HackTool.GameHack.L
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,798 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 5,180 |
| First Seen: | July 24, 2009 |
| Last Seen: | September 30, 2026 |
| OS(es) Affected: | Windows |
The detection of HackTool.GameHack.L on your system indicates a potential threat to your computer's security and integrity. This detection name suggests that the malware is related to hacking tools, specifically designed for gaming hacks. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is HackTool.GameHack.L?
HackTool.GameHack.L is a type of malware that falls under the category of hacking tools. These tools are designed to manipulate or exploit vulnerabilities in games, allowing users to gain unauthorized advantages or access to restricted features. However, the use of such tools can lead to severe consequences, including damage to your system, compromise of personal data, and potential legal repercussions.
How HackTool.GameHack.L Operates
Malware like HackTool.GameHack.L typically operates by exploiting weaknesses in system security or manipulating game vulnerabilities. Once installed, it may attempt to communicate with its command and control servers, potentially leading to the exfiltration of sensitive information or the installation of additional malware. The exact mechanisms of operation can vary, but the primary goal is often to provide unauthorized access or benefits to the user, while also potentially generating revenue for the malware authors through illicit means.
Symptoms of Infection
Identifying the symptoms of a HackTool.GameHack.L infection can be challenging, as they may not always be overt. However, some common indicators include unusual system behavior, such as unexpected crashes, slow performance, or the appearance of unfamiliar programs or icons. Additionally, if you notice that your gaming experience has been altered in ways that seem suspicious or unauthorized, it could be a sign of infection. It's also possible that the malware may not exhibit any noticeable symptoms at all, making regular system scans crucial for detection.
How to Remove HackTool.GameHack.L
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for internet access to download removal tools.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the HackTool.GameHack.L malware.
- Uninstall any suspicious programs that were installed around the time of the suspected infection. Be cautious and only remove programs that you are certain are malicious or unnecessary.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings that the malware may have altered.
- After completing the above steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that all remnants of the malware have been removed.
Conclusion
The removal of HackTool.GameHack.L requires careful and immediate action to prevent further damage to your system and potential legal issues. By following the steps outlined above and maintaining good computer hygiene practices, such as regularly updating your operating system and applications, using strong antivirus software, and being cautious with email attachments and downloads, you can significantly reduce the risk of future infections. Remember, the use of hacking tools and malware is not only a threat to your system's security but can also have legal repercussions. Always prioritize the integrity and security of your computer to protect your personal data and maintain a safe computing environment.
Registry Details
HackTool.GameHack.L may create the following registry entry or registry entries:
File name without path
hackatack.zip
Analysis Report
General information
| Family Name: | HackTool.GameHack.L |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
80f78b974344be20ab70e9a68d0bc150
SHA1:
aef5ee606e5c3e431056ec2adfe9c0baa96fd2f3
SHA256:
081B74491AB122EEE5C2E65208C6058290EE9BFC5C5DFB20DC2121B50C56146A
File Size:
1.24 MB, 1243136 bytes
|
|
MD5:
84b1982320173750bbf29d1e8d7b8caf
SHA1:
e3c6fd1bdc5dec7daf30b5dcb6826ae696745d2b
SHA256:
