1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461

Resubmissions

12/07/2026, 04:52

260712-fhvtvacz4k5

12/07/2026, 04:35

260712-e7mn4aey4w6

12/07/2026, 04:15

260712-evnevsey3t5

Sharing

Copy URL Twitter E-mail

General

Target
GDLauncher__2.0.30__win__x64.exe
Size 150.8MB
Sample260712-evnevsey3t
SHA256 1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461
MD5 c10d9d8fa74bb73239d106b45707741f
SHA1 8f2530042599d9cf309875ab4a6c3bf133db26cb
SHA512 71d270e8a0fc8d3dc67cd76643ac4d0ff621b6cc4ddd71a45d50bffb2e60a6816f52eb6e028ce05e25bd237df13179286013e5ccef856d9d96cbc7a177148330
SSDEEP 3145728:01L+5eWgyYRppCi6pd5fkGe7Ckgo9tzBArJZ1x8sXX7S0xd:i65eWgy3o7dgo/+1Keui
TLSH
T17A783380633A5B47CAE6ADBC6ACB660146AD0E722A837C557D4DFC00F9724DE5CE81D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  GDLauncher__2.0.30__win__x64.exe
- Size 150.8MB
- SHA256 1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461
- MD5 c10d9d8fa74bb73239d106b45707741f
- SHA1 8f2530042599d9cf309875ab4a6c3bf133db26cb
- SHA512 71d270e8a0fc8d3dc67cd76643ac4d0ff621b6cc4ddd71a45d50bffb2e60a6816f52eb6e028ce05e25bd237df13179286013e5ccef856d9d96cbc7a177148330
- SSDEEP 3145728:01L+5eWgyYRppCi6pd5fkGe7Ckgo9tzBArJZ1x8sXX7S0xd:i65eWgy3o7dgo/+1Keui
- TLSH
  T17A783380633A5B47CAE6ADBC6ACB660146AD0E722A837C557D4DFC00F9724DE5CE81D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 150.2MB
- SHA256 a3874eebf9585a830d9169c29305d15059f1905f53c32c7b813ef4fbbbbf64e8
- MD5 8c0b74688978b5a1f3a5c76c0eef1829
- SHA1 2b2cdc97a9a97a517ed2f40d655b77c7269a53cc
- SHA512 9745e74c51e258c21cbb483d1e276aeaef7eb1a85cc934ca11f410f5d5d66f541ef009e9480be3904c2e5cb1bdb9b08d9cbbede9ac82263bf6305feabf708121
- SSDEEP 3145728:8L+5eWgyYRppCi6pd5fkGe7Ckgo9tzBArJZ1x8sXX7S0x/:865eWgy3o7dgo/+1Keu4
- TLSH
  T1B97833C1633A5747CAE5ADBC6ACB660146AD0E722A837C657D4DFC00F9720AE5CE41E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  GDLauncher.exe
- Size 196.1MB
- SHA256 47931bfa0b9327bfe0d2629013b0606bb56bd595ac423afb10ab8e87db2a81f5
- MD5 b65061d54f96ebf958432871f022785e
- SHA1 94665a8bf052d67ea9a7f23d47db56278f22c671
- SHA512 b7237eef1f6206ab7700cb01c8e18edbd1d5da59d0cf8472d0339c7439a824b815a9e0a4588b15de89d779f23826fded2fc74db01a9671b127ad13b92c966386
- SSDEEP 1572864:3gIWXxdfOZoNqCOdfRZKjUVghX838fLHnYlZw7CVZY8tcD+HZHSutmNp59Als9jR:iBoKaDN9ybz
- TLSH
  T1A1A88C13F39A10D9E01DD1798B579633EAB1B8854728A2DF275407522F77EE86B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral8
- Target
  LICENSES.chromium.html
- Size 14.6MB
- SHA256 798583ab2464d3602a63a328c95aec829329a5253b3b2b9cea59979d38fb350a
- MD5 e70cd212e843b2f5169adf6e2762b4d9
- SHA1 1c47db5a6c337519d5576d367feacf4d4a50745b
- SHA512 e5a9c93310fd59f093f737edcd8d8135dddc6ab5aae2080bd02e2287f2e2494585bb3df589a9e90faba4f27224a4e3c6c86a41702c7a631edf4968137a456e11
