9a5c73db8ef859c50af0583a0f6d2e7a891582bdabf678500584c1978bed2e88

General

Target
ring-for-rainbow-six-siege_0.1.3.zip
Size 103.6MB
Sample260625-w9dyeaev6z
SHA256 9a5c73db8ef859c50af0583a0f6d2e7a891582bdabf678500584c1978bed2e88
MD5 148690b1cd253ccfa59de766a8cc4c3e
SHA1 b3a839b736b3000915257c708702c19fdc3db659
SHA512 2ec928c4bf24a9ded3e90176af51ee6046424ef58427888b4513dc8d7e9a02d06d075c7ea1360dd1c392fbfa80e8a0f689779634b3040d368b897970b6ce44a7
SSDEEP 3145728:AJr8EZVkJMc+imTUOpFx2H2V22X8uw4DH07w7Y98EZ:WfiDOrGy22X8uJDZ7YBZ
TLSH
T1AB3833C1CD0074D6B88E7537E98037FDECEEB11BD16758E9446AA49D5622BB382F0A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cmutil.dll
- Size 3.4MB
- SHA256 a0da2372aa189d3ecc5c4d9cc47f5bbd9c40050692030aef595cecda965a664e
- MD5 8910b68e2eaf80a6c6a98a78544d75bd
- SHA1 275a5e636d0de3d6a8be95be7ecb5dfd9f4a6ec7
- SHA512 84e174435bdfaf17b949ae6461fa01676d0298eb2a9806bef2a980c158692bfed6aaeec5a38c2cc138b0305308e8025efe3d36c78d75cea064ab57319184c5cd
- SSDEEP 49152:H5KzTsFHrzNLSDeQta10s5ij6cHZLY+B/z:FJijb5H
- TLSH
  T183F5333034629476C6FE623C206E17288B7D1985CB6098F753C419EE4B753D3DB36EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery persistence ransomware spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  model.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  ring-for-rainbow-six-siege_0.1.3.exe
- Size 80KB
- SHA256 2eb8278210434ced87711889ba19582b7a104190310d2a06f0855a9cf5772d11
- MD5 d7aabfab5befd53ba3a27bd48f3cc675
- SHA1 e1e2758e7427ffef7d943ef1ae9024af76a9142f
- SHA512 aa1e9d9614808bbd53182702d1e0e6b13b70b9b42ebc8f7cafbf4356d2eeaee10955710503edfe485e095335959db92d1f123588a536fc172e2cdb03f37b64ff
- SSDEEP 1536:kvsrU8tbNyQmvDV7zdIpCFo80PA3OBk62FH/IwRw1lqCDo:kErU8tbUQmvDjYndW/IwRw1MC
- TLSH
  T1C4832A4277DC4060F2F256326BB599318A3B7C315F75DDAEE7108A4A2970E80DBB4B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  x86/config.json
- Size 3.8MB
- SHA256 78695d93aa5816a9286d98cd43fe3e91480f5e75c2f093cd0b9770063a0547fd
- MD5 ffa03d1ac6fe3edac1e3d832161b952b
- SHA1 dcf841ba1a9eaad351b0999dfb827cf68e65e945
- SHA512 80983b46723c16766bf68578c61a420ac76780164030fdb37db3c66b8b99ab69b0376f8d01134636a7a314f373d899bb385ae1b3cb069c9c7cbf3e1c4d90baf7
- SSDEEP 49152:NujhpVsu5uFj6n3LUI8JxYA+Wypu41rhWSsdIpJh1nuv6j0+43/pFjDAwBMWpBCt:IhHsQl4ZswrARgvhiWaOuBu0ijfs
- TLSH
  T1B5167C5B75A84196D076C038C957AB0BEBB1BC564730A7CB22A0372D1F737A06ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  x86/core.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
- MD5 71ec18ba5b3578bc2e88f64d60ca0797
- SHA1 23fc447c1f77a0167dccb5cbb5deec32014cac31
- SHA512 f9deea04df889fc493e5d12471451aa1590e15afb4019337fb1a296ca2286dd93f883b255ecf7e1bd84c35b887d425d837ef68ef9cce7ebe58df36ae77ac827a
- SSDEEP 98304:B8jd6lrLddIRBGprPmt/gP2XwIrlw168rk3PFHU:UiVd5PQ/gPawklw19k3Py
- TLSH
  T14ED69E86F0D665ADD617407421BFBB127D213E64425C0DF742E2E9B81FBA7403F2AE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  x86/corel.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  x86/obsidian-source.dll
- Size 95.0MB
- SHA256 a29daf1b537ab3cc653b62849348b8459e328b874b947f2d1a87b7b33dca09ac
- MD5 203874655c31694988df5160c40787d1
- SHA1 bba49e2f4e2b541492ef2e31f825d162c3b356a9
- SHA512 9472e2f42e07a4099e649454428bd6cec7febd57c4d8800a2dbf0e2cc07b97f39a3bee23eb73f964fdc71b416dbed1e86791a25b20a83d1202d19565f43fa730
- SSDEEP 1572864:t9Q1VxiPhNrce8VtCqS5r3QQvzBycQJ6cSeuwafXmhy+cQC6lvRFBYvy6pq74xn2:t94YhZ8VMqSGytQIZNjYdKdM8xgRUitT
- TLSH
  T10D2833C54E4084E229A6741ABCC171F9FDEBFB1390B7ADC9482EB1AD433AA7241F4574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7