92d0ab3a3e48dc990935f0194114eb0e88f9ee83bee9578e7571dc4de11598f5

Sharing

Copy URL Twitter E-mail

General

Target
DBS riggev3 7.zip
Size 1.5MB
Sample260706-aflkhagv2z
SHA256 92d0ab3a3e48dc990935f0194114eb0e88f9ee83bee9578e7571dc4de11598f5
MD5 c5e246a3604ebdc4c0d208dded32659b
SHA1 482aeb96ec03b327c1051dad16063bde63e2d8b6
SHA512 aee1ae3f55878d55c4781bce8958d425f8490792ba334af8f5c507cca95bb98ff0b002de3821c01d159707923efd79d8bf4550825537aa88ce55a61bd0fd77de
SSDEEP 24576:PU4aqdLTu/OOO+wsTOQeF8kWa42Zps9dYlZaZrfycwr3qnL7R/fQbDvio47gy6jR:M4acLTq/wsVQrN4KuL2Za0cm3exf0Dca
TLSH
T19475331ACDC46DEADB4E61B1C353D3A742C4DD10155228CAB7A66B0B2D3B2D33A2D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DBS riggev3 3/VM_STRINGS_ANALYSIS.txt
- Size 2KB
- SHA256 1d2b2e34b18b9529a48670c85ff102c195d6d555b5c98f8488dcb83b71e5b1e7
- MD5 c971e8214e86ad2e26226fdf5e0ffca4
- SHA1 1db2c615b70c0aec9133b238c34b83a67e3724df
- SHA512 4950423c916dc86cf6946f88bff743e4835a78afffcbbf159851ec9543896c526cf3807e5a0a3c0733b089236063966d079afda408c9244209f290d8dfcc65d4
- TLSH
  T109417562DA0C051633B247B2FD111533DDD28F2511838C5AE2ED3320B5CA567F2E9AE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  DBS riggev3 3/adblock_bypass.js
- Size 272KB
- SHA256 09204215cdc4d6e3ea6d583af2cfa6af1e7db616db8799cc319463658adb3e26
- MD5 991ae2c5d9e4b375e915bea945cf4646
- SHA1 b7ad9797f1dd94bc4967ca0ac0aee917df5f5e66
- SHA512 d550b7977cdb5920be3eb4f9599e89bc93ed4eba0e87408ef565f9d1697aac1fa8add4bb5d51e24c2fac1e1aff3ccb5a7608621c1bcba2325ddfa5a07e4643e9
- SSDEEP 6144:lBLGpmO2dVFImvh7CFDR79C1DNXbNA327t:lImbdLImvh7Cr79C1DNXb23ot
- TLSH
  T1CA54538067C47580228F9B72772BB1D4E99E68FF79484C5FC114BD81B96120BEBE1E39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  DBS riggev3 3/background.js
- Size 147B
- SHA256 b80d5361ca9be42443bdd785311c2ae70601362d87042c920dbd7c1eb8e43cc1
- MD5 29d00d52a258b1ce06be813840df0d3c
- SHA1 c6a986bacbcef1c4969bab211568fc96043ad3d2
- SHA512 6d9f69a4136b311fe9d69e35ebf17d28a20f141642b64d25d504b50b359db21b2f5a01b30051fecfab90a53a356833785bbabf8c81d099ba27c6264b8bfc8ef9
- TLSH
  T1B9C08C444AE208202ABF02034AA2816F2C08483048AA730499F843F913C1766088A6A9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DBS riggev3 3/content.js
- Size 6KB
- SHA256 238917ea4a1e82ad892201de3a436ccff88da6ca322008d111423bc4129baf43
- MD5 90371eb40ac40233247d4f07c24c5170
- SHA1 6e54df67607f9eb01b4f0617c14e270877bd9b14
- SHA512 3a3aeeb1cb15d9543275ca24e5fe687973c6e5de72bed5e63e84deb0b2e04454c65f00d711df8eaa921569fe8b7e1ea60559bd7e10a1f508278addd70ccb5a8e
- SSDEEP 96:ki4bLn3Owy+LOhjgJ2OsUhOOoOr8VsYxcoJOVOtMAC27Byh3TE191uSWc:ki4fn+wyhNCoHx2E5rcVTED1x
- TLSH
  T184D15592FB80E77C6306DAAA0D3792C5C416274E38D44747A3ACFA99749E10BD4ADD3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  DBS riggev3 3/dashboard.html
- Size 6KB
