9fe77aaf37b630f846217e3a9c3613d4f3c6ef55201139e79973e10a2c59c062

Sharing

Copy URL Twitter E-mail

General

Target
PZModUpdater.rar
Size 115.6MB
Sample260913-k8f6laxthy
SHA256 9fe77aaf37b630f846217e3a9c3613d4f3c6ef55201139e79973e10a2c59c062
MD5 0b1bae3a980a0b31c47c38f69c90d06a
SHA1 5ab279301949ed8956fa56ed21239c8790ef6cbb
SHA512 387ff967d62ea731869fccd0d5901ef00b4c669dad02b430619686ff33cc804e6ab5e1476378881eb4b62e9d0c3e6b775e10008317342792d0f86782ae511ca4
SSDEEP 3145728:q6J8bV5aFuVC6w4gg4DfMTtZibVWcc9NfRRn6PS:3ibV5aFTEgg4gQzc9NfREPS
TLSH
T1C048337F7F5A7D98D14C0936E5CA2598F3533A120876A4ED0F0119DAC6B4CAB6C2BF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  CefSharp.BrowserSubprocess.Core.dll
- Size 1.7MB
- SHA256 f71b2350862bed7efdb102f1e1154ab5126a03e878be277c9a1820ec446ec78b
- MD5 11176db726ba29988e8b5a467290e354
- SHA1 4a33f40795213796a10947b3ef8b3fa1385bb282
- SHA512 8d0624d89ad8fc45a3c8403ed88a4ff61d93fe1945b2f3b94e0f5fb6c56a59338a0c66aaeb589b811cca8d2e4ffd8bd77a9e0d56ffa9645f91a54fe880312efa
- SSDEEP 49152:kBTK0YSyyNUoUn6P0AcTCzCiVihQaqE7DNsFHGcoSiSTx64Fo:qTKLSyyxUf
- TLSH
  T11E857B1967591521D2BEF27EC2A38A49C6F37801D312DACBA851A3651FDBFD8807F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  CefSharp.BrowserSubprocess.exe
- Size 6KB
- SHA256 45829de1d35182dfc911af1476ce02423accbed82b059fe2601bdf607da0a85b
- MD5 bd41ec757b0d8e1726d85d225b16e937
- SHA1 230dcac4ae3db4b0c7020a8f6c3d08c02427cedc
- SHA512 0cb7a85470c43481cb5f10d0506b7ada32bff3e69b6957a95945c7cf5d6882757f490797ff93876f4c5b36fc431e659e7d46d0b319ccfe348c54dc13cafee690
- SSDEEP 96:v6ZxLI7k5mQBDveB+XLeFZpetmACNt61OYcXe5U:ULIimQBSMXLeFZbsAYcXeS
- TLSH
  T1F0D1A55083D86372F3B306B678735681AFB2BB679C4F47EDB44C415A2F36650D923252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  CefSharp.Core.Runtime.dll
- Size 1.2MB
- SHA256 8c7f841a2bd11fbe52efaa7a77c7e21dd43a0faf26454b6f33319cb36b3d9d9d
- MD5 58222c6e0b8a022b11d38ec77ae8a56f
- SHA1 c7b335b412bffd5bdcd6e17b0e0e2a1d078e5c81
- SHA512 d585e220c948bb4a1327d92c6387a98425ae66208ccf87b2980b8b17a0693f998ad17219e120d847167674aebbb654ed89f60ca23a9b563b275efb7722f40316
- SSDEEP 24576:Tv98ew0NMAouoyFIOpiTieSiecbggIqc8TNWxXNkjngPaTgeWYyyx2NOb/LM:j99zAKFIOpiTieSiecbggIqc8TNWxXNn
- TLSH
  T1C1457D2A22461866D1EFE23F807347A6C7B3B51263A1E3CF965183551F6B7C4C63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  CefSharp.Core.dll
- Size 1.0MB
- SHA256 e02806fe08283aff2ebc38755a90b02e60483b701ad017f84a01473e360332ee
- MD5 4297d262bd9d39c9afcae116894514c3
- SHA1 6104697642233f9c27665f89ca496d175eed4731
- SHA512 85b37cd10702a04525b460436aa72b34f81fadecc70fef8dd37373b2063957d925f0b3f5d0ea28c769bd8a9b27235ce99734d90776f7593c64698b45a4a3e2d3
- SSDEEP 12288:SVoLr+gV7tRxChgPWqGZ7o381lZWs5ZCDMPXqEutqHZM0K5B:Au7QJZSolB5Igf7aqm0K5B
