1a6dad2a1810d0973d193467a1667811b07bff7cbf649071230ba07e1a142ad2

Sharing

Copy URL Twitter E-mail

General

Target
mod_sa.v4.4.1.3.SA-MP.v0.3.7.R1.Setup.exe
Size 714KB
Sample260726-274c6sem9y
SHA256 1a6dad2a1810d0973d193467a1667811b07bff7cbf649071230ba07e1a142ad2
MD5 ec5cc2037ece7f21866e3ce4ca52754f
SHA1 c2794debab756c0c5d923e741d900abfbb7a49c4
SHA512 d2f3d1fd6ae3e748b6562f4c644eb2249961fd8e7ac81affb835486e68bb881edc28d9c4c9504bbd69bd55d7c729d23c93e2fdd1a56e99b2e02e3ceab50f1fc0
SSDEEP 12288:dGesLGFTqduzEJQtVgdfQtseArkdZk637sF+FCvCUuetkdlcaPbtAoVS7:dGeOGF0aEuMdfQatkcJ1jxt3aJAoVe
TLSH
T135F4233335E33597D5A24EF04CA379DB88B9EE8503510713BF509B9ACE86A86780D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mod_sa.v4.4.1.3.SA-MP.v0.3.7.R1.Setup.exe
- Size 714KB
- SHA256 1a6dad2a1810d0973d193467a1667811b07bff7cbf649071230ba07e1a142ad2
- MD5 ec5cc2037ece7f21866e3ce4ca52754f
- SHA1 c2794debab756c0c5d923e741d900abfbb7a49c4
- SHA512 d2f3d1fd6ae3e748b6562f4c644eb2249961fd8e7ac81affb835486e68bb881edc28d9c4c9504bbd69bd55d7c729d23c93e2fdd1a56e99b2e02e3ceab50f1fc0
- SSDEEP 12288:dGesLGFTqduzEJQtVgdfQtseArkdZk637sF+FCvCUuetkdlcaPbtAoVS7:dGeOGF0aEuMdfQatkcJ1jxt3aJAoVe
- TLSH
  T135F4233335E33597D5A24EF04CA379DB88B9EE8503510713BF509B9ACE86A86780D71B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- TLSH
  T178325C15135046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF386C79D79352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/bassmod.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/brandingurl.dll
- Size 3KB
- SHA256 798ce85390508959953b55d966ee3ad8fae938cb107233876566a5823d339a66
- MD5 028857ee4bf29e5379b19027df010071
- SHA1 8cba90942b3ea405f70e4ae899bb08f7b58dfe70
- SHA512 e08d91f53039a1ec0c768a873b91901cae3fa7b91f368157c3adca12cb439b627e9d4558b49d747ef7fe6250a51693183ca29422603bf102bee05aa410539b8c
- TLSH
  T13A61303637F919B2D3724F7B58A31BEB6A7AB4310726404F446B299A6042D63CD79B03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/dumplog.dll
- Size 2KB
- SHA256 0dafc86043fc2d263570cd95b778721924bfcbce36744b828961529b779ca4a3
- MD5 a517578af0baffd5a235d8177a651a5c
- SHA1 900040ea61cb705f5529ffe87522640ca220c8fe
- SHA512 afc20fb8dcae46f65f92300cc51ccf0c21d76d2135e3a8beed2fe363a2b10b1525fc042d7e307ba173ad719c23705a5718d4059c834969bcff7a717845e9ae11
- TLSH
  T11D41EF7747A11DB1F826033771570DC56DE5F21016D3BB1D0A02ED8CF50676B8A2DD10
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/dxwebsetup.exe
- Size 285KB
- SHA256 b68ca13c29b2c9ad899f68fe3f9baff7ecbb848e963604ab5f66bcbf420a26c8
- MD5 14ca145edd4f381e1adad6c2ceda5e7a
- SHA1 1f785ac7c5da7cc2750de9991cbb2d72b570ab82
- SHA512 58c08005db38c9dee19d9ee02717fc9780fcd61a41e14491c51f7f23782511737ec8235637b797b3f83cef4028aad3edf746ab87e02ca08aac2727cd1ba7788f
- SSDEEP 6144:nWK8CN+qHUKfw5R8DPv5N6RkMphh++axWzfAHzxHtUiq4:ngKI5R8DpNakMpWn0zmtUiq4
- TLSH
  T11B54F15266E9817BE0F52BB40EF602533B71BED27D79F32E9382548C1C61395A938327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  Uninstall_mod_sa.exe
- Size 48KB
- SHA256 94de8767d145b9b964bcbaa807c19fcf7fe3ae2efb96f4e84c588aca47222e58
- MD5 812b933e87ac509ff21bdb7c0071bf6e
- SHA1 16242311ba6646f053306d1fe431ae73791aacaa
- SHA512 7a5c9e2de1a3b422346db927d7c6f6cd83b19f4871a8e861d71cb8a62d0747157d40d6abea5896cacae78c9549472b6756c5bca3257a91e1b00738b7421ffb12
- SSDEEP 1536:Eo2s2ruq+ty8EQeerVoOc9gdLeAyNxjD2:Eo2seR+wb4rV5c9ceAOD2
- TLSH
  T12D23AE4637D2947BC6A607B21EBBEBFBE7B2E610111047536B405F7B3D252829E16343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral13 behavioral14
- Target
  d3d9.dll
- Size 793KB
- SHA256 8e9638372c00754ae8fa13f699350eb7e6170c4b3981ed1b2b1e9e957adac1ce
- MD5 77f418e25b44035ae00c3eff6271fb2c
- SHA1 6578697ff428c0b203a112abe11e34b1c2bcc695
- SHA512 eab3a4f521a429135dba7e1d523dc8e86d71efd012e42e19363985bfeb684eff35144df862a45ebbdee11a226b104a16211027f7ed55bd69617d4a7eead7026a
- SSDEEP 12288:aecbQDRhh3dRUw+F0rVkgCBU38lX8r4PZJu:XG6Rhh3dRUw+yjCtd1q
- TLSH
  T114059E447A8D9031D11FD07E3D03B72FABFD7EA44DA48E577FD4196D0AB42812AAE242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16