e9d38116b54ea3bf935a3f3badc12519ad8aa8172f2c265994a99280171339f1

Sharing

Copy URL Twitter E-mail

General

Target
PRAGMATA-DenuvOwO.rar
Size 17.7MB
Sample260713-se718aa18m
SHA256 e9d38116b54ea3bf935a3f3badc12519ad8aa8172f2c265994a99280171339f1
MD5 ad06762d6fe18c2f03b00ddba48ad8d8
SHA1 6bb662fb300997acc7e5d4ba049a6424d02c9046
SHA512 64ef224c450985834a71cb51d5bf66f89fd27fe798a956be2614093041172a81ec66c1cb220a8ec28a48af0a3fe870512f9a12b0eb62967a74d18cc885a9cbf4
SSDEEP 393216:LAcrItScpMxmb19iC4SdOC3qKwJh8oTExppa4wwwY5Z1w:LABScpkmb19ifuqDnzEx2gwYa
TLSH
T193173316D25CB57550D2237A961AC163688DDBC6160FFA26C3FE4BC7D33D48280A63AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  DenuvOwO/coldclient/GameOverlayRenderer64.dll
- Size 1.9MB
- SHA256 58a4664d32878923f240916d66ddc95c8bff9584dc05a2f7b57de5ed69486cf0
- MD5 df0ebd784a2607f7f3461ef849199e3b
- SHA1 4c949b4ca24f02224a8f17780daf043b507a2d1b
- SHA512 a727738c80bc7827af15466ac8e04df81bf51219bf41425b86921cb20a217c2c8a49cf35abb6ab7003afc4138ede32b386991dc7ca1f94c0672b8044893815b9
- SSDEEP 1536:DFnIxKVEWneqdJJfeATHaSHWB2A7gAhmkdOwPnsWpdi9dl43VlPGq5S:Dsrrcfes6wWB2YkNaFyWlleq5S
- TLSH
  T148952954B6E930B8E076C3788B773A47D67678100751AAEF0360425A2EE3FD2C579FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DenuvOwO/coldclient/coldloader.dll
- Size 114KB
- SHA256 4d568e8608e3dd52d251919535292c753f2586a9fdde72986937720f46b76c17
- MD5 7dafe9e2faec1359ea7026d286eeff62
- SHA1 9ca1e38045af299f937da97d722026582a5a5964
- SHA512 ff3c82d3190bea270dbe613747266528adcdfce427b338b01f5b6bfb80955a6b4f4c40ecb2ed161cb84623303f1d38021f069cd8080934273a8e7e341baa90d2
- SSDEEP 1536:LvIMMz6W+OBCpFeYb9E4riuHYZMqHpySvGpun3VivD39ozZghptf3hcwe6db5oB:EdLC193riHpA830DtogtZe6db52
- TLSH
  T19BB33903F28440F9E05DC174836BAA33FB76F8850936A3AF17A456212E66F51AF0E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DenuvOwO/coldclient/steamclient64.dll
- Size 20.8MB
- SHA256 9f0975e2bae41c715aa5adb6887127a0542b3731503b01b27270193b87e78e3e
- MD5 babb36232aa4c4ef33e6b7a050b364e6
- SHA1 99b7599332ccbf1b5c284a75e35c993c3c820fea
- SHA512 5f7211bd837d2f485a6d2465278dd7066c70b3a408a08852f46d2fc5321da420a0c027fed0a05ec1a55c2a7ab31cd64b2a44cc3f1edef355fb88791f05dc66ad
- SSDEEP 98304:UXdrvwmVyxTWFRHARFtv/AmbP7ZgZ0CS0ZUsaAj1oaA71y+4AxYZgAE6EZDi7QZq:U1xGtgaYusaABoaA7wciZgA72D8USYNG
- TLSH
  T151274A47E7BB01E5D6B6C03895B3623BFE7174A5833097D7A680560A1F62BE0E93E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DenuvOwO/driver_amd/SimpleSvm.sys
- Size 17KB
- SHA256 a563ae20b23d9f908d16d70a8e6d1a72ad3dd0eebe9e218e388271e31d0b4b0a
- MD5 307a78d1303fd622fbf386c5de200210
- SHA1 c54bb5479fb285260df7e63960ae18d68c19fd75
