2a7afbefb73e9101f3c604eb6c1032468cc3c089530e060b21707017664d62f9

Sharing

Copy URL Twitter E-mail

General

Target
Fivem_mod_modland.zip
Size 62.2MB
Sample261017-bae17sft5k
SHA256 2a7afbefb73e9101f3c604eb6c1032468cc3c089530e060b21707017664d62f9
MD5 e02a5d8e0ca6796150a5f3c7578583db
SHA1 f80c8f9cfcb15a7ae8c88e0e242345c9a52ce4c9
SHA512 22022a5b8e5b38eebc9dc8a55c9fea3b757c80f178978b2870c7fa3face3f12a1c54eaba118c2b9b2804bab18cd96bf6b29037ef19aab9ce7713c68bf850befa
SSDEEP 1572864:zlE3Rx4uTadXxQ15op/mXfWmawtjBCBkKjTQsGEQYY/LAhQYvMyS45:zWBxjiKJNCyCQYJhrS45
TLSH
T1F9E733D774FC9471671B85023E607BBEDE4541969AE2C50F3E53050CE0AA2D3BEEA398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  FiveM Menu.exe
- Size 86.1MB
- SHA256 d02c801d2c90b69b46eaf62cbbe7e8116249f99e7d29fed5a2292b15f8ab87dc
- MD5 4ccdd0a6713cab83e9d0178e28f8fdf1
- SHA1 ea8f7768af2393e8dc2727cf7c208c49ff0eec3c
- SHA512 40b46f994a1ed833b5ffe448074b94cb5a167361feb5f90cb00cd91782f87ab7d9b0725bd1701f22444f3c979be1f06ddc9ae8bc90fddbcdf4ff1a949dd9bad9
- SSDEEP 786432:jAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:jAZui3zQz2jOZKft
- TLSH
  T12F187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  x64/ExtraBypass.dll
- Size 133KB
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
- MD5 f808357eb75ce997e02ed7c936f33b81
- SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
- SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
- SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
- TLSH
  T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  x64/SQLite.Interop.dll
- Size 1.5MB
- SHA256 93b35c2c65f7eb739f8122ca09b58d0bf8a4653f772281c8c0be450146d32ba2
- MD5 5389512ffe243a7becec1d9fd58c84d0
- SHA1 580b65e88c4e0e4b91fbd13d50d28e858851ae23
- SHA512 ed42d5acb77db2736803c5d118cd0a1335e0396bbb848573d8295809621fc9bfb0b1faff7c085f8b4f5a08fad62e1330502baffba235c2431fbd655124738e91
- SSDEEP 24576:5CYA/V0MQ/AOv4FIljfL0lCNmjMO0qqjh3aF9dfOZph7/akDAz/PrZU+L0/mZfo9:ZA8IBFIljfL0lCNmjujRaF9dg7/YS+E/
- TLSH
  T140657C4BA2B501D8D6ABC17DCA175607FB7274051360ABEF57A08BA62F13FE2167E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  x64/sciter.dll
- Size 18.6MB
- SHA256 77e82cdf92f908a75efc0aa28a5b92ba36837ca309972343930f96c00dab8f00
- MD5 56aedce490069d72f6219d3ba0728168
- SHA1 a6399778ee997c73973be2f188fb3f05bb7be62e
- SHA512 ad648eebb456909edba00c9a795bf8575e3b30671302773831d0cba115d3f20dd55bc72b3d9cfa55d2e798c40d94d1c203aaa9b97387a751fcc967803b78fd9d
- SSDEEP 196608:zYyN5GzA15auSsLGaQz9G2n3VMBvkpYRNiNxK+:zYq5Gc1crsLGaQ82n3eBpRNiNxd
- TLSH
  T18B179D57B2A480A9C4AAC074CA57DE17E7B2BC590270C35F21F466EA9F377706E6E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  x64/wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
- MD5 e861eb5789c50997d9476a6172d1c269
- SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
- SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
- SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
- TLSH
  T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10