4751d4b2fbfc7cd0b3f901d711d1d4c245fef774082ab87f9fed52a49ef3e159

Sharing

Copy URL Twitter E-mail

General

Target
RAGEPluginHook_1_131_1424_17745.zip
Size 12.5MB
Sample260722-2g4k9awdpg
SHA256 4751d4b2fbfc7cd0b3f901d711d1d4c245fef774082ab87f9fed52a49ef3e159
MD5 5fd61bc73e9b5079c39506d72d6bbd3f
SHA1 96a4c6b946661512697699a7f95ff1f243914639
SHA512 8d8ae7b03786565076adc58c72ffc3e13b8c9f4eaeee469b3fb589d36c2fb983d0dfa60565e449dbaa06416fc52bcc3fa5c9eef516295daaa63ac221d67810f0
SSDEEP 393216:IIpr3GBdCTKdjCNEnFvFGOYyfqOTaHgsqglurI:SwsCNOFvMCqWaHg+lurI
TLSH
T11FD6334077C619CE519A537B74D66C8AE8E7884C060724DFFA4D93ACBC0CE1DA9A74B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  FW1FontWrapper.dll
- Size 152KB
- SHA256 1ba5bb9ffea32a8c30b5c8b7139e15ddc36a43130465b4d1ce4c7b77fa6fce25
- MD5 daa32fd4ee493fc1fdf0b66991868ef4
- SHA1 d4184c92b83daa70972723a455912768df1bd1d8
- SHA512 ccb32ef87e4ee7a09fb2d6fa10c21bf411f16f94bf34ae6728057c0be052231ad1a799d77ec73f5193f36044d3eabdec70b8c618dfad47001a2b58ee91c3325a
- SSDEEP 3072:Cve3fyhmCM5WRe+XobT4YHI2ebmXgCkWa/kWHXcU/c:xGE57+eTvHI2os7DWX
- TLSH
  T1EBE3175A33B940A2D163927C8EB39A06E77275914B3593CF125443BE1F63BE09E7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Gwen.UnitTest.dll
- Size 41KB
- SHA256 cf68f7773feb5756e050a4503f142c67b17c1e4becf23a878649960b58259017
- MD5 90b34cfce1f4caba67f42f4d8f135189
- SHA1 660409c7ff31b7ece22bbbde0bca89cd818f8ef5
- SHA512 6833fc7cf62ed8342ad8c8cd06ba6bca0d769b0ca231111f7c1627040ce70cba0c530ce50c2bc5acb105e4af211e7a9c1ee7b45969c63a5633770c5f75b52f01
- SSDEEP 768:5eNvuZWDvclJlVPPRlNgPQPZ1XYQQs9+7+yNhR0sU/mjBzTQBfG:wclJlxGPgZJ3d9+7+yNhmX/aQBfG
- TLSH
  T13C13A51837F48651E4BEE7799AB26444C7B1B90E9931E74C0ECA18FE2877F528984F13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Gwen.dll
- Size 191KB
- SHA256 33275af76fcd12157732a80df4795590d409a1df46b2b32a5112ca11d6aa5267
- MD5 367a1b17121dfc7c2347984380939bc2
- SHA1 5407a022865656494b3427cfd22d72c2d6965819
- SHA512 ff79cb21e08cc4825e1bc20f7938965ba5f09c8df60f9c21e1af11f58742f596daef30e762950171be447bdb772334234e0d0b7e03f0ffe30ac0822fba69c0cb
- SSDEEP 3072:6LGNlqI9IIjDVjUhNOkDRrQXwwZsiaMDGoaAfokaEwYGpZ7hxrZI6rdOW4K6lmuS:6LqqIVPVjUhNOkDRrQXdZsiaMDGoaAfv
- TLSH
  T133144BA4132C09B7DA7F437CE046A029C7F8E652774EFB755D8B68EA1C47F9089050AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  LMS.PortableExecutable.dll
- Size 60KB
- SHA256 4389b18342461cc11b48ec7a35c76bea20beb0a76724ba77c2ed0406e5517ed2
- MD5 6a52fa924073b0f913855f070dc553a7
- SHA1 6f28a3f65608796497f4765b13b37ebcd5fbd804
- SHA512 5548a02bbc7b1104123d7adf14881b83b6f961c2c68ef870ed0b2f16587d31f079c783c67a3efc7114a0cd21a13202dc01dc572ef15a89141ea4e9f6dd8a0ddd
