Analysis
-
max time kernel
514s -
max time network
525s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
16/06/2024, 16:01 UTC
General
-
Target
Orbit.exe
-
Size
2.0MB
-
MD5
5de2a10bbf43eea7059747b139f9f728
-
SHA1
ee56319da9bb880fcc369002c2c628c76910d38a
-
SHA256
e3b1599e3ec5862347b24336ca0e228d45a0becb6f6da45f619dd8e03e75854a
-
SHA512
c206193015d0c663f737b421f77438ff4a62bc4d7cf5016b86a3632ed0ba0f48df6c0ac4e7929fb9f89d37a302ac744c2a0e289c9e669a75537fdd0d4fa8a902
-
SSDEEP
49152:oKn5Sz1xoQrp2OJChuMb14Z+cjDvkui9XZlXR0RcEnAUwn:W/Nr8py+cjDvkui9XHXmREUwn
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orbit.exe"C:\Users\Admin\AppData\Local\Temp\Orbit.exe"1⤵
Network
-
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN A -
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN A
-
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN A
-
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN A
-
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN A
-
127.0.0.1:49728 -
52.111.229.48:443
-
8.8.8.8:53raw.githubusercontent.comdns
DNS Request
raw.githubusercontent.com
DNS Request
raw.githubusercontent.com
DNS Request
raw.githubusercontent.com
DNS Request
raw.githubusercontent.com
DNS Request
raw.githubusercontent.com