edb43552483de634e07f6ba81aa1734ea1a7579088b1f26d434e8dc5feba6815

Sharing

Copy URL Twitter E-mail

General

Target
Crimson.Desert.v1.17.00-DenuvOwO.7z
Size 15.7MB
Sample260827-aj9fqsyamd
SHA256 edb43552483de634e07f6ba81aa1734ea1a7579088b1f26d434e8dc5feba6815
MD5 11fc7b0f0ce409df93071ad92db2fa07
SHA1 eea9348801f80b5c5628e36c9b9042b23fa9d51c
SHA512 5dd8c0ec2aaca5f5d14521ff7e177df2deedfe263d487b197f3ad90adeb414fe230031e54d3e0398cdac9143ed15725150cd9ea76e6e6a2689d6d615b82cdcb1
SSDEEP 196608:swjYRYaBUgs7PVC4rhXalFV1FFzQaMHkbwURfldAp23eWGgqQM1Zv1QDlLS0ifIL:STspfi/1Fb9wytGp4Gg1MrODlcfIL
TLSH
T120F633EF1A8AC8CCE41769996DCEDF65F11948A62B56CC8D30BDD33DA4BE2C17C15802
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Targets

- Target
  DenuvOwO/bin64/cd_id.dll
- Size 1KB
- SHA256 11f6344b30e0352e97a6773ae42013c5bb9ad0cb92b87d25491d68eb09e5c306
- MD5 f9d17168c0736d2345d399bd8a45e06a
- SHA1 c072ea8a719e3e74edb659e3ae28dff2b12aedf6
- SHA512 bdbb76d0a4c081221fed013d0c70acd1d2310afa85af99f09450889f7519f245d71c0b9ad2ddab0a74f54af6c09a147f61d629bc8051d85ba439df22d1d2b29d
- TLSH
  T10F315E1782B449B3C25C03B453C39D0439B9651497E392820B68A03E6C213297EB5E04
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DenuvOwO/bin64/coldclient/GameOverlayRenderer64.dll
- Size 1.9MB
- SHA256 58a4664d32878923f240916d66ddc95c8bff9584dc05a2f7b57de5ed69486cf0
- MD5 df0ebd784a2607f7f3461ef849199e3b
- SHA1 4c949b4ca24f02224a8f17780daf043b507a2d1b
- SHA512 a727738c80bc7827af15466ac8e04df81bf51219bf41425b86921cb20a217c2c8a49cf35abb6ab7003afc4138ede32b386991dc7ca1f94c0672b8044893815b9
- SSDEEP 1536:DFnIxKVEWneqdJJfeATHaSHWB2A7gAhmkdOwPnsWpdi9dl43VlPGq5S:Dsrrcfes6wWB2YkNaFyWlleq5S
- TLSH
  T148952954B6E930B8E076C3788B773A47D67678100751AAEF0360425A2EE3FD2C579FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DenuvOwO/bin64/coldclient/coldloader.dll
- Size 114KB
- SHA256 4d568e8608e3dd52d251919535292c753f2586a9fdde72986937720f46b76c17
- MD5 7dafe9e2faec1359ea7026d286eeff62
- SHA1 9ca1e38045af299f937da97d722026582a5a5964
- SHA512 ff3c82d3190bea270dbe613747266528adcdfce427b338b01f5b6bfb80955a6b4f4c40ecb2ed161cb84623303f1d38021f069cd8080934273a8e7e341baa90d2
- SSDEEP 1536:LvIMMz6W+OBCpFeYb9E4riuHYZMqHpySvGpun3VivD39ozZghptf3hcwe6db5oB:EdLC193riHpA830DtogtZe6db52
- TLSH
  T19BB33903F28440F9E05DC174836BAA33FB76F8850936A3AF17A456212E66F51AF0E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DenuvOwO/bin64/coldclient/steamclient64.dll
- Size 20.8MB
- SHA256 9f0975e2bae41c715aa5adb6887127a0542b3731503b01b27270193b87e78e3e
- MD5 babb36232aa4c4ef33e6b7a050b364e6
- SHA1 99b7599332ccbf1b5c284a75e35c993c3c820fea
- SHA512 5f7211bd837d2f485a6d2465278dd7066c70b3a408a08852f46d2fc5321da420a0c027fed0a05ec1a55c2a7ab31cd64b2a44cc3f1edef355fb88791f05dc66ad
