b687a62807b1b2ab1fb264a985166cfa0443c73aa867a0ff621e85c31b052d2f

Sharing

Copy URL Twitter E-mail

General

Target
GTA VI.zip
Size 70.9MB
Sample260827-h59bvs1bph
SHA256 b687a62807b1b2ab1fb264a985166cfa0443c73aa867a0ff621e85c31b052d2f
MD5 c5b3613599bdd08e854cec834d391a38
SHA1 d2084748aff6757fd79f2b43207cc35f1e959850
SHA512 5da252ba26a6a965e696cf7ac577841c55587cd4c252e3203c552f4d15cf45eed394691bc6f0534a2c2d0d2469907929ee5e151d821fca490997e15b7aebdfa0
SSDEEP 1572864:W1MYDzwrdp0hfu3aN0Rz61dmkZqt7soAa8eWin3GH9LdYWWq5ySD+vDB:W1vz8Uhm37mDmsqhKDeWHppVE
TLSH
T102F733B1C7BE34C1DC0B337755328426FBB144A0C1A3D766FF8BA62879898F25E29591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GTA VI/D3D12/D3D12Core.dll
- Size 5.4MB
- SHA256 8710110eccf43a32e5e1a04552cb344832922a0cd23caeecb764e18bd5cdffa8
- MD5 7fc05c9a8366d19302dfd13d09d3ebac
- SHA1 df07482f58cc84c439979548682cc44c48471a06
- SHA512 68385bde06684b0e9ea809372f151cd266cc4f9c3be14be0127a2e7468538f453c7da434ef5ddd9f751dcc054032dc6c7baa2bc5bbebd1c6ea3e5d148a931c1d
- SSDEEP 49152:DDcfp0Vm21RnkVNaAFiEVTmZA+kkIwaaKsb7Xvdq0SpZcxNom7nLMzh3:Tg21Rn7rImnbDNw
- TLSH
  T131465B47B2E95298F1B7D07CCEA34B4EF671702153605BDB12610BA96E13BE04A7B3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GTA VI/GTA VI.exe
- Size 656KB
- SHA256 6840d22192fcb8552e866790612f6ea6fb69262965d78cf8fe6817518d46b7dd
- MD5 9f28c5278a8db490b67cc7826383ac55
- SHA1 a8c89fe1e305578e158d437d014d3d15dc96d16c
- SHA512 f25e89f3ec80a1d1b08004b1b14b1c9c13e12f634c56d278575e7091ee20c8a6a03fb8bf19201619b695454aeba07b77a61ed3335367c08d6f01323c9c7d95ff
- SSDEEP 6144:z2E4CD20ZB4Gr34QHHkZuURI2/oU6HlIk1dFNL6T3Ee5Wt3T:z2NCD1Jr3dnUI2/SD1NL6T3Eb5T
- TLSH
  T1B2E45BCFB1C114F9D135FE798152CD7897E37DE5BBA86A8A0AA87106AF331C10C05D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  GTA VI/GTA VI_Data/Managed/Assembly-CSharp.dll
- Size 172KB
- SHA256 77083ccc313f2fb627b075ec9660e5bec797b73a71043af8a7c68bc814c65836
- MD5 cd136ff9abf1aba700715218c8aac26b
- SHA1 4987a6342d65df0376d4838b7bddcabba68165df
- SHA512 e21a3d09c91961e095b7d59c125a4cd51c8cb7a810bf8ff612777ba88092b5a26ab690e60513c661104bf3685880c090a4579689fbd4e9782d7f70ad2cff0ae4
- SSDEEP 3072:zbYQewTqR3aVzPTO8cnddJnLZgM+Xz95rKJpsyHj+viwAboIPJ1j4C:bewTA3aVzPTOFdJnLS9/KJpsyHjJwshq
- TLSH
  T1A5044B50B3EC8633C27F0BBFD164998EEB74426B61AED34C1D9454EE1C8AB9405637A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  GTA VI/GTA VI_Data/Managed/Cinemachine.dll
- Size 308KB
- SHA256 185f3cbd70d10b355dfd9310d08e7758846666e2bdbb62e980730ccf4e86b579
- MD5 1d04279db31bf530d270b8a5a0ff6461
- SHA1 ded15427e0ae143b69f0f32d81585c1337c41f28
- SHA512 4e3159dcbb270737b902ebd174f15ddbf715c87f317294e8a2620afc05320fe0a9745b4b8a3ad9a862a26679e144928b44ed813443b5b3e1793d50b99e3bd7f9
- SSDEEP 6144:b/I5HMLhr+feApyLFx5DQ9kd3MBbzpF9+DzI42mxaex+SMOd:swpCeApsFTABXV+DzI42mxaex+Sp
- TLSH
  T15C644B3533608B7BFA8F07B9E09C1955D374D42BA75FDB896988E0F81E03B9055826E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  GTA VI/GTA VI_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 82f99f6fdaa51dd5b68b03e6c1875bb0d6eae1a12570c38ba6b3db0877803206
- MD5 d72ca5cb03e36290e501a7fbbd7db228
- SHA1 9a674b000fae3e2994e6bfcfc4509585b184c35a
- SHA512 2cc70995ea4fd5acd46a4fe5845e950b374fd13fb233682010e7f5b102187c8db400eb3cc129e61778c2c6a54b2ea7265032b6a6c52ac31411335f2e243118c5
- SSDEEP 6144:nUjTQ70cnf8MoVRxS9iJdBF119RJXG2yv+Q:WEiH119RJX43
- TLSH
  T1C3344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  GTA VI/GTA VI_Data/Managed/Newtonsoft.Json.dll
- Size 675KB
- SHA256 a56146202232958f46bd6a28b5a7da166aea123ee0d646735a46e5c341dfbf1f
- MD5 d751086b7423fd5580b5e909b06217b9
- SHA1 c1707b17df636cd6d4a804361fc6ead4ef9db5cf
- SHA512 86655b59ad62664a35a30807cce7dc2c2be8f1ece235f35dc9031873d255dc6f13a22b55d0386becbe927f007a14a6d936ba3861d1103af8f2fe16aa0afebe11
- SSDEEP 12288:aBNYm5IWx4AhnIqjCfP4bYaRLL0eglBmjV+0kRqQCB0jEIF:aBum5I24A5LYa5g1ByNyq5B0jzF
- TLSH
  T119E4282063A89B26D1BF6735B4304D1547FAF807F2B5EB8FA604D5E92C977A08D107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  GTA VI/GTA VI_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 779fd791d6fae4e497528676d12a5112d33f3ef3a726bde6c77879c021881a70
- MD5 68fb05687e545fbb0c76db47537da13a
- SHA1 c7ef11ef5620fe79ef2bca62a3303c5957273fbd
- SHA512 7812e1dca15dd87dad709c9f61a1d1f47a00af0fc13dad8040c3decb1d6f03540c4ffeb81375853f3107d20da062e9961ada06a88a9fc79848009d4bc1362f27
- SSDEEP 6144:RkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:RkwkYfx8ZNCxL
- TLSH
  T18944281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  GTA VI/GTA VI_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 6626c445ca32ae71f40bd1dbc3d384f84e340b0d1a53ef3221ac11f30a3bb1cf
- MD5 43b8112795b9efb5b927f5235f36bcae
- SHA1 550580b04e3e8915f8c5d6d4367cc1d5d7ea7951
- SHA512 ad97bb8c910634f0661306dae4b5fd739cb06426faaf1aaf98891545dacdb1258d926886d59f66b94323d3c4f7c2a0ab109ceadac6500035e95a69b75df0c675
- SSDEEP 3072:bGHTFkizuGCOE/htnREcacWown5WJGL0MIetgNe:bGHT5+H/33vJR
- TLSH
  T1C8C3F92563EC872BE2EE177EF8B515100FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  GTA VI/GTA VI_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 6e53e3fe1bf92fda90a1f53c23eb2ef9ed15736c3223935f7c039d7a26040191
- MD5 7c1a12bb5a0414638926b8c24d615a46
- SHA1 83921713c788d6a96e950959b2a65992a0c76a0a
- SHA512 734759c4c09e0f2dbb679758d24572e23fe55e175c0ff93d6889324155cddfa39fbc6310628f182c067ceafb849704ff7bf65f0b99b6de1be0ed272bbbe98a08
- SSDEEP 12288:hWK8Xi19FV57751umv0RX15PgLdfJ18VjjvM44hvetIX6e+PxHzR:Ll/umv0Z15PyC9vMNV1+PF
- TLSH
  T16F354C01B3EC9B27D5FF7776A4B442A007B6FC46AB3BD78F104891A95D56B008D887A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  GTA VI/GTA VI_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 ed3cddef7e39c558633315becbf07aab5bbaf704bcc19e20eae328e84d0cc587
- MD5 fdab585638e7ae65f4798b252e3c193c
- SHA1 d2ddc16b51c231f4751264e2e38beef1201bedda
- SHA512 a81339ebc18eccc32efcc4761dd11596ed893cbfea14a6321e8369bc4e8d75f535d54523808b8540ba82146b3561a799035268d07c9aaf1ff2d40e961e7e27f4
- SSDEEP 384:7EAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOx0snRbli3ESmMadMkrVr5UhH:7cZC8Ll4LiMXkv2Y2McdGsj5Q
- TLSH
  T135D2C915D3EC4311E3B727B1BCF9518A8AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  GTA VI/GTA VI_Data/Managed/System.Data.dll
- Size 2.0MB
- SHA256 c8c9b0653989639246a55232b59117b68a04f1a01857baf29622dcd6dbe72d68
- MD5 9125696ef436a9d71d432ac7de5fca54
- SHA1 ada9801d3bddcf3edabfb1559f1b39ef883b2a0d
