cb8667d22bdfdd3c72a109c793ce62df84bb3a478b40125bd7e0d113acdc4d23

Sharing

Copy URL Twitter E-mail

General

Target
Jurassic.World.Evolution.3.Update.1.4.2-DenuvOwO.zip
Size 17.0MB
Sample260907-alfanstsax
SHA256 cb8667d22bdfdd3c72a109c793ce62df84bb3a478b40125bd7e0d113acdc4d23
MD5 57ea7620a480de9eb669f1d24a371a1e
SHA1 9ebef6c3f86be5ed3fe461aae6105e8e8bd5d0f6
SHA512 939bd6f69b60350b526bb61272e2b5e29109169b925e99f7954011f231999440fa3569cd7efab4c83e13f7597775e41317f99324df4c0a5df1bc4d35b3eb4deb
SSDEEP 393216:oDccQ6AG+y77hB3x3UvBHlh8vS1s8KuKk0uq:oxAG1FB3qh8vS1/Sk0uq
TLSH
T1820733C8B2492C5EF67587707DCFD30D4E8E489A3292E5A6E02BE635F47A8E2705540F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  DenuvOwO/driver_amd/SimpleSvm.sys
- Size 17KB
- SHA256 15fea1df683dabbb22edfa8753050ee027ee76de3fe6766ae8eb23c38dd62c14
- MD5 74c2f638a1bbb9c48743dde3388c2e52
- SHA1 ccb1fb9dd63be4165deb948804c57f62ff1192ab
- SHA512 47327b83c6833b37d0acfb49856b4351559502fd613168432ba40b485fece9a272c25104f304e155e4ff3aad12024d83a42e6bef2ff1d9acee9bd614aa819509
- SSDEEP 384:U6cmEiSJmWBdILzWQkWNU4zC3StECztxSdAcm:U6NEiSJmW7YzBkWNC3St9zydAcm
- TLSH
  T175825BA0275D71F8CEA14478E5476713E9B2B0690B63E7EF802142552F5BBF0BE3E612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  DenuvOwO/driver_intel/hyperevade.dll
- Size 6KB
- SHA256 64b6fa56fdb34712fa5f3c868243c66f9ccd812637f55e3d7d0ad995c32f2d33
- MD5 eb277ad138e9dcda56c0263ce821338d
- SHA1 32f8084c8e9d9021783979b28cef5ccd61689719
- SHA512 571b9861e61fff446c8627e37c406ba1b2b550a3ea7268ba52065d5c0ddcc39ea14dca684c70594f33c7d70cbfdb2a7d14c87ec0e576a3f81cb599b13ee14821
- SSDEEP 48:CjBQtfTjK8ZCl/bnlF6NwJJ5QUCeh2OHixiiIk9+CyM4dylI7:2+fa8k/jjMuKrezCEin9+8flI7
- TLSH
  T162D1C975DE06D8E5E5AB4A7C81EA4E06B376F54407520BE720D194083C8BFF83D34E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DenuvOwO/driver_intel/hyperhv.dll
- Size 521KB
- SHA256 efcc775e724e2ae78e81f2180c718ceaf685a0aa10905d770dd011041783728c
- MD5 cddf53bdf82d79080d872981c27ffd99
- SHA1 021e432711c7ddebe1d492ca370b3d309c4d681f
- SHA512 4ddb875220af41b496f7e97d6e545fe5a5eaee97ac88ccf6459124516227f676a380370a90f2e7b3e179ed734b3ca7d3b2939eb504b0b13891554e0c431e6e29
- SSDEEP 6144:x9byockU+jem+XtkBeaG23uuGurUqLcowsEZyve3TrrH17:3byTr4e9ncuuGMUQoph7
- TLSH
  T111B4A4B7EC0474B3EC30613589E707AB267BA580976287C71659362B9D827D42F37F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DenuvOwO/driver_intel/hyperkd.sys
- Size 11KB
- SHA256 c7dd86c1087d02e82a3df7016d7cdf91f0585a9736040ea15d97421640ff57d5
- MD5 61f2257169ae4a807068691bc4239e2c
- SHA1 f1982bfc81ef5d4c120eb458585275f83be93468
- SHA512 e41d0fb9ebd9008c555e6f3032361870139d5ab59050642ddad59a8199a657959a181a79ca38f1581f64e9f028087fa1600d60c44f3f7bf61f7dfb2c98469fe1