BB594790E961F17B9481BDBEB27157A7DE80A42AE41757E25D5FF48040BBBC17
File Size:
462.37 KB, 462372 bytes
|
|
MD5:
97686ba83507b28185635c37fecf9507
SHA1:
417e4edb54a9bc099833016f00af4a097a764369
SHA256:
9D8B89080968FF3A394E8538BDD980D21135FDEBEB337AFE484A8CCE735C5E40
File Size:
2.17 MB, 2174656 bytes
|
|
MD5:
93947201fc52fee64473110f98c8cf87
SHA1:
494df3a6e8d59926223a49b59b258c082e4db2bb
SHA256:
C0BEEEA106049B256A7A758666192A3F87D5179D94DF40DD02E1B1B1CF6BF048
File Size:
1.49 MB, 1490112 bytes
|
|
MD5:
bf55ddafc75083d40ef2ce74b02a94e3
SHA1:
bb7981f0f714567f098359440118c5e58f1a7e7e
SHA256:
C336400131342D3A0D7F07EEDE126C60DA6BC4E8F002D8B9120A747B74BF8F28
File Size:
792.61 KB, 792609 bytes
|
Show More
|
MD5:
d308092ea7689f63e60824546c66b441
SHA1:
995b33597db87432e3a960496c8bfb6d4aa5ebde
SHA256:
BB0765E272B2334CD130D86CD97AD82E037D4F14EFD2E136B5EBC87CBCD0FB95
File Size:
1.33 MB, 1333760 bytes
|
|
MD5:
71e8e0c642ca7ed9cd5ad58235052dfa
SHA1:
cd85e46473c347ed875db457d383e42a58a6d150
SHA256:
9FAADABCD79AFCC8FD871A5B09EEB982EF83DA1142887A9D8921151A686F1637
File Size:
1.23 MB, 1233408 bytes
|
|
MD5:
22f434fb5dc620fd9b9b42f19cb4fa49
SHA1:
e7bf7f0357fad4dc1f29c051e750a6319b13c2e9
SHA256:
B790CD08664C9DEF165921B12393C38546C963B8CADED232AE4F1841C80E4706
File Size:
1.31 MB, 1314816 bytes
|
|
MD5:
e751260ce250cc238d82786775feeaed
SHA1:
6fb10d80f326d1268eab32f3ec6a5ed311cf973e
SHA256:
602171C10844667D6FF0B6CEF4A20920D7EECC87A8E0EBEAED9368E4C113178E
File Size:
646.69 KB, 646690 bytes
|
|
MD5:
f8e9f31384e5dc7b10b630a4d0228acc
SHA1:
8272ecca6f11ff7ff009dabc8e279e961df9ea79
SHA256:
EC91ACE2278E79AABB282C089923BF2AADE37F6050CBA240038C5B87940DBB9E
File Size:
1.26 MB, 1260581 bytes
|
|
MD5:
35f971fb1244b90a7b98c686d76074bb
SHA1:
975b329ac7f03adfce8f45fbde1fa996c8ed07b3
SHA256:
0FD4647CAAFE8FCF8B3E4894602838D39B4EC66F560218BE2E5CF1B7DB61604A
File Size:
691.24 KB, 691237 bytes
|
|
MD5:
747b5ee1cebef5ba31b4e200ae369308
SHA1:
f9bb9b6d3f1f2eab971e10217e48b1d91c5c4370
SHA256:
A9CD0269EFAD85D47998BF2FD7E66035E36E4BF9B596734A5EBBADBD48A977A5
File Size:
7.28 KB, 7275 bytes
|
|
MD5:
19e6c93da34b13a234e344add4981385
SHA1:
2a850c8ba46d2baa5fa2470b48924ce115675b6f
SHA256:
3B12498FCEE2ED60D15E2DCB9920C37AEAF8ED55E76F49F8A3378233830F83D5
File Size:
1.26 MB, 1260585 bytes
|
|
MD5:
8ff461c73736469a794605318759d2ee
SHA1:
7ebb10275e6a6616ca4ac748631caf723c494732
SHA256:
C7F447ADB5ED97773DA23BFC6D19CD9561FDF878322CDD18C3461163140682CE
File Size:
656.94 KB, 656937 bytes
|
|
MD5:
87a44f7f3ab73f30d90a869557612185
SHA1:
8ed7f13117507942bca6b6ab6a9e3ad0ff0df416
SHA256:
C0EAD5C1777935E0172A14CFCE2193D26639E998CE00668015C09B2BDDB0CBBD
File Size:
561.71 KB, 561710 bytes
|
|
MD5:
9b6b897a704ed65f6eee117a6af77a8e
SHA1:
e658b14da918a58cecc2cc20f8311c54ac36c563
SHA256:
D04CF1DDF3552DEB23CADBD8D54168EB013DF69B762295BD1239B1EAB3C8A027
File Size:
1.87 MB, 1868480 bytes
|
|
MD5:
e732e6d35c0ca97498f63d8864701baf
SHA1:
83aff64c95d011996f63a37bbc495e2194811e06
SHA256:
77F6EC80F774798C1B632D68FDF37433390A1C6EBA2524FF403BD20B763D0702
File Size:
629.76 KB, 629760 bytes
|
|
MD5:
55ea3a2ea2ae460f30fc2b253286d564
SHA1:
6044743a89213fd84719f5f7f1658f344423bf06
SHA256:
298B2E6763A297DEBFF1B8129B2F2D88D01D58652460765DA0A04CF72E57F712
File Size:
1.48 MB, 1477120 bytes
|
|
MD5:
8162446f3f6e70a3750e36d8ab34c616
SHA1:
f25ccb06f01f7e247443c7070678998694e2cfa1
SHA256:
C6F7828C6747E6676040DCBEFF204D8B734FDED6268D8F0519DBC0C16E43F8C4
File Size:
1.35 MB, 1349632 bytes
|
|
MD5:
59b7e5090dae02d21bda070e92a89c50
SHA1:
b9f9d696cc8a93408e10a79112dbf0480fbda2f2
SHA256:
375DD6AC80A67096CA99C10EBC802CB186CA54571AEFCBF93AD2BAFB2A30E014
File Size:
735.28 KB, 735279 bytes
|
|
MD5:
70f6711b9e9f2219ea676195ff1b3cbc
SHA1:
4d87a45a18c11b85b0e206ac98ac2391f8dc311c
SHA256:
96566E11D38E4970A3534FFC2FBCB9685B774AE11901097A1A5800852298C691
File Size:
579.07 KB, 579072 bytes
|
|
MD5:
0b3d879a5626c7752eb65fe0bc46a50c
SHA1:
c0927b20c79c2e93735bf1641502f3b79d401a9a
SHA256:
981DE2406354A5A293553A12BE54CBC5C22AD9A6EFCFC10D065BFB3023289DB6
File Size:
