3f3234a668d563848d135f69e8adacee9557b1e220e4fd20317209cbc0deb6bd

Sharing

Copy URL Twitter E-mail

General

Target
GTA 3.rar
Size 127.9MB
Sample260908-shqlcasgrf
SHA256 3f3234a668d563848d135f69e8adacee9557b1e220e4fd20317209cbc0deb6bd
MD5 c29f44cc40c095dca5e9049fb6b23f23
SHA1 9fd14390b14d598a9483669d421bf86cbdc84f17
SHA512 df43b49a584c29b31aec7028d21b56182540ba74da2323c45f99bd8133aeb6849a4f2b1b21d3399397c45b685f8afe86378025dfdd71556eedaec39cc81684a6
SSDEEP 3145728:DGwDi0aRZaZVINwEI7WqLH/mqbMlVEctdXfuHsd9XSp24EKkoAqx:DTKWVINmb/efEEXb3Cp2jbnG
TLSH
T1EC5833C652387293143AFD594FFABEF03E9FA090226551E45A56C7420ABC1BB473CE6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GTA 3.rar
- Size 127.9MB
- SHA256 3f3234a668d563848d135f69e8adacee9557b1e220e4fd20317209cbc0deb6bd
- MD5 c29f44cc40c095dca5e9049fb6b23f23
- SHA1 9fd14390b14d598a9483669d421bf86cbdc84f17
- SHA512 df43b49a584c29b31aec7028d21b56182540ba74da2323c45f99bd8133aeb6849a4f2b1b21d3399397c45b685f8afe86378025dfdd71556eedaec39cc81684a6
- SSDEEP 3145728:DGwDi0aRZaZVINwEI7WqLH/mqbMlVEctdXfuHsd9XSp24EKkoAqx:DTKWVINmb/efEEXb3Cp2jbnG
- TLSH
  T1EC5833C652387293143AFD594FFABEF03E9FA090226551E45A56C7420ABC1BB473CE6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  GTA 3/UHARC.EXE
- Size 108KB
- SHA256 bf522b64c3fa144537cb65799f6f11d1676e3c93fbaba5af2de3bc82bf213fea
- MD5 fb9a6dd17ee0b1b8f74b5a9c6b62036a
- SHA1 5b7cc4bdc191de0505bd0d66e1b446f722ef7923
- SHA512 5fc0c006f634c97345642fe0cc4f15c5785299bb5f05af7f98c2c57a7446812567bb590b1e50c9d26b38b1e9b728150e491c02e0e71a14d6c707c09898d225be
- SSDEEP 1536:j5dtPj2UwKoyChlyG4CmPjYYO6FXYz2yDti/rEb8iu5Hj9z6O+JicB6SpbIpj8vm:BHhCOG4CmPjJpYzDkweBRu4cB6Y3
- TLSH
  T125B313861A583A4EDABFDB361E5B7D96F0D6660083F5EB0AEF7002C6207760C712594B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  GTA 3/Unpak.bat
- Size 557B
- SHA256 41cdb18866b325c76c4aa6f5e560bf037b742001e046c744ec496ad4dfde6e0f
- MD5 b2391ec55bbdda331bf0a16dc8e87f0b
- SHA1 98c897d440d45a49aa370beffe984851a7243af1
- SHA512 8730566aa0e5c4e2d10ce66863914b3a03228aedef84b38a27fc16bf36f00834cb6dbfa145572f19ccb46e75bf94d078108e76bff941858f6066ae33d86e928f
- TLSH
  T16EF0AF13030B679E98AA9DD5DE4F95A02F4F819F124531C9440FD9C05684BF7E261CF0
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution upx
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  GTA 3/Unpak2.bat
- Size 224B
- SHA256 9c6ff9ed02395c4c87889f088b400455ffee4273b1789b9354eea6b387d17949
- MD5 a21d26e825601822c2f6f9423323bc91
- SHA1 a5a159e1dc7bcfff4a6d32bd07242f5ee41baa6e
- SHA512 227c161f9094acc9f84df212de658d506631bb9f6fbe918d435577be60be571281fdbd2882601d16fbab1b5ae3703699ece3b5971221f4e9ad51352b62a54837