- TLSH
  T1A43596393BE4872EE6AB0D71DF205225CB70DD863227E3A58AB0D4F96C4D7105A1DDB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  CefSharp.WinForms.dll
- Size 53KB
- SHA256 dc917ce1d3d2216095906348d2337669418946826feac47aca4a260c3e1ef103
- MD5 f7e5581a78ecbf44e630f71bc5fa7344
- SHA1 ad8b5505739819d1d02a2f30d7c713ec69249070
- SHA512 977436b7010982714d4127239228bc04dfd1402c88929a44d5e0f56e85fbb810f5bed8d2f09c2dce8d67ad7c8af0c65c1c305686e36bf17a25a6695329721463
- SSDEEP 1536:XsOC9/oqRXptiDMiztPkmJOpUAi+mrcwKb72:Xe/o2Biz1kmJO2APmrcwKb72
- TLSH
  T11033F91257BC9A3BEBEE0A39683015521F71EF03F996E7B99D40B1E619B73804D403A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  CefSharp.dll
- Size 277KB
- SHA256 8209f716027a60b59a5eef8ddb2b7c963a1fd64fdef5c5a3f155c52a288487a1
- MD5 a0dc2bb1645fd6287cfdf548279b1abf
- SHA1 42516d63b2f738a09baf62f5f962952c3e28baf4
- SHA512 793d838e732fb414bf91c666d7d77751e14cfefe0b199c39847843b8f523b2ef42d4f7f512541d13d10ee8bcc1167e99d095f387bcee7d0f3a792d2bc673a97f
- SSDEEP 6144:IKFXJtmI3XjHCrK6ya1BzBqolTM5xfx8A+pmjCV:KMYdyaMzx8U
- TLSH
  T17A543A1123BC927AE5FE8B39F8B11819063FF90AB431D75D0D0A665D2BA3B449C52B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ObjectListView.dll
- Size 428KB
- SHA256 4f91758b670b3f46d2deacf24fa8ee537041115668216e282381d9ccfd3614a9
- MD5 5a7e33a73f2c67d8ccbd76d684d6a159
- SHA1 dd7596e0f3a847e7ae9e330c7a838ec9ac779b7f
- SHA512 2aa01902efdff85481db3be97c20e10a123fa241c9131fc26348a7c29bba0a06bd17c75bc2e5e0c0dbe4e14e00790330e7718390709a12369f53dd88618f3f10
- SSDEEP 6144:5D03Wzr+DNNMsOUETu20KhofLKINsp+vwfbVgZNNJ7vH4puTPgPgU59lrxmsR7uP:BzrQNzOuxXTGMwfbYH4puTPgg
- TLSH
  T133945C093364A7AEC15E4275F0540968A3F6C27973C7FBAA2D50E3AC2EC3752C9521E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  PZModUpdater.exe
- Size 287KB
- SHA256 61bd9faed0ba6efe160cc2ee60f482d3ccdc48cb1c04a05ef7afc8415b1b0aed
- MD5 808a86a44de6df3fa1435cfbeb432f77
- SHA1 0ab9a7c6a52d8e8ca9c5cf43a2cea1788dc3d609
- SHA512 7c7884dae14d454860e8c563d31837d4320e609a990c0a5c9bbe9b43a4e6b479949e26ed5f0b4928a11b9a6a55d34a8a9eb80b007ee499282361a77b93540c40
- SSDEEP 6144:C974m1Xe+OZ0uycdEGbNU4qtP6v0w0KLfGWJb6LfGW:C1qf0glbw
- TLSH
  T19354394125B5C492F4FEBBF8793291600A73EC6B9875C68919B631CC84B0B83DE6275F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral9
- Target
  Serilog.Sinks.File.dll
- Size 32KB
- SHA256 5b70dc2eeceb1963f9c3690c1cc8ffa793b280e903fa9a31780e6a7bb0bdfcf9
- MD5 c25357a7950dcfc7f85ee9d593cb1a24
- SHA1 6a533712852465ab3c11b5c76004312d6482f07f
- SHA512 30ca628b17b2a51bd9974fe1380caf728e7826c2bb552e4bc5ac15be8f819e908fc1744932db23734fec64e0f2c758372d8c49d019407efdfb076133c6df70c6
- SSDEEP 768:0E4c3g4vuh+t/j7zAJ0eBHdDaXRrbNoihV0gZ:2ktt/Hk2eCXR9/p
- TLSH