- SHA512 a56e4c2f2f36cda59da4b527dd10b84fa3521cce8762e3ec2357274b69a9b6a2a449073e5fd91b43d41132584b249e3d3dee62206ae985acf494e75074fb0386
- SSDEEP 384:3z+QTXwUmWB9XLzWbFMnzsmCpSt9CztxSdxcUP:3z+QTXwUmWb7zKFcCpSt0zydxcUP
- TLSH
  T188827DA02B4D65F8CEA144B8E54A6B17E9F1B0291B63EBDF407141542B2BBF07E3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  DenuvOwO/driver_intel/hyperevade.dll
- Size 6KB
- SHA256 b3dcd78dc2f1482f764a136fa91e836cb3d22eac0d608310f4185e94ec92dcf5
- MD5 5bb2caba882ff70025d89b2453dfeb70
- SHA1 7d27161d7ec0afcd52f32aead275e5d12fe904ff
- SHA512 e735b7f7e9692cecb706bdc920f55c3920c76781b52684bc14e5c8806d8fdc2b83452f26303918b77ef3e5b22b1efe0f4e278968baa2de7873ae98962b7d9320
- SSDEEP 48:CS9+I6QtfTjK8ZCl/bnlF6NwJJ8QUCeh2OHixiiIk9+CyfghY1:x9K+fa8k/jjMuvrezCEin9+vghY1
- TLSH
  T198D1A4669E06D9E2E51B4A7C41EE8E05B326F65403530FE72092994C1C8FFF83D3461A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  DenuvOwO/driver_intel/hyperhv.dll
- Size 520KB
- SHA256 5f663f01fb1c0b3db01495ef2e9326b819ec0fb284ff45f5769ae3617d809a6d
- MD5 53c7f60882a255f6bb1dbc13f9a19dfb
- SHA1 ab0d58b09bb642751f0a0939cbeeb58d1fed606f
- SHA512 9cf5fcc8cfce0a9b1a36e3ecfaa8a73d01a3727ae6ccff4bfa4fa8ad6ae4ee111ca1aa3d522b6a09373955772e1a7f9f0094527ce8f8384a35b036f38a589567
- SSDEEP 6144:Q6tkVaJZfolbPlIlmMYG23uuGurUqLcowsEZyv2TfrrH1G:bt2ioW9cuuGMUQolFG
- TLSH
  T146B4A4B7EC047473EC3061358AE707AB267BA580976287C71659362B9D837D42F37E88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  DenuvOwO/driver_intel/hyperkd.sys
- Size 11KB
- SHA256 abcfd59c2430df6f88f8429519ae69d32ac737720bf576e6491bd09970d67bb7
- MD5 c9de5f9c059290e6ee43ba142c278217
- SHA1 dc1aa4f87b5340c57a9d9ff357889cfc576c637e
- SHA512 620a752b7b98981c5187b4cd109fd66b2c42a7fefa112c2389e8a6ae3eea5a3f8b1cd2e6693a72a1b5c4b6f06b04846a3ba0a56bd3f5458bcd6add1296feed39
- SSDEEP 192:Prq4qGmnydcI9U6mycymyJyJyC6AVGs6mczCNncIk:Prf7cI9U6mhnoQD6AVNLcIk
- TLSH
  T16D32C5619387DCD1C90681BC829A4D2E50A6E100D3275BC79FB598B4CE4E7F16F3BA23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  DenuvOwO/driver_intel/hyperlog.dll
- Size 13KB
- SHA256 81a91bebaed6d0174c8a497b9b3638ab3d617c585a4501a6ac48a1192094593a
- MD5 42832de700ce7463a9f3a74904da84e2
- SHA1 a5a2f49cf667ec9d1ac646a4cdcff00ba7aed893
- SHA512 b53baa70d1bbde576ba42765afebb64a8a4c12d1491347d58ebf02bc478687d83d1638a81d0579d3c7c0c98076c9c25e0ad87dd9a9eec2c326e2f6da08043718
- SSDEEP 192:ObLIkf6QZh7V77O7Tm5ITwHYcHylqaSyxU5WzCNncp:ObLzCSh7xO/mSwH5jvcp
- TLSH
  T13D522829614124F8E81F597985B71E099EB2F8111B2262EF2576C3BB4F26BC1373DA03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  DenuvOwO/driver_intel/kdserial.dll
- Size 29KB
- SHA256 6bf882b56ba004c2bb7e26517d36a93e07ba0a08da70a50c6369e5ec128133f4
- MD5 98d8aa1658adc5946c0e7713f9572af2
