General
- Target Tide.zip
- Size 58.9MB
- Sample260803-jm5rdsek31
- SHA256 e8bcefaeecdfa734c75cd7451ea8ea511dd0b811c35ae18482e8abeac9494566
Malware Config
Targets
-
- Target Tide.NELauncher.2.5.231110/GameAuth.Core.dll
- Size 3.4MB
- SHA256 37e63c3ec880111ab69c7bac777b80350e05a597d3ae02c7793777d5648984b6
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Tide.NELauncher.2.5.231110/GameLib.dll
- Size 7.2MB
- SHA256 b4ae769df3e93ff006ef1d78fab62feec0e6c04cd7a84eb121fd94f4d47e68e6
Score7/10-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
- Target Tide.NELauncher.2.5.231110/HPSocket4C.dll
- Size 1.7MB
- SHA256 d6da8a5c89fbf65e4d59edeb6307e4096071798726e6a143eb6b37d1fe34f796
Score3/10 -
- Target Tide.NELauncher.2.5.231110/MPayCliCppWrapper.dll
- Size 117KB
- SHA256 49c1b2f6c8f107abd43c93363f1cf2f46e7e36a429d20e7fba1105fab83de75d
Score3/10 -
- Target Tide.NELauncher.2.5.231110/NeteaseLogin.dll
- Size 54KB
- SHA256 a24388711a0bbade4762df20418d3af11aa2207e30118cdfda2c5244df06a73b
Score3/10 -
- Target Tide.NELauncher.2.5.231110/Newtonsoft.Json.dll
- Size 420KB
- SHA256 8cab8a4c8998d9c57bf146a38976af1247ca8c2056a5410d18e57ed234de397e
Score1/10 -
- Target Tide.NELauncher.2.5.231110/NtUniSDKResources.dll
- Size 333KB
- SHA256 41bfbebecca7349e38d3d6e3f80b1e0a3dc80f421f0f02dc4139077fd8462ebd
Score1/10 -
- Target Tide.NELauncher.2.5.231110/NtUniSdkBase..dll
- Size 2.8MB
- SHA256 7ee6580201d140396a0dd3cf32b7a04ef11779258a8bf6d66c36b4169f6f242d
Score3/10 -
- Target Tide.NELauncher.2.5.231110/NtUniSdkMpay.dll
- Size 2.3MB
- SHA256 6e10440f7aa5419006e55934b51679bcc99da7fed1576e6cd1ff2748b3f365cf
Score3/10 -
- Target Tide.NELauncher.2.5.231110/NtUniSdkNgWebview.dll
- Size 2.5MB
- SHA256 fefd2f7cbce8261faae5d091cd482682631f2d3dea960f50ede6e772b27efa07
Score3/10 -
- Target Tide.NELauncher.2.5.231110/TEL.ModLoader.exe
- Size 14KB
- SHA256 6ccb3c955a4fc54fd2c1991fd4d9be03346a5f9f1e98e0e05c28cc77b11b2589
Score3/10 -
- Target Tide.NELauncher.2.5.231110/Tide.NELauncher.2.4.231110.exe
- Size 16.4MB
- SHA256 a07b0f10c650388eca2dc8eae28e981dd1f893979b2090fab48968f9e2540d60
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Gh0st RAT payload
-
Disables RegEdit via registry modification
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Creates a new local user account
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Tide.NELauncher.2.5.231110/Tide.Proxy.exe
- Size 6.1MB
- SHA256 88764f6c5ef43e2d94b976400f4b23daf155b1bdb7e5c3314a91a345eabb2282
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Tide.NELauncher.2.5.231110/api-ms-win-crt-utility-l1-1-1.dll
- Size 5.3MB
- SHA256 4902a02d94dc024d0c6eae1a7d46b143f5d53c2ce4416c1c0bc881bb5704534c
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target 4620273834210283309@[email protected]
- Size 46KB
- SHA256 4b5b74988ee5be7a5257def15f94f8f5c437e6fda6c56ca3f6e3b783149b84dd
Score1/10 -
- Target 4620273834395780067@[email protected]
- Size 25KB
- SHA256 8d1b06b9842349e0e354cd296d600b05f891df419385e09669aaf3b46389916f
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create Account
1Local Account
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2