baa0660804200ea5c467d2379ffa77d18a08d29e448b4ec225c6179201c4a39d

General

Target
TibiaHeroes.exe
Size 15.0MB
Sample260809-x58snavajg
SHA256 baa0660804200ea5c467d2379ffa77d18a08d29e448b4ec225c6179201c4a39d
MD5 256d29c4f50b1ee51f2a30dc3f7ddc67
SHA1 bb26eb6013369e0ccdaa9fd6ae2f59c3ec957192
SHA512 df3a6ebf43fbd8d2b9a8e51425843b727d699eb862825b48660fff67c8c59adfbf4af844490f528683692f8f3952821595e34f0325a244a6db1125bda6cb5782
SSDEEP 96:B3fU3znhywhV8Nd6Nl1SZk+ToUk+LjqKm55fIFFR:Razkw4Dc42qY+LjqKmDcF
TLSH
T1DEF63229F77616DCDC6BA4355E6613237B20386057310AFBA68827DA5F90AE0BC39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TibiaHeroes.exe
- Size 15.0MB
- SHA256 baa0660804200ea5c467d2379ffa77d18a08d29e448b4ec225c6179201c4a39d
- MD5 256d29c4f50b1ee51f2a30dc3f7ddc67
- SHA1 bb26eb6013369e0ccdaa9fd6ae2f59c3ec957192
- SHA512 df3a6ebf43fbd8d2b9a8e51425843b727d699eb862825b48660fff67c8c59adfbf4af844490f528683692f8f3952821595e34f0325a244a6db1125bda6cb5782
- SSDEEP 96:B3fU3znhywhV8Nd6Nl1SZk+ToUk+LjqKm55fIFFR:Razkw4Dc42qY+LjqKmDcF
- TLSH
  T1DEF63229F77616DCDC6BA4355E6613237B20386057310AFBA68827DA5F90AE0BC39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2