568ad31758f8c94910a567e280cc31b64eeae7ff719435b12a9a537473320435

Sharing

Copy URL Twitter E-mail

General

Target
Nginx-Rift-main.zip
Size 7KB
Sample260703-gp5hasbz8v
SHA256 568ad31758f8c94910a567e280cc31b64eeae7ff719435b12a9a537473320435
MD5 4ea1a42d5501425f95b03f0bdd09ecea
SHA1 3145bee6e5de2f6e8268191629c40b1ca6237dbc
SHA512 48b2dc98b9e795c8c1564418dea58eb0ca1ea82121d4a767c6e9c42d370856345cbe8756c0a86dcb0b4612ea715ceee943caa85ccfb44135a23247929edebe8f
SSDEEP 192:vG0zMD5US8PCbPFfeQk088/meHB3mihAS+wm3/7uNp:vZIK9PqWQk6xTUjcp
TLSH
T135E15B4C3F8D6B5ACEFB2378384AB283017E1A132955E93F32049C49DE6E4841A1F4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nginx-Rift-main.zip
- Size 7KB
- SHA256 568ad31758f8c94910a567e280cc31b64eeae7ff719435b12a9a537473320435
- MD5 4ea1a42d5501425f95b03f0bdd09ecea
- SHA1 3145bee6e5de2f6e8268191629c40b1ca6237dbc
- SHA512 48b2dc98b9e795c8c1564418dea58eb0ca1ea82121d4a767c6e9c42d370856345cbe8756c0a86dcb0b4612ea715ceee943caa85ccfb44135a23247929edebe8f
- SSDEEP 192:vG0zMD5US8PCbPFfeQk088/meHB3mihAS+wm3/7uNp:vZIK9PqWQk6xTUjcp
- TLSH
  T135E15B4C3F8D6B5ACEFB2378384AB283017E1A132955E93F32049C49DE6E4841A1F4ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Nginx-Rift-main/README.md
- Size 2KB
- SHA256 2a0f708348a825beaa8812699e81d7c21ebec3e7aed47069efd7e3ce6d8bfba8
- MD5 87d07fb72607a7c99d1ef17729abcdcb
- SHA1 b02b063e1a3d6dd77a8142e3bb444e3044c2c5f9
- SHA512 3150f6943abd05b669431e450f7af9761d41ae82bf8ef6c8554b9fc632d99288a6df2be03e46516756a609f4bf0818052417454959fb49a8ee21ba22baa784d8
- TLSH
  T18941B5673340333C0AD44BF2337232C6FB3BE6541386A489545D82F823D287AE3659E9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Nginx-Rift-main/env/Dockerfile
- Size 716B
- SHA256 d26bf679f0d805b2c252a7a1a428059cf3ca002e6425bd528ae4430c75ee7fef
- MD5 b2dd4b226945f99ba24e8246c7d71567
- SHA1 1bf22a4848c42410cb4086be0b280a25d0f9b25e
- SHA512 06c41a19e331b284c337d85e6085e0fc79806eb5d3872f81920492bcde5130380c71d980b1346857514f0ffed9d21842dc3321ae64f3f29125c70e89c7711c4c
- TLSH
  T1C90144414FAD993D3D98235D7CB3C0BBD42B88751CCDBD8875F884368B85474B139601
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Nginx-Rift-main/env/docker-compose.yml
- Size 192B
- SHA256 6a6332b4e202080a34d45adf514b7560dff93f26d3f485d8ce55059027dedc51
- MD5 b9b24a9bdbb3bd68062d911c0d9b2725
- SHA1 c60e329b6eb574d4759c805a7048135646b62117
- SHA512 b7aadbd57f4d40c897c154c53295ab5bc57352cecd56bc49c64f3bea758e534d3517ce393a69c8665faaa8f2c537efdd819e2687f5adcee084e6828a8ac4bf4c
- TLSH
