4b231568964dcfd08b1b5ec65f4c9fb0def19ccb0fa9561a15325de0e0946b19

Sharing

Copy URL Twitter E-mail

General

Target
war-thunder.zip
Size 67.4MB
Sample260724-kkeymaaq2x
SHA256 4b231568964dcfd08b1b5ec65f4c9fb0def19ccb0fa9561a15325de0e0946b19
MD5 969414cbefed051b1d7cc06f51e6616d
SHA1 e4b717eff447ecec0e886fdcb9694384464cb7c3
SHA512 1253f4163427b9466ae9077fbc9f4ccf17a865c9cc9e5f54f6735c8ea4880c15bdd0e991436b815fb6c9fe8d07933fb7cd550e74c300e48459a325d2588e5611
SSDEEP 1572864:lKaokqtn9luTdnvrpyJsX/8xM/CKxEoNkvofSdSVKU:lnoHtn9l0nvr8kUxM/CzoJSoVKU
TLSH
T11CF73358800B66FB6F68456D72B120E6D58335E89A9874F0DF54B72BEF249F3EB04138
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  war-thunder.zip
- Size 67.4MB
- SHA256 4b231568964dcfd08b1b5ec65f4c9fb0def19ccb0fa9561a15325de0e0946b19
- MD5 969414cbefed051b1d7cc06f51e6616d
- SHA1 e4b717eff447ecec0e886fdcb9694384464cb7c3
- SHA512 1253f4163427b9466ae9077fbc9f4ccf17a865c9cc9e5f54f6735c8ea4880c15bdd0e991436b815fb6c9fe8d07933fb7cd550e74c300e48459a325d2588e5611
- SSDEEP 1572864:lKaokqtn9luTdnvrpyJsX/8xM/CKxEoNkvofSdSVKU:lnoHtn9l0nvr8kUxM/CzoJSoVKU
- TLSH
  T11CF73358800B66FB6F68456D72B120E6D58335E89A9874F0DF54B72BEF249F3EB04138
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GgWpCheats/Config_1.cfg
- Size 25KB
- SHA256 41e86c9c4b86f18dda63745f9a2587428ffab6e0df2d49184ce89cf0806a86fe
- MD5 35a0fa36548d471eeaffabf9e6828078
- SHA1 e1b39354616eddd4c1f0553599e72fffb3644c6c
- SHA512 327b7509176704196e53082825771c660f0c637f0f86cc09a5f1441a273dbe6ae2cd266df4ef2f405775f6badfc97c91c9a09a161bd174ea9fbc1ee23659868b
- SSDEEP 24:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:n
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  GgWpCheats/Launcher.dll
- Size 75KB
- SHA256 b9eca165af219a15b9957017cda6de6cbc82bc10f3c1f6f28567c8187a1bc1e2
- MD5 ab1b5187ecad73e3fe31fbaacee78c3f
- SHA1 cbaac298232af145104651d216a2ac5d3c1f417f
- SHA512 4e76a7029935787a11dcab55d90644b3ebc195628978028575d4cb1e3f2b9f2a47e7007431249ad4f35b2d145f2ace969f2f68a4e421079458054432b562300d
- SSDEEP 1536:jAdL5gFa/U6Chlj4LuHQn+zrErnWwxllnW5:jK+AMlhVKQFzrWxxlle
- TLSH
  T162736C63B14209F6CE502438DEA8FB31A9FF8434432895D76B18C2676B671C1AF787C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  GgWpCheats/ggwpcheats.exe
- Size 67.4MB
- SHA256 e2dbb12c30ccf6c57b841edc076922d0248717d06c927e442914ef78e9e3c94d
- MD5 9d7a9772477f361746367d62b07509b6
- SHA1 d7ade7958b8d117cc7c5fc96289db42de2394b75
- SHA512 a1e04aaf662b09fb7da53cf786de0f96c54ec159067300d24ef2c74d2f30901148552a98d370decfb44d30e3f8ba3e53ed9652ebf0074848c0485c9e0a83ec5a
- SSDEEP 1572864:LLdkUDHFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB727:L2U7aABZVPArg/bXeB727
- TLSH
  T1F2F733C443958655D1CB5FFD613F0BE3AE271DE0A31DA0AB16928831F5A986BCACC14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6 behavioral7
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  $PLUGINSDIR/app-64.7z
- Size 67.1MB
- SHA256 4828145e2d6e0e0dd4f9c7b3c4cbf21843164151c58988942f7c34877ff13692
- MD5 c51cfb326271d9f7dfb2462ad7ead909
- SHA1 487b04a9fff8cb8e64e6052aca48f50475513ebb
- SHA512 3b5dbb6ee71198b33d815004a898c87f0ac05fd59ad0c782285dd2ee9c4a9e91bbd7b3b05aa34d6be3ff0460b5c59bab07b9ea84e57e01b75e725980398bac08
- SSDEEP 1572864:rLdkUDHFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7Y:r2U7aABZVPArg/bXeB7Y
- TLSH
  T121F733C443964655D1CF5EFD613F0BE2AE270DE0A319B0AB56A28831F5A987BC9CC14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral14 behavioral15
- Target
  chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH
  T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
- MD5 e02160c24b8077b36ff06dc05a9df057
- SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
- SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
- SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
- TLSH
  T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
- MD5 2602cd68ebe25f12f5d9892d5fa92b11
- SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
- SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
- SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
- TLSH
  T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  locales/am.pak
- Size 776KB
- SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
- MD5 ac7a72616a544cdb022eda20b0dc8872
- SHA1 50b7f8363894a7e33042412804efa2bda510aba2
- SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
- SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
- TLSH
  T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  locales/ar.pak
- Size 851KB
- SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
- MD5 4d0a0771176823bf004f9182b94bde82
- SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
- SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
- SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
- TLSH
  T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  locales/bg.pak
- Size 885KB
- SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
- MD5 d0b47c1cf62b29b866ca630958a019fb
- SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
- SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
- SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
- TLSH
  T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
- MD5 83a0030387afbe1cd2d6790079fc5024
- SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
- SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
- SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
- TLSH
  T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  locales/ca.pak
- Size 538KB
- SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
- MD5 d5d6200b582b9b12a0bd8c773dea0474
- SHA1 341650b76af1c74129a97725673b646b7256d4d6
- SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
- SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
- TLSH
  T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32