- TLSH
  T193D0A9271342BAC224AAD8E29EAF90802F0DC0CA015132E9810BC9E00E80EF29B36C60
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  GTA 3/gta3.exe
- Size 2.3MB
- SHA256 3324566fbf0b654dd910fa90e2e434e3eff1abf9a5cd2d648a118f5597a11134
- MD5 85414bf9eb414d00ad81062360f0db1f
- SHA1 d4d8ec58dc74eaf87d9d8e05b2ebfaacd21079d7
- SHA512 bfb7309d6f47e92ed9fa56ca45e4791cdf7ee0462fa9b9a43f4b5cba47e66eb08ece05e18ca71dbd45883a01ffa9f9be430732b6304b2c5c7e5b8a7c234814aa
- SSDEEP 24576:UFHl0oxv6dYEAGPxvOg4hPG6xw/CcfzYBIuk27Pic1lwT2mhnTOjrSekcJK9l4sq:J1QB4qiA1L6lwd5OiU4m0RaL3G7ZEs
- TLSH
  T1FFB58D41E69681B1D8C20FB95007773ED7290F082574A69BFFF66E639F51E2048BDB88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  GTA 3/rockstar.ico
- Size 5KB
- SHA256 53c3da01924dd2c426bd36d26cbd804072289c6285421285f4e34eb519540d96
- MD5 89f8cc96d7636f136cda64349ff0450c
- SHA1 7d2506346e8dfdc6f37397a50ab9daadb01a3ff6
- SHA512 38ee77dc3da2051fb2dff0d022306c1b0383a3fb05aef1c1a934f43c15064179641013e1d5906f1fd262857d1f43a95d4cb634b31621f34103d311b28a3a7870
- SSDEEP 48:+Otma08t7E/gbN1pv6uFWdOSK43bVh4v1Du/dir4NR/U4NrqFhQ4IbV55t:+OsJyg4Dnn4rVh4Q/G4vU4Yy4k
- TLSH
  T134C196F57111044BEE854F3286CB5CF36CF76EC252816360A6806A6A8D37B8DDC5385F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  GTA 3/teccutsc.uha
- Size 25.2MB
- SHA256 b1fad8150cb2ca244101cf3d3b2ffcab41d6fe363fc3452dd49edc7c2104752d
- MD5 8a2614f0bf7f1760075294a40f14f872
- SHA1 8738a54fe7a022ed7046ef277f8b12e9be1efb9b
- SHA512 9a92d3f65a999e8b7018874cc6a1a6eca3bc606eb632e26a56c2990317802e62f365afc93ac6867062bf44b0ccc1fb7f8c27c5a24a6e5d2fb61fb1a85d0a361a
- SSDEEP 786432:iiGwvbij03cOTNARcAaZpfuyZFCHJ3dqFk:BGwDij03aRZaZpfFDCNwe
- TLSH
  T1CF4733A9131E63457861EDCA8DDA19C26CDA03BD23AC6071E1D026D79F570FCA32C7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  GTA 3/tecimg.uha
- Size 30.3MB
- SHA256 6b6c46d77ed8f4aea79dcd88d0a012c42b2dd3643df7cfb0bf78cbe5700281ab
- MD5 6af32a98e433bd2679492a524970f99f
- SHA1 7436874963d12583259ecee71e1bd09e75c02d0b
- SHA512 03152a09186a4201ee898e6011ba6fdc6f5e29c70865842eed1f9b7ed7f5aafad5e4023a56cd96652d6c94efd94bb3cd54cf751bf56305bf27641cc5a505855e
- SSDEEP 786432:OVcI7n9Mho+EVpnrEyL3ty3iLhGre4rdc4GfFNbGbHjH2lNpM:FI7nWqLTrzLRQ3ri4IFNbM7t
- TLSH
  T1BC67330686786072561BEF240BEE6C366D0E3400BDEA71B85FC7DA5251EC7B7F5E4A08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  GTA 3/tecmain.uha
- Size 5.1MB
- SHA256 d774fc02494be20a66f00e4c69afcb331eecd48bc25ef02b6ee9145c155b7e9c
- MD5 fb6d584362d38fe66d2b4250ebcb2ecb
- SHA1 e303b8e5e69dbc241c56d40eb5200311cc2d58ce