- SSDEEP 768:7L29L0xLEbfbLV0ErjXXYV0xCXpoYvpbl4+DFYQWySk78fC:v29LSEbfbLiErjE069vpbl46BW1kAa
- TLSH
  T137534E897660B2DFC85BC976CEA82C64EA61647B530BC303A41716ED9A0D9DBCF111F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Microsoft.Expression.Drawing.dll
- Size 141KB
- SHA256 1d69eaf538008e0fe1a7eb2ce0124a49b95c491797749640c8351ed4643f5c97
- MD5 5bd39a82aacf1aa423e6eeeeda696eea
- SHA1 b7971f9807520dac9523bfd1185a7dcc9e5cc77c
- SHA512 cbd255e7323a7e82d8b9443e8ce67bef88f88bf46e525333e4017024a31952656f61f93334b3957d85fb0e422e561197c0adb1366653da007c9667651b1f37b1
- SSDEEP 3072:0RZlEOzBzB3yZwUDXSNhB+IIx3zUOEF7xQQwQQQQQQTreulTnXGZFfHjKUhcweTo:0RUONhhUDyhB1IRUOEoUjHBhT/nLN
- TLSH
  T1EEE35A2D03A8CF33CFEE7678786051065B30C7B7A242E7556DC4A2FA47937620A825DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Mono.Cecil.Mdb.dll
- Size 44KB
- SHA256 b8625ace855a3086e2086af418e17daf24a30a4fbffc559c42f329edec52806e
- MD5 3c6cff9ef0ba7748d6c61dfacb6890a7
- SHA1 9eef83f72a47d40d93fd8a7a8e4faa7520aee629
- SHA512 77bcb289b2f333f91b4a3489f21c9ad1354504c3093ccff36dc32a8fb5308def916076881bd8a737b0e5e2816a2c2fff8d2b92f786fc0aabe3d6c1c8077d6b39
- SSDEEP 768:0M4bNv9/X8qyN1iCgbvn+SYubXmw7KTdddy+bPlaN/KPHsVKIiGIpyT6GF:FMNvhX8qyNsCCn+VubEddnbta0iKIijs
- TLSH
  T1A7132A51A7ED8F27C6AD46FDB499111217F18139AA13FB9A4EC4F0FBBA43791440223B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Mono.Cecil.Pdb.dll
- Size 80KB
- SHA256 25eb34cf9a7038d71ca15ddbfb3c180b4a2119219d487fd760437f5da7edf292
- MD5 c7a0b5173df5bea531a20fbace30fc89
- SHA1 67406903ad483ab36418b13171fa5b686d2be457
- SHA512 964739dac25fb4dc9f10a9b76344e1204d79e074df34d935863ee895f9c61a99edb945852ebb4eb69c5b754846760cc87e12c81e508e8274ef28d551c372774a
- SSDEEP 1536:XzCkYN8TKFHgOza9nTO3bqD6nPJ8cMPKzxYX0:Xm/HgOITobO6PeSzxYX0
- TLSH
  T143836CE667E4E67BD4D9543CAAD24C0103F2D17AD223D74B6D88AC3AEC07B1502127DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Mono.Cecil.Rocks.dll
- Size 23KB
- SHA256 822c94d1c2ab96efeb19bc5f1d304586e70a004d2f44f372377f33f2545eb921
- MD5 7c9a0c59ce05aba61485eb46883ba933
- SHA1 e48767493cf6a8a3c16dd5e386438d75b90e264d
- SHA512 04953bda24fa852144644a404684d6a72beeeb328f3ea588de979fd45ac7813b315285266abe9ad9438b3bdde7dc16aa56e0757de202214501684268dcf7462a
- SSDEEP 384:haR6nqAWLpXRbaZ842hiQgnzBNHo2RGFZMzEbSjrBMkR7brppw:haH3hba+4iijVNHpGT63rpp
- TLSH
  T182B22B2A2389CB3FC5EF4639ACE0111803B2D551A003CF16ADDC71BA559EBF66351AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Mono.Cecil.dll
- Size 274KB
- SHA256 0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772
- MD5 6d6292bc8e698e53e69556add6f62442
- SHA1 fab26eb07adab421797689da27ad754aa1c31810
- SHA512 f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32
- SSDEEP 6144:BaUU67x2AE6gaSTYUs8Nr/gaGGv8+iGKdJDkP0bAZ:biG8Nr/vv8+O
- TLSH
  T1BB545B252B985E3BC7CF92B7E06318290AF5D13BB24BE74C9C8CC5BA1D47B658C415A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  RAGEPluginHook.exe
- Size 11.7MB
- SHA256 30d14040f9ee16be3fa54a0065ad726210b6f6030f5d7759ed6463915e12f175
- MD5 a82f06d167357bba89cee924f0663a63
- SHA1 727cd964b4b52c6d2b3137d42ff6beafc3ff9dd8
- SHA512 b791dbb7017779ac89dc4e317e5f442314b06fff4bddfef85140a99aecbb355332f2da12988a79cafc08a6e3b6d677918a03559e17f4330285aeac9c2552f64c
- SSDEEP 196608:nqrpRaSY39W4/Ku9BX81/rK1X2cyHKfXllHp8iblKe/rZm2u292JghE23p2:qrpOJBsNK1X2FKfVlp808u1S292Jqr3c
- TLSH
  T1DEC6236C369076DFC897CA728DA85C64E6B17C7A430B9287A45326EC9D1D4DBCF108F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral19 behavioral20
- Target
  SDK/RagePluginHookSDK.dll
- Size 214KB
- SHA256 5d439745604a5fedbf8fa401520d4f296c1b6800d77e2923ba3bf9772182c7e0
- MD5 03db3dceb62565ab45ce7f7f9c46a94a
- SHA1 f278e4ad3c732d0ce485eec908f6190e4f2b3059
- SHA512 29279305e3e978c7e915bd98f31aac5322df715f18d4ca8425adc2242ad8e0c4835fdee28410d24784f744e85d613501b401e4d3e961e6609a4d17ce8be65bb0
- SSDEEP 3072:2khK3nEgde4e/r9OhUbpa69smMUEAzRv2wtVZrxBkfu8Q:Y3nEX/hOc/sm7Fv2wtVZrziu/
- TLSH
  T172240505A780D45FC86A0776F5BB0E2AA77AC36D3422D7972A1858BDACE731F0D063C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  SlimDX.dll
- Size 3.5MB
- SHA256 194968b5010be986e33669928b9f966a67c6eb4e1cf4ac4da6b90728e242a516
- MD5 5c243b42d2b0103bbe603cf586ea8467
- SHA1 324528b18eca735fb96c631b0973fda82712c918
- SHA512 eb97cb44e579f33becd1a5926cb2c3c88f8f3476220a0e29003c74391058f34a4f66aede6cd31bd6f690d37fd14b70d2dda28672ec71cceeb1a4a182261d3e72
- SSDEEP 49152:TZ+xRaVRQpNMg+QwPTRP1BMqQH8QRJsAW/eYfRx/L+AJK3QJW67eIlTpVcZyRTAk:QMg+QwPwcH
- TLSH
  T176065C01B3D8693FE56A37B4C9E38E288737E0E86366E39B1059D51A2D4B7C489351F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  XInput1_4.dll
- Size 34KB
- SHA256 bd0ba909de46470e0ddbf88cd72d7cf6f1eb04b709616366692eaea87b4c0551
- MD5 d2ef25dff3e2ad78f89a527101767707
- SHA1 bae19c8377c041cd4bab340012fe323ae9eb132a
- SHA512 b08565ef66cba3d076dc12cb67aec747bd9f4ab86d16515d08ea957920b200599bfed49525fbab8a090256c244ef2c816bd9e2ea73265cec634734ad69092cd9
- SSDEEP 384:DGHO0iMpgCDbkmN7J1urXgg1+lGwkpGBrUEZWFQ3aS1s1K+cFnM1eHBOFHPDt17Z:IpRDhN7J1uzcbciwMcyQmqgsn2
- TLSH
  T1E4F24A25A26400F9D89D0278D9E26B66B6B1B8181F7142DF47708249BF17BE0AF3D787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

ConfuserEx .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26