  T13BE24A4577ED239BDAEE5BB8FEB112510375FAE2F832EB2D0648505F2C06B8549107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Serilog.dll
- Size 137KB
- SHA256 37fa210bbdcb8f0b1bd2935b241e0c92859c7d8cd3c017a603cf2f7e958be72e
- MD5 b5a1a1534277ca7c55f8378e9f0b0c6b
- SHA1 39fd423ee30b4927fd297eb8bea3e03752ff708f
- SHA512 3db009417422c2c0a35e82f430f01d640a2cd0fffb50100d3b7ec1a1062bb8d37833107f5857d41386bacdd2ceac2942005feac04f6703176acf2e2b7c67cdfe
- SSDEEP 3072:TCcU8lfCzlwbsUishRyz09AJkNTM5q+n:TCcU8lfCzHLyPDa
- TLSH
  T1EAD32853F7FF4656DBED5A35E4A011040FB9F08BA5AEEB8F7A0966FB18133100B40666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  chrome_elf.dll
- Size 1.7MB
- SHA256 cd72ba59560bef9ab9535363f1f9a43fc6dbcb1d45d3bb6fc758ae0e003a3810
- MD5 fc4a676b9b9848d9c24ae219113aaf89
- SHA1 69cd7d84d44244b9b2b0777ffeabd046ea83b288
- SHA512 3bfba6b97d4c1c761405ad51a4867a2460437a012f9fc1191220d57d9a3aa97dac58c3345633020fc03126804f7062d10b450fe3c9c80318d8d103980385d130
- SSDEEP 24576:8l2OhpVdIN4xAjnqAN88FaPmsUacR3dQ8F3p9uZrUJSQTuQq73uVGZc:8ljZIixVANPvFZwJCSQTuOVA
- TLSH
  T14F857B13F29901E8C05DD179875B9232AA62BC450B35B6DF0A90B7962F7BFE4673D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 6f193603585e3ae3436e354c70a7e52c279c99857f666becfbd805b5ba1e94a2
- MD5 7009851ec438b78c45886a26eed1add6
- SHA1 3649e636ff0e28524d072659f5d96801c4ea410c
- SHA512 1f82d3f4b3233d68c63dc52f97c5ada7787390cdebafd6a8829daeb4e6c94d8aee7f598f0b5b4daa8a98fd33e14853e3993bc7a82a6a1bc985f3114bfc5a2dd9
- SSDEEP 196608:vQ975R/wzptWO9DOtR6d5qTyX4OEVWiVwQZTDyg2geZX+7cLPT:I97jwVtWO9DM06TyDERV/pDygeZX+7G
- TLSH
  T145472A122646D49DC099C8B9C3678726CA6C30E73FA778EFC0B451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 494KB
- SHA256 edc2277ee2a8e30b0bf1cf9d15bf5aecfd3e8b6c2b9645a83b49150ee0c98442
- MD5 e2e86773aee55a3e1b4272046ce4c157
- SHA1 77e0ae59a053f3cf90c0ab6645340f676e414f76
- SHA512 929df785e15710d424f420e79ba47b1891d5abf4a44dfd1d668edd51f098958eaa61d3bf947deb3df3d27a7d95dbf7061eb4b5859f0566ca09bae26a78e9f6ba
- SSDEEP 6144:G2EUlafVTsYn6TB5rqzeFU0jwbMGDfc9jV3NkCl63okvBv8faV5A:WUAUTBUeF+bMGDfc9Z3uClMRpU+A
- TLSH
  T182B48D16B2AD86ACD42AC134CE538647D6B678521B70F6DF03E0527A2F77BE45A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.8MB
- SHA256 7d6b61bffbbea5be37ea6ff6ee5ac3de32da9434493655377c8f2af541a2dbc6
- MD5 9fc2b94cf7f4a2f9ae640fc44ca93d4d
- SHA1 fc8d2daf2c8f4ec1f336cb9aec26c618643f8dd1
- SHA512 5344380505c8f3c885e839a6f6c98d7b799acb3288567160a69542da22de9fbcb901d21b1fb16d7a6ef1a29559194b8bc5008b6a5684ee9fc29d802308843a93
- SSDEEP 98304:CNFU4yJ33qh3A9vgaORbbzPo8Pnc926971:OPyt3LRgaYr+B
- TLSH
  T12D867B03F69580D9C01DE278876B9623F634B8850734B3DF2A9457152FAAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libcef.dll
- Size 237.8MB
- SHA256 f390d3e7a7f1003beab5f0e78d224abedfce6e8d67b5c3806fe1db07f84e22f0