- SHA512 29e348e17d3db8b8516b645ab2414ba73018aaf8d06a67e053433d7d221109cb779e6dfefdf9d9c687581025ee34be52afcb92cc01e2f0e3c91adc21205b3175
- SSDEEP 98304:14KA/tnF8Adjqbg6ZcGr827O9NKR8YbZEu5rLvN58pbVJk+NM:dA/lFf+gCcGr1OYlEelyG++
- TLSH
  T14C463389A51D6969ECFF66EB9BF6DBD0D848E0037BA0E4C5300F425214ABB046C8F5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  GTA 3/tecmisc.uha
- Size 3.3MB
- SHA256 1fac651994919ab3f3ee6eee8d91fec5cdb5a912c78b46ac619bc5c7e5cf637c
- MD5 c07b758e156ac68cc84a1042612913bf
- SHA1 0d0228de0fc3d0559d8daa71e68b99e8a9f316bb
- SHA512 5ff7618336ec121ebf61b463605703fd9df47bdf60a0481c2d55a5d2d180b0f66340b19e05d26588df12e1d4bf926f9118f9e36c63eb27929cc7b40bd476eb4d
- SSDEEP 49152:pTDM6mWtzVVqkfoUNQIIJH/bhBBBgJeUB5zpTXg8J+ePyEbRgih5kG86MwhaC1:pTg7CjIIIJfbhrCJeszZJ+1EbrC6ZL1
- TLSH
  T16EF533302940B273C1205955B8AA6CAA3B5FF401C486BCBE065DF743B1A77DCF85EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  GTA 3/tecsnd1.uha
- Size 9.1MB
- SHA256 085b676b2824ccd1bba0ad3644b471cccb2f652a735719752f94d18766ddc571
- MD5 13878018388673b01f41055cb9483a07
- SHA1 4f3f3fae5175a1981c2e6ee8d57c06cd20dda5a2
- SHA512 ea210cabf08f939508c084e348dac3d0d39ea8f44fe84c2cdfee03adb3913b981f1f6bb38629e3b620851f5c73ecbdb3742f3c9e6663478ec66d0361d00e3bbb
- SSDEEP 196608:Mr9HLERZcQZb8t2KxRLtcLmmNuIWhDFA9mi62s1GbGHLQM:M9YRZcQb8t26LnmNPW1i62sd1
- TLSH
  T120A633E03EA82B17930264E78EE079B08515E7E3012A91E3DD5452774FA9737889CDBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  GTA 3/tecsnd2.uha
- Size 51.4MB
- SHA256 9657676248dccf26cdbf4ffd214a6de6879ab29cf3cf74d125a08e6b4516c0b6
- MD5 5ee4f7e9a1f755ebd912630543d8cc4e
- SHA1 29bf6fe2d28c0ad4175083ec0c92798abd2684d1
- SHA512 a9811260d9b726c8fc666f7db5aea954886ce7b36cdd48710c3470bf42821d06b63615eaf2fdc25cadd9ea1a574915ab9fa4ac1a21da050b4c9b1191c5b1de3e
- SSDEEP 1572864:VztdXfuHsd9XR6fptYqTpaK2noIpdewfn:5tdXfuHsd9XSp24EKkoAn
- TLSH
  T115C733D79572B5C7283DB129A1E9A7F837FE98D0612643480F398A415A3CDA70B38D3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  GTA 3/tectxd.uha
- Size 2.6MB
- SHA256 fbad486f83499e6fef5dc9bc082fad0cd5472ffe3cac86a732bb33f2b55b117e
- MD5 c1502fd45382c3aa59fbe3253dd19be2
- SHA1 d414f58eaafdc1451331ce3a2cea528d9c6c9c5e
- SHA512 d56c673a178044b8415f9d2d829a1f7fab111aaed854763e66d784e940e3b2eacd2da0930610d8110263cf0d2c50cb2ddc4c32c5bcd4dd8759f2401ae2a0104d
- SSDEEP 49152:cjjhBj07ZYBscoMhOiAZYDBennULj5n46Fo2lu9HHAeMNFjK1wt1EQ7b801YJ:c/3j0eLAZQAUfxDqkYPMbKY1EQ7l14
- TLSH
  T189C53367D03D4D665C4BB51E7B44F6F4625AA1EB7A9C7BEB3122ABC034508A8C138C4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Executes dropped EXE

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13