6ce4ae3dce7edae0f673088782011fc708be8f39347806fc40328b41e0f665bd

Sharing

Copy URL Twitter E-mail

General

Target
r6siege-esp-tool_2.6.5.zip
Size 103.9MB
Sample260604-n3acmsdw7w
SHA256 6ce4ae3dce7edae0f673088782011fc708be8f39347806fc40328b41e0f665bd
MD5 7b181b5de7b8231c05652267dfb3f39a
SHA1 7ea9103ff4802dc0510fddc17dab372ff81b10d8
SHA512 43924f63e3df5256b5994a8583899ab45143440bb3a674ceee2526c24c20f085077b2f18314e5cc2ec2ca6af2552bc076b13f3159c44df4cdde1cb6840ca152c
SSDEEP 3145728:0Cp0Jr8EZVkJMc+imTUOpFx2H2V22X8uw4DH07w7Y98EJ:AfiDOrGy22X8uJDZ7YBJ
TLSH
T1E23833C58D00A4C6644F7637EC4077FDECEAF61AD16388E9447EA49D4A22BB342F4A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  MSVCP140.dll
- Size 540KB
- SHA256 1e0547cc52028ff6bcfab1948b028366ca886aab4b4df53e6f7ed65b4aad0a6e
- MD5 51b38ba8816aacc681d133c378498a49
- SHA1 154fe0f63c53fd5c778d33136e97a6abacf8e2f2
- SHA512 65b898e037a10ec885d367a23c7cd371411b7f6015991658f1c4d2f674484eb38dc6fe9ce40a9ccf3bc646c95ab95941ba534c36e0016d4e3ba281397211c0c5
- SSDEEP 12288:+0MrE03u1mHWV/I3XJbQEKZm+jWodEEV7fM:+0p1F/IlQEKZm+jWodEEN0
- TLSH
  T1C3C42A23F75906E0E195E3B8A1838702D7F1BC598322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  VCRUNTIME140.dll
- Size 120KB
- SHA256 6a611ee3550f5d27952ddf02fa6e919f4c83a53d54efcde1d880614f0695bef0
- MD5 ae07f486215099f0a97164cb7a993bd5
- SHA1 6be3d6e8eb460ff24e80ef219257d6e7ceb1d0e6
- SHA512 71bc97240b5494c0d4536fbd2c863e0bd2dcf4acdd481ca7a33142d8616a1b6ed8b91f54644003545fe3b73db576a0c0014929717465993e9f9572b6f3708507
- SSDEEP 1536:29pCUgtBAVcxStMXcfG8VwfmpcGLOI5ZvIvecbeQ6N7y63LzD5rezF:GyA+3EOfmpcGSUgecbeQ6NO6bMx
- TLSH
  T13DC38B4272B802FBD16BD234C292AE67EB76F50687605BDF07AA86650F237D06D3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  VCRUNTIME140_1.dll
- Size 46KB
- SHA256 95f782c2a301004e8e2028c3ac622754e483b829d9382d0bf91fff3f8de7c19c
- MD5 725f9ae33bef3d7f18bc9f9021d84bdd
- SHA1 0ee3b9dc4cc0e5d670b359c1528d8d89e7bf1d6b
- SHA512 177ebf279b64db6ecb8ead8a0446c7757fa23285c6faea82441302c010035f6a29c31bc0df5fad9c9b2dfb43888f5ae8ed5c66f0a9052f1b61e405115422721b
- SSDEEP 768:zezSkbhNfI4fWLZySK4dPWGSw4DYKk/9zGnAQkC9zawC:IYZyNgPWGSgKkzGABezU
- TLSH
  T167237D92977C40C7E8AB99B0C1EADE17BD39F792576092CB0BA4D51C1E537C0973832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  r6siege-esp-tool_2.6.5.exe
- Size 23KB
- SHA256 4370360c76929c71f104c90ee0c51d53cf23294eb75bc91d90e9a7b9ff5131f6
- MD5 60783bef5407aad641ee4e4fbf437f2a
- SHA1 50715aa197543e14eab72ca740cf2665da3fe010
- SHA512 81cc0f8b1c79133d2d87b7c65b4b9902cc3de31e2c00c426569f60736630ebebf5777a4d5b6d99c5fec9cefdf1aac62976fa513d97d26bbe4ff342f35f8ff74f
- SSDEEP 384:rJ9tOg5Hw5rWlkhTWAxaWJOSEHRN7ZCcDR9zMSBeE0:rJTfHw5Klk1wpZz9zM+u
- TLSH
  T1D9B29E59EA6814D7F99A9570D1BAE84B7C38B7962B1181DF03A5E1180CA37C0EF3439E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral7
- Target
  vsdbg.dll
- Size 3.4MB
- SHA256 31100c7caa8d1b31d8089226fb8a7b629aa895e9a97db2f56e8bd7a04b485630
- MD5 ddb0e69f3d7ba4d49a9bb422e5cea38d
- SHA1 b0325ee06a4110df02c0c185eba7806f3b1c1aa4
- SHA512 c847cb7a4a45192eb7bb67558d6f6122f8f4b8acd742c0f395e8caef45ddc09923b4e416349f2a2f72eed56f4009806aaecad4d1ae61fd3570cd5360a7d0ecbc
- SSDEEP 98304:aLUnFeH0CnhZWt/59h3ExQaJKpptWLSYKUEARKNjCPV5AsHCh69Huhfxv6fD:2UnFeUChs/Xh2QaJhyEd5AsHx9Huhfd6
- TLSH
  T1C6F5BF43B3C06A9AC106D9758717EA36C2B3B8224F7691CB5D66DB0A5F73B418F39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral8 behavioral9
- Target
  vsdebugeng.dll
- Size 3.6MB
- SHA256 c8b55c35e1377f31d1146fd1afa85d241414e7e2b42b4cbd9c26150be0f3ea3f
- MD5 8ac7027a14dc5c4d55185b701da3b413
- SHA1 1e64deedfed714a0ad79b1beb3f08f55dbcab7f5
- SHA512 529d29f520f7aed821b3552947f00e58ab5cf484839c4fcfe5c5ea9eac7faebe609333ed3be2c6950d40e36389afe1418d846175a06df1755e4d76f7f595b506
- SSDEEP 49152:/TcBXx8ymjhrmdw02M9l367TJZWDs0w09nXBT/Ff/w2ZywfKi5eDg3WaFX1J:/Cnb6fLWDs0w09nX/wwfKiWSW
- TLSH
  T1B2061B02B35AC9A6C17DE6748C9B871EFAF175518B724BC761B00B6E6F5B7C04B3A204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  x86/config.json
- Size 3.8MB
- SHA256 78695d93aa5816a9286d98cd43fe3e91480f5e75c2f093cd0b9770063a0547fd
- MD5 ffa03d1ac6fe3edac1e3d832161b952b
- SHA1 dcf841ba1a9eaad351b0999dfb827cf68e65e945
- SHA512 80983b46723c16766bf68578c61a420ac76780164030fdb37db3c66b8b99ab69b0376f8d01134636a7a314f373d899bb385ae1b3cb069c9c7cbf3e1c4d90baf7
- SSDEEP 49152:NujhpVsu5uFj6n3LUI8JxYA+Wypu41rhWSsdIpJh1nuv6j0+43/pFjDAwBMWpBCt:IhHsQl4ZswrARgvhiWaOuBu0ijfs
- TLSH
  T1B5167C5B75A84196D076C038C957AB0BEBB1BC564730A7CB22A0372D1F737A06ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  x86/core.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
- MD5 71ec18ba5b3578bc2e88f64d60ca0797
- SHA1 23fc447c1f77a0167dccb5cbb5deec32014cac31
- SHA512 f9deea04df889fc493e5d12471451aa1590e15afb4019337fb1a296ca2286dd93f883b255ecf7e1bd84c35b887d425d837ef68ef9cce7ebe58df36ae77ac827a
- SSDEEP 98304:B8jd6lrLddIRBGprPmt/gP2XwIrlw168rk3PFHU:UiVd5PQ/gPawklw19k3Py
- TLSH
  T14ED69E86F0D665ADD617407421BFBB127D213E64425C0DF742E2E9B81FBA7403F2AE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  x86/corel.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  x86/obsidian-source.dll
- Size 95.0MB
- SHA256 a29daf1b537ab3cc653b62849348b8459e328b874b947f2d1a87b7b33dca09ac
- MD5 203874655c31694988df5160c40787d1
- SHA1 bba49e2f4e2b541492ef2e31f825d162c3b356a9
- SHA512 9472e2f42e07a4099e649454428bd6cec7febd57c4d8800a2dbf0e2cc07b97f39a3bee23eb73f964fdc71b416dbed1e86791a25b20a83d1202d19565f43fa730
- SSDEEP 1572864:t9Q1VxiPhNrce8VtCqS5r3QQvzBycQJ6cSeuwafXmhy+cQC6lvRFBYvy6pq74xn2:t94YhZ8VMqSGytQIZNjYdKdM8xgRUitT
- TLSH
  T10D2833C54E4084E229A6741ABCC171F9FDEBFB1390B7ADC9482EB1AD433AA7241F4574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Suspicious use of SetThreadContext

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18