- SSDEEP 24576:X8BdGjZ6JojjZ6XxjZ6yCjK6SwRquT1mfgjr6ZjK6yjr6mjK6ajK6XjK6QjR6pji:X8Te8rn8mfRxs
- TLSH
  T1A4F6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  chrome_100_percent.pak
- Size 163KB
- SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
- MD5 7bd1757ba953d8b304da1d6fb4fd7573
- SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
- SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
- SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
- TLSH
  T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  chrome_200_percent.pak
- Size 252KB
- SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
- MD5 6a460ee2c4e796e53f9be9b050cca017
- SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
- SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
- SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
- TLSH
  T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 d68a77d0e0e09e7c63e8304fee8d2f6fb71a070352a90b0b9c7c097f6a446774
- MD5 390688d37dc0f4b831cb8223d92dec54
- SHA1 b3fe646c3ba3e8aeb3f6c2d82ece13cf9bbbdbdd
- SHA512 f27c1ad0007952aae5678398005ed40b34a23d5dd18dc6efb25c33ce06e0c0f8bc740d2ec66d35234124a0b2f054b65a7b6a24a7edeabb2bd384ee9452fd2bfe
- SSDEEP 49152:MDySbgSR605G78PBsKGra12wLYW5sBUxo7l+ynjVmn7n8IK+ZJgQdhwlnwZGM6UU:MOocb78PZG7Co7l+ynjVmn7n8IK+ZJg3
- TLSH
  T197E5AD07F6D6109DD029C070979F9213F631345A8B205AEF26D089243FABFD86E7E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
- MD5 4171402e385f07007de57f45ff540e9a
- SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
- SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
- SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
- TLSH
  T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  libEGL.dll
- Size 503KB
- SHA256 f1521023210cbb2bf4b8341c77369e278ff18b6218619faf902a77864c1b9554
- MD5 f9b7a6d036b49099b0ef3986f5d9256d
- SHA1 bd7c7f4dd5ce2a0d942e60785410a82060bb160b
- SHA512 741a0a1f3b006fd749a8c18a5bac5c8a40f9267fa5f72665764085dad8bbd77880086541536ca32788796c1ae84de82494e6958e79876f312c1bec3ae5891168
- SSDEEP 6144:ZRrffvhM4pquMRXqJln2dYtfg4/9L6cOMC+lZ8zVVpf1qr:ZR7BMqqu8q6dr4/9L6cOMCLpVk
- TLSH
  T10FB49E15B3D845A8E06AC1348A534642DB76B8860B65FADF03E493792F3BFE45B3E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 574337d1d39eb5ff0c2eb88fe4b96ab161b1e0054e6b5ff94b94cefe19bc04ce
- MD5 fb7be860fc21437f1bc4719052ea21f7
- SHA1 ba27f4effba482f34803eeadd59a06859245b627
- SHA512 ca98fc2d16e7516bf0a03a47fe32535380eeb831860f1589358df7fa5ba06cf0ed43e009d94bb2ade1c75b2b22231f5e1515482d968ac3a46fbb8bdb8464a615
- SSDEEP 98304:bv78iLy9EinTQnFL8yiWYzz+SV3q7wjX45CRKG:3PLcZncYzJV67u/H
- TLSH
  T1E5867C03F69680DAD04DD2B8C75B9227FA3478850334B6CF279457152F67BE0AB7AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  locales/af.pak
- Size 546KB
- SHA256 5f3f662f860d0f319027e68d4fb1e68933b2bc3d1beff05bbcfd13f490623bab
- MD5 f9d4287aaa472d737c5e84cedb6b3286
- SHA1 de63ba9fb66188e5e8af131545803e9ef3d00834
- SHA512 473bf981832b7ea633a0f402b809cf05aa4e1da4b519871540a347d62c89d015853ce25f1cb78a04de1e90481e23095633af867f235d9ef823b48676a0d4fcaa
- SSDEEP 12288:XR1mwiCkm2BRxBjtRGtGc0IRSuNCi0G4GlZWFN4H2JynIjl2BrILDEo0vhOIAgML:h1tiJTBRxttRGtGc00SuNCi0G4UWFN4C
- TLSH
  T1EDC41B0AE780273D09A076D6FB0845F7BB9CA26CD770B2BADDA982310566EFC117D1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  locales/am.pak
- Size 886KB
- SHA256 ca2e31cb035c8f48758c1181078edfce56127ee782198f8765cfd16b5163bf16
- MD5 b1dc128ebf0c6beee3c97474af9ad786
- SHA1 837b4adc5545aa55c1d73e6c8925fd8285cc1386
- SHA512 0038bf024f8887fa707e14a304042993c284a6041a1d6e820e271968d95bb7dfda8a59b82c6d71175d99ae3ead89b208071f49ed2143a27e535668377fd5c86c
- SSDEEP 24576:g+Ts1nVhTCMuytBxIzU2jHFfrz6tXcO5eueiXlVoq+XG/6FZ2Pt5:w5N
- TLSH
  T1D115BC547EF9F7570F8E8A1994320E4EA594AE4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  locales/ar.pak
- Size 980KB
- SHA256 a9bc6ec0e5d458468e0659e19641b52ca371f03daa92b84c63bab38e4ce3bdcd
- MD5 d6b6f32878f4c37f34b191dd2359597a
- SHA1 6adfa104ba92d70f92ade4571247a9efbf64d7e5
- SHA512 f09690ba4dc35bd033f775d168e19491ef455b7ebe3f8854ed5b81fe90dc2d035905ecc62bce942ef7e43c55cadc29380d9e840c0891c509fdee8935cc6eec6c
- SSDEEP 12288:t7p8+fis3BHztYtL9TjuFQZAvNUiKPVJk0pSe5xGNj32ExBDXEW6:8+c5ZEc
- TLSH
  T1AD258AE21B2984720B56DF0FD1E23668E872BD23DB4BFD3124934A2156D7513E78E638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  owutility.dll
- Size 2.8MB
- SHA256 4b75969f28449b0a1115fafccf7b9bb26042d45c48e6bb7f829329caf2ccae8b
- MD5 019dc4e1fd7003911a694c9511b68c02
- SHA1 b39bcf279a914b7cbedde4771478115f575881e2
- SHA512 cfe1f75f7e357e9d488cf11f5a4a1047fc2e2a48f02ca7ae9d02157b7abe423da287b9ee5bead6b96005ad9d2964fdf722f529e43ea32e10425d3f828f50d029
- SSDEEP 49152:xuQg45iZHPvFocfYKdTkToSpgnAAuBUmGXz+cthzmrvStDYhXO4kerPE:xhCZHPvFFfYK1p/tu6Jz/irviMnPE
- TLSH
  T17DD59D5766A540E8C12BC17DC596B60FF7F378290B3593DB42A5A32E1F73AE12A39310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/binaries/core_module.exe
- Size 44.9MB
- SHA256 aefecb82a7493a420f5a6cd787323c6f5a47ea818cf09067ec5f253e94aadab9
- MD5 9100298a20755cd9cd05f5ced0e72c74
- SHA1 350af8911cc683cecc41bd314ffc3fbc6b11bcb9
- SHA512 1871510d3bb612248a717426459bcfaa8c0273cf43b1d3d338c3321d01e85a5d448be639886f3658d52dc59fd6020f3dd259fe9f74a5d03f64f07433e52fda21
- SSDEEP 196608:X9DFAX6Pv+z8p5eCSoInM97eLf6BGWGSBE+3WFa/SSn9CvnHjbjAqwSRKR:tWW+CdInM9Wf6BTGShWFa/T6nDbgSRS
- TLSH
  T183A7F7157BABA96EC55AC8B0C34A4A735E6130CB0B35B9FB44C486353F79AF42B38714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral21
