1aeecbc2e971fa1ca83bcc6c995fdd720e78acf71cdcfbc968c03ab614f678ea

Sharing

Copy URL Twitter E-mail

General

Target
Orbit (1).zip
Size 74.6MB
Sample260416-a225dadv2k
SHA256 1aeecbc2e971fa1ca83bcc6c995fdd720e78acf71cdcfbc968c03ab614f678ea
MD5 3b61d0d78e0131ad9537159bc00f0279
SHA1 3d0a3fad97d39fb393d9d5ab2a5109653de4a04a
SHA512 f221f576f0997cfba51467e30020ffa7df555259763db0e486a96811202275cfa663dad924cb397374a3b0be0d922f4df67ea1990876c89d88ddfa4b0d6d85a6
SSDEEP 1572864:wpDZgx+M7YYr37nYeLCGaye3u27fadpJa3TOO8yrM92j6+oY0DFdJKZiT7VQ3:wgMM7zTYeww27KOi9xLBd7VQ3
TLSH
T13A083383E0C9C69CCB5A2029F67CA90D17D6B653A0BE4637A54DC7C9239B4560F3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  !!! DEPENDENCIES !!!\VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH
  T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  !!! DEPENDENCIES !!!\Win64OpenSSL_Light-3_6_0.exe
- Size 5.6MB
- SHA256 b995a5fbbd9a3d03bf33f974496749e5743abae97e5561b814e1adf72306dce7
- MD5 26814fd4a5ef7984d1f0927cb67f6c5e
- SHA1 db7e885dbcd302fc30b33b8c3c4a9a6d95e63dfd
- SHA512 357430c3e928c563de856d4764e77f7a80831a0571c96cea42a066c46382b8b19167b2e6ea64b2d6f06bd901fc47ba4e07748c83c2b5492d3dfec9bf13be72cd
- SSDEEP 98304:ZHQMqdYKcqQVQ1dS+uPApyYPdzogGKCqGXFYKcqQVQ1dS+uPApyYPdzogGRj1X:l9qdYhqQAS/PA0ydbGKDGVYhqQAS/PAw
- TLSH
  T1614633C769669BBECD00D4B9BF2D07586B763E63CCFCA629B29F635CB5325442420231
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer phishing
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  !!! DIAGNOSIS !!!.exe
- Size 12KB
- SHA256 efd2859c60e3d4cad67e47fe6c4dd6ddb70894389c8ad35ecc081964769a854e
- MD5 c0841c27405846fe0bd5fa24d82d6cb4
- SHA1 8ed3e2d3e6f6667f704ef859dd08cc73585c4673
- SHA512 d6447e770fae4e70188ccdc803005bc31574909e103b25366aff44e0a74e04137f0d1b7a26cfc15e61b1c4c2601557c86eb064638b25768c4bbae84e5c0f5353
- SSDEEP 192:BM4T7Ei2npVbeI2kNyKExTLmpl9a4/FOIV9K3Q5tfMcmGW:BMW7Ei2npd/HyKEcpl9+3N
- TLSH
  T14B42080BBB934CFAD42082B580B31E11D6B3BF309322938B8BA4D5291E552D0BD7B54C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  !!! EXECUTION !!!\Resources\Source2Viewer-CLI.exe
- Size 48.7MB
- SHA256 1ef232ccbc4c7e319db8c2467f7a3afe493ef86821aad0c6e6470b06787c1ae9
- MD5 8e8b2512849eccf99cb330d6cc1c85d0
- SHA1 e016064809e4f114fc4d590be02116e386b23441
- SHA512 ca030a81c6aa76b7ec12efe6bd46b3ddac7c7efb5f74259e88610f964b115b567093ead68380ce7360db45fdaa74e9cd849dfde1258753d3a3902691bf155434
- SSDEEP 1572864:PHO3wvHivBA2PmWBPf1ROAWeJUO/p7UFlDudgjzg:PO3hvBAeme37puDudgjc
- TLSH
  T14DB71256E2F900E8D57BC0B8C65B5527EBB23855133097EB56A08A692F33FE16E3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral7 behavioral8
- Target
  !!! EXECUTION !!!\Resources\cs2-dumper.exe
- Size 2.1MB
- SHA256 d8c6037429da3502682905ec8d0e6bb3ae33da5f0392a293d67d9e1b9b546de4
- MD5 a38a353a4b6b0230e453c79455fbf3ac
- SHA1 09c8ec91c1f4212a86c67df575cddd695d07892e
- SHA512 7b364bf4a88bd27c6d546ee06de9a7a7a45a8f5e0cf9678d699e0fbf18428fcbd841dce396d98e63370c39c6ab7fab8147bd25134e430b17bc1587ffb40e45e3
- SSDEEP 49152:K3t5r5U+LN4W0UWZa3EDauXkfwwpgRxgOoowpQMvc:e6UybSiP
- TLSH
  T17AA52816BAAE98ECD2A9C474C3464A732B6170CB0B367AFF40D456353E69AE41F3C714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

A potential corporate email address has been identified in the URL: [email protected]

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10