- SHA512 62c795e02aecf99ad31baa51b88dc1a6c6cd69519dcce7f747fbb965da0b706e84d5cd3e748d088ed457d195e20662cc3fee9b235fd51a4030f2af16c7c74eac
- SSDEEP 24576:2Ty8NQuznGO4TiWB1V0Nt8OZUuhHwjpj5zuctRoOB4MNQ4cggyT:0ykz74VHV0MOZUsgoOB4MNi
- TLSH
  T120A5185077FC5A16E5FF2B31A871101567FAFC16EB72D38E6508A17E1C62B508CA23A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  GTA VI/GTA VI_Data/Managed/System.Drawing.dll
- Size 478KB
- SHA256 97863e8f566cdfd1e650643cc7dc26364220536693d2522c2075af8624ffb032
- MD5 74958c6afb5991fc40a78ba255912a2d
- SHA1 1db8e45942df42ec28ddb34e6518b33e7acd2850
- SHA512 ad2f2e83a1662b370c25d6ba2d1160dad0500672a30f85721e9069779958410af755b70623f000b015e404dc9440cf2b80605db044f68666c9b07807b52cb5e3
- SSDEEP 6144:yHutOmSUsXjt/z5B4CqvhOgEGKPx+Jg/NY7c/nENZ4k7cheeEh:yOtOmVsXjt/PicgEN/MGq4k
- TLSH
  T1F8A44A1077B4592BD5EF2B38E0B24968A631FC076B26E75F4681B62D1CF2B809D417E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  GTA VI/GTA VI_Data/Managed/System.EnterpriseServices.dll
- Size 43KB
- SHA256 f753bd8640f79a7be03c8eefb5b734e09f761d81997429b99785c20e190eadd8
- MD5 3a51475d4d1ec53b93cfb41db4a39e8e
- SHA1 fa50c796c5d2be9c651edf7c8d166d27bf550fe0
- SHA512 4f4f27c22bdf33e06d847d5a38e43f98fd34cc0633babed1ad3cd0b6254bc93f1325220daee5216e2c111a9cc728fb0cca2800fa29b6cdb7f56649a722478cbc
- SSDEEP 768:6T7LlB8tFJutlA/kUTr8yI32JVmugdQSwGHZgm5S:M7BBk8tlA/kVy7JVmuguSwGHZgm5S
- TLSH
  T1C513D51043D48B7ACAFB4BBAFCB342264676BB026F37D3EF2605D2995E4374C4412666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  GTA VI/GTA VI_Data/Managed/System.IO.Compression.FileSystem.dll
- Size 18KB
- SHA256 ab36e2a2dd272d35a579ffe1ed1539d4f47a32343f550c16d87f654a9e398fc0
- MD5 23d90368e759cf8f692a386aa4ec32d0
- SHA1 39212056540287f1b10f1f7d91151d06a26c3d18
- SHA512 e6a02e15f119ed82a1e6d611ebccc2b482efa7034b461892617f5bf974555b4814920f8fea4497c18d7f65a7c1d5159d13f87fdf72bfbaeee92851de5f79c43d
- SSDEEP 384:KPQA4DgKGRwrtLsW2Rbli3ESmMadM1vz2a:KoA4D/Jtq
- TLSH
  T18282602493E44315F6FB4BB4ACF7428686727D13AE36C79D298A135E0C327884D63B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  GTA VI/GTA VI_Data/Managed/System.IO.Compression.dll
- Size 112KB
- SHA256 d751c802f29177a6764bf2528c4ae9b16c5b3c1ff75e6134a0bc480b5231f151
- MD5 4329b08f7bf685b94bcae94bd2fe19cc
- SHA1 bbac720c926f237b5a8166e9da5a840a76a966b0
- SHA512 9f05542c75208f840511d25fd3e943e2ceea5454beccb405ac71661f70d934df68a0817a4dc42f738057be5647d038c948257600691ba23915c3fadfa40c8288
- SSDEEP 3072:zaN5/sy/nNo7hPjma0m9Y4gbcRiuT/CHuVra:zmsyPOL1x
- TLSH
  T118B3291463F80757F2FB6BB8A87509550772BD83A93ED78D390864EE1C62B808C61777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  GTA VI/GTA VI_Data/Managed/System.Net.Http.dll
- Size 120KB
- SHA256 a5280c99f8f5f5a0dc64eb769e63243c4b1458b8c44f408c32cd6ca5869917c7
- MD5 0ea51eb823985dd11f223eba12eb28b6
- SHA1 a2fff6ea8795f4e7f7f3406e0471ad8984797d6f
- SHA512 63d9ff1979247a04118a2f75b4980d4a3cfbe1c4a86a6ff23266c65af042240a9833b0157132b5c01ec429e0b4a370928fc5138c73ba150b3f522ca9eeaebaf1
- SSDEEP 3072:XaL12qTuf3JSsjMP+P9YPU6tLD7SZf/rh4miR9eKRN:5V3zK+l0+mN1R
- TLSH
  T1B2C33B5497AC8B3DDB9F6A79F03802A9E7B2D6073213EB5E5908F8F814537C0D9116A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32