05ab6df3be42fdda4b9b300a3d1bcdd434baf28ed754d2d2827ab4110f74a99a

Sharing

Copy URL Twitter E-mail

General

Target
release_Siphon_v1.rar
Size 173.6MB
Sample260703-2bpvxagy81
SHA256 05ab6df3be42fdda4b9b300a3d1bcdd434baf28ed754d2d2827ab4110f74a99a
MD5 b6845a54dd6606ae9c2e3460069e583a
SHA1 9575e5f33f3bf9099b19b28cc63cbe1115fd4ad3
SHA512 524cd5b8926817f7c1e06c39f14dfd64db2a06298739440fb6a1a0ce2ba6a86a8784ccb170c0ad28ec4e5502511587ce157465a61e132383a088f94cdfbb002b
SSDEEP 3145728:ktLljKo59PzsDXlhBTofgFaH/K9WSpjft/4hNbMR4F7ck+m:kDKeBzquIGbmjftArMe9ck+m
TLSH
T10A9833E7E064F4E8E13922752239ADC4F56C96442175C322FD818AD54CF6E723A27E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  release_Siphon_v1/Bin/citizen/scripting/lua/scheduler.lua
- Size 22KB
- SHA256 9b4043c0bbe0fbade2a79a65e9f5739b0d55245ab1defaf05ce507b63b354def
- MD5 3e8de11518c3d0c535eb5a70756f8451
- SHA1 68f906898a68bcbc9b85fded76620c5f6e230ad9
- SHA512 b4c6032925dfb3058134a6cc659342d8b1892e11b7d6e5ad163446ed4e364d6192e592df2946c4c85168f107f570ca17fa4521600923dae81499714e5c3b8e7a
- SSDEEP 384:eVJqoFnzU0QEwSlhDOVBl3VJoPTwZCdJyzJduHkTVzyAuAaoSr/z6eN3rVM5iGL8:IJqoFnzU0QEdha7l3VJoPFJyzbacV+AI
- TLSH
  T199A2A85FF24F51528EA171A6C73F9681A83EE677143D1295F4C04FA524106ACC2EBEEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  release_Siphon_v1/Bin/citizen/scripting/resource_init.lua
- Size 900B
- SHA256 af4e2b9133fe8e7491a3e9f729d370f348a63a721504cec7975a495136cbd1ab
- MD5 c73cf6a0b205f1f0577388630f2c32f7
- SHA1 460384d6cb91856bd35b404a0bd573ae66ec7c08
- SHA512 76c0e2428617c1f92bc01a0e19ce34464d4b36b166ea65d2e4bb89dac89f4a1a2d861f8e2aec28ca75800fed2e66f63b4dd5cd23c6c0ded3158f26e18822f180
- TLSH
  T18F11A651370E2091AEF3C026C8AFD02DDB5AC42732649050F9E049923F7C6AF8281E9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/console.js
- Size 10KB
- SHA256 4b23830b9fb3ca1cfacfbaf99db4656256efc077c0794662c8a7a79779c0aa59
- MD5 b462e16119895d06546909b14cc1c295
- SHA1 7e479be3624eda71cc11b86b9bb60eac35e4a424
- SHA512 83dd287f7d86a45932cc166c1fcee224bd07e595f562ad21866e40bbafc38c753cf211063ddec7ad21cb93f2958d24875b1fc1e7f05ef83624de25d916c7d2c0
- SSDEEP 192:3zI9hK8zEO83NAubhYUImjFAlCEYRDjEMk/:3sdc35hkmjFAl1T
- TLSH
  T18232EE495FAB1414C0B373ADAE139009EF7A5637100A679AB9AC81E42F71C10C6A6FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/eventemitter2.js
- Size 22KB
- SHA256 43d978620a09e0cd591703ae557d300bff4d2a96fb24acc5ea97faf010be58f6
- MD5 92e1bfe9fb85ed9a1901b0bd53552c12
- SHA1 7c78ab97449158fddd72743aa86337cf62e4adc5
- SHA512 3819e98ab0f4c5d13f44da3d7b54f377b8aaf20ba1a5236f4b3389acd9bb05e0de5ccb9efdd0b2c39723fdefb8ed108458f1385d57d10f6fe05a35eb22da1310
- SSDEEP 384:JERHH0BYR3tWw15f6eLOljg5LrmRumQeRRv/wRG/Hd:ytR3F5SAOK5LrmYmQeRRv/wRGl
- TLSH
  T19AA21D8C5A0E557682B2B77FAF6B924AF7308227000146903E8C97F41F75C5882E2FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/index.d.ts
- Size 5KB
- SHA256 790d112e4ee81cce653df1bb408de6d41f198636f825c679a937ad78fb83658a
- MD5 090d3435f703078034ccb9ecee1d232a
- SHA1 983d73611b844adb089f74149f9d1a7601a4a995
- SHA512 fb471b917180f7c90aed769d7cf6074924343181a981ef486642befc535151edf895895b5cbb6122c27f5aa2f83963dd6a63712613a193b3faf83487fdcc1da0
