11ba5e81ce4713a29ce1b48ae79df19290cfef4193ab206b6045aca3520eeb98

Sharing

Copy URL Twitter E-mail

General

Target
R6S_OffsetDumper.zip
Size 15KB
Sample260623-pq62hscy2m
SHA256 11ba5e81ce4713a29ce1b48ae79df19290cfef4193ab206b6045aca3520eeb98
MD5 fa8082faf848ab583861136fd9c17540
SHA1 050415b640de9ffdffaac9993f790438807ef610
SHA512 e8e1f22ebab48f97c0622ac54359fcce64a932d3b352dc10ae63190dcfbdc6c6cc3c4c5db7de3d7de91bfa565c4907ea43ca3363580111c865c22f6254e3c60e
SSDEEP 192:KuZ1U9tCWGHSS/5VdXOXxf8hSbdLiGR7JvV+JXdNVKx6yq/sSED9wWAv/biLSPMc:YKjdCxkhEFiGRpgsxBgjE2biiJvh4CdZ
TLSH
T12D72CF7488784C03D533C779892A468D7D79024513EEB6EF621C13BB2F8B58A874A74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  R6S_OffsetDumper.zip
- Size 15KB
- SHA256 11ba5e81ce4713a29ce1b48ae79df19290cfef4193ab206b6045aca3520eeb98
- MD5 fa8082faf848ab583861136fd9c17540
- SHA1 050415b640de9ffdffaac9993f790438807ef610
- SHA512 e8e1f22ebab48f97c0622ac54359fcce64a932d3b352dc10ae63190dcfbdc6c6cc3c4c5db7de3d7de91bfa565c4907ea43ca3363580111c865c22f6254e3c60e
- SSDEEP 192:KuZ1U9tCWGHSS/5VdXOXxf8hSbdLiGR7JvV+JXdNVKx6yq/sSED9wWAv/biLSPMc:YKjdCxkhEFiGRpgsxBgjE2biiJvh4CdZ
- TLSH
  T12D72CF7488784C03D533C779892A468D7D79024513EEB6EF621C13BB2F8B58A874A74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  R6S_OffsetDumper/R6S_OffsetDumper.sln
- Size 935B
- SHA256 bbdb92c8ee46d16e4de213b8e372f5be0ae50171e13d800d78ee69ced98c08af
- MD5 8421c8e70f1013251cbb563b816e9ece
- SHA1 33bf430b432b16b32b30c73c68dff803d67e2f28
- SHA512 c35765086fd8dc014e7f8dc04f4435b44d682d1e492e11414a822d474bd67d2e0d01492b5d41005a47fbadba18202ce22c64d39432ea2e59282a3243d4f0765d
- TLSH
  T19B117AAC51AD6993E556039FF0D40C077E72038AB2B846BF889B685C7717B42C10B48B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  R6S_OffsetDumper/R6S_OffsetDumper.vcxproj
- Size 6KB
- SHA256 52bab5bcefcff74717bc0eec507eb68d2cc936afa9579e7f547508b7b2d34cbd
- MD5 75fdce23a4eedf69ccaf714f7b5e5f59
- SHA1 2c1d630fceaff5519e7be08fd01ac610e7c856ba
- SHA512 eaf3eafb5b796a1aa17600c07043965dda17926e57249d94a464a5963d74341443dbee0645ff215fabcfd7f4e8199d9594cc35ecf83974396e804f86d48dd257
- SSDEEP 96:CVwzL1fQU+UW14aZN4aZJRAf/zdPcbF+AI8zAPcRFeao:wwzLJdn/JPcbFu8sPcRFeJ
- TLSH
  T10DE1F190E4F89E66C1930237E1D24C469F71D7870D5A4828F5AEAB593F5B3446313B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  R6S_OffsetDumper/R6S_OffsetDumper.vcxproj.filters
- Size 1KB
- SHA256 28201179b6cf6478f0023b70a1b85c2b04a0710228447e123098c9593e020363
- MD5 9cceb697221a0f4b3d56e0ed8205668f
- SHA1 a736ec05bc85842e26c065f28d5ec340feabbc77
- SHA512 de3c0082efa21d825471371efca976000a4d09f2cd458e9e51768f3f1791c53d00613acec4b60c367d72856a7371075587d6f0d3c0f649c9a349ad250dffebc6
- TLSH
  T178212621C4FC1B8960265C2BFB84CD092F69B3F3A0C5514876EAD14B2FE2309A12B76C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  R6S_OffsetDumper/app.manifest
- Size 802B
- SHA256 c92faeef492c3b05067e5973ef18ebad6866dd24cc2710b97a701b19da0c6143
- MD5 c675c6375d766294e53d9cec9873045d
- SHA1 5f6b51a7ea175410ff3d709059f25cd303cdfb95
- SHA512 796f6aa948750310d138c71852405487c989659863db87e39b7414301e09d563fb9da990f7e41a4e921831a5b128a90751555ad17f19216b467db4013c59b96b
- TLSH
  T1C301BD81D9B8A5A1F34A11932A3192085675976F548D41ACF4CC4BBA9F42DC78B930F4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  R6S_OffsetDumper/main.cpp
- Size 22KB
- SHA256 f05f978786bbd5b8b89ce54272dd04be5db62d96627740e3c07979af0faa3bc6
- MD5 7b9625dafb4be6a0563dc85ffa8f1996
- SHA1 cd0ff9bc1e246aa26b7e94b2acf4723301b600c3
- SHA512 477bb46790ea348e8688b699d58b2d06c2da8fda8b5227b49547f681e605a5512dcb5bda7e84f862f873d7a4012192222c3ab677ca71193d7b5e13851966e5ba
- SSDEEP 384:nAc2OUdMW08XxQi2xuN3ekiWfN/MQqG2Wdj+KnFMfuB01nEyCzHuD:nAGi/N3FVfN/MFGTdjDFMvOi
- TLSH
  T1EFB2EE06ACA27E2904B7D56E8721610AB91B4007DEB0C6113F4F5E9FBF4B31356B52BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  R6S_OffsetDumper/scanner.h
- Size 11KB
- SHA256 58e368b33336f8704f7f514b8838d8ce65f115f3e30378cc64d9b4046c781457
- MD5 6f20e7335348e2e61445148d4e478190
- SHA1 87fb20a4bbf22fe53711dfbbcde0927a188ac5a3
- SHA512 29d56f7098dd281852bf3cdc9b8fff7b1c47f2befb6afe76bd2e8bb3ec3f9b71d661cada7efb31ec161b66fa09bd5f85e1d19300acf4bd32d3cd482303ee156c
- SSDEEP 192:vYiKaAnsBFllyWr2C+QkR7oDuUP4HwAqdLNiSjYGcBorIymlfmwob1DhG:vYiKaLFprq4/+N1o51A
- TLSH
  T18D3296885CE2684268A7E3BDEB4A7007FA74501796DACD10BC4E43E05F56365DCBC2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  R6S_OffsetDumper/signatures.h
- Size 10KB
- SHA256 c49fa7aa5c7bc4d595796a20f10d94e21e19de4572b2ff5cc68bdd6343d5944a
- MD5 7a9febf6db7cc664a0cd2da6a307170b
- SHA1 1c06ebe43803e0730319b6ded2107a45f93b812c
- SHA512 f312481536351ab179c30921114f0de5d4ff13f13a03174e4fa8d899754123af8c1bdd32fad5e7f785178d61f34451171504fcdb81fc7c2517ae4159193d32d8
- SSDEEP 192:vJ0teqaYLf4gUiLAbhFVNiszWOFJLqCBhonUZQF:vJ0tVLQZ1L2sqwe
- TLSH
  T19532A9ABC93B1C2D0E79C63A2F4B1C55A09C04075D925C16378F43AD5F2E71E4B3E1AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  R6S_OffsetDumper/structs.h
- Size 4KB
- SHA256 6172aadd36cd926efd0f0edcfaa65ff8c83bdc21b09c5622efa23fb9e486f894
- MD5 323e8772bb9f9b1ff8b5b032c6ba1a1d
- SHA1 8108202747ef4d65dd8c9c8400748152fbae5131
- SHA512 9430aecaf66e595e91ed02e9b870d5870f2a9c1f2e3f3c423d6f58192a212015d4f01ec6ad716174d3bcf3213f282b92cdcdc99d9c4c033ee09f2795258fafc7
- SSDEEP 96:vf3J/yJ3zqhOKljj90jqlCL6YOxGb8b5m:vhitwUICLtOEbP
- TLSH
  T123A187482EFB94820C835A6557A7340360CC609B2699C419BF8FB37D6F45B891BF39D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18