Extracted

• • Target
    GTA6_CyberLeak_Launcher.exe
  • Size 70.8MB
  • SHA256 4c0c90a91446f8f408f15349cc74d828f1b984c9ad355ffbbb87f8fb1beb9a7c
  • MD5 626e0779cd07b78c7df33c296e348e26
  • SHA1 cc1d0aaac759973fd5aa6587b92d32fa72f3734c
  • SHA512 5310d50cc7364b890920e8b6cbd87abb9c9b737ecf14b069b3a87301bbe15dcda4b5c280bc18654a8cbc34689d34cbe541b570110013361a36ffd8144ad95132
  • SSDEEP 1572864:W5shdn0iKCTGXA/F7crWwOXIU93jHh7tGPkwVoSPxj0b:uFCTGgJwOB3jHhQrR0b
  • TLSH
    T190F72356E2FD00E8D57AC0BCC6575517E7B1385917309BEB62A48A652F33BE0AE3D310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2