Overview

overview

8

Static

static

gameover_0...ir.exe

windows7_x64

8

gameover_0...ir.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gameover_0.0.0.21.vir

  • Size

    3.6MB

  • Sample

    200719-tactefrqfa

  • MD5

    d03a42dc109f4b890b3d1d0bd70e0e31

  • SHA1

    38002380c8937a25ffc93aedfd73b2eb74c42eb7

  • SHA256

    d6a8fb2eea4ebfd8d25afde9234335afca980c7c49d94ebda88db4a00c493c87

  • SHA512

    05f487d2940692a370696df5ad65f343ee25c1d9456409392c990cac871fca37c90020e7e0ee11a85337cb73bc76707923f4d0b3777f15c1ac208878d2851966

Score
8/10
persistence

Malware Config

Targets

    • Target

      gameover_0.0.0.21.vir

    • Size

      3.6MB

    • MD5

      d03a42dc109f4b890b3d1d0bd70e0e31

    • SHA1

      38002380c8937a25ffc93aedfd73b2eb74c42eb7

    • SHA256

      d6a8fb2eea4ebfd8d25afde9234335afca980c7c49d94ebda88db4a00c493c87

    • SHA512

      05f487d2940692a370696df5ad65f343ee25c1d9456409392c990cac871fca37c90020e7e0ee11a85337cb73bc76707923f4d0b3777f15c1ac208878d2851966

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks