a51d330b5bc67fd5d54fc8fa38c168c76b5065f3919e94397cb0129edf023387

General

Target
otclientv8.zip
Size 31.1MB
Sample260809-xlnclstgkc
SHA256 a51d330b5bc67fd5d54fc8fa38c168c76b5065f3919e94397cb0129edf023387
MD5 6beb242d2b4f8c2484c04b7cc8a27ad8
SHA1 0fa8140d9871cbdfa4db2d6fec770c82eb7a4c55
SHA512 45e70b1acbfabe842cdbf2505f90b8667897e04b582ec29ca80cc6e668617efa937b1c3beaa7576668380d755e1f3c498a295606fb29240491ecf4509bf36be2
SSDEEP 786432:n+9ySLIB546XVsmbdemgTyGzHrUMJo92e7wizJ7nRW:+gSU546+XTHQt92e7wClnRW
TLSH
T12D6733DC21142899FE20B634C6E1C655B371572E07C0AEDA767E3647BB79ED206C0BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TibiaHeroes.exe
- Size 15.0MB
- SHA256 baa0660804200ea5c467d2379ffa77d18a08d29e448b4ec225c6179201c4a39d
- MD5 256d29c4f50b1ee51f2a30dc3f7ddc67
- SHA1 bb26eb6013369e0ccdaa9fd6ae2f59c3ec957192
- SHA512 df3a6ebf43fbd8d2b9a8e51425843b727d699eb862825b48660fff67c8c59adfbf4af844490f528683692f8f3952821595e34f0325a244a6db1125bda6cb5782
- SSDEEP 96:B3fU3znhywhV8Nd6Nl1SZk+ToUk+LjqKm55fIFFR:Razkw4Dc42qY+LjqKmDcF
- TLSH
  T1DEF63229F77616DCDC6BA4355E6613237B20386057310AFBA68827DA5F90AE0BC39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2
- Target
  otclientv8.bat
- Size 2KB
- SHA256 0b0e2b4d7fae6ee854c8027098533bd5044afc3c360eb9f68c41a6a91ac3a340
- MD5 426845645f41d3fb5275006701e98122
- SHA1 ecf81cc8cdebfe0e93ec40362ac1cb471dbcc27c
- SHA512 f983778f5443b2e1868ae67be37974fa57f1233ddc94c451bea22e07f102eb0c4dc0eff2a6b302a7a17e213cb8cec171e81a461620294fe3fc0276af5b2ea073
- TLSH
  T1A251594E3E12AEAF3575CF494E954144FA00424B4E0E0A9AF09FC27C2B4B3823ABD4D9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral3 behavioral4