5459546f1a0ac1c32d5b02d730ada5473167fd31573e66ba6133bb7cac7f5dce

Sharing

Copy URL Twitter E-mail

General

Target
GNOSIA.rar
Size 727.2MB
Sample260804-cytd6stxex
SHA256 5459546f1a0ac1c32d5b02d730ada5473167fd31573e66ba6133bb7cac7f5dce
MD5 82d887b5844c5aafff13da6e4f297b6d
SHA1 aa7978caf60a363fa819a3b291a2b29fcd47fef0
SHA512 9f690ab2f97d0d048dcecc78d1c2218cb90df3964d29a3d0b28759f11347edce137fb6031c9b794d5178d29aaec9ba153576c1e592cf04a0e5e70d9a4fea27c2
SSDEEP 12582912:qZWr5GBynXAbV0qHYWx9UcE5K/LpE6XXfxZuqcQY6UUwLiEf1X94jLhB0MI5ZM3f:So5GB6ohp9lgSL26XXHuqcQYpvlf1t47
TLSH
T1D58933A4953A4647C2030932D3573889E27A207AB6E68CD7FF44F72C7C6B9C246B5D39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  GNOSIA/GNOSIA/Gnosia_Data/Managed/UnityEngine.WindModule.dll
- Size 9KB
- SHA256 aae109b40fafe585e31bf59c2eede748ed606b6a2475c140d527293c50f8b25b
- MD5 3edff4bd3625e66d57bacde7485a11b9
- SHA1 e9ef11f907246e1f449197d29f885d8279f63b80
- SHA512 4ebaeac4b828b5af0e028428427d701b6ee011d3375c2d0a5eb3364368b745b5b086c529568b3ad2104ed16da808e85860e600510daca968d268867ae03a655e
- SSDEEP 96:r30weVwj8uHgl6tBOUIcMgyZ2LUzQVaLcjObgwL8qmx:Re+8uHg6tBOUAgyZ2LUzdcjOwjx
- TLSH
  T16312DEF17684269BEC4A1F33D03993803990D027CF72D7564A8E62A4B57D0EEBE217E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Managed/UnityEngine.XRModule.dll
- Size 53KB
- SHA256 f9e54cc8b22e8121b38f2d100ec0f1d33429b2436dbdd3b11e5ae2e79d0be024
- MD5 e26b8ca3a170ecb510bf14fd2432266c
- SHA1 cc57ae85342e593f07c011145b3a274c13958ea9
- SHA512 33e81fcf79b9f0808069961e3637229fd0c3dd87f593372e583d2ef4fdbf69d058206812ffd6b63f1f20ff6086b8e211f7056280bd751c1ea477bf714617b5d6
- SSDEEP 768:aDOxpi/3+i9SPVFosXIU4Mfm/AHjDsSpk8O38aKdxwlsa4VcHDbB1hO9gyJh+:7i/3+YSN6yIegyISC4yjDhO9gyJh+
- TLSH
  T1D53349A57BC4925ADCDF1B75F83086001F74E0AAD613E75B11C86078783B7E44E66BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Managed/UnityEngine.dll
- Size 83KB
- SHA256 78014c03a6dedc1ebe7f4699afc1a3662c3c05ce557910392ccec304d82497a8
- MD5 3a05ea9d7f5bf19f2a1d15987ee61c0b
- SHA1 66a909e14c39da910ab885716de1d205add8e84f
- SHA512 3a4c49d77650d324e0ae77d7b987831e1617bec1085b6dab0ce7e38c2c13339ce320acda11b8799c4e2baefee7e87cae03ad9cb02b58419a6db249cd6593768e
- SSDEEP 1536:m1sKxQmEG1SN1akfj6xZa1Sst+m/Uh0gmL7qo0J1YLBKmiFCON/:mOKxj1SN1aq13+Mg8On
- TLSH
  T19783E87216EE8E72DC8E1B378CAF49401BF0048F4436EB9D656942CFA0BA6853F1D756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Managed/mscorlib.dll
- Size 3.7MB
- SHA256 d2e5ba4dbb3909d6ce314c7bbf8cfd544c829303d8eaa064cdc06f61f856b48b
- MD5 6991dc94b1e4eb0b947bdfd8d140c661
- SHA1 18f4f78a6071fc8dcd6041f0cfbef790693ffa44
