e533934a4ad637caa26e010723ac8494032dd58a76ff4a77182372a5f4fd6609

Sharing

Copy URL Twitter E-mail

General

Target
Grand Theft Auto 6 real.zip
Size 548.4MB
Sample260809-lysx3sdj9w
SHA256 e533934a4ad637caa26e010723ac8494032dd58a76ff4a77182372a5f4fd6609
MD5 01d64a39e5dab890499aeb42932c8eab
SHA1 5a7f8101dc39fbc24bc632c9cbb699d6f621bdc3
SHA512 1d1066bb467b2045bc118b7213115f4c2f943ba6a4bd419c86df827d48fe3ef23f3b0bf85b742f2653a02fa58394b35a34987e4c7a807246caf04892773b5966
SSDEEP 12582912:RlABk6A+UTWeJ+w8mRxnYD7eFQImF5tg/iO1VsOyOvcxGPvlAijJGqz:7ABk6A+UT2w8qdGlF5tg/aivMcegJ5
TLSH
T192593382A159D9CFF78A4231D07F4D8464AEBD4B502A426AAFF23F3F157A3DD4076809
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
- Size 2.1MB
- SHA256 d65dff2ebe90bf79fba62f3bb1f105a7ce8efaefaa8349379a886bb893a4ef45
- MD5 0e585ea67a33c7802ebbd1fd576f156c
- SHA1 ce92aecf2b3903b4dda8b0a71968b69e909cddca
- SHA512 e927c7426b263a5ca286080c04603b2052433e88062f5ebff78fd39de1305087213cc1ed6e7b408056d48804e5daad54ef80bf39e027ec6094e039924ed3c192
- SSDEEP 49152:wwocwVH+umtSiRFXIrZ4mTQHuEnmDdE51pd:whcAH0r+OFrmD01pd
- TLSH
  T12FA58C4792EC40A8D57EE13CD657421BD7B238450330A7DF52A887AE6F23BE51ABE341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/MsQuic/v220/win64/msquic.dll
- Size 2.4MB
- SHA256 832f4ae560b1623aa4d8f87b982e9c9414312723fbc905ddab93fd80d7f1cea2
- MD5 c575038f5b2487c4cc00b89121160d81
- SHA1 cf0a3e08b4520264a979560c849d649ad875c725
- SHA512 07f48a83db65b10a4180259fb4173d298455f8a6532e4b685eea0540b902fbdc7d1dc6c197eea42d7f690ca5fe8874b67f092a486e49f61364ff4bfe5aa04cb6
- SSDEEP 49152:KVwASO0Gtlq1IU6idfp1s7NJt0fegH1yZWxWT4ttWDGyPj8VVu:k+FC0144b+8K
- TLSH
  T105C59E17A7A811E8D877C238C9638137E7B1B81513B0ABDF16A4C6B90F67BD1673A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
- Size 5.2MB
- SHA256 f2f1a88185345b28d05673e11111ee21845f3ebe65919cf6b3085bee7d09e30a
- MD5 1052b1d6a2b53d55b994638df35a3710
- SHA1 293cd1ed31ad542a4dbd1a8113d9feee08751954
- SHA512 d23b7c76b39ee1f9744088aa3a12dae3bb33c83b670b091fd4d0acb5a6460f00ed52226c825c07141dd24794b62b723c95833f0789f128fdcb9fb5aba0ccbb1e
- SSDEEP 49152:551CObepcfBU/Rqt6Dg/Auobysa3amwQdvvT+FUnEui9a46W3BXlC133Zt9FSb4f:pgid4tc9pYNIOjgOO
- TLSH
  T100467C7A335841DDC47AE178DA431E0BC335BC454371AAEB03A29A6A5F277E51F3BA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
- Size 58KB
- SHA256 1e2fe8a3dfe9616edcb3cd3a5a958c791f690d5b604eb1658b0f844cef156eee
- MD5 febc787569459172d20b343c378ab85b
- SHA1 3066f2661d2b7bcc9d4fa3c712332976583809db
- SHA512 cf4c7965caa27a1a6336a03d2d903fe13bba48fb49d523eddcc4b1e61664133602a7973bc24051202c3d3f97f125ecec4c17bfdeab454124d088be025f7de080
- SSDEEP 384:G9KN7KRked7VWjLmPnUunFqphqaNQL2PnQftfKNRvrzAcojOYPuUIYiBndCxuqyP:NkSQyQUuFq19HAhjXulYiBdq5ALF
- TLSH
  T18E438D1B4754A86FE83B543898E5D326E5767814936057DF2248C39E0F22BCD3E7A3B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
- Size 1.6MB
- SHA256 676bbdc5838755d7a881c847f84ca79997b525882594b66160ab800676cab9c0
- MD5 139c8393996808afa5169b54f8292334
- SHA1 a64bc7bc4d07dd423017540c2810f01b5fbca26c
- SHA512 dc3733604bf18decb9b3176ce65543f5a73fe74d564ff2f201ff04e7d35a43023032d6a3697d1bf3ec5c4556f31eadcf7e190e2da12874f82ff61cdb20d4d425
- SSDEEP 6144:ebbUbUwlPxtVNA0ueMSMMYGUXoz0A1VoqxRCvF:oulPcDe2XNS2F
- TLSH
  T13F851F0759928B34C1BC50B588DB557853322C4DAE800F9E7BDCE67434D3678BEA2BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
- Size 47KB
- SHA256 ceb067771c03ae1a7afc125c15c85dbab027aaec72575dc101c618eba2bafea0
- MD5 79690df471ceee261f8e4752602adc80
- SHA1 b1b7e277ff4d8cd4d7f04e332dc7d8151b56347c
- SHA512 d51805d5bd0db862f0db092bab2a5a8158ae18ae379144afb144dd0763588406eff6956dc5732014582eae7b211b7d753a92ec4a0f8865ed0889a6edf92a1e19
- SSDEEP 384:me2rmsvpGwK9QaXYBZ9b/kwmVkSA3/pTNYTdk1aLPHXrgP7gpw5WOOBp8FoIYiBp:4nv89iBswdSAQS7kWW/BexYiBP5ALo
- TLSH
  T1FB237CD796F120DADCA7C938D69B2B2BFEB17006536066DF1354812A1F22BC1733A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_api_dump.dll
- Size 10.5MB
- SHA256 84429d4ee54a717f33c176eff9c4738d7bd2ab30ba5c0928e8698f7c12c70551
- MD5 c3a88d8a42001e4d0a26cece559aa402
- SHA1 9e4bbb3dfa6cc03cdb8c15d9ab7ccbfcf06f2a16
- SHA512 df9e302123270ccdd3c8496fb9ff9ff48f45e3e9e59f99cfa82208a01e8bdbd9632179a337f943e0014323ab3e5df9e86db6015982a7626ab4136b0111d5aa5c
- SSDEEP 98304:wp9jCHQcCE3c8N3XoxxPkq0kD8ZsSIxYqEzyUjK5XqJGU/QUzygFFrAzYxI605Ep:wp9jbnp2D
- TLSH
  T177B6D65DD7242488C5AF80BCC3022E0BEAE0301187F622EB55778E565B676D7C9BBE17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_crash_diagnostic.dll
- Size 1.9MB
- SHA256 ad1d992bfcc0744c9f914a5cb24cd1a2ec9df2ef48538695c0788d13dd3c0d75
- MD5 f44d8fc82296c9db4fd6221cf2dd956b
- SHA1 bb4dcfd4320bce46dfcc2b5cffdf4d44c84e863a
- SHA512 f775ae68c29b4962b4a7d01dfb6c03050e72dd82a28da64501ba5694a26b2170d2c3d9ca953f8743ea47bbb57f883b15061bfd93d8ed17e73dc79bf13e076d11
- SSDEEP 49152:IBLPWAfxivuCxErC7Vsb+b1nVhymREjsb0RkaAJQiMbaM7iBfCBuMnIML4KNlC2u:IFuZ4gesb0RkaAJQiMbaM7iBfCBuMnIv
- TLSH
  T1E3951B5E60653BF9C2B6CDB8C001240BF1E17C4E5334DBDB61C58AA15FAE2F2257AE85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_gfxreconstruct.dll
- Size 5.3MB
- SHA256 2bb443f869596c64194e73541a61b252a74db2beb467bbd6d7bfe8a9aa227758
- MD5 111497094b90e1bfea030e52709202b2
- SHA1 bb91e00553fedbd896185a68ed162cffb0869241
- SHA512 610e1d95de479df8774f76c48498c57471c19b8ff1f94461a6d821ed946582f88002238ed035b55e04b1d4b07965df523982c36f85dd8feed200c88e6401a473
- SSDEEP 98304:CVVCM0feT5Ls4kQJJes70xkaAJQiMbaM7ihfChuMHIMrkD:a0mT5Ls8
- TLSH
  T140465B9B367C11C6E13BE17EC603AA6AD67236820320D7DF596443AE2F039E55D3B361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_khronos_profiles.dll
- Size 1.7MB
- SHA256 35240f401e2b220c7bafd2a91480ff6ada203c7af6ceb04c08421dcf2e35881d
- MD5 9661c3cc7f9754c195f35b5e49e1d435
- SHA1 b9f9a28fdebea46a4da33eac69df3007e9cf392a
- SHA512 3b806133085729699a19fe461177b044fd641980f5dd7b5d4b8365ce236c279c48242383c4ac707f008d51889f7b8b05de9ee58c653061aefcf2a6c4e8461405
- SSDEEP 49152:JvL4Pp197XsOFIAnHHattUEPc8aOhymRTaqC:uNkAHeq
- TLSH
  T14B854C3767A552D9D0BFD038D90BBD43EAB4300A437C69FB06A105660E677F2AE3D660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_khronos_shader_object.dll
- Size 362KB
- SHA256 a4a1635578f92f529cd29e463b90823458cfc0ea6d0cb5ab1f57bd6814f2e73d
- MD5 b3ccd842967bb3f81f1032f98cae9cfe
- SHA1 f362d7bae52af66ed53f8ff43363a004cdcb8a0f
- SHA512 cd682dacdcccdae668a98864a4e44d2999c82898444f66bbf824e1df430c3c64e7a22c31c28a67810f9f43201ef9fc4fad340b4b1e27097599fcb9a7c1eea88a
- SSDEEP 6144:d4MYT1kK355KR+PBVuDu9aBcdMzY9EsVqFSlE844+XaLTjD4bQ0t2824vwrQwQdT:bCZ355JuDIaBotPVOmnppQd7p/x
- TLSH
  T177844A7D19781875EB1650BDCA8BDA07C27A784A13E0E6C707C143823F6BAC8997DF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_khronos_synchronization2.dll
- Size 333KB
- SHA256 4ba97ee2194ba4f8aeb8cf92d0351c163a3c25e121d304851a16508cc47b8ad8
- MD5 1bcd824abcb5cc9c0febefc650dfe711
- SHA1 5bac08793d448988b559ae8dcdbdb3934bf8e550
- SHA512 b9b9731c21e2c041a9130cb8e42646a3850605de607465d9bcd9637b242c04c277ca16318dd77eac3a9a98f69c843f0974d513ba7209b0753eed17148147849b
- SSDEEP 6144:UKgXMlq8oD1/Q2sMmasQ1dmouGY2W/7tdlKSXoOZqCvyGjdXrtwqStNQ:J8tJ/QLBQ14FGAndbqA
- TLSH
  T1B974193E15780C76E65A90FDDACAC607D572348613A0EAC707D15382BF1F6C8AA7CB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Vulkan/Win64/VkLayer_khronos_validation.dll
- Size 17.1MB
- SHA256 2d86828d287b75c366b475b1db2125c334ddee3dfa993c42be79016addd7057c
- MD5 3b55c7a21386df8bcaa816fa52153ae8
- SHA1 18fd2afa2bcef98ddd460e0b674abdb0b98cbb83
- SHA512 35c89818fa717299fbe887c1f813aa42f3340faf29f96cdd44739634314bdf1a30673c86ae01bbc361f4ec4cbc62c5d591ad1e9ea9801aa9df97b0dc4fb895de
- SSDEEP 98304:rAXVYlU3VXBRZlDWuP4o63VMO7EB5sY6T2eZVcNExd0O:rKViQXRZlDWuP4o6lV7E/skeZTnJ
- TLSH
  T182075B1DB2D571F9C1BAE138914B7A0BF7E13C700331ABDB45E4484A6F5ABE46A3E250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Windows/WinPixEventRuntime/x64/WinPixEventRuntime.dll
- Size 67KB
- SHA256 fdbab7782b213852c6eaa38ab9343f7db3f788f43e032fb5db3bade192d6d5a0
- MD5 da1f0420ef92bfe5d9b8dfdb3529e38f
- SHA1 720c85bff33bd04edb283c58c62e0f5faedaf35c
- SHA512 0e8e95e6d1750b63bd5a67bc2f8d459a1c1f22e01ae82ec67c051a7687c392772278c1383c45201e6119f1b82a8cc2f5e7dd51e19c6e6f317bb32cc5fa46159f
- SSDEEP 1536:760OTSpRak+AxmLRwdwjbsyBej3z6jPK3z6qhl7Br4y:760rpMAYLRwdwjbzB83uji3uUdR
- TLSH