- SSDEEP 96:MBgKgJgAg7gmgVg1gYgeg3gYs2811uUHUg3racAWB9V9doGBZeMcfJz8Y1YVYttZ:0z6X2pwkj9wfsIcAWB9V9ddBIPWgaiKS
- TLSH
  T142C1EF06B7523A758C79923BE54F210ADC753156186900EDFCEE57A20F738EC42939BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/main.js
- Size 23KB
- SHA256 03249a44e90e0370fba314f5b39e899d61597dd565db44491090f49ad0d0c156
- MD5 636ff3dc5fe86448b89af6da5f3e7775
- SHA1 5e7ababa76d7fdbac4425c007e29d0077dd0665d
- SHA512 bcd4f8764cab682e270cfed993d1c4a934644a4b29df4d8fa6fb22d8d8798b5216e3851b83b0061134cd7f27ccf6260e313b4d599dfac7518d167aa8d222fa29
- SSDEEP 384:ToElZCaCTfD8NMLKvC8Ct/tsE9qDTEsX5yuub4rd5C4Waij4X5i6rXuSAzOPb:TooCaCrD8qLKvC8Ct1sE9qDTEAyuubSF
- TLSH
  T195B294C6735F21EE87E93399403B714E9C7CDAB3392D82FCF89C6A5414A6A19C255C8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/msgpack.js
- Size 51KB
- SHA256 f523afd1902ad1a6975cc0d52bfc2ccf9a0fa92f6a76300019e10e93a393ddd0
- MD5 ecc937ad04f3d534e14777b90bc00162
- SHA1 a0a224bdd5e6a74ca1516dd62982b931c8b20f2d
- SHA512 ac62e933ed2ad2a778ad5a8fee85495fafaad5e41cf3c02be98de2e2a3dd15240319b11d89e9ac76717db71210efd447247b533ec14ad26a0ba264f95490b232
- SSDEEP 768:UyToecRKwKR7ChQ15Qc4VP/613CiqYGUrsVDP73urz/E2hA+2UxwfkK9Kz1dbAKo:Us1bCDcx358rurE+cz
- TLSH
  T15033C6C4BE95B0199766716540EF194FE13DE928A48D0884F229E8F13CB88EDC677E7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/natives_blob.bin
- Size 2KB
- SHA256 1bd1a8996b1dadffef79c298c17f709838bd678a0933a0d56dc8be8f60db00ec
- MD5 2ffe40c89e31363d5d894fd5429daa0a
- SHA1 a2439c1cc402126094111410c6b7439ec8c5c412
- SHA512 f691498938715df2ce7bcc0a42aa864d632c6d30b323e4e7b16d87fbfb3e3bdb33738adfd04fc17cda6898fc3a6fd92db70f6dbd16d59ce3caf8eb7ce8d5ab8c
- TLSH
  T14D51DE6BB8E7E47F949138FD704F1D4BE93984E0387DADEA950E9480193701C9239E1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/natives_server.d.ts
- Size 149KB
- SHA256 65f77ec5488b3488b142df1944e5840c676f32edb79af52bb16a7d37462fef10
- MD5 8998dd90f0cc0943fba78f25432b3950
- SHA1 6134b14cd9185c6df298ff777d328fbb36d4821a
- SHA512 60688cdabfa5b6730eb173eb33ac632da4d67f47fd82cc8ecb16bc6def6f3cdcd4d7efcbd83f489dce115133fc4b6f0e0dbb674b4a5f3bd737db26e5ad5fa200
- SSDEEP 1536:ZPwjFgzlafffPi+3LR9VyLRnxA5xZEMrPhiGiS2ftfVNCJSfBLnREeorUA88uV9C:fIER2Y9A8zIzF4gtuGl2al6By
- TLSH
  T140E3959BAF88333169B25262A1BF4048D965A224751131EDFCF4A9142F0FA7F46B7CCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/natives_server.js
- Size 164KB
- SHA256 e54be6266af6421d47834ffa0a81e9751dd90914cf18b317b8e44772171dc61f
- MD5 007d1cdd3d841b046e7be4d95696fa9c
- SHA1 ffb9edb3da25fb49d68888c68606b1929d8337f3
- SHA512 28575a45078f67ad5bffc6d7a6bd2418aa8a148437c6a7e11252294b9cb26197fb9e82b144592da3c053c313c4aedeb0665b78f7a707800675d5144a1a3a9bac
- SSDEEP 1536:YOQ4OJ6fjPh+0hV94Xq62J3Q7wRnxI5x8ECrAhiGZp2iHXWNtJSfgbPREkhOUmZi:ENa9Q8RqD+OMYmgZe6PDxcbCN/jBUgg
- TLSH
  T172F3B5A62DC82325E4736264D26F740DF669F13021CE2198FCE8A5582C1DE7B46BBDCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  release_Siphon_v1/Bin/citizen/scripting/v8/timer.js
- Size 7KB
- SHA256 3c0a089db7b91d37ee7688207ff0e1e0a3e7c74a2c62b563713b1540efec1799
- MD5 0b2d2009f6a36f8a2d7a81b9feea036f
- SHA1 235979f343cccc665ce8f0548bb6502e8eb7d446
