569e308e0a8dc545b3ea61555a6d36ed9dc4674370596dc57d1e1982cd234701

Sharing

Copy URL Twitter E-mail

General

Target
AntiCheatRemover.zip
Size 24.4MB
Sample260804-v23fcsttey
SHA256 569e308e0a8dc545b3ea61555a6d36ed9dc4674370596dc57d1e1982cd234701
MD5 f747b7379f09d23531a4dd20bdd4f5b6
SHA1 f095ea4207789d47c74461eaa4442fc6b521c560
SHA512 491f69770d34a75434c8df69e63f8dd870eb7d32d3364ebd4c9825f7a78c60e3d9211674bf5fdba0170fe63227e4e610be9ecb977ed6f6d4e767a794348a225a
SSDEEP 786432:eEj4E8isMvJhjov4yyKaSfLN0vw0SkyZfAv7CVMs:B0ifvHYaSfLNASVDVMs
TLSH
T1894733E43843237B6A846B115CB909E5F35380460E0972B91BA4EF319837A9FEDF58DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AntiCheatRemover.zip
- Size 24.4MB
- SHA256 569e308e0a8dc545b3ea61555a6d36ed9dc4674370596dc57d1e1982cd234701
- MD5 f747b7379f09d23531a4dd20bdd4f5b6
- SHA1 f095ea4207789d47c74461eaa4442fc6b521c560
- SHA512 491f69770d34a75434c8df69e63f8dd870eb7d32d3364ebd4c9825f7a78c60e3d9211674bf5fdba0170fe63227e4e610be9ecb977ed6f6d4e767a794348a225a
- SSDEEP 786432:eEj4E8isMvJhjov4yyKaSfLN0vw0SkyZfAv7CVMs:B0ifvHYaSfLNASVDVMs
- TLSH
  T1894733E43843237B6A846B115CB909E5F35380460E0972B91BA4EF319837A9FEDF58DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  AntiCheatRemover/Config/Unity.3d_Config.exe
- Size 24.6MB
- SHA256 ddbd191d6f20a1a2ca9164088ff6bed0e48b1a1eb7dc856694d0c63d697f1fd1
- MD5 f17921b7f8d6eac4bd2edb368a44ffb8
- SHA1 4643ff3ffb2e22284a798518501296bf62c07eb8
- SHA512 4734cfd5b663d0510349deaee2067b9fa75582af567ac61cb66b92fd2cde8a86bd1a8e4559c7c1796967fad1bacf58c588c2c8aff5f4b60b274c26308c62004a
- SSDEEP 786432:+qzbS4ce2s7w238odmUJAzRphFBo+htstLkvF7U:+qq4f/15JAzPhbmKU
- TLSH
  T1A44733A43A9205FFD8D6523958A588A2F33371CB0F94E0FF07A469761E7BAC44D3C694
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  stealer.pyc
- Size 43KB
- SHA256 d96f417a55a8bde86570d60cc3b36efc4e484b8142e2a8896d5631b62acd72a3
- MD5 7f26f950b83673887be692539423ed0c
- SHA1 6570115c1bc48e132a5b749e51f5251254434df5
- SHA512 7af43ef66449b7093410b70ff42c535a8b08019756a229957db0bfe7fbb547a65b952baf49bb5353ecb726e055b81a00105500fe3856ac0dee108241f821f687
- SSDEEP 768:Hk/TBwr/sEEeNKeF8Dcf+q7GkTcTyzR4B/X:HkOrGQyq7G64e8/X
- TLSH
  T11B1305F9A920943BFCE8F43871E358C5E332C2846691DB07F4285CB9FD993599D6821C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  AntiCheatRemover/GameProtectionRemover.py
- Size 96KB
- SHA256 1b17101d6af0341ec99533452de53163693a3510dd6c218a5900a27ed6f5574a
- MD5 7f5d1b6e91c14a0a0259d6a95e7ab03b
- SHA1 9bfe473ea7522d98b0678bf2147c620673be7331
- SHA512 688fdea74b816b274eec03a2dfe0e355ca1b0b5667dd778c0fe20aef58944b93e879ac34ff8697bbc642d5bbc8e0671abde4f2ada97413168aa5b948569b2c04
- SSDEEP 768:5UFuF8Pvvo521hsxs9OH3f44pAIYQzjwlc34pAr7q344pAIQQzjwl5v:5rFovoI1hsxs9OiIYQzYcr7qKIQQzYd
- TLSH
  T140A3097DE4069DE7B41091776ED339C02B1009036EA674147F9806E8CF6DA9FB9722EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  AntiCheatRemover/README.md
- Size 328B
- SHA256 3b67d9e97b6533c125b93137c499109f97afd81451b31b8e4db3710ea4d41ce4
- MD5 13558090c9fbc35d18b1f0437e9932df
- SHA1 d3951f19359d2729747f9fa39b2360b445a9f165
- SHA512 872ae60a6e4f9f4082096fd99ec4eafe61e3ab9519380f03f5c77ef086ecee1a3d7d71c93d0d32b163c9e4fcecab05d5687c91485fb4c51da06067295fc942f0
- TLSH
  T1E9E07DEF03540433529556EBC15E773FF782687671501C0788BED54F8B522012253380
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9