30bcdf40e9bf3014807931f67d80cf2a529f455b7dcd6853720ae46424033dee

Resubmissions

28/08/2026, 13:08

260828-qdft8sak418

28/08/2026, 12:46

260828-pzwxxaxxfz7

Sharing

Copy URL Twitter E-mail

General

Target
GTA-VI_Launcher-2024.02511.rar
Size 67.2MB
Sample260828-qdft8sak41
SHA256 30bcdf40e9bf3014807931f67d80cf2a529f455b7dcd6853720ae46424033dee
MD5 bac981b81fd40dad228db16828eb674e
SHA1 24602cc1bbb4e70f679c3b77d7666aff1679c4a1
SHA512 e33a4b5faf9ee04e6382b9623cadcf9b63d3868b80ffd3df5aa1660098f3fa08e1b32b10755e40a67fadd89c0d884a8423f7302388cca317621a886d7a1c391c
SSDEEP 1572864:FiQKUUotaYJ/Rb7rxdBJLKj7L3GLBO9YSGoI7a:FrKzcRPJgj3p9YWIG
TLSH
T124F733FB151057D01A28B09DDA87DFFAE2BB1CEF68D653853A8E732061B069470B257C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GTA-VI_Launcher-2024.02511.exe
- Size 67.1MB
- SHA256 91108c925812760f883beb7f7facb5aa1e0adf781afcf8c1298478469efdfd15
- MD5 11ee99b439d428d16970e18c429a6bbd
- SHA1 39303a600c307ef76a8bb1c08bca0b134792eecb
- SHA512 3476e199a73794c7f4ad59848f627358c6d018cf0c764dc57c551c54db4daa637ddaa7e73f18b9e69e152477275e8aaf9481b81db0ee18b1b98f6f02b436ba8b
- SSDEEP 1572864:oLdket4okjeDwd3KAoSSiMdbIKy8bo9gfceyYM5qD7:o2eOwwIAjdM1w8qgfXvmqD7
- TLSH
  T1A5F73359629C8F7AF48A8B338B7C1312643E86D82325C07B77B4557AFA558D6E6CC00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  GTA-VI_Launcher-2024.02511.exe
- Size 168.1MB
- SHA256 a77b97f718e5712e2ccb819330ae6c1deb3733b6a655537e7d5141d174d07e28
- MD5 f8ec081af120ded170515279184d3c98
- SHA1 36c41a02c8407a206189f2c1f87c9717b1c53de2
- SHA512 25ac502e48244f976c3fa20af887b7b150f7d8ec1ef96a75aea9351aaf65556020faf6f47bc48b43cf457d85dbc7a0b7b42094386ce12bcf0955c4717e62bcf2
- SSDEEP 1572864:0gRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:4g/geeFXzGa9Fz
- TLSH
  T1FA887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware
- Contacts a large (515) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH
  T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH
  T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH
  T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app/bundle.jsc
- Size 1.0MB
- SHA256 da8d25e60296f8f503fcf3527ce5b5cf567c80c4cf0dc48a285842f471ed44f6
- MD5 9c29ebaa32f7274ea319ea61aa56084a
- SHA1 1edcd50dccc0cd9820514143d033c48725f3699d
- SHA512 86ec9c98d3ca9e9c002f249f836dbb2003aa6bda4e6cace85e2f6fc40646e27915026f5ba9ba8bbd8982758d87807f6104a9f35fdade2dec6020e5dd90ccac2b
- SSDEEP 3072:6cnTF4W2NymXGqaKMpAcNQBjsAIRTZSKCFfStY0VORTD0xxKuXzGka0PGqljbG6k:6cnph6aNp9o1eOQaz73f
- TLSH
  T1D33524EB129B1F6B845233898C72DCCCEC793D611A9D901AFE3779A1913C66177E1328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/loader.js
- Size 183B
- SHA256 195136147a5049f4af25bc27f80e92a531373bc7ca667325f407f3fa79a13433
- MD5 30c835fbd9b01d0daa6cff7eb75d7e40
- SHA1 a52a408dbde427eec8c5545c7cc0017e468b7d90
- SHA512 e0bc6e474750f4d6d53bfd3c50861f3a638665082fdfb9c3eff178731d8d27dd6fd630ece58c3d17c5cc9de8caed8ffb29f794a3f074bb2c7809337ee4aca2d6
- TLSH
  T12EC012448761D45E51A192A5F158145738C3C05023059534C0A58ED95B86DD50A6586F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/node_modules/adm-zip/util/constants.js
- Size 6KB
