98833e626721cb6ebfbfcdbcddcbdf3cc9cfbc2641dd22e413760f6ebbfad46f

Sharing

Copy URL Twitter E-mail

General

Target
Lychee Fixed.zip
Size 149.0MB
Sample260717-klb85abt2v
SHA256 98833e626721cb6ebfbfcdbcddcbdf3cc9cfbc2641dd22e413760f6ebbfad46f
MD5 66d1e9bf201317dd874081d9edbeaf26
SHA1 df825df92aafdec548bd84295aec0f76dbcb38b9
SHA512 70069ef9b377339b55b5cb3b1b8d4bb6f89599c0b8d306e6517d5e8fc5e3c906dfcbf60d8dc3cae0add79812e90d3e42816cb0f5d6a4f746265d84e24bdd7238
SSDEEP 3145728:d8yGxM93InMYd8CAUB24WkurwBX+T0E2i/O1EC7WjNZhZe2BK:Oyn9YMYdxARbkurwBXEvC1EIWjDhZe2Q
TLSH
T14B7833CAE4A6B38AD067C635CA72104381B425B54260E52FDC7D33C785DB3C5A7EA1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  Lychee Fixed/auto#1.txt
- Size 30KB
- SHA256 73dd8e50afa43b610bed99bcc0c16e668eec6149163ff71ea8dddf622a18b018
- MD5 80c822a6a85369233e2dc8301d7c1da1
- SHA1 0f48cb10d54b6298e64ea4e62c04ac390aeeb7ee
- SHA512 c5b761b15f968ed0e11a73365fcbfc67ebdc9f16d5fa7adafa7968b6cbdda0e848af236dfba3975fa849b8dec790ec7657f38ee5d8521b92ecc9556f1263fdec
- SSDEEP 768:1lygSWbIGdvi3gIIHF2Ld9f2++7duOoOZLPFw+d5hd7Wtin2pvNT/rOjzb6l6flQ:1lygSWddvi3gIIHF2Ld9f2++7duOoOZC
- TLSH
  T1B3E2B65E210016997F7B9BE76A7E3206F596017306B04609FC7E82F81FF580A7F39626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  Lychee Fixed/build/Lychee.exe
- Size 5.4MB
- SHA256 4025e2058abd2a8b07686ae523917d1f2b0691b73299701ba4077ff1d13a8c31
- MD5 ffd86f86491eab51c41d44354caf2023
- SHA1 c59874f2aaf5f9d553489d0b250a3767cda6d516
- SHA512 932804714311135e96e6283b27ee0d123a0a3273844396aef3a6b3c1a597832ec9e39fd6785022f6730734aa22de0c61f9edcecf21128edc670726fc444bf5fc
- SSDEEP 98304:7JkPUzOnkxF6cwAekYkPwJ08u7cg+PKd1ui1bhiMfZiMfBo/Y7mgTm05AwJHE6h:7JkRnkxF6cwAekd4JuOCh1Jtug7PAmk
- TLSH
  T1D746F10AF3E6869ED3A2A138CD5EA317D6B13448472143EB37C44D689F467E05E3DB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Lychee Fixed/src/auth/lib/QRCode/qr.png.cpp
- Size 4KB
- SHA256 4c558b6959ed98007051ed3d37d896f6668166b54936a829a5deca329f78ad85
- MD5 54eac4290a312b3f5501f9f8079602c9
- SHA1 7eac5a8bd9d8462e210f9a77c5d7f60748212afe
- SHA512 54afc71f3b186e789fbba9b920a05456a938aa3539a8a3e6f5d836ffdeee46527cc4aad7551720cf2cf2b6b120939bf9cc7ef23ed31edc8ac8084f191b3ff1cf
- SSDEEP 96:AT9YYK5vcv5biK8DtE/FMIWj+GDO9bNWaWw9wJ:AaYK5vomKbFDWj+NWal+J
- TLSH
  T1FCA1228E06863E7F6D7216384EA5C214EB89E0B7C6D12351BEDE03503F7683431A6F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Lychee Fixed/src/auth/lib/curl/Makefile.in
- Size 21KB
- SHA256 b99678d23139074bde35083fd780105262b5757d55f7c3a7ca6945bc2dcffc7d
- MD5 c86e54e49bf251eb162a6a1bae6584d8
- SHA1 6867a73b64415b5569229f4203d157f2416da433
- SHA512 07b9bd2de0dc46fb2ae55df079201ec9f3a2e84f864730bfb3376e3d44093ff1aa0f3755c312b29ca24b97bd2fdbd497e234f2a98a0963852d63ef4c5382e9c1