- SSDEEP 192:tq4qGmnydcI9U6mycymyJyJyC6AVGs6mszCNnc7:tf7cI9U6mhnoQD6AVNbc7
- TLSH
  T17132E721A387DCD1C91681BC859A4D2E60A5E004D32757C79FA698B4CE4E7F12F3BA63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  DenuvOwO/driver_intel/hyperlog.dll
- Size 13KB
- SHA256 2c723807688f898581a10fe496977bfb9fe6e404fbe60b5150da1f11e89598ea
- MD5 959341e2f31b545c70bb78545188bf35
- SHA1 57580fc10565e07edf02939682bdb2c28440ebcf
- SHA512 ef1d09f83c36fb93551510a7bb8f51517fadc1afb10910139d9382d6253c6518443ae8d315c97d5f59b7798634a924e9de3a385931f20d495b96defb2d76be53
- SSDEEP 192:PIkf6QZh7V77O7Tm5ITwHYcHylqaSyxU55zCNnc0ZGg:PzCSh7xO/mSwH5jgcsGg
- TLSH
  T15F522929604134F8E51B59B991B31E0AADB2B8111B2262DF2576C7BF4F26BC1333DA03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  DenuvOwO/driver_intel/kdserial.dll
- Size 29KB
- SHA256 45ae5bc1bfea113b579ebba5babb174df111bf109da5b816d64ea44408cf90c2
- MD5 52b3f9c64df67e4dc2f04939488c0fba
- SHA1 a86f83d3f57adf192a44c312759f5bd97e09c8f0
- SHA512 423ad4bddc03a73b63c75a08991593ea233aad70235ff1e4fa03420d2042ea93e927e4f5e1a232ae7703f760f9234e1e2d112b59f44cfa6dbe9dd1172e7caace
- SSDEEP 768:aKRkD9uVFoZpRZ5Z2Pz7iePkO24lVvgA+8yfX0jxh6sJ6cq:aQTofZ52PPkO2/AUX0TNq
- TLSH
  T104D21A9A12F424AAC559927DC9536D1FC6FFF8281310A6DF0320627E6F23BF15A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  DenuvOwO/reflex.dll
- Size 177KB
- SHA256 b557a5e8c7c818bbfef202a97bdfa959b126be22d33b20b7bef728e393960a18
- MD5 b59481bcf51e370a80f0597d1715b5c2
- SHA1 46e9b46237c776bd38498e2b10f40c875da694ec
- SHA512 a1be95462d6dcc5f534605c420d9feaf8d043901c8b1d2a86e8142325ed6a43a4e614f932220f29c72aa169d438b2f475d260c046438f9906c2cab23b116e39e
- SSDEEP 3072:Zw6JDPvvT1hcZP4FVdjLHk6D5zSCKUBUBHcUdWE5H/b/g9:ZDv71bvtD5zSCKRF9g9
- TLSH
  T166044B07F29880F8C09EC175835BE533FA72B8895B25B29F5B905B612F69F90B71E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DenuvOwO/steam_api64.dll
- Size 20.9MB
- SHA256 7f743dbd7493a4c1295ca41886e83a49525d78a3896e8f280d420ef305087d35
- MD5 10c7c63d3515c2c3ab16aaae5e6961a0
- SHA1 1469bfa1baa862821c84b9e3e09a463c66dae80d
- SHA512 ad994fb6b805af4f7b222b924184b2278210c9f63cb52f443edcbf0daa46397caf0a23332232eebd0ad664eb3dff1ae61a350e5e7276ed30dd155e5eacc2dcf1
- SSDEEP 98304:syR1zTYxOL2J0aAoBpSv+fF87nWHivj80/4P71y+4AxYZgAE6EZDi7QZaqV3uIVt:fwNAo6+Nuj8i4P7wciZgA72D8UJ3pS0
- TLSH
  T178275A17E7BB01E4D6B6D07895B3622BFE717495833097DBA6C0560A1F62BE0E93E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DenuvOwO/steamclient64.dll
- Size 108KB
- SHA256 c8f2747a69e96732f82af251b69ff25a5126d71ac400614e1a077dba66e636f8
- MD5 70d16c8ee56f142a15e3c6beac252e49
- SHA1 193cf53f12c471fd7eed47e69205b163ebbf0581
- SHA512 51d98c2ad4503f66bd719c5c6291ecb1df575734ac7fb44fbdfba3c2b11bd96512ff4de020d038633a034cb1a4e46692286a80294cfa3ea9db82516a0f43eb4e
