630faf2300c38995dbf49c09e6087a4318bcb4e4e9af45ae00458d3f38ec87c7

Sharing

Copy URL Twitter E-mail

General

Target
Install.RIVALSFPS.GG.exe
Size 14.9MB
Sample260815-z96j7stfma
SHA256 630faf2300c38995dbf49c09e6087a4318bcb4e4e9af45ae00458d3f38ec87c7
MD5 7a8ae90ab93f5944dd8b3093b1982fba
SHA1 5985bf412571098adfacf82ec3200f7a62cf325c
SHA512 a7dedf6fd61ad076ef90c1678bf12df10c12d802f431ab0050c1efaa59799d4aab8907f6dd0934ef8829f8b2bccca708f127a1340192df8205d052a799f9cc06
SSDEEP 393216:JUiYzVZ+ctcjCovfT/SGgD/NzysKcWscdhAAt:JUiYzVZtovfLSGO/Nzyxzdz
TLSH
T129F633101F5B5F5BEDF90DF0053322255A8A2B110A708A5FB1119ABD5B7C78BAFF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Install.RIVALSFPS.GG.exe
- Size 14.9MB
- SHA256 630faf2300c38995dbf49c09e6087a4318bcb4e4e9af45ae00458d3f38ec87c7
- MD5 7a8ae90ab93f5944dd8b3093b1982fba
- SHA1 5985bf412571098adfacf82ec3200f7a62cf325c
- SHA512 a7dedf6fd61ad076ef90c1678bf12df10c12d802f431ab0050c1efaa59799d4aab8907f6dd0934ef8829f8b2bccca708f127a1340192df8205d052a799f9cc06
- SSDEEP 393216:JUiYzVZ+ctcjCovfT/SGgD/NzysKcWscdhAAt:JUiYzVZtovfLSGO/Nzyxzdz
- TLSH
  T129F633101F5B5F5BEDF90DF0053322255A8A2B110A708A5FB1119ABD5B7C78BAFF2682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  resources/THIRD_PARTY_NOTICES.md
- Size 310KB
- SHA256 d3a9db2b382223db087058c7e0e14e3928a6b38bdecc60894a3b20820a6d6e36
- MD5 2e0ff716d3aa7db2a3e1d00651bac0cf
- SHA1 3c434d1e9b6f43f7a7310dee21332350fc348dcc
- SHA512 328acdbf6e8fea6e3c1722a7580fad54d1cf986e56e0f1aadd538db1511eeb7b1c4359416cedaa38492c2e168b19043cd29d12578e42e73c180e45d959eb91ff
- SSDEEP 6144:LoCNZM0IRon33h5n84JIdFfb0Mon0Gok0GouuC:cCNZM0IRon33hx2zjPon3ok3ouuC
- TLSH
  T1E164D82E7765077718D642615A6BA8CAF31FB12F7A9B2784309CF214273F46882FF458
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  resources/rivalsfps-builder/Marvel.usmap
- Size 767KB
- SHA256 d3ee6bd3aff6188196379d2b39114c053ac0e6ec6a990acb4e07579626386f4c
- MD5 87f433f5c977ed32dec295b852ad4673
- SHA1 f2d7eb0f6dc56e74c5adeedbf70ebf23b0ac2582
- SHA512 343cb0f4819af516431c5b65b76e52cf0a4ebf4deabd4d1c0839bcd5cb140b7a5bfe9e0a5e330b8f0d00b2b03ab056d473ed3ee035297cec628cd4cb0f928033
- SSDEEP 12288:RTRhul/VtRQbNy+x9bKXyFnXfqjMl/9apVYc1DzQGMiymxW/bzHqRiot3Mwbez/y:R2tmTjQovhlVapVYuDcGMi8bzAiotcwn
- TLSH
  T1FBF423A61193AE3A8F272C8C1087D53EDE0FAA8211D44627DEE1D3D31C76EFC5569D12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/rivalsfps-builder/_base_full_cache.json
- Size 451KB
