2711dd8d2a49681886f9e770e1d7685ec41a63e4f92aca57234cb4e5fffcc40b

Sharing

Copy URL Twitter E-mail

General

Target
assistant.zip
Size 9.9MB
Sample261102-xtvrnayx9k
SHA256 2711dd8d2a49681886f9e770e1d7685ec41a63e4f92aca57234cb4e5fffcc40b
MD5 81b63a5f5e574ec3edaa0ecb641969bf
SHA1 62cd23a6d6a65e1c314faa488e8fedb6e9732a3d
SHA512 094b2f0498667926ac5879bb623816691b0d7b41a24b5d1f988ae834cdbcefa51e4f1715e5dcecfb840604cb93c016b1493057ffe983a1b4a3a2ba879138f521
SSDEEP 196608:gXZRyNLxbyW1KR83YlkEzj38GpWCH1gBB/vShrAYBzybtB92Vlu8fhsaPPAFy:gL+1ja8Ylkij3ivSdAkVQGAg
TLSH
T161A633E9E215F8A9E09F8A7CC89F716F02DD0541DE91B68BDD9500FE402909B27D13BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  cports.exe
- Size 190KB
- SHA256 a82c70fe52f0142b4f72340aefe2a4f54c55cf352e8a042274802f43a9c3c19a
- MD5 996b2a9ad2af67fbf9629e86a42597c2
- SHA1 14f47a3b1fc82806540c5139b37d2f2a834dcd60
- SHA512 47892c4d65871d45c12aaa8a889b2be2d2a87b1a12494a5fa7a35baecf36be72a0103a9e643b0ba77f6805624d3e1be15d5228196a99d0ab24bb11b24d38ab3a
- SSDEEP 3072:9tOcwHdlKCt4fasynGmluPVV5ro2EGixRHFNc4q3cxxUw3yL8YXI/1:9CspGGmu9XrGhFNcRuyw1
- TLSH
  T1EC146D46A7B410E5D5ABC976CDB38723EBB178944734865F5370DABA0F23310BE19326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  dependencies/ViGEmBusX/ViGEmWrapper.dll
- Size 43KB
- SHA256 9828b5e6c7a5c8e3d684d8c048e14b0cc567d07f2a649b926e31126a4d6d45db
- MD5 9053d4747feb614cbe4947d80231f791
- SHA1 ec7e0487e22942951d949826ac907080056d8108
- SHA512 bd787e9bf503007a3fb70a7756af9e4e2aaee9c0852f06430aaa1354bd26889fbe0a7589bc35d168ec70b89a04ae7388ab75f37aca6af2eeb60e49ef47748e07
- SSDEEP 768:ALj+IdyImAbdvgQwh4Krih4VbZ8Ik//PcqQ33ScQIvMl83:4xHEhprA4VbZMPK3iuAA
- TLSH
  T12C13E00A1BF9A5A5DC699F3EEAF3AE510330E716040ED7CC1CD8BDE94512B65062237E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  dependencies/ViGEmBusX/_virtualGamepadPoe2.exe
- Size 653KB
- SHA256 9f18e298b1b8d1409cd6e40b7211947d4d05c9ebe1c14f7245cb5b771e8162fd
- MD5 9ad3834a4801be413ff1380d6bd0e027
- SHA1 448180cf4a9cd134c221fb745ec4907a3be160a8
- SHA512 bac23ea2be9139c7d326b50c5041fe5c603d80febcd248d5e8a95ebbcab92fbd6418b59f62b64cac0d62ddf985da53ccce3aecaf8b072d3d6f1cbbe9e7fd1f94
- SSDEEP 12288:XKPjdhAUJFWgl6riAcbMuJl2/ZEkXHP3KEUU3:6Jhjrl6EDlCEuKEUU3
- TLSH
  T119E4E0D69E404464CB2DDBF556B6DE3B93BBDEE56F32E0009006B7A26B331CD2172906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  dependencies/ViGEmBusX/virtualGamepadPoe2.exe
- Size 670KB
- SHA256 cff1a09cdaf01e35464653556cc7caa2ce26a3e13cda9f68e9d73acc3f973478
- MD5 fcd255276844c319ce19e8d50025242f
- SHA1 46d044faa0ea6f2bce67fa877423cf3e0c588b90
- SHA512 9ea3623fe0107022ec631029ed79302fd1c10d1558b0f877f43634536c81306c1f27a0bb5a9ce6453a3ea2581c3f71f0b325b189f15e788c7923881498dd6944
- SSDEEP 12288:5U62YZ6GRhLOiIuLhtZsKo4RUiD4xYmFnjye0WWBxEaf:5UgnnPLr1/RUiDwYm4ZPf
- TLSH
  T123E4EFDA8E444560CB5CEBF455B6DA7A43BFEEE52B32E5089016FB766B330CD2531802
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  dependencies/ggpxeditor/GgpXeditUI.exe
- Size 3.3MB
- SHA256 5fd2d0ab763573430230b353ce7e60bf5e8935b1b29eed7ef12a9c1c8a7adcf5
- MD5 87f0271301a4a08c4aa11dfb20be72ce
- SHA1 5aa06ec6e03596254237774efac94068c9198ec1
