a51d330b5bc67fd5d54fc8fa38c168c76b5065f3919e94397cb0129edf023387

Sharing

General

Target
otclientv8.zip
Size 31.1MB
Sample260809-yvg3madj3s
SHA256 a51d330b5bc67fd5d54fc8fa38c168c76b5065f3919e94397cb0129edf023387
MD5 6beb242d2b4f8c2484c04b7cc8a27ad8
SHA1 0fa8140d9871cbdfa4db2d6fec770c82eb7a4c55
SHA512 45e70b1acbfabe842cdbf2505f90b8667897e04b582ec29ca80cc6e668617efa937b1c3beaa7576668380d755e1f3c498a295606fb29240491ecf4509bf36be2
SSDEEP 786432:n+9ySLIB546XVsmbdemgTyGzHrUMJo92e7wizJ7nRW:+gSU546+XTHQt92e7wClnRW
TLSH
T12D6733DC21142899FE20B634C6E1C655B371572E07C0AEDA767E3647BB79ED206C0BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LICENSE
- Size 1KB
- SHA256 39560542896f362c74a3a7fd5768434ef6bca98de09d352678cac2dbee4bde0a
- MD5 6308b53914c7667bd98b979d29a62cb5
- SHA1 44e2f39bef9c02202294c7d622752e677f7d2e4b
- SHA512 dd880f3093b0c1cb3e86cc681e7aeb93ff21034431e1735c0f94de2392a3f78384368626d41ad93914fb8d6c46c1a0c049a998932c15178d2acd6abf4095c0f8
- TLSH
  T18C21625E725007721C6713A5E669E8E8F33B714B7A5F2940246EF288732A06A93FF850
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  README.md
- Size 3KB
- SHA256 86adb37e8249502b1320a2c9d71bb529718442af12336f40acbb0ba971a6f12f
- MD5 80a9102da87802905609859164e5653e
- SHA1 67453f8dd0405fd4d11e6255d10b837f63b2efd9
- SHA512 5c4cb5e3b5934bc3d3b6bb5e7494af12ce2c9eb28b54a6a064a10b8122e9d24c41b2458d7ae54c3d283914e8d375aa9d18cc3fdb2b34c50ba50a7c448bc2e21b
- TLSH
  T1FA81626F132C21320663178FF252E6A4BB37A465660F5899809D518C3B1A53EA3FF239
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  TibiaHeroes.exe
- Size 15.0MB
- SHA256 baa0660804200ea5c467d2379ffa77d18a08d29e448b4ec225c6179201c4a39d
- MD5 256d29c4f50b1ee51f2a30dc3f7ddc67
- SHA1 bb26eb6013369e0ccdaa9fd6ae2f59c3ec957192
- SHA512 df3a6ebf43fbd8d2b9a8e51425843b727d699eb862825b48660fff67c8c59adfbf4af844490f528683692f8f3952821595e34f0325a244a6db1125bda6cb5782
- SSDEEP 96:B3fU3znhywhV8Nd6Nl1SZk+ToUk+LjqKm55fIFFR:Razkw4Dc42qY+LjqKmDcF
- TLSH
  T1DEF63229F77616DCDC6BA4355E6613237B20386057310AFBA68827DA5F90AE0BC39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral5 behavioral6
- Target
  d3dcompiler_47.dll
- Size 3.5MB
- SHA256 7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228
- MD5 6bc4ada9a7cab72f49c564e6c86b4c3e
- SHA1 f0fba01542a0fbe585106f7efd884df65e8c89dc
- SHA512 d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e
- SSDEEP 49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
- TLSH
  T1C0068D21FE018072E8CB01B265AE7F6A947C5730477451C351D4AEE6EC706E36F3ABA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  libEGL.dll
- Size 109KB
- SHA256 c5a1a7b95b94eab58340a131e47f0f05f820761d02da63e31b73f76fc696588f
- MD5 05570a5b5980a4e66a83ccb8cc7fac35
- SHA1 96cf2eb2dafa27d2cf0a0fa371fafc2f8f708096
- SHA512 03f852f32b9b9427a965ed2aa24d94d1752dedd92221d102f8a3d7379c3864f4c27bab29587fa8a9bb4cf51dd711761c4e9d1cc4eb8dc2021ec424c4465ad8c4
- SSDEEP 3072:K98L8xx+IsXdWQOsKs0pRSyPCFKyH0Gy2ue9mZ6lrJaXhSoL:KWL8xxUXY+KxDqFv0Mue9m1t