- SHA256 208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
- MD5 9557c90a448baec12cf2cb2f97e2c5a2
- SHA1 19ece17c4aed05723601ec510ad2020fb462cf52
- SHA512 433a683e049a8d2fa321e9cf6932c2f5075c83f1713a9d0514956310174ef2959d0c8378a039d27d0a34f321262f6cf7eee40066ca54da1b57c5483b6d00f089
- SSDEEP 96:Dtbl0W6xP0XM0gly+ESo5Etdt0f2cnHBE8WdQx8Z5h+IrrOnQTUlZmsA:DxyWCsXM06I/uSjG8WdQx8Z5h7rrO72
- TLSH
  T129D1F3A6A8C824536A01C850773EEEF2979DEF0B59645214361F4E8C2F0C97C7FA66C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app/node_modules/adm-zip/util/decoder.js
- Size 130B
- SHA256 73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
- MD5 36fb8dd4a6ffe2655530fd6c9c8cf1e0
- SHA1 85e85bf9a92432ab576876334e64b026ab3aa18e
- SHA512 f7e6e74931b368ef0c78f9ca6798b09ef9804bd4203b19269ba5fae0190aa59ccb5d972d8993f63f1925f042f0f0d4d730c667646be2041a9989b5e802c5d1ad
- TLSH
  T1B1C09B5674F0206241B7F1485565EF0F64C876651E05547739519BC4454C53474725D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app/node_modules/adm-zip/util/errors.js
- Size 2KB
- SHA256 d2d243647737c795c2db8aeba2e1f3841d5f76370b521d436cf465322dd4aab7
- MD5 d88386a6ea50c20cfd5ef4517f07bb70
- SHA1 3a75921ab1b86126b2788f2de773ef493198a0f2
- SHA512 84ed1fa8ecbee930b5f34553610ee330f548bd9a9cf9b37a474eba44c63365e1948eb4f0ef66d6798b54fcf23089eed0a25b34ee3c320eb7be913c5cf40b5520
- TLSH
  T1F45184416EA0284B04D680602E95BD1A3A6483175F543D86FFBC03942FAEEDFC9769CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/node_modules/adm-zip/util/index.js
- Size 226B
- SHA256 dc5b230ed853947ea55c0bf69f0e525fbeffefff09aa3da296d541bb8898314e
- MD5 1916e3ec47c420bdcc49bf9a97c7a73d
- SHA1 c14a7e823e8e6b5cd473ce9612e028f03b045ad2
- SHA512 719b4e15c49eecf7d52859018f916043427474f02ca7b456f8dc0e2aa9f4495aaa1eca15fdc3d9b563aace6ec2d2b90c65ff0f531a3ddb9f3fd1a51dfc2c8255
- TLSH
  T19FD0C7C66FE53187621C49D0E262E4021DC6DCB31111D010960C8BFB4288CD186BBCD1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app/node_modules/adm-zip/zipEntry.js
- Size 15KB
- SHA256 61b6fcc1675725efbd7f0bc7c17529806bd3819b43e3794ffd067eeb7bb88e5c
- MD5 dc76411bba511d17cdcc1e5fbf0fa67f
- SHA1 3844131da4ec7e460c309e54cabd7c48dd0e195c
- SHA512 5c60dfc3b563448eee0d7def6e957eab54f3557904b31955ce71f5362057679b3be264a2c3967e8ab2fde28b9ddd036dea09cb8d912bd498e40a735ebd54b880
- SSDEEP 384:Sd0Gmb6whQz6TuJjjUZCL94kIz/S8+s3P9eqWVZYe:uLmb6whQz6iIkIzq8+s3P9xWLYe
- TLSH
  T13B621F4D59F372014913B529CF8F891A6224B507690DC906BF2E834B6F8847DDEEFAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  resources/app/node_modules/bytenode/lib/cli.js
- Size 5KB
- SHA256 24a55246e1183b53ec2f926d1d90958e7fb0a813575bf88d3ca8b895a27fea29
- MD5 fbea827b80fab18279151221306b238e
- SHA1 321fbf0f9b9b96f8ad34e899b39e791c2233ad53
- SHA512 614e6eedc8978b801821e122593dd60c8dbbdf1abffb31d19e5e3dd55105cc226fb1c50307255d97ee46aa09b95179ba60e35fa7b1d3240ac0842804099fb8c9
- SSDEEP 96:iqhoaU2pZh3weaU2KgMaGCxc+ymWM97U51+dZNb1nCt9Lx9O7E6E4AL1:iTc+B7//Nb1nyfr4AL1
- TLSH
  T1F3C12218ADFD8A320353206A065A5C0AB35AE0173508DB517AEC8359FFD19F584EF6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Contacts a large (515) amount of remote hosts

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32