PUP.Gamehack.GSD
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.GSD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0ec1fd9c7a7334be2a7015ef272d43cb
SHA1:
fb7fa8fdd5ec401f140f480117cc5a0d39123a75
SHA256:
1A30E590181298595DFB072D4C14EB8F0BD8E56E75BA85FC26B18ABCFF289863
File Size:
46.59 KB, 46592 bytes
|
|
MD5:
dba923526818bc9962e67c77f20761cc
SHA1:
9ab6cabef4e2648d627e1a21a75424af943d7ce3
SHA256:
03ECC1BC096C66F66DCAFED59068BB9E9892E75D43C6A924C7D0C1BCEAD69A5A
File Size:
151.55 KB, 151552 bytes
|
|
MD5:
f81f087e5fb76e55be09fa1ec3f4a55d
SHA1:
efdddb58c505a62e57bc37fd248fba14367ac407
SHA256:
A869A84A38E20B5EEEE5EC7261960DE774199B541C20D2ED3C06C85802A86DE8
File Size:
147.46 KB, 147456 bytes
|
|
MD5:
5b08e86a0c178116420d15e7560aead4
SHA1:
035b7b4fa0ed22f154557cf97a2f84c3bcc511c5
SHA256:
100437B0046B1B03E5167152DEFF40C3C3A37F393973BD2F4728D3686D905383
File Size:
25.09 KB, 25088 bytes
|
|
MD5:
42deebff3add713031554245dd03ec7e
SHA1:
6833cd070ae36177e4df9aed36c66d35310e6d23
SHA256:
61E0A15828EFD8EB21BD8258EFD22F42470CE4554B85B562549D329BE19FD589
File Size:
55.81 KB, 55808 bytes
|
Show More
|
MD5:
0d6b443766bdb2415de4978bf9622be1
SHA1:
aadc1379b3650e3a14684e577fe6ce21a75bafbe
SHA256:
70AE3F225421CF240F0F1D7DA80A2A93EDE90962A2B5CD057040350FFE3D60B4
File Size:
55.81 KB, 55808 bytes
|
|
MD5:
1d3124ee2d24014cd2163a0a335dfd1c
SHA1:
5c753fdc3a12a0ed3f9b2752aaab4a5c36e28312
SHA256:
01E204AFD8D63FBDB582FDD332A10F2AC95C72158A0BFF826FE1F2AAC6E58542
File Size:
47.10 KB, 47104 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- 2+ executable sections
- dll
- HighEntropy
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 135 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 130 |
| Unknown Blocks: | 4 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
1
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.GSD
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\desktop\cshacked.pl.url | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 块뿺佧ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 㥲֎꘧ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\edge\thirdparty::statuscodes | (NULL) | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\elfbeacon::version | 143.0.3650.96 | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 輶ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\elfbeacon::version | 148.0.3967.70 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ꁘ黖ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
10 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open https://www.cshacked.pl/csh-super-simple-cs2-glow-t188083/
|
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.cshacked.pl/csh-super-simple-cs2-glow-t188083/
|