- SHA256 898c95ea258f00da963e317dc0f331eb29643661275cc3d28e4666412835ef0e
- MD5 bc0bd9ccd851c57a6dc4bb94113eaa3d
- SHA1 c9133fb7abb9afa7568b38163efb3a90a1467ec4
- SHA512 ecf026b624b759ef13ea1a92e7f93a805c2dec50ebed4f386a7bde205e72b690f0e45b79fc864954e3cec4b2286cca1d7e25218ac1d72e45ecb2fc24abc9af09
- SSDEEP 12288:/woXczpvTg4NAr4w+T3OdIYVMj+PK8/oc5:/jWTg8Ar4wNdJm+Pzgc5
- TLSH
  T1CEA4239CB465D7A448ABF25E3A29EF440308C92327E8567EEE0BF16BF498631D4D50CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/rivalsfps-builder/_broad_foliage.pkl
- Size 5KB
- SHA256 6d614854ea2c3d864f7f70fd8c0ee03df19b8d140db1253f80af7433719054e7
- MD5 3f0e6f8750ec2c52773cc62ca3a80535
- SHA1 a7eb50a35fb2cff5f80ffb5afbb8d93f65e02694
- SHA512 7cc0577aac894a56bec939cac798b51594a53f7c3af128ab3822887faba7e570f8c6a4e991596fb31b6fab7587ac4933501729837c5ce1910294c1ba1f082fe9
- SSDEEP 96:SXGqC5YVzh6G2nMeaPQpelOe3tlPL7+wx0+EpqeYePNoemTX3Ghl3rKnCO64oLZV:SXGq9yMepQlOa3tx0+OdY33GhRKR/ob
- TLSH
  T125B17DF07796EE0A82B8656C1AF44602932501E626853C517FF4BA235C0E5EC8441BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/rivalsfps-builder/_foliage_full.json
- Size 171KB
- SHA256 d0ab2b438dedb58146a3b3c25911c9242e34e26ca096eda144206c1cdbe1dd98
- MD5 489bc050d360beb38e18d5f030e4caa5
- SHA1 c69ddc1f62f5bb65aa00fda4f451804988457b8d
- SHA512 3a2ab73a87dcc8fc1acd0850cdf34fc2196a1b3d7b9b6e7519178470e4a388012072e4033b4a5f870e5902fe655c3bd9459283f8225344207cb3ac343d9c0ad6
- SSDEEP 3072:rM7mzNiixNKQ0sGupSXFIuu4wd6kDuV2Btk93ZZKbUTlo9nGoOz/Zg05qYK0f+8I:MXXihjOz/Zg05Pu
- TLSH
  T1A804AE3491B77423C584BD203639BEB56602B4EB9BCCF54B92C85A07235FA31D54BCBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  resources/rivalsfps-builder/_gameplay_deps.json
- Size 255KB
- SHA256 877331c1242cb7376087d7ff7113def879c43d7ca03744dd12374b87b4c8465c
- MD5 6bfa1749eb6c7823765581765b56b216
- SHA1 56b5ac8492d29c30b1a741368a70ae4994060c56
- SHA512 97356453ed0365d5faa995775f57f2a6c4e024d61a979fe28ba1c7c72f500dc77208c011fd1255d55e0f21e5a29aa8ef95257b5586a2a773c10b63e9f7b1247b
- SSDEEP 1536:6Fz/43MnM+rF6Td4TOj94x4Sl5cDfgUqSiw9wyh8nCYbP7DparG0u6gAUTr+G:EnM44yl5cDYM+HCgP7DQqtmG
- TLSH
  T18A44CB2E51F611536F91770E81DD1F63932847ADBDE36CC2E79930EAA2C0F251ACB426
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  resources/rivalsfps-builder/_green_masked_foliage.json
- Size 40KB
- SHA256 b1ce5e06f2ba52def608c577d92634526ac8497ff1c29ca64dd47842a1fab2c1
- MD5 35f6a4b2a2cab9382efeb60ddb1f538f