  T12D639E9696540482E86B9470D6E5EE0BFD7AB6D61B10E3CF1360E2491F633C1EB3D728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  Grand Theft Auto 6 real/Windows/Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
- Size 838KB
- SHA256 013984e33e884bd0b823734ab86a599a8dceffed675039ff293d15ffcf7f2be9
- MD5 77e13eb4bdcf9abfb4eb936145543a30
- SHA1 e62564bed6757ec44be53a881c9c2cf18809ba30
- SHA512 30b9cc754a89cf4f00047e509d68f0595eacb08b6e5fa33eb5d355edd23936a584bdf532b3249545385efc1c09fe62f92d11be0a1e7d4e9a5d48a272df4e311a
- SSDEEP 24576:4+6PHmQBNmTqtEcl+4n0wcktNvSRbESezW:4hBI9InQMNvMH
- TLSH
  T12A058C53F6E589F5D16B51359167BB1BF672B40027254EFB02A086283FF37C01ABA3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  Grand Theft Auto 6 real/Windows/Engine/Extras/GPUDumpViewer/GPUDumpViewer.html
- Size 182KB
- SHA256 15966544a010b56930a7389b5e9cbeee7a9ae545d132906e983ac954a839df67
- MD5 bf7698f64e9ddded748c0a8540878013
- SHA1 5f843e1302af99c7f3db98897fca8a70a550d688
- SHA512 b6bdee3fefc5c9cd476e703a220cfa11d3287930e5fd2ff831c6d9ed86f0b82d3d45388fff7c9f44257c23b636a18af794e94ff0b29c19214141a5116ead6e71
- SSDEEP 3072:ghoPsMI00TsT7fvp/fxzROiMGm25Fm7Z4QFRlZx6w9EPWIuPZ8EUs5:ghoPsMI00TsT7fvp/fxvMGm25Fm7Z4Qz
- TLSH
  T1DC04C583BE0F803A95A3F25621780F49EA3DC151992091EDF87C5A7890F1EA5539DEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral16
- Target
  Grand Theft Auto 6 real/Windows/Engine/Extras/GPUDumpViewer/OpenGPUDumpViewer.bat
- Size 879B
- SHA256 e8f7ef9c88697041bd87902b76e52558979ca866c7450b1da108a94a027f441b
- MD5 7dbda1f0697d023fe931feb4a3cf75c6
- SHA1 91b109182fdcbda1e523d39f03e0812da29964f3
- SHA512 cecb09bc1bc7b915a89becf42b2dd56f6ce1f129cf5b2d7de8e1fa1063330182f50a22381c4f30fea461906cfe5a00db139fa916c6a557b0663a20d2984e8fd2
- TLSH
  T13F11C0DA790192C834A37CE53B402B1A2F0FD52DB395CA4F3695110540C046993DDAF5
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral17
- Target
  Grand Theft Auto 6 real/Windows/Engine/Extras/GPUDumpViewer/OpenGPUDumpViewer.sh
- Size 2KB
- SHA256 1b222b5d5aad6dd9b5b9f0a1c72d38635149540f2c7a368600ec76c1d304390a
- MD5 414950e294df62d5981a768ecc61222c
- SHA1 f00e4e61c907ba56b8a1886a85a68047e7d9ccb9
- SHA512 bfa6db51efd7748781f75155b9704648c70bfde15e8986d80d0774f8ce42ad6954fc1a47ae2f98ed7bef9f56ac8f5fe64d519a06b1bd04cbd5db02abd52b912e
- TLSH
  T159418419B18F63324CCC28C1AD3D04233A858274EA3634B8B168A91F5B3EC7C71749BC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  Grand Theft Auto 6 real/Windows/Engine/Extras/Redist/en-us/vc_redist.arm64.exe
- Size 11.2MB
- SHA256 07698e7186563f0f9c78c37b2acb58136813fd5cfb068d41a339be2ee5b49cef
- MD5 212abba875c4ef0ceec8924d819d9718
- SHA1 8184b77436dd7e6bae7061a3365d06078be05137
- SHA512 79915152714caf71f8b5e4c281cc793cadd0134250e4888c0844b21bfc4912f923942585071c17b08e438a2e0ee62e81b2c5cbfb242d75f35b57be2c4c9b6b37