- SHA512 bd90d41669705aef9d225eaef1d7f712e97bff347206c1964bb85b1dbd3056926e64679ddc1929150d97c05de3674dd72e6a76a68a8e22ea4ae7f00e29f40ecc
- SSDEEP 49152:GpIOn7knUlAbg2XEY//h5XCGk78MHtzjA:M7knUmjD//
- TLSH
  T116065B00BBEC9E2AE1AB6B39E87204154BF2FC49B732D70F2611976E1C637508D52767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Managed/netstandard.dll
- Size 83KB
- SHA256 994be039eb23da7b0c14fc2fa2c09b3ca2a73bb330e840275ab8275063716f0e
- MD5 92e14598f1f886b75f0a02bf934350b3
- SHA1 7c8022fff30a45ba04940ebb7ef924a9146056e3
- SHA512 e49af894dc52c21bb02040989cfa1907ad0b021d13a56d8f854df591ec594a2c2b8f1270341c28173a866bb0498625d116d87bddc5b0b872d8a87a4716dd162a
- SSDEEP 1536:1DzF+czO/mQxvvn5W4zyH04rU5SSn5ioLlcv9rK:1CFo4zy1y2RK
- TLSH
  T16483C530BD806EB6C98F43BADDB7958207F271CD807A1DB566C1B64B85DF689122334E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Plugins/x86_64/Galaxy64.dll
- Size 12.9MB
- SHA256 f92a130c80588db7f2ee38e1e3394c141bbcf5e08cc84a5aa92cdf50663ce593
- MD5 b59f1a8e3679f4fed50f55e9eae7f370
- SHA1 3f333dc924e902ffb0d9c9caf16c551c74720df2
- SHA512 457545af0888dba3d835ab8a5542a1ed6fd63cc54dfe510bf73b836791d40bca8548badf756f5c217201a18112d873fe8d122d30328db486e522614ca6ff8a44
- SSDEEP 393216:n13Tt54gSfX6uGnGT0eJTH9qfA4ruwFhmetn2EONEw3lL1TaJrsAHM6frSptpw53:n13n4HFGnIJZD
- TLSH
  T1E8D67D6636AC0195D0B7C0BDCA978B06EBB2340647319BDF0051C7AE1E67FE95E7EA01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Plugins/x86_64/GalaxyCSharpGlue.dll
- Size 1.8MB
- SHA256 1b1607dff5e1d7ba1cf44401eff3999cbe2bba504cf7e213a6a735704ed0edd5
- MD5 abd9a04b2f712e0ffb6cda609091af55
- SHA1 e9a36d6ebc13f2cf1d97c6df3eeb3b5c48fd65ef
- SHA512 b13370bf75cae225ed0693b6b08e828f92d2bcbbbad204aef1ad151a2e611384f161b680de32ef97d130425356e4c44a2384ec770af16fad224423ad2aa95fca
- SSDEEP 24576:/CqQMCkA0OG3pAhqvDgPxSUeaGpnOuJA1k2PPexfPWt:aqQLkROzqPN2Pmfu
- TLSH
  T1CF955A9667940882DAFB927EC08B4F1BC57574250B2577CF029883EE1F03BD62D7A762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Plugins/x86_64/Rewired_DirectInput.dll
- Size 12KB
- SHA256 9989b282d43621259160954f3c2191afc3e3a13adb0091c3f60be228831858ad
- MD5 0afaa40682693c887a168878a20848f7
- SHA1 8145451c75c6264aaa58a6d89f01d734a96ea879
- SHA512 6896f54b289249683e2c6471dfabb6c3437e2ac17a9bc848cebc0d1696701755007a7f306cb34eceff49ac51493e4387464ecc05acd21836dd65fb37899dfd51
- SSDEEP 192:TH0LEDv1KAaMBah/F0BJWId1w0jBheChQlgJnd8:TUgDoAaZkJWIHN1BhQlgP
- TLSH
  T19342B412B7C28CAAE0964274C8DB1A16E075F21853578BCF53184B2D0DA7BC52736F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  GNOSIA/GNOSIA/Gnosia_Data/Plugins/x86_64/steam_api64.dll
- Size 3.4MB
- SHA256 de0f5247398d327369b48c4395df40b51c7a76e1bdd45eb796227ddf833d592e
- MD5 98fbe569fb16e18466cd5747ff2654c3