- SSDEEP 3072:UQbt3HjsdsfOjWo2W8RjP2ZsdtV0hOGOt2rzSiJRCzsw:PdHjOwiz2BRz26Pez+sw
- TLSH
  T103B3175776E530ABE1B6C6749B773A05D3B6F81107619BAF03A0425A2F233D1CD3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DenuvOwO/winmm.dll
- Size 87KB
- SHA256 320e8254bcd3aeeb4f52370ac340d908001d855f282639b21df11d0dfef55c16
- MD5 1080bb0e069b6d391bfaf5648600406f
- SHA1 d8513eacfcdd6005afacf89a8fd08b06ff491b6b
- SHA512 fc2e15e2460fe4c2e79334a72398293c3c901137a9b4a3a5e177c4ee47e9fcbd436e1a289bd243d536336a646a589af828ba5b30895837d440715a422f2eed5d
- SSDEEP 1536:zhqVsK+wEQdw+UNsyA549YOTV2aia9zx2UfUlLORhEiiKmbkY7ckVPxIiTLbW:zIsK+Qdw+Umaia9zx2UfuORhryckVPxo
- TLSH
  T1D1932936B1EC4979D10AD034D7B10906C7BEB22D193063EE77B99B003BAA1697D1F748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/doc.py
- Size 12KB
- SHA256 1a0ecf1821da472922bcb0f85d5b5d68a45b8d55a9c34c2a90d1415dd64ceed6
- MD5 5e4212bcab061f8aa730d7464e5c86b1
- SHA1 8017eb8a6a4fbec721bce039202149913f1da83b
- SHA512 29fe7eecde303a104929dae46814938838cea6ce3249444f13a38b745094c8e6343c15a8ad2fa8651679c09cede75a8867afa16ae45c3475f041ad1e915540be
- SSDEEP 192:4PBzS5/X99mCJt0nxqCAfhsZ7MRodSs3OEoVA4zye:42990nxqCAfEMRodSs3OEo64zye
- TLSH
  T1FA4298BA5D4BEC3065F78A7E8C10E847F30F46A3522EA453B67C20782F71585C6A5DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/options.py
- Size 8KB
- SHA256 cccf06963f94a2db1b86d668499c6a71d692303eb5e99006849bd976b1922111
- MD5 fed754a2d03ba930605a041b1d2a1c1b
- SHA1 f8cb4dc1fd901dcedd3596ec6bd97674a82b86a3
- SHA512 c091f78468f5562d8992e9aa61f0fc380ce28a8417f46fd700ef06b857b62335089cb7ec6f22ff9632a8e49ee421a89990056d194d7d2f5decf0aeb217d59a0c
- SSDEEP 192:oAlhZeO/wNAN5nWIrsuO/H/e/J///KbXGkwApwXdL:oAlhZeO/wNAN5nRrxC/wXdL
- TLSH
  T18B02CD125E9A990040B3CA361C8CE53BD75D8B03DAAD59967B7CDA1B0F70B90A0C7D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/base.py
- Size 3KB
- SHA256 f5ffe813ba84e0d0b447b463d07719d57db1f5b2d33a0b071ff33562ba94fd66
- MD5 6413fb9a1804443fbf6a181b7dea0df5
- SHA1 d7161073ca4b82911023c4edf3113c4b7a360912
- SHA512 f8469f1b0751d50ac118b1377924ebdf6c53f9cd6aaa52a35f3090728bff1e2dd623922d6a0a75d3f37cda2f816b0f0d02b6a669161a1403d4a605aa8467cfdf
- TLSH
  T1B5715B186C4BD796D5B3CF2BB8065817D75E83A359AEB453B8FCA4860FB1120C0D8DE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/processors/c_processor.py
- Size 25KB
- SHA256 50af0f5cb11e69185fda4e4689393002ee8f2a4f07b58632d4cd843bca3948af
- MD5 075aaa3794e9a755be8db61931c7b075
- SHA1 95daf9e706fd5a9f39424160d253dbb6ebd55df0
- SHA512 d5d07a22f782d18342c6d5cda2c84f472db46fccd0a7678a0f7b487c5629d74d0fa3a8c7338036a0f295cfc7a45f7a1af1537e805cc6135efd0f639e9d6d9d0b
- SSDEEP 384:flV7jDxnfIvOkdQGfHKmEamShRKErI1G8ULo:fX7xnfIWUfLIkE
- TLSH
