336ef4c8323af190e7925b4da1d7ef84119b0f7eb90aaf70fb4b49f21fb197d0

General

Target
igi2covertstrike.zip
Size 781.2MB
Sample260809-rkbpjaswct
SHA256 336ef4c8323af190e7925b4da1d7ef84119b0f7eb90aaf70fb4b49f21fb197d0
MD5 c11f4dd27b1c3c4927d1f743315d3678
SHA1 38bba27201abb4a5a702f0b134de7de05e0d913e
SHA512 3fa51c5bd453c9266e499b162e3ad77f1ec62332602304d6e378428e78dcd2910ee761b828e01c527074183549161706f539cc1e5492cf61e9dc9ffac5380f40
SSDEEP 25165824:X9YvMJg84jwNB64Dz3mcOaIxlAyw72oR+0O:X+0D4w3YaIxlAbKwO
TLSH
T16B8933A46772B0B42DF52B525CA074E9707F7AC14B2D83F7DC0349FE06C9CA9499622D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  igi2covertstrike.zip
- Size 781.2MB
- SHA256 336ef4c8323af190e7925b4da1d7ef84119b0f7eb90aaf70fb4b49f21fb197d0
- MD5 c11f4dd27b1c3c4927d1f743315d3678
- SHA1 38bba27201abb4a5a702f0b134de7de05e0d913e
- SHA512 3fa51c5bd453c9266e499b162e3ad77f1ec62332602304d6e378428e78dcd2910ee761b828e01c527074183549161706f539cc1e5492cf61e9dc9ffac5380f40
- SSDEEP 25165824:X9YvMJg84jwNB64Dz3mcOaIxlAyw72oR+0O:X+0D4w3YaIxlAbKwO
- TLSH
  T16B8933A46772B0B42DF52B525CA074E9707F7AC14B2D83F7DC0349FE06C9CA9499622D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  GOG Unlocked » Free GOG Games.url
- Size 50B
- SHA256 467b3db00b8db3a9a9406bb0ce46b7e83563a91c767458dc1f33a81577a5c01c
- MD5 82d61530bbf17b759e5435090ce3e02c
- SHA1 5736863a67ab9776708bf9d994972d1cba6fe95b
- SHA512 1b5bc09b968ec3568bfb999599ec7169d857b1c38b3ab53598ee6f4ad91048dee99ae04337c32096ff4ec37e7890ed246345d567aada1ca30797777c3d752f7c
- TLSH
  T1669002924119C055AA16084D84249565980220954952C8AC9541CA08184B1918595604
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  setup_igi_2_-_covert_strike_1.3_(18995).exe
- Size 781.7MB
- SHA256 eaaddbf258804bb8d0356126e06f06aac17754cf4bc7a7fae89c9d8c69a49392
- MD5 962c97e316f0f6d536126075549d2a82
- SHA1 83f55dcfd04807d69a0a6916d4140e3ae4daf347
- SHA512 418090163da501329be9a4c4f7e9c33a1b4fbc9c40533d07a60ecc21ff3604eb75ba18984d837672f8cd41c4248f188455d73f5e2a4942c79eb4dcfeabbbb74f
- SSDEEP 25165824:r7GVCs/nICGt1yuxbw9X3SdHHZUK6H8ovhEB:rq8wnIbzGnSdHHZUXchB
- TLSH
  T17189331341637D5CE8F5AFB1486461AAB8772FC6267442F3AC01BA4F0176C564FE82AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3