- SHA1 b17b87a3eda5420e44185b457e250b5681bfa9fc
- SHA512 b48fe9d8b2eaa61cd3fdc510d6bb0fe15bc0182594f5714c7df61ba3cc60d0bc2e7f2c4b48f50e130796989e61994a22be99d41f60cfd1168175907067356505
- SSDEEP 98304:oKJmovY6EPC3Q4Uo8l+COcvJudw73pK7XtIShbAmU:Fbn0vOHClIurITiSh0
- TLSH
  T14BF502F9A1443778C017C8309523ED4AF2B1101F1FB99EBEB6D6BB906F5B8019A26F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  GNOSIA/GNOSIA/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size 762KB
- SHA256 90c2f89fd0f92038685cdce8d3a900453c1b60ff5a6d9308361d5edcc39c51ea
- MD5 71dfa7950ff7ea5840f97225095b8c86
- SHA1 8737d337ebd78793a680fadb92c8086c88656d2b
- SHA512 8061edc03e504b125e840904e620e500ea1e30d7d7b4ccd439762f241295b5de7ad9381ee03d2eb7977783fc56d06661fe7a21129dec823141f3bb2f9b1eb651
- SSDEEP 12288:gDO9tW5xZpTCJvEFvN9TH+m36rm+QFk0Po1TnmfqXTymL:RILZpTCJvEFvN9Tp2DQFk0Po1TIqDL
- TLSH
  T12FF49D953BA41296C57BD13DCAC74B69DA71B8150321A7CF019843BE2F13BF82A3B764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  GNOSIA/GNOSIA/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size 4.7MB
- SHA256 84cb9d95450e8abef2ceaddc632d455b066a6159173d2b214863883fa283e098
- MD5 f1513259a5b6be0b9d9fa6509498b9fe
- SHA1 74df6db301c91c64419e38b4fd1e454521f35534
- SHA512 9fe8d4b7f7b8b40e7cc8888e6f7e52412f5d312ed6cc8c63a0529635d2aa161cba9499e1ee25f8588339c3fc10a96fbca3d2eacf66419f551a60ab2e63c7b956
- SSDEEP 49152:s07USdrGFxZUs3doHWfd1hTAhmnSK7lmsyVrXoOtwglFQ3XiDedOpxW5//4xd+CB:CDBjd1hAmzIrX7i04cd+CwVgnuU
- TLSH
  T12D362856B6B910A4C827C27D8BA75263F6757044A330A6DF8BA017A63F23ED0173D7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  GNOSIA/GNOSIA/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  GNOSIA/GNOSIA/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  GNOSIA/GNOSIA/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  GNOSIA/GNOSIA/Redist/vc_redist.x644.exe
- Size 13.9MB
- SHA256 5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3
- MD5 27b141aacc2777a82bb3fa9f6e5e5c1c
- SHA1 3155cb0f146b927fcc30647c1a904cd162548c8c
- SHA512 7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011
- SSDEEP 393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
- TLSH
  T131E63332E6644227C6D30973ED65E2246EBCA22D7F108476C784AE1DBDAC4D393B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  GNOSIA/GNOSIA/Redist/vc_redist.x864.exe
- Size 13.1MB
- SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
- MD5 1a15e6606bac9647e7ad3caa543377cf
- SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
- SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
- SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
- TLSH
  T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32