  T149C08C5ADA523C72D4A945830E93FA180663BCAFC2C673393DCE425E2FA330073944A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Nginx-Rift-main/env/entrypoint.sh
- Size 203B
- SHA256 5b9f40e95698b9b7435764dd5bf118a8105f1b75c5a7d5f0d103cf13b170b733
- MD5 f79a391c2f6c77c11c25a518734e35e2
- SHA1 11cfc0892b74caa6cc87fa7c00af4d7708c484c0
- SHA512 5fa3147e01cfe8b5ba0d695c713e50467fdd4414a09e7bfd783db204ffdffb9aa14132ef7b85867db4f16b539b5d8b19b400a5e95a25797704df5c077ecf6bdc
- TLSH
  T181D023D25710657D4B84921C143B41F0464F17B00167979010138B8F057F45CB422791
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Nginx-Rift-main/env/nginx.conf
- Size 1KB
- SHA256 3d87cc989c5adf0bf6f25db6e282e133ed5160e46ce16e097ad9b477ef4b2e72
- MD5 8508f53842fb3d9731a9cd1daf9c25c5
- SHA1 bad77ed398658127324e370b9c509df229569aa8
- SHA512 f3ff4a8d03bbf6ed046776372ecde6ef31906d84cdc5e6da54b87cf9f0b1ad2eda5eee2588c4754a4b2635412e1a43a0abe780257f0ac4f20844c90b39381f48
- TLSH
  T11431050F9E6F1809439A63368F569704D236A0AF5445CC5C7C5CC214BF1423ECBE5F98
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Nginx-Rift-main/env/server.py
- Size 1KB
- SHA256 50022219fd1b4bd39b15b86a870eb5e316f5bf2ff4705e80c03573e1b14c5221
- MD5 f4f4cd5511f0b899d97207c9df1fa692
- SHA1 fded8f26cd2eece35f4f9a956be93bda555da064
- SHA512 2df4f105cf156381d1bd4d4618dbb9e3a5f2ee09a97ca37d8c3d69969c1b0e1bac62551ce77955a158553bca75a9acdbda31b02f477b8fd2287d561bc983b7b9
- TLSH
  T1DB11BA428A52605E9B13CD16D622B993A73E141B920CB406773D159A2FA8B31C0FBFEC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  Nginx-Rift-main/poc.py
- Size 7KB
- SHA256 e0e1ffc5429bb074d5cb7ae3bbfe6f5df6033931a12d24a0d377568150dfa11a
- MD5 edbe5377f141cbe265e61d0907a929cb
- SHA1 14c15d70f6dffa715d0b38bb9373839142f23078
- SHA512 5c0af6b42a4266e7f09e0d8cbd5824be531fbc1b4949e95318ba9223c07e5011bf3f470886cb150c88734b29929b54f06341653f5f9ecd6d05798b7ca0db1563
- SSDEEP 96:K37CPHokPSyDc/npV2Y4j+HaBHtFAMhCiSbpWNcFOm1DZm4Z6ryA:K37oHo0SyDc/npw+HCHtFRw1yyA
- TLSH
  T1FCF18541AE1069A6C7A3855D8967A55023B37C0B0E463C797ADDC320EF29839E0755EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  Nginx-Rift-main/setup.sh
- Size 619B
- SHA256 27d1945e62c4e62278ff11007cbfe9b5d74146dcee6cbb6cec3393978380f582
- MD5 2f2f09fe56b5ed3bf66d12d870c9f9d6
- SHA1 5fafe59d866b9eb24a5416519d5cc4d91e6d2ac4
- SHA512 3c43e5aa2fd8173555053435d96c8d43997c995c0d7ff913f9ab3013fbc43800292c934bebbce074a1b85a4c6ef97a1a8e8b8762b0179728f3ab9857c3613ab8
- TLSH
  T187F026B5B7285130147313F41BA5C28A3647901301665E2D215B12B383DBAE0F1BE4D8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26