- SSDEEP 196608:sLZLmQOh0nL5VU13d+ohfBBm9yaAo7GaO0Pm7wIwBI4/lZdJryezarDrSyd3THr8:Qq7mLm3ddhJBdoqaJWxwVlnJGe2njdT
- TLSH
  T15AC6333291568123F7F50472B924E2303D7CB724679489BAE7D4F81C3EAA5C267BB217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  Grand Theft Auto 6 real/Windows/Engine/Extras/Redist/en-us/vc_redist.x64.exe
- Size 24.5MB
- SHA256 d027d8eb8edbef6c8740683b41d00442f4108351c034b9e0cb36fff27349b5be
- MD5 730be72094933ce1d691aeb22f863a86
- SHA1 760fdff19fbc538745adf05f948849207d097d98
- SHA512 d154310b8b43675574aa8ff9cf5a21d6e75c54da8f80b0743ddb21f0194ecdc1d65c80d4f3c4a5b6a0fea16659a72b9ad63234b44699adb72f6877ecd341fda3
- SSDEEP 786432:Yjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdS:Gpx56Bu61eGv1pjg6pw
- TLSH
  T1FF473332E0448026DBE61037A168F5206F7CF624A3649ABBE6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  Grand Theft Auto 6 real/Windows/Engine/Plugins/NNE/NNERuntimeORT/Binaries/ThirdParty/Onnxruntime/Win64/onnxruntime.dll
- Size 14.0MB
- SHA256 381497f383b457180aba6e5bf56a2eb18cefd6735cfd47257539f6d87fbc8584
- MD5 c7a2ca5047f177fc05dd36aa722b3ffc
- SHA1 147d009726ee142df77b3a75f4094cc16124b029
- SHA512 227a291368c3c7c7159dd18f7b76bccb5b570ef3e68bb69a61dddadf27035926daa9dfeba401c4234f209d352a5826d0a8c2c2e775b252636f110ec03791f32f
- SSDEEP 98304:XFoSlq0Rw2sadqTyYijSpYkrji69ROrjHp:XFocRwvDGjMVrjX90p
- TLSH
  T198E66C1666A902ECD1BFD17C9A4B5A03F771744943715BEB02F041AA2F6B7E09E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Grand Theft Auto 6 real/Windows/GTA 6.exe
- Size 161KB
- SHA256 fd8b9a5a2cea4260cb9c3d6746e1637237ac60575456b064a1d054d494b65f49
- MD5 fecc6d53f2fee814086cbb92724b5f1b
- SHA1 8b7d9a7267a89f1d7d30d637ecb0b58fdb086fd6
- SHA512 71a3bfd22a7e745ec30c5fbd9a9e2c99e8ab620b17be27394fb77e66a65f9fb79dcdc284e7e07aca6fc34f5f79e337228c49a5e7ba5da7b2544ae08a41ef4b6f
- SSDEEP 3072:bFIyuaR5V3hVd6719Qtb2676RP7gYrmddhdLIrOcd5P:b6zY5lfd6nQtC67xdhdL
- TLSH
  T1B2F37C07B3A130F9E177973489A04556EB73B97147609BAF07E4825A1F232D0DD3EBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral22
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/D3D12/x64/D3D12Core.dll
- Size 4.3MB
- SHA256 fb197903fea91aaf352d2322f342b1cec8db36ff0292a49f24173577e08f26cf
- MD5 1e0c8a7f2bb0e6c957a8d7d975a6d5df
- SHA1 7feeb113c49ad60c0dc2450e0b7985993244feaa
- SHA512 ca7d21a514eba37cdf95a56a2242473f51a42135ac3215f1a106de0f13f06864762cc41553b3167089ee4a1197e4b7caf9c1a7b666a882600ca7481ce02dac0c
- SSDEEP 49152:njdqq0UTKxFddI3OtRnSJpWO7UFZccaCVwEGDUIVvn+GtDotLmUXZEilSjpOJAai:nBXZ+vIefS+FDXzTf3TLPEj
- TLSH
  T16C267D07B7A940E8D4A7C179C967861BE7B27864537097CB1AE0835E1F63BE11A3F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/D3D12/x64/d3d12SDKLayers.dll
- Size 4.9MB
- SHA256 a817223446f53b3da894edb1ee7a92b94573690e689a9470b87bf42866115f91
