7ab88942e8d6713fea2ec700524c74b8f4c67c42000f765ae7efdc86704c4ead

Sharing

Copy URL Twitter E-mail

General

Target
GTA-VI-Launcher-Portable-0.0.0.exe
Size 96.4MB
Sample260814-lebvfszfpf
SHA256 7ab88942e8d6713fea2ec700524c74b8f4c67c42000f765ae7efdc86704c4ead
MD5 cd5565decdabcf8cd70e4740040d1d34
SHA1 f8963660857f0773d2417d08ecb2bf980d522a34
SHA512 058d09f9ebf2e21117a2c0edde484b39041dbdb64119dca6129a3ac22a3ade7c273be6c25eecfa545d43deff727da943add68b3e84e032188c5a1dda4dede4e1
SSDEEP 3145728:vLIwYija7OMrUc8zBlCVis9uKRiahHXvW1r2+RenlPut0Cb+Q7:TIwVjaPY7Fli7kKRiwXQ2+R026Cb+0
TLSH
T17E28338300EB1BA6D355FA73D13FFA18C2CA875552AE54B78470AB76B61C822BFD40C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GTA-VI-Launcher-Portable-0.0.0.exe
- Size 96.4MB
- SHA256 7ab88942e8d6713fea2ec700524c74b8f4c67c42000f765ae7efdc86704c4ead
- MD5 cd5565decdabcf8cd70e4740040d1d34
- SHA1 f8963660857f0773d2417d08ecb2bf980d522a34
- SHA512 058d09f9ebf2e21117a2c0edde484b39041dbdb64119dca6129a3ac22a3ade7c273be6c25eecfa545d43deff727da943add68b3e84e032188c5a1dda4dede4e1
- SSDEEP 3145728:vLIwYija7OMrUc8zBlCVis9uKRiahHXvW1r2+RenlPut0Cb+Q7:TIwVjaPY7Fli7kKRiwXQ2+R026Cb+0
- TLSH
  T17E28338300EB1BA6D355FA73D13FFA18C2CA875552AE54B78470AB76B61C822BFD40C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  GTA VI Launcher.exe
- Size 215.3MB
- SHA256 bea0af2eb434048240d66ff851736f81d9c490d4f8dc7ef21625625d4b20608a
- MD5 56e174408ef9f7a76f8e54d82cd4c076
- SHA1 30a2965e5ef18e85aac1b902a4af07724bb8245f
- SHA512 4f208e6ab5d91b1fa77732163891454fdaa2e2a42177ab161be8c3a108ef78e4e0b3f24e9ec2ea6ca0d22c9c6337a7b10410cd5ffb56728e3d23990c24b7b364
- SSDEEP 1572864:ZbpjJekfutJ9SxucNqyRimAR3uG8lV4BOhr1PjxE9q4RdOhenveNabziKVTTqI3z:Hkk2t+IcK4ZmV3x7x
- TLSH
  T15BB88D03F29A41D9C05DC1B98B5A9633FE71B8054B25A3DF2B5847922F66EF82B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral4
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 36c6f0af0cd7ff8585cea0a6090f1c2ce5db044d16b366074b2e9f85ef2e2629
- MD5 c44c3c69c4353949711acc151c43ccde
- SHA1 e838b8b9b555a71a91bb74338aeff331fd71ea8a
- SHA512 82bfb704772fd7193c7b766a021b4a74039c85999e6a73ea783a43dc2acc47418b9bead2a5c616face4afab17d95b3d750a2c21ac99a9fcf8b96bf15f8d32418
- SSDEEP 393216:K2Kz8w0D063Lp8Fj6XHMy+A4joAPKxVbQ6nKOwx0u:g63ZMOAsbQAwxr
- TLSH
  T140473A122646D49DC099C879C7678B268A2C30E73FA7B9EFC0F451212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 e3b958ec29f381d9872f1f19e5c29661693f6aeaf382f969f97d5c6a9da53cca
- MD5 041989f8e67ad4ea5e9c0c3f58d23b0d
- SHA1 dddee0ebe876857c56afef42b8d169f5f0aca8a3
- SHA512 02c687b609639688f482ab922857aaf83a8f9a2c039122f19f30573e30dc8e6711609a7fae2e5835ed56da147e558966f9b94d167a945ba64a039f52933ca0ab
- SSDEEP 49152:0/QNVdw4YesUuZLJPbdzKKtBr4ZjB+WRBxtqYaLueWUekYi:0EibUuZd2BDaLueWe
- TLSH
