0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06

Sharing

Copy URL Twitter E-mail

General

Target
Game.exe
Size 4.4MB
Sample261024-1tqdqaxtbw
SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
MD5 617b560ff5b82a7ef6953c0da35f2aea
SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
TLSH
T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://xiansearch.com/xext?i=

Targets

- Target
  Game.exe
- Size 4.4MB
- SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
- MD5 617b560ff5b82a7ef6953c0da35f2aea
- SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
- SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
- SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
- TLSH
  T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/tidy.bat
- Size 10KB
- SHA256 4306c2771929f739eb95ccb194a7eb433fb384703db9b10e0460abb996bad142
- MD5 e3166d068f5fbd5f2d4cf876b6570023
- SHA1 76838b5dd4f056426438ea57a7f53ab95426a9fd
- SHA512 f20a753d47cb787474202c42f08f77c4fcbf1bcb26ccaf3543fca7e93acd891ac67aa18c660331350b8c25cb2b60f13e126ad68571b3837e1b7e936daf66a0ec
- SSDEEP 192:uMWapyx5oB++XpcHK5fAdGbHZgQvnZ53jkRO6UZrbNsOi2v3G839ufIl3AQ694mc:uMMU/Xpc0AdK/NufckGSYvuE1EGl0GlD
- TLSH
  T1EE22649E35039AE603769BACCDE36C10D66DA2A9C1B1D1DCF4CCD3CD83D9697828225C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $_2_/DiagnosticsNET/configuration.tmp
- Size 2KB
- SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
- MD5 0a011fde5ef12a6aedd47d625852fda3
- SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
- SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
- TLSH
  T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $_2_/DiagnosticsNET/update.tmp
- Size 636B
- SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
- MD5 bf7546635574ef69ad6aea52341f2ed1
- SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
- SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
- TLSH
  T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  $_2_/Features/update.tmp
- Size 1KB
- SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
- MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
- SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
- SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
- TLSH
  T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $_2_/Features/x/interface.html
- Size 1KB
- SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
- MD5 654bd04df4f45643537d9c5e0fd3d351
- SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
- SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
- TLSH
  T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $_2_/Features/x/interface.js
- Size 1KB
- SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
- MD5 833ef87f0265c87a2cdb6600a0ed39cb
- SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
- SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
- TLSH
  T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $_2_/Features/x/script.js
- Size 296B
- SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
- MD5 5c38641814eaf858f45080f8d3bb0a0a
- SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
- SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
- TLSH
  T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $_2_/Features/x/security.js
- Size 31KB
- SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
- MD5 b4020d683acf7468ba58f0025848891b
- SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
- SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
- SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
- TLSH
  T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $_2_/Features/x/web_accessible_resource.js
- Size 1KB
- SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
- MD5 dcc592cf6d40300bd8e61e650438dcda
- SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
- SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
- TLSH
  T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $_2_/GameSavings/Windows/win_libraries/32/dll/aplt.dll
- Size 6.0MB
- SHA256 43440b15e2863f53483d61bb2f219e0a7e76b5b575b3b63ba166d94ea81e0c1f
- MD5 c673c311f3733e3ff49b381b2ce0e66f
- SHA1 6289753f51222af4b7da9d5c2717db9895cc816e
- SHA512 8e4ede3a68895d3cd631088cb21dce922c578fc4262d7612ccfefa5493b6a9bb2a6bd6f542fd0f169ef458f4942b0569ef46f87864d694ac181f8833547c6aa6
- SSDEEP 49152:eScQ3mB3o6Q7P1wJIFAM4fIRHsrN/EoG9W9ZauQudLfQWRsdenarH0WHiOiupWY:eSvmqNP1rFAOHw69i6udLidenarHiOl
- TLSH
  T114567C42B702A0FBC24F4170F19D973DDB234A5843648EEB93946D78BCE6F911D62A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $_2_/GameSavings/Windows/win_libraries/64/dll/aplt.dll
- Size 7.4MB
- SHA256 f0cc602460e122c431e0c47b484c8917ef7b38483ad470f5a6540d5acdc37a8b
- MD5 6b81344f9de5e0f9b50d18b091e4403e
- SHA1 d96f0648a29e6f4a743706ab62178125553d37d1
- SHA512 5f5e8351ffb0a123bed229afb49b2927db19ab845701beff8fb5e7bf63642c1b83112dcc655087e8760b425eeee085b3ad7037a68d664ff72fda893a9d4efac4
- SSDEEP 98304:ms9RoXoYBPn+FWLBGBbVL+ipFC5uDnXnV3n+PV:QLkpoyXV3a
- TLSH
  T1FA761911BA5B98ADD15AC87483478A735E2170DB0B36B9FF41D482383F69BF02B39719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  $_2_/GameSavings/Windows/win_libraries/update.tmp
- Size 630B
- SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
- MD5 84b4ed0b6882be985d81dfceff59a9bc
- SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
- SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
- TLSH
  T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  $_2_/GameSavings/Windows/win_libraries/updater.tmp
- Size 13KB
- SHA256 77142f53bb0bddb4a8bd57701f65dd90d1cda8804c3e995bf23934653bf7d1cc
- MD5 9696b2c7cf128ae6ffcc4d82f33d5b71
- SHA1 29b6f15c524c456112bcf79febbff57a7d525364
- SHA512 5716eedf31b7f54a5ca5aba19ee31f7ec89a5a5d011561bc2964cef66fbbb8489a8ce55ce06ed48b08501a1bbacb653046671899342e73c8568967be915687b0
- SSDEEP 192:oJkbGDL67REEWI6/sTirEBADMqCCWA16PhY4cyEGoiJfUA/eQ:oa7REBI0clA1cp
- TLSH
  T1A25251146D43661A0AF6D72DEE99902CFF0B403F5A791220B9AC47082F76069967CF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $_2_/SdkWin/update.tmp
- Size 2KB
- SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
- MD5 43e825f9f6cfe537a3e623343b2a7d5b
- SHA1 f0f33f66637f30f992797973a80d8063f6687869
- SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
- TLSH
  T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32