- SHA512 9b58522ac22fe2ba10eb02b0d73e3d28271b6a98d45c01c02e6ba2b0d9daf66d1a288b9797ed70b0ee8bb484b6b81aa3593c9c8b498c050f752310d06a4c99a8
- SSDEEP 96:tP+LNLxuXe510zW5Wpbi5Wgn75PDBMgpI6hXYBXZgI6RCtv:0xLx110SWp+WgttzXYBpYCtv
- TLSH
  T197E1DA8E5A67244349B3F37E9F535249FF295233141842B57CBE82A68F3502893D2F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  release_Siphon_v1/Bin/citizen/system_resources/chat/cl_chat.lua
- Size 8KB
- SHA256 e48050489116ef379ebbb9bc1f69522605217017287b66cef4b3c019c130c0f5
- MD5 e07748c7c28d83a991f0105bcaa51f5e
- SHA1 3827028e718c07d879d241fd78449aaf0f7af80e
- SHA512 4f969f664ade001e914ea53ddc3c33eb5d39f124fa6554f71c4c8e823288bc053d6ab796d0dd502ab2eb054edaf24f7e26995186df88b49fd83f9ad13a0bc11f
- SSDEEP 192:yvSGx1IiVxix5tCrO8UNCyj3BHZXkX/c0daNFUF6FlFsbGJ41fzCBXHSfSt+Y2UJ:gxVGbHScEavg6n6GJ4JCZyqX2LAhMWF
- TLSH
  T19502412714671679EC72A056FE5B6506C61310832A2B1022F4FC58E11F753ECDAF2FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  release_Siphon_v1/Bin/citizen/system_resources/chat/dist/chat.js
- Size 69KB
- SHA256 f192cfff13e1098cafdef1a1d8aa417592dc4a13a6c4ce0c93f17b6e85e6dd21
- MD5 55d9a7572f47abac936496b9b09b7cb8
- SHA1 7b83d164c27e35bcc015684543e38eaaea1c3748
- SHA512 95978cc039a2050dfc314e9dabc79f8caffb8bca26f9a53f9b4498ddcf1fbb4a3a36183d275e14d953244b440e74ac06c1174c8d2582386bef6a577ee62409ec
- SSDEEP 768:JshAu04yTy3jKH2pdS/6EmweoCpqkCvskycZ9J0cMMDJLHDMPmdQDDdz4pZcEy2c:8AwzxT7d7NxYVbxfnqLETkLcA
- TLSH
  T1D0632AE93191B92213FA09F654361015F33918193C09E5E8F1ADAEEB2E7340951EBFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  release_Siphon_v1/Bin/citizen/system_resources/chat/dist/ui.html
- Size 387B
- SHA256 ae13b297cc7e4c839dd7d1e3ac2658253d5b588df732a39a9655c43a8e402c7d
- MD5 2a1d6f7c0dbec8db4ad0ebcd5db59589
- SHA1 4c3f761698e32f61e66099686ae87c8d8bc8b400
- SHA512 fd8808c253dcff710618f83ef94d6d0632eaee1a2d55b847426cb394f935922e1ad02c9d5a5eeb937ab2c4ff377bb3ce7604ed8e44b4e32ed4f4f4cce61f6396
- TLSH
  T19EE0D848C850235CA6602E96FF81736DC8CF390E1A607C1059B5123885B83CC885DC81
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  release_Siphon_v1/Bin/citizen/system_resources/chat/sv_chat.lua
- Size 7KB
- SHA256 cc1bd606fa4e87a37f10992fa23d696d5e0fc53c1a42875e2f488031045d5ecb
- MD5 6036eeb088cda9da562a4d0ab2f60e8b
- SHA1 2892d323d8cbb9566b12f1f94c42dea091bd753d
- SHA512 0f7681c43959eb5dd965f18e96a66d2dadebaaa24a3d2f22c4af711b77b878fd64208962b34450cc1c57b20c8751a8532c79c718e82033235e74ec0f9c98b387
- SSDEEP 192:AGygDbihss2EKloD0tlzJO8qB455NaDfiFWzIVE3TBHn3TtFUF6F1FBeH2J4N:9ro4tlEu52nzIVAjPg6XSN
- TLSH
  T1CDF1455B66531D7899B2E015FF077006D33500431A292129F6ACAAF22FB22DD97F0F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  release_Siphon_v1/Bin/citizen/system_resources/chat/webpack.config.js
- Size 1KB
- SHA256 6ce8a393b23250275a5a03abe4273fb1232379c9bb71f12dac18a17c1e56862d
- MD5 8db1b722d37e966a605d972cca8599a5
- SHA1 dfa6e0cbf2971ad51455bb54f1a4ecabfdcf72c9
- SHA512 04ca89453f104f7d4f43d442b2faf60508a3a1c383a9c85dac47ac5a3f1fd63d9644700248eae80ea2710d29796e385e020021f05f66bd67f827add7fba8f9c9
- TLSH
  T18621AFD700B8611A9536E3E0A6AD8DA7F41AE31325008473BABC02D98FB39457395EDC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32