- MD5 fdfc9fde5b3d456888581ec9836949cf
- SHA1 be29e1ce15cbc17c8f2288996ac7fadaa53b074b
- SHA512 676220b32c4571ad04186488ad700bf1e1453ee0c690f2cc54407ba3406dbcc57198750d4a0f8cfd0607b6151e183ea276fe37ef065105cea3c95f8b53351ecc
- SSDEEP 49152:SMOZT2LOibAvFGmcwBijneM1dNLF95J7kT0WPMw6rKxCe8MICMQLxKCHQkLJgBnY:z8xijX6T+rAlI7Zm8KmiZ
- TLSH
  T1C5367C1677F802F5C0BAD1B9CA938A07E7F2B86443B1938F05A5074A1F677B15A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/DML/x64/DirectML.dll
- Size 17.7MB
- SHA256 664255a3d9a6b976e2d0e2440403537d9d0dd91b1fad866768638b4e73a2c33a
- MD5 7bd75a7faf95b9db1da410d870416b8e
- SHA1 a02c27e586a98c929f7bcf4329167db8eef8e97b
- SHA512 232bd6ea20d081d9d65f751b89c7ad4366b75f9cba8f8658757e72ca06255d1d504e9c1333427a4bcfed11f8e72c843984a2651d793ae10f79853c4b8640aae3
- SSDEEP 196608:r6Kj5yxjROGq0Ytzn7OBdzIkRnyrQAH5+sM3TKO:9U2GMtz7oZIkByrQo5QTj
- TLSH
  T15717D01A6F6415A6C17BD23D9A530A43E3B6748A43706AE706F80D311F97BE05B3F386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/Something.exe
- Size 277.9MB
- SHA256 e187ed5946745fa6cec5c413a0a7c24e4d759cf7a64ee6e7f6725bb003ae4d49
- MD5 c69937eae6879ba9297e3de67c07d210
- SHA1 b1f5988ed0b714b841b09bbe3f038b542f482fb9
- SHA512 68e92ec8c1d22eb773597763daf5b96bcae42db3a5a95d1a279b1bf8976715ad47e35684d0a0d5f68877abd2153d10eac9ba77a7fecc0710eef663b08e06a74f
- SSDEEP 1572864:em6N13SMTy0Et9vtLMvW1zHcNn+3AWcjJIvkPbec3v1T:GNrUvdMyz8NnGcr
- TLSH
  T10BD89D4B72E500D8E1BBD13CDA6F5A16EAB23865073187DF05A006995F33FE4A53EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/tbb12.dll
- Size 323KB
- SHA256 645b681e3581c04d57f468bd85c17648172decf873653ab00382211b96cc98fb
- MD5 e7c3bf6f1824930a6956ebc13817b5aa
- SHA1 3fc66757e427fbc34a1f1f6945c843a6aa5ccc69
- SHA512 1aa84c5cf24f7067f4cc5c28c2fd909876c1e466ca89b94c713657e5736a471741a6e1018d3aeb4792257415afa83e0688c277cb642c88abba4e3ae3c25fefc1
- SSDEEP 3072:AIE7Jyz964oXz+D0xgiQLNSlsn+G2O4i5VAJYYHHzsd8+uvHnbkSMFCW0dl:AtJyzXoGlNR+G2O4BJBzsd8fvHnbpH
- TLSH
  T17D64170ABA980496D91A927CCA734A59E3F27C541391C3CF3260437EAF7BFD6663D214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  Grand Theft Auto 6 real/Windows/Something/Binaries/Win64/tbbmalloc.dll
- Size 114KB
- SHA256 f81a11f2e6e93036bab4e51a1daab9940fb8a9a5ec0f508c4cb76d398e27c100
- MD5 e7be685a46199e43edbd991eb6af436d
- SHA1 740818bcffdcae9c4468170e27850cfc76466f09
- SHA512 914237a154142e368cfaf978159200ff8640f8fe5a2aa393245464d1f2ef0ac3fff275c69b749aabf37705ffd882b683f1f5a7a340e8e22432a4e1385afbbcc6
- SSDEEP 3072:gLLJbu9Q0zdf2rjFrQcF2MtVuNodWJcd5:gLLJbYQ4df2rhrQk2DNodWM
- TLSH
  T1F8B33A4BB6AC084AD52F4378AA934959C3BAF491175087CF137843E92F67BE62E7D301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Network Share Discovery

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28