- SHA256 1851637ead126c9d11aac3f95b07a2e2853c6a3064b465b9f1b88b20dc4d8c4b
- MD5 aa8e1d7913b04fa22cfece502c614f80
- SHA1 3fa9bf40dc894fa3286101c2451856107a74bf61
- SHA512 b20a93de844205f6078430861de5f6d0b239ea89579cea1a730ad97d2c7722b3007839ee3c74a2caf21ec4d76279e0e3baf272f44685f65fec0e094933363e04
- SSDEEP 96:Fclls6F0q4uX5A0HGGgip7pkZ63zaPZjv+eZ+ZdR8ziA:Fc4uX5HHGGgiFg6KN+GmciA
- TLSH
  T1D5D1B671E058603AF127D9C6B5C1979F71C5820BE5231A29B6B5F0B1CBCE9E7AF12309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  DBS riggev3 3/dashboard.js
- Size 19KB
- SHA256 65843dae3437cd97a0b951b53dc43399c99cb2d127c796f2b9957cc28d29fc1b
- MD5 717c7eec1b1543c1d688a1e1bb55dca1
- SHA1 cb6a9ae9cc811f1de309d04c7002c3aca71d377a
- SHA512 df555570cf26f8a5eddcdd9b76324dca9d6d48fe4e943e2054d7caf1566fe26126b6df9f47b46a9801a8b40657235e130ab7574fcd9a00ddc866caf93cbbcd29
- SSDEEP 384:iCC0fI532XbkOQnGzk6WhW4qVSxOnrp8n+eihVMiHI9ozpzG4lhNwNCwD/gcHxzJ:iCC0fIJWxz5WhW4qWxRAMiHI9ozpzG4e
- TLSH
  T15E92D66167C4136C279E89BBA313F2D0D6120D467A04CC9BD234DD7C98E4E4BD9FAA74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  DBS riggev3 3/dice_content.js
- Size 343KB
- SHA256 6fd7e84731ae30a01a624c3327969ed38e5c0cd222d0b669d396de7ff57d8f5c
- MD5 0767ba4c1ec73344ea09ce8b2ec2274f
- SHA1 377959fb8b03490470b741c4a37f89fff285188e
- SHA512 d5400f1f7ea8dcdd399315dd5b087d01456cfac4dbda86b9c892ce2dba7e450b9f19159ac5dda1bfed8be24804acfd2e4219b574e75436f4303c34e1efed9543
- SSDEEP 6144:wDjx86te1VA8EWExuRM2qwTwGEs8CbHa1vKEOrRit:wDjx1te1a8EJxuRM2fTwGZ9bHa5KtrRu
- TLSH
  T16674936067C57985229F1F77B31BB1E5F82F1CAFB9440C9BC294BD90BAA1605DAE0D30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  DBS riggev3 3/firebase-app-compat.js
- Size 31KB
- SHA256 eeb6f33bbdb49f9bbb9040a671d54b69c5ba702447a78a42c49dea963b26026f
- MD5 97bf59e1d28c5a93972e922bae6bc2d1
- SHA1 bc0611da2c8bb484d4f9037c755acb8c78cf7559
- SHA512 b4fb2b3d6d9477a08f04806e8f5ee926a8110a140ced465126157984ceb6950dc075167296bf2b4aa5938b00551d8cb64ed38ff7f6d5b6c8b66fd6a2b3a7313d
- SSDEEP 768:doe1yi7IW38Zp6H8udXfC2tMNBLJMYbzljTFwIyc7mfz4ynBlT:OW361uL8bzmVJvT
- TLSH
  T13BE20B587BE3F0270BFA40DA10362403F72D5A48194D846CF26CEDEBAA95887917BF75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  DBS riggev3 3/firebase-auth-compat.js
- Size 135KB
- SHA256 825762d074943a0e17425a467fb4a5a3798107577ac7a271b7b257befacd2c0e
- MD5 3dbf060b64fad239c72e0de449e426de
- SHA1 2faeb7773780dcce972e6c095ec0b275343051cd
- SHA512 f8f23719451369cc8f1b8e746e72802c7fc7f8c99ae6d5b0de944a3bdff728d03ee41db607439293532910792a0b57dd8b3445efeac625862ff9fa6fd385fa78
- SSDEEP 1536:LpW3e2g+RLrb0gsHUXtqopqKVhuJnO2tvJm0xIDLKXS4crHRyapHZiGdfQWjdViM:OlgCLH0gs5BmZ1xjdELHWGXgWlK
- TLSH
  T107D31A8573E7E02286E984ABF07B0103E22D59197D4D802CB6299DDE799AC85B737F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  DBS riggev3 3/firebase-database-compat.js
