ad5cad2b9a860bbfc8f29262f9ecfec88384010e
- SHA512 737f8cec0482314d47821cbb068021e80954c2479c4e353ad1da41d84c604a3e5ef897a617eb877250c580b2c7c54dae58b89c1f0e9a9b009ddbd4049df0be1c
- SSDEEP 96:utSuf9JSjFjtn0JF44iKMKelzX6uVMFgrX:aSul8jlmkYMKelzX6OcsX
- TLSH
  T17CC1BE7AFE8B81924AA7E3DC8976A011F262A325452D17183C7E848293644DD81EDFFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  garrysmod/addons/derma/lua/vgui/DFrame.lua
- Size 4KB
- SHA256 282ad8884ef4291c60dadd5bbb698552673d7fb3a63eed479fc3854b7c2f5e15
- MD5 ac55c7bca7b1a16a8f11c2680c24708d
- SHA1 9f9ad1401b5e060a4ba9f94a2621d332b8436e7b
- SHA512 1c881fd9866cf4ee41c79fb1145370663bcfe402094e901c20e17b8e434a7cc166aa2b9b858a9adef726912887853edda4ee992641c127553d4a38018466c12c
- SSDEEP 48:ocAPr3SiLKQe/ziaZK53iLR643fJ3U/3uN3voNi3bF5FbpphBUGc3A8Bvhgq3WaP:u2iCPVWNgH7Uc8Bh39PDp
- TLSH
  T1BB9101523C8F9126A1B2F7B596B77002F6559022833C93443C7FA1D36B218AD41EDFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  garrysmod/addons/derma/lua/vgui/DListView.lua
- Size 14KB
- SHA256 41cd46312f2342656a3c38b1a6ea39fc4e79064e636494a439fce92ff1a7c907
- MD5 c59b94e9bb7378d81928dc889542e6be
- SHA1 b606f05fba17c31c407fa7c634f8cb75bb4570b8
- SHA512 06f01aced5856964812956452b508757816c7d8ca6d02450555058c222b98f59d8b1ec56c9aaa82ed43a63eb53ccda98c8f6b1c32f08b021f1a4f7eedc14bea5
- SSDEEP 96:ueuEQYqwssGZu8nyNhnAMsIJP9dYKVsJgQJoGXGnpJhXmBkohOogPy7tLygEikc:ZQ424gyN1ARItwRgyMtuOog8N
- TLSH
  T12662535B7C47D02596B3F3947AB90809E656C03B453922E47CAD809A6520CAE80FDFEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  garrysmod/addons/derma/lua/vgui/DListView_Column.lua
- Size 4KB
- SHA256 7739568f19d2d10ced22a5970c7a701f239bad369b2c947353effd2e84412736
- MD5 04a4718f7baf4e639630705b3a5e610f
- SHA1 4f16b13bf5ed7e33a539748a5c6b8cc71b273b89
- SHA512 9f1b7b7a1c52f6c3cf3ff2160c2b2c6db2e4563dfb5112566a6d2a2f5ce8ee53dab51a0ae1fb0f7862902e9fec428bb2cfb910b8b223902e8561caf3c4d23610
- SSDEEP 48:ocAeQUz4AWq2WS7PkJFUA8K3ByYLeGcph48YPgcj7qch7fodxRWv4A6LLPT1ZXgE:uy/S7cJttSGuh4X4tSAdmLk7cT/bt3S
- TLSH
  T125A143177D87A0128572F7354BB62505FA12511B427AA2903CED88C71F24CEA01DDFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  garrysmod/addons/derma/lua/vgui/DMenu.lua
- Size 6KB
- SHA256 f53c73ee5dfafdea18841bb12248dd99cea2d82396eb52fc56581b604bf06199
- MD5 438ff28c6563e9dceca4892537aa27b0
- SHA1 8922902dc164aab0be654508ffc2f02316c92346
- SHA512 3115bb9a3b97d4006585ee266a1e238847a071c7e7291c89674cb28c99ec19035c231482f99d924518337d0de717609468e45f6fbb656a8613ca184f723c4fd4
- SSDEEP 96:uopMudWYR+czhfQNbyvd0h5l6DpAgJxy3bAO:VGCvHfQ520h5cOl
- TLSH
  T175E11046BC8BE133D2A2F394877A6014FB299171522D23553C5D84CE66148FE81EEFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  garrysmod/addons/derma/lua/vgui/DMultiChoice.lua
- Size 5KB
- SHA256 89e298e8f948e855c3547c3fc53732e11eea80b5c76da0cd911601c0aeaca605
- MD5 1b55bed56884ad3c67ee11d7f67a105c
- SHA1 28b4175709861d52b115f88a4e4dc4a0e29f229d
- SHA512 fcf871b52d3bdfb204130f6ba97e91db521a470f7f7240c45cd1ab5d75008806b11f1916bdf2bcf162be8baedb5f1cf66817a396cff079b545bb7f70484f2c36
- SSDEEP 48:ocAN3OK6MTmPamKBm9NBonjBwhVCUXWVzLSzR2ejByZz7v2jBYAIZzvP070lyACN:uKI6a3sqjYbjZjp6RCAvjiEDjSB0S
- TLSH
  T107B1148ABC4B923185E3F360D63B2811EB52422B863D52657CED49DA2721CA940DEF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  garrysmod/addons/derma/lua/vgui/DNumPad.lua
- Size 5KB
- SHA256 c00a9e68a0adcaebd34d61e18d3a20ff128b530179903b320998060e82ac9445
- MD5 b832f257cd4e842083a5438986d060c5
- SHA1 5cf9244187fbc67b08e4405468a1549701f9c500
- SHA512 cbbb253163a47010d5030111bfb354fc646ff4dece38c81c03511455a7022616e5f0c2bf7f55d2207bf5009a9cb9d6c72fd0819dafd1dac7135bd2f6ea6caffc
- SSDEEP 96:uu1Skh+jucM6yl5/FA0FVqmeptF0DIpIoRxIaB:X1l8ydHqmeptLpIoRxHB
- TLSH
  T103C124E2BD46402615E7F3E98ABB10C2EED19035417E7E84B8BD35CB03C526541ECEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  garrysmod/addons/derma/lua/vgui/DNumSlider.lua
- Size 5KB
- SHA256 ad943831a531ddd10045763db26f29172b6150ce03fbb48a71e00aeec0808f47
- MD5 3654f88d0ae24627b958ef6f7a4e1842
- SHA1 5fbc0e69a634e9e578b17f1514d7b0ad35d0b8fc
- SHA512 f203a869cc2c6ffa46bf5ce125c0fb789bd0acdd44523be023792310d848f89aff4e55ba84e7b5c2017b4fd408035828a9e18c0783ea96753dd0f970b3f66fe8
- SSDEEP 48:ocAOkdK+0xx+KAOkZJfJZ1bpuC1QqWbgCeZbyPZxnBzacP4ZMGx5sIhVCkBDSGx7:uch6JfDtv3eGuca2P
- TLSH
  T121C1BF167CC7D115C173F3A05ABA2905EFA5826A4A288255BDADC8C36B31D9F01CDFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  garrysmod/addons/derma/lua/vgui/DNumberWang.lua
- Size 9KB
- SHA256 054e9387a04a5890e8c4f8ff91cfd2bd3ff486468fdb1d4f6d8d4402f5925f63
- MD5 fe8a2e907e1d6ccb8812a3ac20fab9b5
- SHA1 bb20952be952c0a0900a7a9ea2fc0365ab0c0f0d
- SHA512 340587a9c4b6dac98270b621b385b0d1fc83402cdab4735451915e14362dac654db932d03f487a3c9186db23206e2333c49d8aa62b3998683058d4902b929549
- SSDEEP 96:upJSZHZa8EiuKDuPgtMX1gUjomtRo9cU1swG:uJSZ8AzanjM51dG
- TLSH
  T1C0120F56ECC7922785A7F3E08EB62103EB1181B5872852583C7D48C26A71DED41DEFDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  garrysmod/addons/derma/lua/vgui/DPanelList.lua
- Size 7KB
- SHA256 48b792771ff725cf3a5e4e20e3f70ddef9521e222307b5b4da56522b15b510a9
- MD5 774c670ea4109aafd5c681d2f7cabe1b
- SHA1 7f0b714b2042ae4da9db7b06a5df35d3f2dd31f4
- SHA512 962000930f5f6e7ce5fd07eac242f752d701a9c5511a67833e9edf98aba5788699c9e11c5705cf781f633b848ea9b4b0dea7db783a70503bb2808c0c09fd1b9b
- SSDEEP 96:u3p2jP9NJP7mtqRROWmtqQtnNmttb0Nmt1hPY95h2SYndF2vMFP0aoBmHy:epalN4A3mA4QAQBY5h2SZaoAHy
- TLSH
  T1EFF123127DCFD12A46E3F334EA762006EA1EC135811D92883CED65926E3595E40FEFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  garrysmod/addons/derma/lua/vgui/DTextEntry.lua
- Size 7KB
- SHA256 7a5a80e453d606927ce69cf3ae1e767772044ac65a2e1dccc0b1b43410e0ad53
- MD5 3fdd2fba601532f97fe162fa6b46f385
- SHA1 24caf5311b3300c120acdc44721b0fa3e2beba24
- SHA512 1d2a9a29e6e8b68c3981de01d5d420e344b20840b8a1954202e8a4b4078ca0cdbb990f6a3ce24765e11e159408564fb798d653d21243f8f1265142d44de61df6
- SSDEEP 96:uId9o5SqtBvYEREQ6v1A0hNZygvx9ks11uv8NqJU0r+C+W:fdW5zt2EREVNA0hNZygvxZm7tqW
- TLSH
  T1DBF1334BBCCBE2236AA2F3606E7E5010EB155167C33A53647C5D84CA16354AD42EEFDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32