- SHA1 40e6b5f946adeec8718f4fdac90572f771f6f473
- SHA512 93458bab4ffb44bf64a6c5a12406f550a76665a851ab670da904e33c49f4303df655a3e50fc74a7f22ffbd03fbb75311484130a6046137b4cf85a87df20f5e89
- SSDEEP 768:EbG8YDLgx/wU/b1WTHmqoHZGc9Kz9Dzb855UCHUlvZUAr:E9YfgxXMTTKc/JD/BC0lvZT
- TLSH
  T13703963465D85873D792CE586A5DBFA45B223207BECE3D4C42C5AF2318BFA37435A809
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/rivalsfps-builder/_lowres_cache_ui64.pkl
- Size 3.4MB
- SHA256 319051aefc0fba99efb8f7ad7f51b80300962bbb94b47ce7fd235065283a8656
- MD5 6648e5014270931d82365555ba3579a6
- SHA1 e6b34582e0a39e87eefb48393d0eced8f8cdce3e
- SHA512 f0bd6029c05da6470e2ecdd0b6ed1ba0d55ba3b629f780f07ac938863c6edefbb21e3cea5dbd473821dfd707dfcf49417cefa108f0d55863a859dd84796fbc70
- SSDEEP 49152:ImlHM3EXX6Zuc/0XI6n6ydBqTrazBizRn3sLCkuVVzivkpnltVV2gvsLXGgLoi4u:PacWV66ydSdzqLluV1ial/jsC6o9C
- TLSH
  T18AF53371023DA4EFE255DAB06D6CBA128727CC40B5DF45509CD8DFE02B29AB32981FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/rivalsfps-builder/_missing_foliage.json
- Size 58KB
- SHA256 7df1a02a73e7ed29404fd29af9c8dad21b2f10ba9dc61d7bb898fe5cb986f6d6
- MD5 72d597d47c5cbe2e6a2e9c6cbbd0415e
- SHA1 62d07c22b0ddfcf15f89c9b3819824e8ac4c3028
- SHA512 5ea0cb6998989c0f59db71019519218e58adba1c2727eab6ebff7b76b4fdcc02535e8c0cea27dddbe2f8cd259490af6a610c04d8a485cc2e7d1e201f8160b702
- SSDEEP 1536:rM7mzAF06jctk9I8vLg/ERXVNcKbUTlo93Gy:rM7mzAF3wtk9TZwKbUTlo93Gy
- TLSH
  T136434C3490A77023C585BC20363ABD706202B4BF9BDDF64AD1D85616236F671E687CBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/rivalsfps-builder/_noshadows_chunks.pkl
- Size 2.7MB
- SHA256 1cc1e4599f9de5051ead09be7f7784bf7f881170ef2debbe26a8f5d637c6867a
- MD5 d5ac3f7f04c71f12a0e109a352578d7e
- SHA1 56586787a349b3d8fd0d2c4a717b92cb9c61c609
- SHA512 60c1b0ea716389d6cd196815654827568b4d15ae8e84e34e3532d9de3cae94b938b0f56c36d25a524a8dd8ac712eed566a73dcef2862cbff6deac947788de061
- SSDEEP 49152:zdoumEIdZPCQFzKOeYlq6VWMqNGp7XxmELHXuRx9kp8Z/URbnfzDwPxv1zd4d:hoXdZPC0kYlRnXlGxKq/UhAzdK
- TLSH
  T1C6D53314D3B59CDE5F6AA9BC509E44E4A88EC6F621E3011A3FF069C2C275390981FE5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/rivalsfps-builder/_tint_scan.pkl
- Size 25KB
- SHA256 03a8f7f8fb9562da1a8b7eb267c8407ae211df99336cf3f50acae56e39615453
- MD5 e3619dcd02bf392a2fcc82b3596bff67
- SHA1 c3b353927ddb6f4dcc751af2c56d368a36e714e3
- SHA512 641a1856b07d8447ef869caed2318f01e0a9fc7846f35718cf80879c861aad6797814b20576a9e214537083477da4c5f07cfbc592df4f2bd6d0989e83bb67504
