Extracted

• • Target
    Game.exe
  • Size 4.4MB
  • SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
  • MD5 617b560ff5b82a7ef6953c0da35f2aea
  • SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
  • SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
  • SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
  • TLSH
    T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
  • MD5 4add245d4ba34b04f213409bfe504c07
  • SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
  • SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
  • SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
  • TLSH
    T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $TEMP/temp_cleanup.ico
  • Size 2KB
  • SHA256 f3ca0866c22c802a2e562d2d3c299ab16b0a480687add02880b553fe9d1f3b5b
  • MD5 c8902a54bbf2b6eef30b18c39632da06
  • SHA1 830d1dacfca896933b120a7623c87c9538285a95
  • SHA512 8784ca999ffe2922a58ce71856a54f66db2bd59bc8f29eeccc3bc730e8069ccada0a121c9f9725faaf10f46bb8dd1e1bfc6b9cb43d1e553fdbfa7f6c00d427f2
  • TLSH
    T108417F3D6403C4FFD72075641001FD97365ABAA3F7D89979B6EB1728E9C7C20814980D
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    $TEMP/tidy.bat
  • Size 10KB
  • SHA256 4306c2771929f739eb95ccb194a7eb433fb384703db9b10e0460abb996bad142
  • MD5 e3166d068f5fbd5f2d4cf876b6570023
  • SHA1 76838b5dd4f056426438ea57a7f53ab95426a9fd
  • SHA512 f20a753d47cb787474202c42f08f77c4fcbf1bcb26ccaf3543fca7e93acd891ac67aa18c660331350b8c25cb2b60f13e126ad68571b3837e1b7e936daf66a0ec
  • SSDEEP 192:uMWapyx5oB++XpcHK5fAdGbHZgQvnZ53jkRO6UZrbNsOi2v3G839ufIl3AQ694mc:uMMU/Xpc0AdK/NufckGSYvuE1EGl0GlD
  • TLSH
    T1EE22649E35039AE603769BACCDE36C10D66DA2A9C1B1D1DCF4CCD3CD83D9697828225C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    $_2_/DiagnosticsNET/configuration.tmp
  • Size 2KB
  • SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
  • MD5 0a011fde5ef12a6aedd47d625852fda3
  • SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
  • SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
  • TLSH
    T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    $_2_/DiagnosticsNET/update.tmp
  • Size 636B
  • SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
  • MD5 bf7546635574ef69ad6aea52341f2ed1
  • SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
  • SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
  • TLSH
    T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral11behavioral12
• • Target
    $_2_/Features/update.tmp
  • Size 1KB
  • SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
  • MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
  • SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
  • SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
  • TLSH
    T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    $_2_/Features/x/_locales/en/messages.json
  • Size 79B
  • SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
  • MD5 e7909dcc8014f623d623ff3d8535c7d7
  • SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
  • SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
  • TLSH
    T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    $_2_/Features/x/icon.png
  • Size 2KB
  • SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
  • MD5 5f62e1708f9891439ed643945fd4752f
  • SHA1 d9f8adccc718e9555dbf968912d53db909479679
  • SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
  • TLSH
    T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    $_2_/Features/x/icon2.png
  • Size 4KB
  • SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
  • MD5 2c9317bbdf91f7e4fe7d785e45f47210
  • SHA1 02e2166007e5d8628310800854121b9afbe95723
  • SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
  • SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
  • TLSH
    T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    $_2_/Features/x/interface.html
  • Size 1KB
  • SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
  • MD5 654bd04df4f45643537d9c5e0fd3d351
  • SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
  • SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
  • TLSH
    T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  discovery
  behavioral21behavioral22
• • Target
    $_2_/Features/x/interface.js
  • Size 1KB
  • SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
  • MD5 833ef87f0265c87a2cdb6600a0ed39cb
  • SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
  • SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
  • TLSH
    T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral23behavioral24
• • Target
    $_2_/Features/x/manifest.json
  • Size 7KB
  • SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
  • MD5 eb905bf14a8a0c383e50c8422fbf3d60
  • SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
  • SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
  • SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
  • TLSH
    T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    $_2_/Features/x/script.js
  • Size 296B
  • SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
  • MD5 5c38641814eaf858f45080f8d3bb0a0a
  • SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
  • SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
  • TLSH
    T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral27behavioral28
• • Target
    $_2_/Features/x/security.js
  • Size 31KB
  • SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
  • MD5 b4020d683acf7468ba58f0025848891b
  • SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
  • SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
  • SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
  • TLSH
    T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral29behavioral30
• • Target
    $_2_/Features/x/web_accessible_resource.js
  • Size 1KB
  • SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
  • MD5 dcc592cf6d40300bd8e61e650438dcda
  • SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
  • SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
  • TLSH
    T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32