877.64 KB, 877639 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | CheatHappens |
| File Version |
|
| Internal Name | 1.3.3107442 Build 3107442 |
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- 2+ executable sections
- HighEntropy
- No Version Info
- ntdll
- packed
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 106 |
|---|---|
| Potentially Malicious Blocks: | 17 |
| Whitelisted Blocks: | 88 |
| Unknown Blocks: | 1 |
Visual Map
?
0
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
x
x
0
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Autorun.SA
- Buma.A
- CheatEngine.GA
- GameHack.L
- GameHack.LA
Show More
- GameHack.LE
- Gamehack.LH
- Ursu.H
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\delete.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\files.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\gta_snow_andreas_launcher.bat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\gta_snow_andreas_launcher.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\tempfile.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\tempfile.dat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\tempfile.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\tempfile.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\cheathappens\work\cheathappens.net | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\cheathappens\work\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\runtime\cheathappens.net | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\downloads\0.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\0.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\1.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\1.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\3.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\3.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\4.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\4.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\5.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\5.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\6.mp3 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 6fb10d80f326d1268eab32f3ec6a5ed311cf973e_0000646690 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 皺冶 | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䁽삈ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Ik g �B �� �v �� 7� �� ��� T�B� �����%Bx �< �!$�� %�'�!(�(X�(�) ;*J*9*�",=� 1�1HO 5,]5�G>�� @V� @�*B F Fy� G�IH[uH�pM�lN$N� P@jR�� X � c�w e0Te�h h�rk�qq(q�XrnJ r�vy�v�!w�ny�a | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 闪 ȁ 獖} 偫~ 엦1d ᵂċ ᵆċr ֢ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Jk k �B �� �v �� 7� �� ��� T�B� �����%Bx �< �!$�� %�'�!(�(X�(�) ;*J*9*�",=� 1�1HO 5,]5�G>�� @V� @�*B F Fy� G�IH[uH�pM�lN$N� P@jR�� X � c�w e0Te�h h�rk�qq(q�XrnJ r�vy�v�!w�ny�a | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | Kk k �B �� �v �� 7� �� ��� T�B� �����%Bx �< �!$�� %�'�!(�(X�(�) ;*J*9*�",=� 1�1HO 5,]5�G>�� @V� @�*B F Fy� G�IH[uH�pM�lN$N� P@jR�� X � c�w e0Te�h h�rk�qq(q�XrnJ r�vy�v�!w�ny�a | RegNtPreCreateKey |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\ndfapi.dll,-40001 | Windows Network Diagnostics | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 7ebb10275e6a6616ca4ac748631caf723c494732_0000656937 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 폭嚁 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 83aff64c95d011996f63a37bbc495e2194811e06_0000629760 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 휹䭛 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 4d87a45a18c11b85b0e206ac98ac2391f8dc311c_0000579072 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 邦䳐 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| Network Winhttp |
|
| Network Urlomon |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
|
| User Data Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open C:\Users\Zyvhckqw\AppData\Local\Temp\gta_snow_andreas_launcher.bat
|
WriteConsole:
|
WriteConsole: c:\users\user\do
|
WriteConsole: start
|
WriteConsole: SAgfxHack.exe
|