- SHA1 8d2b6647ab76279e63fe83b7b2a78ff0f602adbc
- SHA512 fcc5324b051d9197f639ac0365a5f0479f468e12100198647c528629b94117f5ecc2ba387499876d2a9c66fa3cccf0d885ee354d410f775ab6d8181987dd8460
- SSDEEP 768:5KRkD9uVFoZpRZ5Z2Pz7iePkO24lVvgA+8yfX0jxh6sJQcVF:5QTofZ52PPkO2/AUX0TNnF
- TLSH
  T184D22B9A12F424AAC559827DC9536D1FC6FFF8281310A6DF4360627E6F23BF15A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  DenuvOwO/steam_api64.dll
- Size 291KB
- SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
- MD5 6b4ab6e60364c55f18a56a39021b74a6
- SHA1 39cac2889d8ca497ee0d8434fc9f6966f18fa336
- SHA512 c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+uei1:QZu/i874ZcrMv2cRh7yqO2CPLHxYq8/B
- TLSH
  T1AB54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DenuvOwO/winmm.dll
- Size 409KB
- SHA256 96c9749f4610f6ff60696db52c77efec4a770055f3d68f0eabb0ee28f9c1043b
- MD5 4a17f58ff0992454c95dbedffb34037c
- SHA1 cf24e16db10d2f3215104eefb41b60a670d7d758
- SHA512 ee7d54902842427fa2df1a810792cbbee789a1c96ecf0a12b14041c994286c8ab64a3883a190600a8849478e2a4648f90e37049481b816adca1250be9a9a0d2e
- SSDEEP 6144:P56wUf2Uez3t8OlsVQ68fu6f1NGN4cKOfgm:P5NX7+QJ/zGN4cKO
- TLSH
  T163946E22E796187AD6BAC47CC3474B51DE21F48E0761F5EB43C44BA91EA5BE48B3C740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/ia32doc/doc.py
- Size 12KB
- SHA256 1a0ecf1821da472922bcb0f85d5b5d68a45b8d55a9c34c2a90d1415dd64ceed6
- MD5 5e4212bcab061f8aa730d7464e5c86b1
- SHA1 8017eb8a6a4fbec721bce039202149913f1da83b
- SHA512 29fe7eecde303a104929dae46814938838cea6ce3249444f13a38b745094c8e6343c15a8ad2fa8651679c09cede75a8867afa16ae45c3475f041ad1e915540be
- SSDEEP 192:4PBzS5/X99mCJt0nxqCAfhsZ7MRodSs3OEoVA4zye:42990nxqCAfEMRodSs3OEo64zye
- TLSH
  T1FA4298BA5D4BEC3065F78A7E8C10E847F30F46A3522EA453B67C20782F71585C6A5DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/ia32doc/options.py
- Size 8KB
- SHA256 cccf06963f94a2db1b86d668499c6a71d692303eb5e99006849bd976b1922111
- MD5 fed754a2d03ba930605a041b1d2a1c1b
- SHA1 f8cb4dc1fd901dcedd3596ec6bd97674a82b86a3
- SHA512 c091f78468f5562d8992e9aa61f0fc380ce28a8417f46fd700ef06b857b62335089cb7ec6f22ff9632a8e49ee421a89990056d194d7d2f5decf0aeb217d59a0c
- SSDEEP 192:oAlhZeO/wNAN5nWIrsuO/H/e/J///KbXGkwApwXdL:oAlhZeO/wNAN5nRrxC/wXdL
- TLSH
  T18B02CD125E9A990040B3CA361C8CE53BD75D8B03DAAD59967B7CDA1B0F70B90A0C7D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/base.py
- Size 3KB
- SHA256 f5ffe813ba84e0d0b447b463d07719d57db1f5b2d33a0b071ff33562ba94fd66
- MD5 6413fb9a1804443fbf6a181b7dea0df5
- SHA1 d7161073ca4b82911023c4edf3113c4b7a360912
- SHA512 f8469f1b0751d50ac118b1377924ebdf6c53f9cd6aaa52a35f3090728bff1e2dd623922d6a0a75d3f37cda2f816b0f0d02b6a669161a1403d4a605aa8467cfdf
- TLSH
  T1B5715B186C4BD796D5B3CF2BB8065817D75E83A359AEB453B8FCA4860FB1120C0D8DE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/c_processor.py
- Size 25KB
- SHA256 50af0f5cb11e69185fda4e4689393002ee8f2a4f07b58632d4cd843bca3948af
- MD5 075aaa3794e9a755be8db61931c7b075
- SHA1 95daf9e706fd5a9f39424160d253dbb6ebd55df0
- SHA512 d5d07a22f782d18342c6d5cda2c84f472db46fccd0a7678a0f7b487c5629d74d0fa3a8c7338036a0f295cfc7a45f7a1af1537e805cc6135efd0f639e9d6d9d0b
- SSDEEP 384:flV7jDxnfIvOkdQGfHKmEamShRKErI1G8ULo:fX7xnfIWUfLIkE
- TLSH
  T1D5C2BD194D61A55550F3CD3ADC49E92BE31F07239BBC7042BBBD40522FB039186BAEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/ia32doc/text.py
- Size 4KB
- SHA256 d4e7bb81cab81b02279d9c1568ebae047d078757393fac82e754917935d541dc
- MD5 fa3962530231fa7d5462c69b96e777bf
- SHA1 f006797afe5aa14a875339c04b9d8ade5be1f2d9
- SHA512 16458c17fbec086b7384bd5c039aa4a590abe338714c1c388b57edb9ec374c61552ed0f7ab32ccbc63dd0507fb60f610ee711f7f95dec0880a5ffd6e8115a8bc
- SSDEEP 96:KUHRXdpRRBdTpa+RtnRrRbRfhmAfd9e94iJM6NrMvRubsRU:93BdTpautRF1UAfd9eRydEwU
- TLSH
  T15EA1E1008D5FE64C6276C76F4588C92AF30689AF5342452EF9CEC1961FB1D8E87F15E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/main.py
- Size 1KB
- SHA256 916cf6f005c87982f860966642e4483eae954e877ce1f195defc8e97652b9b76
- MD5 0cf9d1af9e9ba9cab8c26f086e0dafcb
- SHA1 b5212c3cd17a8e20e51eec8576d581559866d04c
- SHA512 3b97de1ebb13ba9a2025f93f1f61a117774cad33f4f38d5b39cc2d6f24703646f95235220aa9991e11bd747fba35434fb21ebb5d8dd2165b982f8cf263d2616a
- TLSH
  T19D218841AC0E656151FA026C7858ED03EEAAD7A32732507370FCC7553FB4890E0AB52E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/ia32-doc/yaml/Intel/DebugRegisters/DR7.yml
- Size 5KB
- SHA256 dfeb387cc1f0a4180506f37586a2f54dffb00ad0d061b03443504cba32108792
- MD5 e54763bd15a0fcf7c50da001dfa9a020
- SHA1 683445dcc01707f46da6bb37fc4e8b1ab5769997
- SHA512 8d8c6d10e4148da2893cf7e3013dd958a952249ae1ef0fa2ea625a1456a37e79a82fa037e9b93a9e51cf59044aa8e53c0b8d7713a0aabd39ae6d6adb187ab380
- SSDEEP 96:OEiRh1toEhNM/coCEgpXUDnBMtfoXQvnH10EJbaHL8Ns1ojRNMZ2kBEAdT:OEiRhHoEh8coCEgpXUL+fAQvnH10Exaz
- TLSH
  T131C11F22CA16619709B78272289BC747D33BDC1BD2195872BACCD3185F711CADABA06D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  DenuvOwO_SRC_V5/HypervisorSource/dependencies/pdbex/Scripts/env.bat
- Size 111B
- SHA256 44fb60f6d1b25363f6a1969696de1f204d0af72dc49821e1cb404227bbd081b6
- MD5 246b676eb1a4d7af50a039025052bab2
- SHA1 8eca5f794fe5880e7afd23700dbef694d4908b6a
- SHA512 305127370bc0d898d4e8475611a18dafeacbf0b365c0163355a0ca106d1c4649b1f8cb40a1802a421e9f804af4b392b67aaf164b3cc78545fff9c2d2869f354f
- TLSH
  T176B02288A22088A20020E80C22882C803008AA822BA02EA300008A22A882B80C2AC8A2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32