62a80bd17dfa2d7f1e844a8209164dba68ce0cb3dba6eea8999d39dfb6b39edd

Sharing

Copy URL Twitter E-mail

General

Target
Outhold-SteamGG.NET.zip
Size 66.6MB
Sample260815-tlb3ssgf84
SHA256 62a80bd17dfa2d7f1e844a8209164dba68ce0cb3dba6eea8999d39dfb6b39edd
MD5 657c73b690d0a05fbce28adab2ff0090
SHA1 55dbe9f9affc949a04cd4f7d304392246a62ddbe
SHA512 e6cfb7f7279504a68889314c4476812a8559191576c393b6e2e75dca3e59e0b8c923024010f2e594d124f69aa77950ca2d4b6975a8b4489212f5e810280ab6c7
SSDEEP 1572864:WpV8NDfTzftH9PEzVlavrvEZOHKdMIIRnohSl1RgJpfUUVgbUh:IVQvtH9Pilaj5HUAnoh20sUuY
TLSH
T138E73340E4623070F0CB55F26D1C7A58F9D9B2B851DACE52FBC61B969984AF280EF4C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  Outhold-SteamGG.NET/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Outhold-SteamGG.NET/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  Outhold-SteamGG.NET/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  Outhold-SteamGG.NET/crashpad_handler.exe
- Size 2.4MB
- SHA256 07d34fe6836384d5ef5b9bf1958b0e6bc6fb05f3de8fbff08518375d2a93fd90
- MD5 66151257343179fa28c4d88d4e8d5f4f
- SHA1 ff6ff53b7dbf2e58618b27940e95229be4a4566d
- SHA512 d46b1b5d3063a1bebf269c02422cdef8ee4e87c5fa176c4663eeea7cab933f26c2d76d458f72e5f249e0cc3d5d72e6680d6dab91eddd6c23a9fe5c1cac66e460
- SSDEEP 49152:G4DmyrBvxmstVDTvwlH/eQk27uXva4BTQO/ixxK5qOjdECaY7Mm:5xvxmDuxM
- TLSH
  T135B58D2633A811D9E1B7C17DCB868F46E7B2740A43719BCF019542A91F27AED4E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Outhold-SteamGG.NET/outhold_windows.exe
- Size 92.2MB
- SHA256 f3eebcbbd5389922061ab23e071e3ee2dd11de046d11140368005d2d39910c45
- MD5 be862ad532c137602c5659c4cab3c1dc
- SHA1 2846e248f36133da91fe8d5478a43716ca80b6ea
- SHA512 d6031788f3c92a36f21e84c5ff107e0485d8301c219ea1ce78a3282e9ffe57efdf400f82fda123146701816fdd3bbb2dc623bf548ad512a2f6a88e06452c89b2
- SSDEEP 393216:3LJD5OEviPi/5VQV3+i2/Ky1xAq0i09swVb0ZH5upGXVm5hOM8ROc1MLFnzlrL9v:3ZLviPiI+z/BaiyjAVm5hOMUDAFX
- TLSH
  T1BC284B07F2A370ECC46BF1309F7BA672BA71B84911386D6B5692CB342F61E10576DE18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10