  T14AE5AE02F6D251EDD019C034979FA223F271780A4F206AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libEGL.dll
- Size 463KB
- SHA256 700bde9f10d03c37bec6fef9471f5016650c2b8a3c7229060e996c232fa19bdc
- MD5 ef7ec96ef22bfabb866ba6e3a517c4f6
- SHA1 9e8666868e892bef1e80acabe7209975715b8022
- SHA512 e9e452f6805e026cc71b5adc638291c4c20ee4315428e46e81232303e958f008dc14d537ee52d0844aaef9771ec94f3ff6162f304e2249b2b2ec7d9319f60a5a
- SSDEEP 12288:hr6jqPQTSyEiM/bacC7g3pOvMVr5HsMQF:hr6uPU/P0Ow1a
- TLSH
  T1E0A47C15B3E549B9E07BD1388A538643EB71B4560B61FADF03A0D2392F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 1811383343e2c4efd7f5275787188ae12ab9d059067032bc57d511fd25e03d70
- MD5 c34f3b42af269c84d2a978c9eadb6fc3
- SHA1 1b5af23d0994889cdd28bdbf925106c7535b94bf
- SHA512 98ef576f93c15fa0184e97627f2a7796dd52ab1a609ecf257e077aef1b51262bab00f51f3586c10769efeebc68c75c3217ea6b7d2aabc9f8e2c1fcfe44acd68c
- SSDEEP 49152:NubBr5jcjehig/1s5lA8QORsZrfrkTq2Cus78Ogr7JjcTR0BjfuvHzoN12yN9UNa:4DjHAlAnM5B6v0N4lXgHCCGZXO
- TLSH
  T16B866C03F69681D9C05DD2788767A223FA34B4450724F6CF2AA497152F6AFF0AB3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/app.asar
- Size 8.8MB
- SHA256 ef5a3b4d1457b0b7f53e7620c1ca50a825f89b5288aaee03c13ddf7966e13a21
- MD5 091ba69c565c1bbf741e149a4b94dcc4
- SHA1 fac5ad34ea9b86323da023c01b75d7565b1ec94f
- SHA512 b0977b4069a1bcb0ce960abfa10039f42c3e3111c5921b0d514e13215e692d6edf7b350f988ba1c3b3cf29c69cb21e88500d827981c4f7fd75b04bf644d1fc6f
- SSDEEP 49152:zSSar4iwSqhRmRX7KS3dpcdkSYP4nj/3CnVypIq11mRX7W19dmcdO+v4IO/4z+lZ:7JzSHDD+iXzt3
- TLSH
  T1B896E9A5A8A31422D913527E5F6F51427E7880131D0CF864798CC2A85F9DB2D62FFFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 292eb353e8a0bf89806f951483bb6df890a638d6f17dd692baae96ca80fe5719
- MD5 af943eb9c9162c3b7ec6d737baa090c3
- SHA1 4c20198282cd5963b3f0ddc8048826fed76818e6
- SHA512 2f6e4f3628c6142599659f907ef2a7de2f0050bda8520c3045d7358cb559b2967c1e8ccf8094344572dc5e4cfc7049ebf5f7a15c3ad6c0329a8ca7398b7fb279
- SSDEEP 49152:7lNxNXcrPXnxidJ+34ZfQ1fzEhZJm/PekA5uOpI8/KGVKA+FpOGehAuMEDuxEPe/:7nXcrAifrg4FO7Hb1Jr78d
- TLSH
  T1AB463803F28681D9C06DE6798B5FA623F631F8844B2276DF56A00F192E66FE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  vulkan-1.dll
- Size 908KB
- SHA256 3f482a27a955eef4921bfb796a043dd338363eea285efae34d299aef0fee6afe
- MD5 01d56a4e9394b8c00f4422fae4bb4578
- SHA1 2417a0bd5f8b98e83440c339832edd991e49d133
- SHA512 5de7c6770d4f3babee8ff27ba7e0c8544baafe01c54798d7d860f5bb814c9c9d489e2590f096c2a92d03ec4bb4126a8abf3e6cc04fc006a3ef31171ad6d81acc
- SSDEEP 24576:ilg7pfgm3WP0ZaB4dS3b7Sr6Z5WzcADYsHkDn6g3P0zAk76oOHQfWB:im1ommP0UL7Sr6Z5WzcADYsHkDn6g3P4
- TLSH
  T1A2156D12DA64CA79D67A8074D8D14A0389F074821723BACF17B817147F6AFF42B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16