- SHA512 40040227b20be03056257aa9fb698b830f03b4c37ceec4897597b05a24bc9ebc1ae2bdc22d8582277dd162376d94ee1911ebca8f7f42c6575faca0b8bddf5d80
- SSDEEP 98304:n93zeoa88zCRERpm0/Mw0o2PZ0vuHspGZ0:n93z1a88zCRERpm0/Mw0lZEuHspl
- TLSH
  T19DF5F702A6E04916F2BB5B3C99B54920E773B9871831CE1E36AD144D0BFBB40BC65F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  dependencies/ggpxeditor/oo2core.dll
- Size 630KB
- SHA256 4758c7901cbd68df1848b7afed48c1975ad59b509886c21b87c0e91d717446b5
- MD5 a555e1cd5870d1fd7c385d0ea695aa2a
- SHA1 28b7f7ffe991a02bde8e62fe0da92e2e259348f3
- SHA512 3404ab5a635a5980683d73265190647399e4ea062ba6a3f0abab59c2b69e503abfc4af2942291ce2e4e829fa079cfa73000cf8cd88c7489963b59ba3b28d1c39
- SSDEEP 12288:VdAwMfEGT/SOqa61m1qdjOsLI4iVcwIBBih5m5JQgzFf/3FL5icE//rekCye:VdAwMfEGT/SBdkUBBihM5JQgzd346kC1
- TLSH
  T1E3D47C92A2D151ECE2A78139CBABA213F3B13859032459F352B8DE752F4BED0637D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  dependencies/overlay/overlayapp.exe
- Size 7.8MB
- SHA256 241e7f33e36a3db5acb6a750820db80789d09b546793ada9ec2ab28ca1c18451
- MD5 38218addec8590e6ac4f71aab0fef094
- SHA1 35730e61fb9cca35529cd7d77a1da7f93f2060fd
- SHA512 51a6a3c3c0e1e95f019b4c743212b53c463ac9f430999fc125c1461ee158b3781eb50e27e8c4247ec74b768dc86423ef2421fe2abc4ea639a6b0a762711bc29e
- SSDEEP 49152:ic37znoOw5xqwzpdjrlo8j1IZZGGT3pb80E0AvLqK7C0HQV/2XNqwfo6ZRA4ZHcS:ic3nQpdjqA6qIATHCd/wNs74Upq
- TLSH
  T1AA869D13B7984A77C59E1736D4F6840143F0FA13A602E74F39CFA6681F93BA669113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  dependencies/selfpatch/PatchGGPX.exe
- Size 275KB
- SHA256 05a68647e25cc2bfad790b9a21e93a95f71e4e913833f8e4810c3ad64c151e66
- MD5 a193792712e37a6ca4e05a270441231f
- SHA1 01f933831c4de1c98d8aca409d6e4589df465774
- SHA512 523d715047696e67703f0e1890221e6b36ddbc8e9ef5eb73b684df9f745b7b918e52b2ccdf294359501626cc0720f9b44812d9c7d5066bb64847e2c5742c3453
- SSDEEP 3072:rqvmgiYSoIk8uIHzlqRwa/fB26dPIgNZvd2T2q+jSzdsnOclpJ1dPzCzkT80:r64k83TlEvhTIg7sTq2TcPekL
- TLSH
  T1F3547D0BB7D843A5D1B59A38C5E35814A7F2B88B5773E7CF2B4046B60E137D09E69382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  dependencies/tradebot/BuyBot.exe
- Size 1.2MB
- SHA256 d56a0594fe1dc839596206872c6c4c646471f8b917fb7a0a90c1b734f42ac4a7
- MD5 8a25cd5fc5ea14da30ab1e3e9fbe955a
- SHA1 fb9865c25f3b10e3fe3dc411027cb33b3e3d4f39
- SHA512 67dbccddc23e769a6f2a82bf1b17f969e5038342c8cf127085fd4ca1f984ca97bed0eb8689226be16a04f3f86f417ac63fd22105d0121c8e96c5fb38147b94ef
- SSDEEP 12288:tvggNaxme6lTd41oB+Nh0iNIfNbjwL9Ju9dOeqe8Gl8W+XkOJxPqu2mSKps:+L+Td41IeswL9JsdcGCdXkOJxPTqos
- TLSH
  T16E455B13B6E58D36E2BE0B34C0B2580897B2DA05AF67EB8B2B96137D0C43791DD552C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  main.exe
- Size 2.9MB
- SHA256 dbaa7944905055060653034ae2112ed39a89188ef581f8334e96e0b621c4d896
- MD5 5a72ea7cf62a6e6faca85d2dd0ed5783
- SHA1 7224f59ab4e9e01c8e0d7fd570d46f19d50d7c48
- SHA512 294ee0631a8f9ecc94841ab11b6cfe17523a5d4ff4c48938da6176124cf64988c9eac2d5a0076086c913597ecc33db39351b342b1714a147de8d81a00eb7d597
- SSDEEP 49152:qiuSiClkzCqIqUXzLdxwEg1/w8+W3rnaPLR6HSk1rsDj8HWAJEiGLtcBV6fiAIYV:qiqr1B+Snu4HTJsYWAeiH/JCV
- TLSH
  T159E5E14773E6C1E9DE6781F6C9114223D671BC2017388ADB25E49A2EEF73ED05A3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20