- Target
  resources/elevate.exe
- Size 115KB
- SHA256 15f2fbcc376f78b61f927660810f66a476b2deb378270eaeff77993c9c1b0605
- MD5 e103fbb1f1d5d0ac3d314f417f450315
- SHA1 487b2f497fb8dac07d80f5889782cdf27d37b5ec
- SHA512 7109365bd508e88509fecdffac5f86d37346a3d60057daafcbf7383bcc966d0bb6efbc5a299a8f9774395651a80a130455995de5a1aed54f9eddf0d33ff8249f
- SSDEEP 3072:+CbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlMZ:NPrwRhte1XsE1lk
- TLSH
  T112B37C1274C0C471E9732A3559B4C9714E6DFD710E759FAB6398027A4FA02C0AA3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 a52712b9545687582f8160013a03a6b362114a2579a0e4ad12f07a24a494fd81
- MD5 772cd0d03bde5a339a029913552d37ac
- SHA1 bd49ce0b75d183b01305e5cc8f40d02653adb566
- SHA512 c822efdb4ec957d60951af16d15012a06741c1f447e8aa48036fe1fcc084bf6be9ca2bf4a92d42c32dbdfe5f88d5ec812852af495a89d124bc31242e01dd4a35
- SSDEEP 49152:fDW1Poli1Z7qWQaqMVEgGL1G8MZ0CsEzKnzzA6Pr3kd7bCXTGnHIzHC2Rmgeqwkl:fDW1PTkdXLR04q6
- TLSH
  T16B463803F28680D9F05DD679875F9622F672B8814B2276DF52A01F192E7BFE0A739701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 910KB
- SHA256 d6222e3877379a4f967fc9a08286288cdbf3675cb94de474ef181a3b78e76daf
- MD5 a0d802f03f7501c8162e36712f44b88a
- SHA1 77ad88236f20f00ba58b187055fde8a2d19c74be
- SHA512 caea4c0b485e060fad8784af108c3773daa09c39c469179413896c2b4b815d9500ca5aaf95f6d263121ec0409189af93dd95220ae3bc5825a5dc7f66a8adddd9
- SSDEEP 24576:jsRkqGlxBNI4OBs8lG0mt16Z5WRDYsHm6g3P0zAk7Nlw0:vxlxBNIasG0mX6Z5WRDYsHm6g3P0zAk/
- TLSH
  T1FF154B13A69485A9D57AD034C9D28603C9B174822316B9CF02AC5708BF6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $R0/Uninstall GDLauncher.exe
- Size 268KB
- SHA256 82819c586bf344e85103f1648c9f9812ddb6f765a142f33fbc1823e8fcd4aacd
- MD5 73d467ea57e501f7f7ae7232bd62539b
- SHA1 2da6624941b3f3a053627502d667e1e581214a5a
- SHA512 6a02ca34af3dbf391957e4de21fa425697602d5a0bd59129002e9febf0b1eb4b1bed6bd054e43c6439feceed5b39e3f94081a59dca037ee60230839fd496cc22
- SSDEEP 6144:N740IAEPuA1foU83s2t0EyL+yaCDPFH6XdR+EkiH3yd:tMX1RKJCDPNKT1zH30
- TLSH
  T117441201A6D0D413E9AB2F706AF582AB5EB1F80514319B9737C5679E3EE27D0DE1C322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral27
- Target
  $PLUGINSDIR/INetC.dll
- Size 238KB
- SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
- MD5 38caa11a462b16538e0a3daeb2fc0eaf
- SHA1 c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
- SHA512 777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1
- SSDEEP 3072:hD2ekNFXiQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0L:hD2vhaqoDfb6mxk2LqHXj3if/Pa
- TLSH
  T16334BF857F68D80BE65402F87A71CFBA1669EC206C21C203E7E1BE5F3D79B56AD01381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Enumerates processes with tasklist

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32