- TLSH
  T156B36B557290C432E8EE1D394878D6B28B3EBD70DEA0DDAB239445795E713C08E35F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  libGLESv2.dll
- Size 6.0MB
- SHA256 7a75735bbcb6df9ee2ab17a79e125bee28939e76eb1d3f7586201b63a90d1c86
- MD5 9b8dda72b13b49668f1ae0fb9d1d0c18
- SHA1 32b7eec130fb7f0bfa43cb8e535b9d81dd33e08e
- SHA512 fc53a44397037e4a0b7bd432c78277993dd6b7839577f8c26be9d7f245fb549961abf970fb6c68b9450d8a40f8f23c13f2edec8025707ea2eacea93295985cfa
- SSDEEP 98304:pe3Ol4ZJHj97biLrVIcLDjXDDSzAQp66IGRQr81cSd7QA:pepJHlbA1rDWp6gREcd
- TLSH
  T11F56AE12B1A04436DA5E43348A57BB15E3FCAAB425B2C753239C39197FF2AC26727353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  otclient_linux
- Size 15.1MB
- SHA256 e985437dca4eac80b60821e96d0dc5d8c98df87bdf22f12238ea2f395f2bd1a2
- MD5 61b8040cdd388835faf903cff713d075
- SHA1 7ecbc0d6f63da22f37b7e74bb5ecf2814531ff54
- SHA512 3d0b3571b048ed30f97ff15dbef6f9ba55c86148e6137d2c431faa91b07372eb8c2d430fa060df22c9643b1e213fdae2833d9bf9affaf294272031551358eb7c
- SSDEEP 196608:JtdNacRbSpwpnam/9UK2L1Sw5NsHbK9fwP36EqCEVzdU:JXNacRbSpwpnam/9Uxjcbef+36L/dU
- TLSH
  T10AF66E1BB65A68FDC4CDD570121FC6A7A731B854813037AEB588CA311ED2F689B3E790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  otclient_mac
- Size 21.5MB
- SHA256 4e6dec7108ebfe9461abef9418939dd12ec4d236da22c572da8fe4ce8e2d732d
- MD5 52f02a16d5156c750ee08ea1caa58a2b
- SHA1 257f11803da168de0051c69c03d910ed2cc89252
- SHA512 8354e918fde3a59cbb0754593d71788a2214e2ce337653940097f6e21b68ac5334ab555102f870c246fa4aa76fa6a68d21f83de2127922ffbb4992b6432a1139
- SSDEEP 196608:h8fkPq9ANdjhQ3bqE9WL62eJUhhBEyh1o:h8ffgjhCbqE9WL62eJUPq2o
- TLSH
  T14037292B350DF817C88F20F8181F8DABA2A09D415EBA74C9E4C7E1B16EE075D576E748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  otclientv8.apk
- Size 11.4MB
- SHA256 6d3e45e4af46f0dbb9c546f0f7619481c5eee3c6e3837dedcd24c8acc289e854
- MD5 f6d5a398a4876d33302c987144173136
- SHA1 b0a7acb4bdaaa7572f3e903789a801313f8cfd5e
- SHA512 6604e1e4897097f7bb9e3550b1ab2386ea04b0ab2cfa8ed937f0afcb066900ac93f2e6c7bdf1ed58814a23c7d8afc715b5fcc9043c7a3b41b0616613107cde63
- SSDEEP 196608:rWJ7DHxwL+oTOBYmSMWX5XNsndhsxzj0N1fwJaoaHNNefdvt+Fv4PMVl0AzJTO:u7DR89GOX5U4lj0NuQGlkFQPGyis
- TLSH
  T1C4C63398E8BEA873D46B767DF7BFF91284640A988804761F950C50CDDFD2E6247CA01B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  otclientv8.bat
- Size 2KB
- SHA256 0b0e2b4d7fae6ee854c8027098533bd5044afc3c360eb9f68c41a6a91ac3a340
- MD5 426845645f41d3fb5275006701e98122
- SHA1 ecf81cc8cdebfe0e93ec40362ac1cb471dbcc27c
- SHA512 f983778f5443b2e1868ae67be37974fa57f1233ddc94c451bea22e07f102eb0c4dc0eff2a6b302a7a17e213cb8cec171e81a461620294fe3fc0276af5b2ea073
- TLSH
  T1A251594E3E12AEAF3575CF494E954144FA00424B4E0E0A9AF09FC27C2B4B3823ABD4D9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

credential_access defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral15 behavioral16