- Size 162KB
- SHA256 f95f56f0317409ef36dc04e3d0cde031ff3d2b9303f3d2f654fb7199342a042c
- MD5 f0e3ab82eacc695ba38b1031016effd5
- SHA1 5c24eff4aa1ecf6d7c7a7062aef0144b6e423d07
- SHA512 f8199b59dc8660b1e09671ea3c1f732a00c190ed8f85073c3f764cf1f8dda73b953610d5779747738008596abc9807d9d428f220191d705ed1c5602b16311d7e
- SSDEEP 3072:5OGZyJhNOJVJzJIJ/JXJgJBJlJnJVJ4JsJdJTJd/TVgevklykU4tP3Z:5B2EjdKxhGzndXaqv3d/hgAkEkU4tP3Z
- TLSH
  T1D7F318483291B52357FA96D641368243F33A18653909443CFA7CDCE678A4A8A71FFFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  DBS riggev3 3/id_randomizer.js
- Size 3KB
- SHA256 d7d0415a6691f8c64df3dc6d517c22e487d206e4b101e69e02a515d22efacb90
- MD5 cf7e68d9a0035a0b267754d2983dedb4
- SHA1 bee62eda5ba432f1ce0c40de510ab29d3e82e3f5
- SHA512 82234b6a1b33bfb1d49e2b7efe84e5ab8f794950c80aaa22b6990d3fcff7dfcb0b6ba9a9637b98991dde7f43844324bc1ca9418df653f91ade1c1180d0e0a8bb
- TLSH
  T12561FF58F9E3B879563B313957EFA1007C799523180DDF22F48C6B029FF2AA4526ADC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  DBS riggev3 3/popup.html
- Size 10KB
- SHA256 63962cbe81e9f681d2a1a3a8f2b2739a0d1d3bbffd1f9824c00b5feb4de43c83
- MD5 bb52a31213e8d9811dcfafd370fbbbe6
- SHA1 f2d6d0fec5bc8be3ee07b57513b4ba87f78ac93f
- SHA512 f75e6bbdf333cccd506b1772b5f78a8469b983074f435bbccc757c9c671549c34dff90239f0283221b31d2519f62179fc92a24e9476ae345a94a5b964142d8e0
- SSDEEP 192:aN81ueA3sK42diOmfP9YTwOud/iIO9nXwCxGSZwz8/uOKhwD9mqHnT+8KmqKcDPC:xW6tbWuyNw8wjPoF9jqUl4hompQNFsU
- TLSH
  T136320130A241191372B396F0BF63874FF6A59203C74B522877E963C64FB6948CD67E98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  DBS riggev3 3/popup.js
- Size 4KB
- SHA256 8a8a123583eb4a7ebd33a60ac132af9459b90e1fb77eab82f65e2988dd0046df
- MD5 ad903ffca56ef22b93990da84093a47b
- SHA1 8118bf6cb59bda85a923e3f79516f751b5470820
- SHA512 7a9481f61b5748f0683feea7d04d72366de150f876aec1ffd9b5db0b0914f1b66b0aac455c1f9548634f517d7cb3ae0c72a7ed1c3f042f46121346e565ec9e3e
- SSDEEP 96:EF6P0QczlrZ0mGY//hBFG1qi19G1+1qf5m77aQu277fACENx0j8Z1qcREiDafD0u:EF00QOfrFUl9UcY5m77aQu277iNx0aId
- TLSH
  T164A1733F36E313200BB712BE551E92BE3420684905CDE7113AECC9546FA0EE559FDADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  DBS riggev3 3/verify_early.js
- Size 276KB
- SHA256 d850f78dc0cc9105555a27501d5236c23277a9fc8aa5ef9aabe5eeb2e1358aae
- MD5 99eba1c696cc9ec3310dd8182daba2da
- SHA1 dc6dd358c72e96620678b830a2a15ac62cc4f78f
- SHA512 6e1e5518f39cea22d795af8bba10f398eb1ab19c7d354e0d64078dcbc7937dc274c93768c5bd4190c5338600595d69b5ba8dadf57c0c98189056657f82505479
- SSDEEP 6144:kQmXtkgv3mzAVVZlqQlz7cQiC20Us/TA/C/6f/ga:kQWkgv3mzAdlqm7cQiC20Us/TAq/6f/P
- TLSH
  T14654514063D07491138F6F72FB6BB1D5F82E59BB7C54085FC220FCA1A9A6A06D6E1E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28