  T1D5C2BD194D61A55550F3CD3ADC49E92BE31F07239BBC7042BBBD40522FB039186BAEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/ia32doc/text.py
- Size 4KB
- SHA256 d4e7bb81cab81b02279d9c1568ebae047d078757393fac82e754917935d541dc
- MD5 fa3962530231fa7d5462c69b96e777bf
- SHA1 f006797afe5aa14a875339c04b9d8ade5be1f2d9
- SHA512 16458c17fbec086b7384bd5c039aa4a590abe338714c1c388b57edb9ec374c61552ed0f7ab32ccbc63dd0507fb60f610ee711f7f95dec0880a5ffd6e8115a8bc
- SSDEEP 96:KUHRXdpRRBdTpa+RtnRrRbRfhmAfd9e94iJM6NrMvRubsRU:93BdTpautRF1UAfd9eRydEwU
- TLSH
  T15EA1E1008D5FE64C6276C76F4588C92AF30689AF5342452EF9CEC1961FB1D8E87F15E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/main.py
- Size 1KB
- SHA256 916cf6f005c87982f860966642e4483eae954e877ce1f195defc8e97652b9b76
- MD5 0cf9d1af9e9ba9cab8c26f086e0dafcb
- SHA1 b5212c3cd17a8e20e51eec8576d581559866d04c
- SHA512 3b97de1ebb13ba9a2025f93f1f61a117774cad33f4f38d5b39cc2d6f24703646f95235220aa9991e11bd747fba35434fb21ebb5d8dd2165b982f8cf263d2616a
- TLSH
  T19D218841AC0E656151FA026C7858ED03EEAAD7A32732507370FCC7553FB4890E0AB52E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/yaml/Intel/ControlRegisters/CR0.yml
- Size 8KB
- SHA256 f449ef5babea3afaf8118a7d95aaf649d6aaac5224336b29a9a5392c0f2777a4
- MD5 bd6dc5c8c67e22f9af01c2b123f8592c
- SHA1 89282043166333543a1e7443cbcb71b83f5ee61b
- SHA512 26f5d8dd961f7d335787d5a2bff37ad1ed33477ddad92a700a6ab6679aeb20f152e0768dcf0e31d673b517c48e672a16a669500a6039412547930c5b993672b8
- SSDEEP 192:nEpqo7xoObTLYsg+qeLzWBdsYw4J5sXOkM7FbTqDlQYjyWdPo:Es8xrAsg+qevWk5ky+byQYjyF
- TLSH
  T1A5024E8BB610A3B61DB70024083ED386D3365947A361D565788DE3382F717EAC67B2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/ia32-doc/yaml/Intel/DebugRegisters/DR7.yml
- Size 5KB
- SHA256 dfeb387cc1f0a4180506f37586a2f54dffb00ad0d061b03443504cba32108792
- MD5 e54763bd15a0fcf7c50da001dfa9a020
- SHA1 683445dcc01707f46da6bb37fc4e8b1ab5769997
- SHA512 8d8c6d10e4148da2893cf7e3013dd958a952249ae1ef0fa2ea625a1456a37e79a82fa037e9b93a9e51cf59044aa8e53c0b8d7713a0aabd39ae6d6adb187ab380
- SSDEEP 96:OEiRh1toEhNM/coCEgpXUDnBMtfoXQvnH10EJbaHL8Ns1ojRNMZ2kBEAdT:OEiRhHoEh8coCEgpXUL+fAQvnH10Exaz
- TLSH
  T131C11F22CA16619709B78272289BC747D33BDC1BD2195872BACCD3185F711CADABA06D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  DenuvOwO_SRC_V6/HypervisorSource/dependencies/pdbex/Scripts/env.bat
- Size 111B
- SHA256 44fb60f6d1b25363f6a1969696de1f204d0af72dc49821e1cb404227bbd081b6
- MD5 246b676eb1a4d7af50a039025052bab2
- SHA1 8eca5f794fe5880e7afd23700dbef694d4908b6a
- SHA512 305127370bc0d898d4e8475611a18dafeacbf0b365c0163355a0ca106d1c4649b1f8cb40a1802a421e9f804af4b392b67aaf164b3cc78545fff9c2d2869f354f
- TLSH
  T176B02288A22088A20020E80C22882C803008AA822BA02EA300008A22A882B80C2AC8A2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32