- SSDEEP 98304:UXdrvwmVyxTWFRHARFtv/AmbP7ZgZ0CS0ZUsaAj1oaA71y+4AxYZgAE6EZDi7QZq:U1xGtgaYusaABoaA7wciZgA72D8USYNG
- TLSH
  T151274A47E7BB01E5D6B6C03895B3623BFE7174A5833097D7A680560A1F62BE0E93E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DenuvOwO/bin64/driver_amd/SimpleSvm.sys
- Size 17KB
- SHA256 15fea1df683dabbb22edfa8753050ee027ee76de3fe6766ae8eb23c38dd62c14
- MD5 74c2f638a1bbb9c48743dde3388c2e52
- SHA1 ccb1fb9dd63be4165deb948804c57f62ff1192ab
- SHA512 47327b83c6833b37d0acfb49856b4351559502fd613168432ba40b485fece9a272c25104f304e155e4ff3aad12024d83a42e6bef2ff1d9acee9bd614aa819509
- SSDEEP 384:U6cmEiSJmWBdILzWQkWNU4zC3StECztxSdAcm:U6NEiSJmW7YzBkWNC3St9zydAcm
- TLSH
  T175825BA0275D71F8CEA14478E5476713E9B2B0690B63E7EF802142552F5BBF0BE3E612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  DenuvOwO/bin64/driver_intel/hyperevade.dll
- Size 6KB
- SHA256 64b6fa56fdb34712fa5f3c868243c66f9ccd812637f55e3d7d0ad995c32f2d33
- MD5 eb277ad138e9dcda56c0263ce821338d
- SHA1 32f8084c8e9d9021783979b28cef5ccd61689719
- SHA512 571b9861e61fff446c8627e37c406ba1b2b550a3ea7268ba52065d5c0ddcc39ea14dca684c70594f33c7d70cbfdb2a7d14c87ec0e576a3f81cb599b13ee14821
- SSDEEP 48:CjBQtfTjK8ZCl/bnlF6NwJJ5QUCeh2OHixiiIk9+CyM4dylI7:2+fa8k/jjMuKrezCEin9+8flI7
- TLSH
  T162D1C975DE06D8E5E5AB4A7C81EA4E06B376F54407520BE720D194083C8BFF83D34E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  DenuvOwO/bin64/driver_intel/hyperhv.dll
- Size 521KB
- SHA256 efcc775e724e2ae78e81f2180c718ceaf685a0aa10905d770dd011041783728c
- MD5 cddf53bdf82d79080d872981c27ffd99
- SHA1 021e432711c7ddebe1d492ca370b3d309c4d681f
- SHA512 4ddb875220af41b496f7e97d6e545fe5a5eaee97ac88ccf6459124516227f676a380370a90f2e7b3e179ed734b3ca7d3b2939eb504b0b13891554e0c431e6e29
- SSDEEP 6144:x9byockU+jem+XtkBeaG23uuGurUqLcowsEZyve3TrrH17:3byTr4e9ncuuGMUQoph7
- TLSH
  T111B4A4B7EC0474B3EC30613589E707AB267BA580976287C71659362B9D827D42F37F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  DenuvOwO/bin64/driver_intel/hyperkd.sys
- Size 11KB
- SHA256 c7dd86c1087d02e82a3df7016d7cdf91f0585a9736040ea15d97421640ff57d5
- MD5 61f2257169ae4a807068691bc4239e2c
- SHA1 f1982bfc81ef5d4c120eb458585275f83be93468
- SHA512 e41d0fb9ebd9008c555e6f3032361870139d5ab59050642ddad59a8199a657959a181a79ca38f1581f64e9f028087fa1600d60c44f3f7bf61f7dfb2c98469fe1
- SSDEEP 192:tq4qGmnydcI9U6mycymyJyJyC6AVGs6mszCNnc7:tf7cI9U6mhnoQD6AVNbc7
- TLSH
  T17132E721A387DCD1C91681BC859A4D2E60A5E004D32757C79FA698B4CE4E7F12F3BA63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  DenuvOwO/bin64/driver_intel/hyperlog.dll
- Size 13KB
- SHA256 2c723807688f898581a10fe496977bfb9fe6e404fbe60b5150da1f11e89598ea
- MD5 959341e2f31b545c70bb78545188bf35
- SHA1 57580fc10565e07edf02939682bdb2c28440ebcf
- SHA512 ef1d09f83c36fb93551510a7bb8f51517fadc1afb10910139d9382d6253c6518443ae8d315c97d5f59b7798634a924e9de3a385931f20d495b96defb2d76be53
