10baf521d06c8ff5d79e13d859fb281a4a0836d9ad476e33a13a17de989cc576

Sharing

Copy URL Twitter E-mail

General

Target
Install.RIVALSFPS.GG.exe
Size 14.4MB
Sample260810-a4je2sdc43
SHA256 10baf521d06c8ff5d79e13d859fb281a4a0836d9ad476e33a13a17de989cc576
MD5 13a4f29b2723e1c8ca224be70c8843da
SHA1 a4ad059b5a39b748de5917b215b53a304aa32505
SHA512 6a319b74cb365eff35d598447b9afea8ed3dd33e92f14601cdcd3f1488dd001da23e0cf0deac53448a5d7c39768b0967995507939a84d7f633c781d4a7199b57
SSDEEP 393216:JngTxj32rPLE3lAd3hWl/l7HGtj1R55IgUZekjw/qAFrEXlFI:Jqh2LJ4Nl7QL559UZeIwPEVFI
TLSH
T1C5E6336C5338B69DE9ABE0750366B753B86D4E0F28DB0F92DE244E56BA34C923015F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Install.RIVALSFPS.GG.exe
- Size 14.4MB
- SHA256 10baf521d06c8ff5d79e13d859fb281a4a0836d9ad476e33a13a17de989cc576
- MD5 13a4f29b2723e1c8ca224be70c8843da
- SHA1 a4ad059b5a39b748de5917b215b53a304aa32505
- SHA512 6a319b74cb365eff35d598447b9afea8ed3dd33e92f14601cdcd3f1488dd001da23e0cf0deac53448a5d7c39768b0967995507939a84d7f633c781d4a7199b57
- SSDEEP 393216:JngTxj32rPLE3lAd3hWl/l7HGtj1R55IgUZekjw/qAFrEXlFI:Jqh2LJ4Nl7QL559UZeIwPEVFI
- TLSH
  T1C5E6336C5338B69DE9ABE0750366B753B86D4E0F28DB0F92DE244E56BA34C923015F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  resources/THIRD_PARTY_NOTICES.md
- Size 303KB
- SHA256 e5e93c479090e9640946b559c31e806b523235d77ea2cc3f9ef340e5b454bee4
- MD5 da8d292a2b162eeaf65c9ef139ac3197
- SHA1 c2d74d93c360599a9eadaca131bd512792412304
- SHA512 e8272bcb5ec6b942c199739ebc6b7307763b83421bb0259a9452d17e533c7285815d221ae63e4abb895be7468b0ee42864fd81f2548cecd03cf56ed7221181bf
- SSDEEP 6144:roCNZM0IRon3315n84JIdFCB0Mon0Go40GouuC:8CNZM0IRon331x2zSPon3o43ouuC
- TLSH
  T14364D82E7765077714D642615A6BA8CAF31FB12F7A9B2784309CF214273F86882FF458
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/rivalsfps-builder/Marvel.usmap
- Size 767KB
- SHA256 d3ee6bd3aff6188196379d2b39114c053ac0e6ec6a990acb4e07579626386f4c
- MD5 87f433f5c977ed32dec295b852ad4673
- SHA1 f2d7eb0f6dc56e74c5adeedbf70ebf23b0ac2582
- SHA512 343cb0f4819af516431c5b65b76e52cf0a4ebf4deabd4d1c0839bcd5cb140b7a5bfe9e0a5e330b8f0d00b2b03ab056d473ed3ee035297cec628cd4cb0f928033
- SSDEEP 12288:RTRhul/VtRQbNy+x9bKXyFnXfqjMl/9apVYc1DzQGMiymxW/bzHqRiot3Mwbez/y:R2tmTjQovhlVapVYuDcGMi8bzAiotcwn
- TLSH
  T1FBF423A61193AE3A8F272C8C1087D53EDE0FAA8211D44627DEE1D3D31C76EFC5569D12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/rivalsfps-builder/_base_full_cache.json
- Size 451KB
- SHA256 898c95ea258f00da963e317dc0f331eb29643661275cc3d28e4666412835ef0e
- MD5 bc0bd9ccd851c57a6dc4bb94113eaa3d
- SHA1 c9133fb7abb9afa7568b38163efb3a90a1467ec4
- SHA512 ecf026b624b759ef13ea1a92e7f93a805c2dec50ebed4f386a7bde205e72b690f0e45b79fc864954e3cec4b2286cca1d7e25218ac1d72e45ecb2fc24abc9af09
- SSDEEP 12288:/woXczpvTg4NAr4w+T3OdIYVMj+PK8/oc5:/jWTg8Ar4wNdJm+Pzgc5
- TLSH
  T1CEA4239CB465D7A448ABF25E3A29EF440308C92327E8567EEE0BF16BF498631D4D50CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/rivalsfps-builder/_broad_foliage.pkl
- Size 5KB
- SHA256 6d614854ea2c3d864f7f70fd8c0ee03df19b8d140db1253f80af7433719054e7
- MD5 3f0e6f8750ec2c52773cc62ca3a80535
- SHA1 a7eb50a35fb2cff5f80ffb5afbb8d93f65e02694
- SHA512 7cc0577aac894a56bec939cac798b51594a53f7c3af128ab3822887faba7e570f8c6a4e991596fb31b6fab7587ac4933501729837c5ce1910294c1ba1f082fe9
- SSDEEP 96:SXGqC5YVzh6G2nMeaPQpelOe3tlPL7+wx0+EpqeYePNoemTX3Ghl3rKnCO64oLZV:SXGq9yMepQlOa3tx0+OdY33GhRKR/ob
- TLSH
  T125B17DF07796EE0A82B8656C1AF44602932501E626853C517FF4BA235C0E5EC8441BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/rivalsfps-builder/_foliage_full.json
- Size 171KB
- SHA256 d0ab2b438dedb58146a3b3c25911c9242e34e26ca096eda144206c1cdbe1dd98
- MD5 489bc050d360beb38e18d5f030e4caa5
- SHA1 c69ddc1f62f5bb65aa00fda4f451804988457b8d
- SHA512 3a2ab73a87dcc8fc1acd0850cdf34fc2196a1b3d7b9b6e7519178470e4a388012072e4033b4a5f870e5902fe655c3bd9459283f8225344207cb3ac343d9c0ad6
- SSDEEP 3072:rM7mzNiixNKQ0sGupSXFIuu4wd6kDuV2Btk93ZZKbUTlo9nGoOz/Zg05qYK0f+8I:MXXihjOz/Zg05Pu
- TLSH
  T1A804AE3491B77423C584BD203639BEB56602B4EB9BCCF54B92C85A07235FA31D54BCBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/rivalsfps-builder/_gameplay_deps.json
- Size 255KB
- SHA256 877331c1242cb7376087d7ff7113def879c43d7ca03744dd12374b87b4c8465c
- MD5 6bfa1749eb6c7823765581765b56b216
- SHA1 56b5ac8492d29c30b1a741368a70ae4994060c56
- SHA512 97356453ed0365d5faa995775f57f2a6c4e024d61a979fe28ba1c7c72f500dc77208c011fd1255d55e0f21e5a29aa8ef95257b5586a2a773c10b63e9f7b1247b
- SSDEEP 1536:6Fz/43MnM+rF6Td4TOj94x4Sl5cDfgUqSiw9wyh8nCYbP7DparG0u6gAUTr+G:EnM44yl5cDYM+HCgP7DQqtmG
- TLSH
  T18A44CB2E51F611536F91770E81DD1F63932847ADBDE36CC2E79930EAA2C0F251ACB426
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/rivalsfps-builder/_green_masked_foliage.json
- Size 40KB
- SHA256 b1ce5e06f2ba52def608c577d92634526ac8497ff1c29ca64dd47842a1fab2c1
- MD5 35f6a4b2a2cab9382efeb60ddb1f538f
- SHA1 40e6b5f946adeec8718f4fdac90572f771f6f473
- SHA512 93458bab4ffb44bf64a6c5a12406f550a76665a851ab670da904e33c49f4303df655a3e50fc74a7f22ffbd03fbb75311484130a6046137b4cf85a87df20f5e89
- SSDEEP 768:EbG8YDLgx/wU/b1WTHmqoHZGc9Kz9Dzb855UCHUlvZUAr:E9YfgxXMTTKc/JD/BC0lvZT
- TLSH
  T13703963465D85873D792CE586A5DBFA45B223207BECE3D4C42C5AF2318BFA37435A809
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/rivalsfps-builder/_lowres_cache_ui64.pkl
- Size 3.4MB
- SHA256 319051aefc0fba99efb8f7ad7f51b80300962bbb94b47ce7fd235065283a8656
- MD5 6648e5014270931d82365555ba3579a6
- SHA1 e6b34582e0a39e87eefb48393d0eced8f8cdce3e
- SHA512 f0bd6029c05da6470e2ecdd0b6ed1ba0d55ba3b629f780f07ac938863c6edefbb21e3cea5dbd473821dfd707dfcf49417cefa108f0d55863a859dd84796fbc70
- SSDEEP 49152:ImlHM3EXX6Zuc/0XI6n6ydBqTrazBizRn3sLCkuVVzivkpnltVV2gvsLXGgLoi4u:PacWV66ydSdzqLluV1ial/jsC6o9C
- TLSH
  T18AF53371023DA4EFE255DAB06D6CBA128727CC40B5DF45509CD8DFE02B29AB32981FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/rivalsfps-builder/_missing_foliage.json
- Size 58KB
- SHA256 7df1a02a73e7ed29404fd29af9c8dad21b2f10ba9dc61d7bb898fe5cb986f6d6
- MD5 72d597d47c5cbe2e6a2e9c6cbbd0415e
- SHA1 62d07c22b0ddfcf15f89c9b3819824e8ac4c3028
- SHA512 5ea0cb6998989c0f59db71019519218e58adba1c2727eab6ebff7b76b4fdcc02535e8c0cea27dddbe2f8cd259490af6a610c04d8a485cc2e7d1e201f8160b702
- SSDEEP 1536:rM7mzAF06jctk9I8vLg/ERXVNcKbUTlo93Gy:rM7mzAF3wtk9TZwKbUTlo93Gy
- TLSH
  T136434C3490A77023C585BC20363ABD706202B4BF9BDDF64AD1D85616236F671E687CBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/rivalsfps-builder/_noshadows_chunks.pkl
- Size 2.7MB
- SHA256 1cc1e4599f9de5051ead09be7f7784bf7f881170ef2debbe26a8f5d637c6867a
- MD5 d5ac3f7f04c71f12a0e109a352578d7e
- SHA1 56586787a349b3d8fd0d2c4a717b92cb9c61c609
- SHA512 60c1b0ea716389d6cd196815654827568b4d15ae8e84e34e3532d9de3cae94b938b0f56c36d25a524a8dd8ac712eed566a73dcef2862cbff6deac947788de061
- SSDEEP 49152:zdoumEIdZPCQFzKOeYlq6VWMqNGp7XxmELHXuRx9kp8Z/URbnfzDwPxv1zd4d:hoXdZPC0kYlRnXlGxKq/UhAzdK
- TLSH
  T1C6D53314D3B59CDE5F6AA9BC509E44E4A88EC6F621E3011A3FF069C2C275390981FE5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32