- MD5 ebc70eacd9fed3a97e72d4796bcfd077
- SHA1 8250da0aad62925b1d8dcea2f266ea672badc2bd
- SHA512 8680ec7646828ea48f69ffdad6cb72b6dec77d8759643a7cc66ee5143842a7f94e15578d3ddc1e981305824dfea657e8d82d5b1f8b6f68ca76c7287f9d0e9c71
- SSDEEP 1572864:ykqXFOArsan3PjhOq2I2uQ/El2KJkEOwA9RdCbNKtXYTWhH4iYhLrWPazhefl8B3:446sejPQ/Wv1e
- TLSH
  T1DDC88D03F29A41D9C06DC1799B4B9633FEB1B8494B25B6DF0B504B922E66FE4273D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  steamHelper.js
- Size 4KB
- SHA256 4f08850d6f312ca99709bb0e87d27a899effed05b74bed75e7898ea7209ba522
- MD5 00fa6720b82560c45f4254c3078b3116
- SHA1 014d8843925e1b673757e8a74f0dde54e7510e85
- SHA512 bba81dc48f7e25c6a2dded0e1e391af67361ab6dd5cd0667831fb6b57b19fc62e196da1dba46f3f8ca2a26836cc8af9bcc2e3eb8b353ea6f99b9f63e5008180a
- SSDEEP 96:qwkL59uE25Tpm7qiQ+Wct05QTDgHuCus3KU4rliEeI9Cyb:Zm7qiQ+Wct0WgOr4b4rliE79Cyb
- TLSH
  T1F8910F1F31B053744A9730251F8FA6887224541B9209AA043CEE925CBFB197D8EFB7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  steamcmd/steamcmd.exe
- Size 5.2MB
- SHA256 4254b193ecb34ed539a691f254f78bfc10112bb6800111e4b43c24ad2d7f9e92
- MD5 0e6212774d13d42fe66cbfcfaf7ee1d2
- SHA1 690869e65d8cf7fefcaca8aa58ba059f369c2a2c
- SHA512 012639754f778d16980f9144b9fee72acae6ed378329b76311dd6f4b652290a51f23510050049bbade4e8cfdb33e6fad6c81b5ffdaf7d5ff12903f41ce9162ab
- SSDEEP 49152:YGtlqEToIU6iFVwASOSC35utho2q1auxUj3hkZ9lFIbTXzHhfrtZCO4u5EqePtWq:7j+LsLvkUw4tZCOleoXsyO/Aj/m0KT
- TLSH
  T12F46AE56A7E850E9D57BC178C9868617EBF2B80503719BCF06A0877A1F23AE51F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion spyware trojan
behavioral20
- Target
  vk_swiftshader.dll
- Size 5.1MB
- SHA256 bf4d7cfd835fe6b835b495fdf6034485c9af3a7bcefd33e30f6b7e04d6fae227
- MD5 16eaa074da42641899d40965440a67c7
- SHA1 94abe293a68ca7bd3cef7d729a610e406aa4a7f6
- SHA512 c4260da758952c3f483493f872007b673188868f2205b14d2245248898f2a1319c49cea940ffedd0faaaad42158f674743d294de25171ae4063d97f1515d8320
- SSDEEP 49152:dHz3Hagx+rUr36slQe9LGht2Xay6oRnmgPqBaxjYAPqIJoF1PsYxWU8h7cNw/w4H:5z3HagxuBLvzd5tXUlK
- TLSH
  T1E7463803F29680E9C06DD579875AA633F231F8854B3276DF26A00F1A2E69FE0673D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vulkan-1.dll
- Size 907KB
- SHA256 8fe708f1986bfb51c10b2f6bbb4ae8bbdd6c71b35431f036de1f5a64716d0755
- MD5 22e1eb048b7aae61e94e50aea9ac95d6
- SHA1 46c64b346bf2a7a54c51b1ed900462a962907466
- SHA512 c980bf2944c2499113c393ac543bc59009b3bf32450bae6ac435a7dc9abf46ac872a95ac9cf14a33e7fe3d94181dc548680f8065409b19c04c4dccc66486f361
- SSDEEP 24576:WP534J+TU15Tamum4jV6Z5WGcTDYsHQD26g3P0zAk79oOHaFNZlS:2M+TkGmuvV6Z5WGcTDYsHQD26g3P0zAs
- TLSH
  T1D8156C13D654CA69D97AD034C9D1870389B174832726BACF02A817047F6AFF47B7EB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22