- SSDEEP 192:PIkf6QZh7V77O7Tm5ITwHYcHylqaSyxU55zCNnc0ZGg:PzCSh7xO/mSwH5jgcsGg
- TLSH
  T15F522929604134F8E51B59B991B31E0AADB2B8111B2262DF2576C7BF4F26BC1333DA03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  DenuvOwO/bin64/driver_intel/kdserial.dll
- Size 29KB
- SHA256 45ae5bc1bfea113b579ebba5babb174df111bf109da5b816d64ea44408cf90c2
- MD5 52b3f9c64df67e4dc2f04939488c0fba
- SHA1 a86f83d3f57adf192a44c312759f5bd97e09c8f0
- SHA512 423ad4bddc03a73b63c75a08991593ea233aad70235ff1e4fa03420d2042ea93e927e4f5e1a232ae7703f760f9234e1e2d112b59f44cfa6dbe9dd1172e7caace
- SSDEEP 768:aKRkD9uVFoZpRZ5Z2Pz7iePkO24lVvgA+8yfX0jxh6sJ6cq:aQTofZ52PPkO2/AUX0TNq
- TLSH
  T104D21A9A12F424AAC559927DC9536D1FC6FFF8281310A6DF0320627E6F23BF15A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  DenuvOwO/bin64/reflex.dll
- Size 177KB
- SHA256 b557a5e8c7c818bbfef202a97bdfa959b126be22d33b20b7bef728e393960a18
- MD5 b59481bcf51e370a80f0597d1715b5c2
- SHA1 46e9b46237c776bd38498e2b10f40c875da694ec
- SHA512 a1be95462d6dcc5f534605c420d9feaf8d043901c8b1d2a86e8142325ed6a43a4e614f932220f29c72aa169d438b2f475d260c046438f9906c2cab23b116e39e
- SSDEEP 3072:Zw6JDPvvT1hcZP4FVdjLHk6D5zSCKUBUBHcUdWE5H/b/g9:ZDv71bvtD5zSCKRF9g9
- TLSH
  T166044B07F29880F8C09EC175835BE533FA72B8895B25B29F5B905B612F69F90B71E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DenuvOwO/bin64/steam_api64.dll
- Size 312KB
- SHA256 670d654aa3255c5061cf0236a1cdbb2f5076cbd5ae44f613b6f4921558e83e2d
- MD5 b3caec4d455160acf21a318073c40dc7
- SHA1 fcb09f9da2172d58fbf4aa57bdd30d607ccbf237
- SHA512 bd3417c5c5c022f2b3f729283d77a335200fab8a7c439eee00f9d298608f804a3f6698049d30351d8a5dbfa3e728518691472fc78b91b8785ca5d1a5c52c6142
- SSDEEP 6144:JfgdBtTW65Q6tW31ghwXRTRylO2CXuPu+SQ:JodBtW6pte1gsbys2Cza
- TLSH
  T199645B3962750CF4E077C13A88565E0BFA79344B23219EEF236062769E537C21EBB791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  DenuvOwO/bin64/winmm.dll
- Size 87KB
- SHA256 320e8254bcd3aeeb4f52370ac340d908001d855f282639b21df11d0dfef55c16
- MD5 1080bb0e069b6d391bfaf5648600406f
- SHA1 d8513eacfcdd6005afacf89a8fd08b06ff491b6b
- SHA512 fc2e15e2460fe4c2e79334a72398293c3c901137a9b4a3a5e177c4ee47e9fcbd436e1a289bd243d536336a646a589af828ba5b30895837d440715a422f2eed5d
- SSDEEP 1536:zhqVsK+wEQdw+UNsyA549YOTV2aia9zx2UfUlLORhEiiKmbkY7ckVPxIiTLbW:zIsK+Qdw+Umaia9zx2UfuORhryckVPxo
- TLSH
  T1D1932936B1EC4979D10AD034D7B10906C7BEB22D193063EE77B99B003BAA1697D1F748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/doc.py
- Size 12KB
- SHA256 1a0ecf1821da472922bcb0f85d5b5d68a45b8d55a9c34c2a90d1415dd64ceed6
- MD5 5e4212bcab061f8aa730d7464e5c86b1
- SHA1 8017eb8a6a4fbec721bce039202149913f1da83b
- SHA512 29fe7eecde303a104929dae46814938838cea6ce3249444f13a38b745094c8e6343c15a8ad2fa8651679c09cede75a8867afa16ae45c3475f041ad1e915540be