- SSDEEP 768:cdiUYYVjYEsIObxg8aqfH0lx6ipjEbJG686:jYd12fUlgsjYa6
- TLSH
  T1AEC2E1A015FAFF2350D83A3F8EF501782582ADE65658DB6CA30BCE6475468813D97DC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/rivalsfps-builder/oo2core_9_win64.dll
- Size 623KB
- SHA256 6f5d41a7892ea6b2db420f2458dad2f84a63901c9a93ce9497337b16c195f457
- MD5 cc81123b3396b838037113d230d31efe
- SHA1 b5120a64e2756eb99978a9ddc4fb36939a3d4cfe
- SHA512 8aad08bed85e0837a5593ccf1ae3bb2d9f25364c7cdf8c290e2ac3c33c019e7585f497f63c02ced97ea9aaaee850d7d3e454271ab5211f4a7506aa0c7f87437c
- SSDEEP 12288:cdAwMfEGT/SOqa61m1qdjOsLI4iVcwIBBih5m5JQgzFf/3FL5icE//rekCy:cdAwMfEGT/SBdkUBBihM5JQgzd346kCy
- TLSH
  T17FD47C92A2D151ECE2A78139CBABA253F3B13859032459F352B8DE752F4BED0633D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/rivalsfps-builder/recipes.json
- Size 10KB
- SHA256 9c59152e3659a7c262b912f777ed72dbf1dbea2c05cba7f41d28c9cb9ec51736
- MD5 2de57ae9226b1409325e04a8cf0ed3e0
- SHA1 7027950d43d4c4ccc622c2897045a1a048be0064
- SHA512 5eb3a45aaed7f037ba11de6f9a69713e6b9ecb610fe158a9fb7e67ea73f7084e2a3b6d132024a933053d437f23ddf5132c59c4be006942551fb772845786cec2
- SSDEEP 192:pWbb7yy98U0xf9afCQIkJfqXB0JepkhcKkiV:p8bg9aftqIepChV
- TLSH
  T18D22761FD8700F375AF1697BA19813A3FD25939F0222096BB97C2E6C1F3B931605266D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/rivalsfps-builder/rivalsfps-builder.exe
- Size 1.5MB
- SHA256 ca509d8811151b1f3bf28e7d2fe5be1becc71512f04d019a3fb859847011a64b
- MD5 293db7f27e194894d4e36da9e549ded7
- SHA1 515cd5885655b7521a1e3396f0645031a78f1c49
- SHA512 3f367762d6e8e1b4e963727b4cae378847048ad4698fe74bf38d4ac84fb7d86b8c1f41a25a22cdae56fa723f90c57669a1fdb0595161a51b54eff7b0a533725b
- SSDEEP 24576:VJB73LTaNjZGQKedDhz31YWm1fFqCbqrdy91iUC:VJZbTyZGQPdNz31Y11f
- TLSH
  T193754C06B95B58A8D059C874C3478B639A2534CB1A35F9FF02C911793FAEBB45F2D30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  rivalsfps-installer.exe
- Size 12.8MB
- SHA256 69e716e66e328fb8c0a42315cfd8afc13cd8047e48b7bc7e8290e55618519487
- MD5 7ed32273f667661ff447a0ad82675796
- SHA1 85765f61357492c98b2e19044e2d33e5dbdbe50b
- SHA512 5a9ed198c4620dd63b1f5fe0fce793d7bc548d3aa082fb6000d1ff3340f35481be2067b453a6dd50b6bd18851af0af1609f40e05cb2bc191fd931289d4f9d87b
- SSDEEP 196608:8fpeJXZKJeVr53hhE8PG/w/kJb1RiZNf:8f0JWej3hhpPCw/kDRi/f
- TLSH
  T1B8D68D43F5A190E8C0AEC1B4835AE633EB317C894A24B2BB5BD45F233E65F406B1D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral21