6b951afaff00957d981d67b1ac5380864dd6145eb5dfaf8a7fd730b2bcbc0258

Sharing

Copy URL Twitter E-mail

General

Target
csgo_gc-windows-latest.zip
Size 943KB
Sample260722-t1wqrayemd
SHA256 6b951afaff00957d981d67b1ac5380864dd6145eb5dfaf8a7fd730b2bcbc0258
MD5 1db4d60c7d83174d0b390d6b827d76c9
SHA1 522812e01a849c7d549c0f318409dc07cca1b49d
SHA512 917689cc2ccf7969cfd07071d9831ff2492251acfc8ed0a33df760af937437ccdb41feb94b887dab13aed02eee4965d390d6fc67ca97c20ab51d842815ee3344
SSDEEP 24576:ZkV8XDFEiVDzwzfSKGmZtsIgzokv5Nzo2:qgDamuSKGmHez3RNz7
TLSH
T1AB25336B55CD0DB2AC0FABF5D4ADF93BB9341632480C9FE21681972DAD03F0D8885765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  csgo_gc-windows-latest.zip
- Size 943KB
- SHA256 6b951afaff00957d981d67b1ac5380864dd6145eb5dfaf8a7fd730b2bcbc0258
- MD5 1db4d60c7d83174d0b390d6b827d76c9
- SHA1 522812e01a849c7d549c0f318409dc07cca1b49d
- SHA512 917689cc2ccf7969cfd07071d9831ff2492251acfc8ed0a33df760af937437ccdb41feb94b887dab13aed02eee4965d390d6fc67ca97c20ab51d842815ee3344
- SSDEEP 24576:ZkV8XDFEiVDzwzfSKGmZtsIgzokv5Nzo2:qgDamuSKGmHez3RNz7
- TLSH
  T1AB25336B55CD0DB2AC0FABF5D4ADF93BB9341632480C9FE21681972DAD03F0D8885765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1
- Target
  README.md
- Size 4KB
- SHA256 ff6bc7921ef030e695b164a44ec38aec0c38abc7d8af8ada8fe343271b756690
- MD5 8a7175fb555cfb4d114464b04a818935
- SHA1 69580607d3055ad214eca43f6a1ceb3fa0c44f3e
- SHA512 ccbb93d1a199c9be787907b4fab6ebfe3c5ee8c76965f36ac738798206d068ed1d422d6572f8114a0c85301d62e093e715576eb1a8f9f7c9f3f77d94e2c7b338
- SSDEEP 96:50GjUHRJOGdnFSwcYnc4BH1L9C/eAGxuk:GGjUfOEF1c4BVLjAGxuk
- TLSH
  T14991C75FB602E3FB1FE205DAA55F32D9EB3AC0F053AA5068A07D924C122145A87BF184
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  csgo.exe
- Size 270KB
- SHA256 888b4871b95018ee72f13c8be987507e5d7678c512fb207e6cd5a8e5ebfa37d0
- MD5 6593580a4d1c650e432d48220dafeddf
- SHA1 514d3ac66cf68d8d881bd3a871e2ac0963af1911
- SHA512 06add384682e16862bcce6fdd6e49d9103e1baed0b81970c999a6f69542e47b08a1d8df662fa5d7cda83d74832cf769c66a88563c51403f4b2e188a24cb38bdc
- SSDEEP 6144:mjhW+PRzAr07GAFCqNV3v0Kkc9RXdDUXU4qwyzQuvLA/8:mfPgL03vn9RNDUSjzxDC8
- TLSH
  T1E7446C417CC8C961DD200879C1B5A6F1593ECCB9CB2919E7ABD53F29BE3A5C12C3486B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral3
- Target
  csgo_gc/config.txt
- Size 1KB
- SHA256 77877db02c87463c0794181f1386a8c09991a20a661d734655f5731f20f87e9e
- MD5 8dfad5e4cbf87339847d5f3040af7e8b
- SHA1 7b2fe0accea35c7fd57048fd2871896423182c8f
- SHA512 a15d8a70ae7df91885a58a7fafecfde46abbbd497a759a310a06173cc1063abafa5c7b2f49507a21689a49acfd446ba5481d8561478938b91db7746aaedaebde
- TLSH
  T1B421113318CB31B7966781A32A15B0E5DF08728E228F591122A8CD2980A2A39C7610DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral4
- Target
  csgo_gc/csgo_gc.dll
- Size 1.5MB
- SHA256 ebcf7aed80f8629a5a20d57b835ad740a100e0acb399f283fed09e86c399d52a
- MD5 f9c87c029493655ec082fc9851007007
- SHA1 56c9de12ec7f7963531438637fce1fcfb7b607cc
- SHA512 8382e43637f2f47a98b05464f0d54c52714b5fab9ea8322bac52f34b4ebbcc1fb1e5fd67f3d59f65021a2c59286fa65fe85f046ab64610e6ddea335ef1268989
- SSDEEP 24576:BcQJ/kKHSgnKrFnwTxP2Eoa9FP/sS65l5dRDeO/+2LuHVUoH:S0H1KrFnwc5GiB7//+2LuyM
- TLSH
  T132757B217656C433F8CE62B48C7E7F2E154D98960B3808EBBB8C6C9999725C32F35647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  csgo_gc/inventory.txt
- Size 381B
- SHA256 9eafff46e4929d70ca5569a2da78a4fb9665d2233dff8d603b376ebc25ef22dc
- MD5 756f17cd4ef2c6ff96af8939aec626e5
- SHA1 9e07ef70a4d98d32729a3a087857d0818334aae9
- SHA512 4cbb899db110811f89f27c1256add957782071bc642ff4c2097ba03c974b9547d12ddb186a7cb4f8fcfd17be0879ae308cd483619953c956d7d8c1b20d137b17
- TLSH
  T149E0DF233187C2F89BC2164316382DC86958F20D10DFAEEACCD4092DC175D2427A82CC
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral6
- Target
  csgo_gc/price_sheet.txt
- Size 212KB
- SHA256 170fc6b1050e50b0392fdb51a310dc9af6c8e32fc91ee75c23cc863b5a4b3b52
- MD5 ff6acdc3a509bf459ef402debc0b02c9
- SHA1 62adb25e708074525a32d14ae080b4d062765ac0
- SHA512 5dcd4a52fbc064b740e70c3845b7e3ae9c44f48a7a311202a2a144af6eb72dd26805c2a208607c5ba6d345b04bd50efa820f5b50bd459c2e4840c6f3dd17075c
- SSDEEP 384:Ad2lnuoZGdjhiH+no2OG8iC7H+no2OG8iCDH+no2OG8iCBH+no2OG8iC3H+no2Oc:Ad20q7ZWy30Nz9
- TLSH
  T1DA2429773B4F24C864A05C0776B728D9868CF48B56DEE9DB4E8A422D50C5C3D8339FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral7
- Target
  csgo_gc/unusual_loot_lists.txt
- Size 28KB
- SHA256 cc742f95ce34cb3b2c4d80212d41646ef8c89ce9c751ca65a887e23dc98aaffa
- MD5 af0c96719c5a8d8056177231638fecf3
- SHA1 503f10efba3247e6db6c72c878d62957d5e26566
- SHA512 4ba9b0798b911f778c899a00d3987c5d912ec8f215015e14bf79c7ca4af20107b1327edd002c272803d6c31f1b2dfdd60208d42c6b125447732e9477c8195743
- SSDEEP 768:clc/okXyyH6pFovmGyVE9KQMwuFI2O3Ya7cNSkz+GxC/u:RK3
- TLSH
  T18ED2AADB55BB3BF5204099C7D7289DD26C5E009D292F1C83ADB80ADCC6F9EA1A15C3D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral8
- Target
  licenses/LICENSE-crypto++.txt
- Size 3KB
- SHA256 78e4010b682cb94187fe0b57e50116d0ba271ef81104d1ddb35c80c3d81e3169
- MD5 ca6dacb7ef68b1ab5dfa3bed24c12003
- SHA1 e5435a5baa500ed2b0ca001a2a81e117e0e2b130
- SHA512 20aba6b5af5342bba10f41f010dd78084a1eb936b0e5f9a3aebd805ecc3773964dd30134ccdd95cb8ef2a2557027b005da1401998d4aa3608a87872e9c05d539
- TLSH
  T1CC81A43AB3A82B721AE14E15DA9DB4DBF11FD058F78B2E42782CD14C0367814C3F25A4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  licenses/LICENSE-csgo_gc.txt
- Size 1KB
- SHA256 1fa101130e0193970115ffc065a3d406eca64fc041ae22312653bdcd3e20e734
- MD5 5ef491947282ac45d64529b5a2136cce
- SHA1 1d4924b90fa20b986d7adcaecf69c7dcd5993e4c
- SHA512 b919e359965190310a71d79f692c77855434f902dc8f172cf6cf2c583201b6b489d35e2fc49a17b28a52337f64288500a69a801de90b293cad2ddf315a61c6c4
- TLSH
  T13421638B11440FE649E20B8179A1AA84F08CE02D3F136C04387AF34C6B7B11ED8F7454
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  licenses/LICENSE-distorm.txt
- Size 1KB
- SHA256 7f19532f8aae6605f524cbc28ee93ecfe72b2d89211a438e8a0795beebbebe6c
- MD5 ba4ee0921e47dc536e627fffd0ff897d
- SHA1 075fa6c22f2892ba3d546121b63c62c28c99b011
- SHA512 5fd372161ef2cc4cfb75b0f5550cdf39d1d66a8f9da9ef266836acb26998e5e5a1e1a0dfde19570a0bb7ce731dab0fcb9d8642f6233395260f92e19e706b47ce
- TLSH
  T1BD31955B02844B931AF2568535AAFAC0F09DC02E3B176E05387DF3189B7B43EE5B7544
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  licenses/LICENSE-funchook.txt
- Size 19KB
- SHA256 37e1f61b0b4337053de5d232949d311bc1d0ce831bca677bb10681c69ee7507b
- MD5 5709abd3d2238ab71099c9033a4c710f
- SHA1 e849842e43cf6f5d7e576b66392ffbe5d5624a51
- SHA512 eaedf64ca4295e107879f397d7b0daa1c4fd558769067a39a3ef378bfa2dac6de319768a380d801cfa56ebf1104871c12b92884eafc59314177822f55fe0150b
- SSDEEP 384:cCb4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPpDqHZ:cO46uh1iYWrTXoPpDqHZ
- TLSH
  T15592932E670543F206D202916A4F68DEE32ED4B9722E1154345DC1AD237FF3583BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  licenses/LICENSE-protobuf.txt
- Size 1KB
- SHA256 f4df8b2457697851385d9ebb93267832c1dfa24e0e61881952f6b0c452663dc9
- MD5 ce79a5e699943b3a132c0deba1777ac6
- SHA1 57919d5bf210193d05ba496a870832582f475559
- SHA512 82cda6f61e3dff94228d3eefe4e1f65dc483aca9c8597e482c1d6584d2f70ab7327af6461080447649dc4986b9932025dbcae5c078a2dbcca82c3a985d118f4c
- TLSH
  T11831616713885BB31AF25A903269E9C4F18DD02C3F3B6A00286AA249677743ED5B3590
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  srcds.exe
- Size 269KB
- SHA256 a4e80eff9aeebf63a44b80443958a9fa313cf035bbed6742778afe43cda95ad3
- MD5 9039d0f644d88266621a778ebd41230b
- SHA1 cce52d958ed2e49c022285313173c95ecad9960e
- SHA512 7128cf788540795f9bc370fedd10c6d228bfb62b896c56307ffff52bd1262655f6476285a06ab2cff528c43b5fcb0ac72bb0c29132fc02df1495a6be73c76c03
- SSDEEP 6144:tPxbiSn8pEipW2G5FCDVV3v0Kkc9RXdDUXU4qwyzQuvLAA8:t8Sn8E+/3vn9RNDUSjzxDF8
- TLSH
  T111446C427CC4C961DD300879C1B6A6F1593ACCB9CB2919E7ABD53F29BE3A5C12C34867
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Drops desktop.ini file(s)

Network Service Discovery

Drops desktop.ini file(s)

Network Service Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14