- SSDEEP 192:4PBzS5/X99mCJt0nxqCAfhsZ7MRodSs3OEoVA4zye:42990nxqCAfEMRodSs3OEo64zye
- TLSH
  T1FA4298BA5D4BEC3065F78A7E8C10E847F30F46A3522EA453B67C20782F71585C6A5DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/options.py
- Size 8KB
- SHA256 cccf06963f94a2db1b86d668499c6a71d692303eb5e99006849bd976b1922111
- MD5 fed754a2d03ba930605a041b1d2a1c1b
- SHA1 f8cb4dc1fd901dcedd3596ec6bd97674a82b86a3
- SHA512 c091f78468f5562d8992e9aa61f0fc380ce28a8417f46fd700ef06b857b62335089cb7ec6f22ff9632a8e49ee421a89990056d194d7d2f5decf0aeb217d59a0c
- SSDEEP 192:oAlhZeO/wNAN5nWIrsuO/H/e/J///KbXGkwApwXdL:oAlhZeO/wNAN5nRrxC/wXdL
- TLSH
  T18B02CD125E9A990040B3CA361C8CE53BD75D8B03DAAD59967B7CDA1B0F70B90A0C7D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/base.py
- Size 3KB
- SHA256 f5ffe813ba84e0d0b447b463d07719d57db1f5b2d33a0b071ff33562ba94fd66
- MD5 6413fb9a1804443fbf6a181b7dea0df5
- SHA1 d7161073ca4b82911023c4edf3113c4b7a360912
- SHA512 f8469f1b0751d50ac118b1377924ebdf6c53f9cd6aaa52a35f3090728bff1e2dd623922d6a0a75d3f37cda2f816b0f0d02b6a669161a1403d4a605aa8467cfdf
- TLSH
  T1B5715B186C4BD796D5B3CF2BB8065817D75E83A359AEB453B8FCA4860FB1120C0D8DE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/c_processor.py
- Size 25KB
- SHA256 50af0f5cb11e69185fda4e4689393002ee8f2a4f07b58632d4cd843bca3948af
- MD5 075aaa3794e9a755be8db61931c7b075
- SHA1 95daf9e706fd5a9f39424160d253dbb6ebd55df0
- SHA512 d5d07a22f782d18342c6d5cda2c84f472db46fccd0a7678a0f7b487c5629d74d0fa3a8c7338036a0f295cfc7a45f7a1af1537e805cc6135efd0f639e9d6d9d0b
- SSDEEP 384:flV7jDxnfIvOkdQGfHKmEamShRKErI1G8ULo:fX7xnfIWUfLIkE
- TLSH
  T1D5C2BD194D61A55550F3CD3ADC49E92BE31F07239BBC7042BBBD40522FB039186BAEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/text.py
- Size 4KB
- SHA256 d4e7bb81cab81b02279d9c1568ebae047d078757393fac82e754917935d541dc
- MD5 fa3962530231fa7d5462c69b96e777bf
- SHA1 f006797afe5aa14a875339c04b9d8ade5be1f2d9
- SHA512 16458c17fbec086b7384bd5c039aa4a590abe338714c1c388b57edb9ec374c61552ed0f7ab32ccbc63dd0507fb60f610ee711f7f95dec0880a5ffd6e8115a8bc
- SSDEEP 96:KUHRXdpRRBdTpa+RtnRrRbRfhmAfd9e94iJM6NrMvRubsRU:93BdTpautRF1UAfd9eRydEwU
- TLSH
  T15EA1E1008D5FE64C6276C76F4588C92AF30689AF5342452EF9CEC1961FB1D8E87F15E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/main.py
- Size 1KB
- SHA256 916cf6f005c87982f860966642e4483eae954e877ce1f195defc8e97652b9b76
- MD5 0cf9d1af9e9ba9cab8c26f086e0dafcb
- SHA1 b5212c3cd17a8e20e51eec8576d581559866d04c
- SHA512 3b97de1ebb13ba9a2025f93f1f61a117774cad33f4f38d5b39cc2d6f24703646f95235220aa9991e11bd747fba35434fb21ebb5d8dd2165b982f8cf263d2616a
- TLSH
  T19D218841AC0E656151FA026C7858ED03EEAAD7A32732507370FCC7553FB4890E0AB52E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32