bf7835d02a1d17a8f2a9473a3210cc6454904fe136574b8319821fbafedb6ec8

Sharing

Copy URL Twitter E-mail

General

Target
gothania_client.zip
Size 161.8MB
Sample260724-vp2nasvare
SHA256 bf7835d02a1d17a8f2a9473a3210cc6454904fe136574b8319821fbafedb6ec8
MD5 2e21946a90c938c1248f070016205917
SHA1 ca5acc8646a604773e00bfc9450fc47bff07ba9b
SHA512 68333e8f529975b2d51191c959609aff9931075186003d2c01462da845bf146c63cc6400719c05b87e311c6fb68fc73f23719b7f99172234f195f01e498963fa
SSDEEP 3145728:03NQog2XPdjzHBJKOwOUe5pryHfl98ZMUAhIPwKQ+H6bHbzzPG5Ga+jWpViEj40d:03NQj2FXH/nwow8LAhIPw9+abHz+Gncd
TLSH
T1308833FCAE80190265A9453DBA00DF9C9E3C4CDBBD8C8AD94C57B716B905DE88DE0C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  gothania_client.zip
- Size 161.8MB
- SHA256 bf7835d02a1d17a8f2a9473a3210cc6454904fe136574b8319821fbafedb6ec8
- MD5 2e21946a90c938c1248f070016205917
- SHA1 ca5acc8646a604773e00bfc9450fc47bff07ba9b
- SHA512 68333e8f529975b2d51191c959609aff9931075186003d2c01462da845bf146c63cc6400719c05b87e311c6fb68fc73f23719b7f99172234f195f01e498963fa
- SSDEEP 3145728:03NQog2XPdjzHBJKOwOUe5pryHfl98ZMUAhIPwKQ+H6bHbzzPG5Ga+jWpViEj40d:03NQj2FXH/nwow8LAhIPw9+abHz+Gncd
- TLSH
  T1308833FCAE80190265A9453DBA00DF9C9E3C4CDBBD8C8AD94C57B716B905DE88DE0C5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  config.enc
- Size 810B
- SHA256 87c7023b99dab4ea491c1f598a364d0fdf14a5281e7d50e3b328d098dad5e35e
- MD5 6f4d04021b66e8da95b40a28fc44e162
- SHA1 35bd76bc64ac81e831c766583c7398e036fc4308
- SHA512 b0c0d4f120a099ed34a93075a71851c3feea008f594a50dc5615cb4f13072b5bc6c3faa4a7bda8dd0f14aa0ef322bf9aef2a48ec92a8bfa417ee6646d7be6750
- TLSH
  T1EC0186320B1E1A961217B49221CB8AE59ED98977298F3C486C291B3CA1926980AAE050
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  data.pak
- Size 21.4MB
- SHA256 64958eae0cf23d480df077cad1b99de6cdbcb7df2bbad7e97ad280f6d84e8ee1
- MD5 a0f875a13484280283432343f990a31d
- SHA1 13feaa6a4f23ae66524c5cd530d06ebecc1970a9
- SHA512 16d72fa2c3f7a56b04fa3b122c64ab214632e7faa6d7410e413b884f29bdfe81644bcaeba42cdfd460201c6a7be80f3999b8f2665e96fdb21cc8d6e5f91f9cae
- SSDEEP 393216:5kveo5dAzF1DotYRS2vSL19hCItEepTIO3qGNykEKcUYyqQFcLhcZD+Dz0ucE+Yj:+1dwF1Dot0TaBPF1pEO3Pybh8c8+vmE7
- TLSH
  T1323733A0AA023557579C89E893C66A5CB912F40EFDA400C53F4FF5EBB621DC0EE9197C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  init.enc
- Size 4KB
- SHA256 71298ce655c1f1c669c392a39e3c5b3a7de58c1041c3de1089a342753d783811
- MD5 85bbe1c6bf3e8b2e976f0438871fea0b
- SHA1 c665c2ca5c3edcfee7c95cc4f633b7c9564c02e1
- SHA512 9c84239830de0f92b5ab1b5f0a6d4afe7636ca168d9d233b813fead70694603b95fe6a4212fed312bc58aa8f5844e11c6374bfef1bf188b5ff66085ea2a3f725
- SSDEEP 96:pTQjZH67naiz+JzUHjHmPPY08feu+RJmUi5dZ/a7t9Yd1hXVORy/vNjF:pTQNa7naE+qDT08feVLmUinZ/it4jARA
- TLSH
  T1D0916D98C3DEA902443399B0CA2BEB1E563F55B09098C457D243E322A18DBC89FFE50C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  mods.pak
- Size 6KB
- SHA256 7aec337bfc3d3195808b1f274bec7f7a4444f56dffd9fceb823c0fe0d158cbbf
- MD5 54dcd6d3a69ba56325cae317b04a3c05
- SHA1 81b8250b988cffc989907ebd16af51f69c66c810
- SHA512 1dadb5e18f329f6a20e8bfef6f23f519e2097bfe6e71e0dce77f257e1a861169c4d778205ffad0372c4d583dd2614b1cddee30614759a8e5925afd781362a3c2
- SSDEEP 192:LjT2Iv3j7UoQpH6x2r++fHLffxW/FZQBUJR:r2U7Ul1DfItZUUX
- TLSH
  T157E18D7BA8856F4A25C5AF906FFC7819C0F6822C2F2F63594047D19EBD0F5A99A8D007
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  modules.pak
- Size 29.5MB
- SHA256 72c08eace44952ef55919ac6a76ee1b80f3a8f4dda538444d4137bb834971d4e
- MD5 7902ef08b39323d20d0bd17461790310
- SHA1 0ee1f46abfa059f78edd95cb0504cf711bb8d27e
- SHA512 d1f7022e8fa399f527c8e822823f181e15f3e6313ef0efc2d016cc3109a38515632ce2c0ab859c6498a6dfef25fb5af9de52219248c58b228896194ab3529219
- SSDEEP 786432:2+ejsfKhZBD2inTpRzAveTZlsvwARHsl9qysIAK5s4:fejsfkZBD2sTjzDTZlsY4Ml4ysIAK57
- TLSH
  T1756733F9B350010C91ABC6215818D9767AFD1DD02C6D064E8DA736A8EF088ED6DFDE4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  otclient_dx.exe
- Size 19.2MB
- SHA256 215c0ee8e21f0a33e394a7bb1aa106a0c91f07842781bf4e1a7e563ea6ebfaac
- MD5 88bd2ee36847cbf9fcfe4c533144c779
- SHA1 b2225206b9f8cb46d21c42d373190b1f6322dafd
- SHA512 0a43ae2e587a191d9788e0823326d4359aba27ef582304cf3617df1cea888e606765f3f1f852bb55b838bf23c063d1cefae8885817c3da54528e94d9d84a8527
- SSDEEP 393216:sR1319LEYUplbT54Y+ULqKnwCXzF1Jro8HFksFkYnLDHSP:3154Y+Sro8ltkes
- TLSH
  T12A179E20B74BC072D98602F1456DAFBF573DC9250B2546C3A2E83E6E9E711C31F3AA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  setup.enc
- Size 1KB
- SHA256 96fc6b12e6dbdc794502667fb9296403c211b8343106e3d06e87e0c8fe58ffd6
- MD5 066a5cf48d295d606e5b26b1ab7dbd3d
- SHA1 c08e7054b53eb6eb4aa00496fe66f26c29e5dbc7
- SHA512 86019b7e1ff10cacbefed630dcbb4c43ebd573abb442df5f5b006c672fe0e5bd8535c3333b456d35ecae98eddac500acf02895bec1fdd87a2028f4df155a8e8f
- TLSH
  T1C5117939A999F3FD2BF8E01F9751C5485C5E88D268F81592FF516412C9195B08744062
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  sprites.pak
- Size 103.6MB
- SHA256 7f1352bfbf211b3057c24cb69056849e18144e65d5e9efa9f32ea294c2c56c79
- MD5 42bd414fcb26d6045cc8f1d18a94ad3c
- SHA1 8d9f70c11b3439b5c7631f0c936adb894e2d8b57
- SHA512 25c10f17c86390da0afcdca0526694aea03b0fd66a5849c30fa8394d4068ff36ea551374281cd4b4da2f815ad0dc79d5d720a190d24ef13fc34669de8bdb2345
- SSDEEP 3145728:UAlfr/Yr0kKHEhUOYMd+Ffh7fRGNiY4jMdnm+dk6WeXx6:HYTKHEhUFM0Ffnsi3Oq
- TLSH
  T16638339D5DA50E027EA6163DFA01EBCC8E384C9E6ECCDD92489598073947FF885E0CD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18