- SSDEEP 384:wqspDu6TSKW8+Iqps+it28ckoQh5frmWkYOkZjj2FVQM0Gqr3xHDIDgxBWPpTMI2:bspDBTSKW82diEJjWkYOkZjjQVEr3gSP
- TLSH
  T17FA2D63EE85D1E313A60D0E62ABA4197958363174A4A6E213FCDEE44730E44B717F573
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Lychee Fixed/src/auth/lib/curl/system.h
- Size 18KB
- SHA256 9eec4a36e131b02b793278fdf1975c50cdfa551d7d5fa8036a65c2254582530f
- MD5 90bbc243ef15033a186b3e32cead7008
- SHA1 91bfea075721a71211e920f5ab26d68291924246
- SHA512 08e117be36c70d7747428c0adba17844699ddc805efc8abff300ffe34b8f60a36e6bf7ced4ca7b64925f34d599325c2230ff0dad9092144b6a74c8abfcc59259
- SSDEEP 384:jseODo9QIsTqF6TOzbKQYH/nFkhRMw4BgqfWyj3xwZ4MMp3V1n+Xg5ZvZStfSqwh:jJW5b
- TLSH
  T1A082AB811E9B989481E69521704C59EB83C08A73F1103EE1B1BF988C9F4D625F5E7EFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Lychee Fixed/src/d3dcompiler_43.dll
- Size 2.0MB
- SHA256 9db5277df836c5eca4cc0c9b56cb637af9ad2102ed19a303e91c8c74b79b6795
- MD5 0c20f567e2e586f6bcf3f0ce3ae64aab
- SHA1 ca04736674751ab4f4a1051f5a3e0e299c1a5f2c
- SHA512 eb39715e2588b5fc4b455abcfaa97cf726e222b9f4ef3220a6e40a66158660c303647b4deabc763a1d52556bd3e38f548e18707f3164cad7787fb3f608465316
- SSDEEP 49152:apX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5AkH:y3P9HP6Zpy9KyhMI50Du8LljslNsyHiK
- TLSH
  T1E8A59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Lychee Fixed/src/entry.hpp
- Size 6KB
- SHA256 790852fadf2dc3fbb23475a48675716df74cd44cd97d15d7584287abacaee81c
- MD5 058d79d55f6b725fa5112a354283b72b
- SHA1 23cd6938103087c83babd8aef1c1b31be8e06b25
- SHA512 a6c9ccf0efc2e17bf5cae8303f1181551011fcb440b3fbdd85183fbe73d165a1d90c74da8f00bad3af96d5c3e4801f559f2ec013e5b533cdc89df4bcd551253a
- SSDEEP 192:CYwUuQ+driTfQulycpVYBUUbCXrqdcr+mcrNM0879iH:vw5Q+KjYBVbCXrqdcr+mcrNr87g
- TLSH
  T158D143015CF72A16AA23A6ADC7778007725658075B38CF317A8E1B90EF580D561FABE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Lychee Fixed/src/freetype.dll
- Size 668KB
- SHA256 48267df7f4619ab4b12a8ee75d513c4c378a30bfec5c48cbabcb678b72f8f697
- MD5 11e2f9863b259a4290cc953f63d1aa36
- SHA1 27246eb83962360ed42737444111f5668673fad2
- SHA512 a161b90cef8ab326f91c2e2f5535398a065d04df6f4d008bdafaf0b5c9c7744c849ebdeed12f559dbfb2d52ea0e5bcbce8c11a6b98b40702a6ffbd0c52aa668b
- SSDEEP 12288:N0k+w5CvoS3+wNewEu3G4j1irSIVqmonjsxbtaMWhWvoYZwafEWm3z7qZKHy:N0k+Hv73+wNewL3Jj1i6XnMbtaMsZg
- TLSH
  T1F3E48D82F3A405ACD66BC2788657872BE37674051310ABDB16E05B6B7F13FE16B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Lychee Fixed/src/misc/configs/configs.cpp
- Size 12KB
- SHA256 d20539e02572e2a76201f6469a13173c20d8b3010cc4c06c1a5a188fe77275c0
- MD5 aca444204c520df48956afc61f0ce785
- SHA1 ba3277cf5c32c20f3c736106fcbe5c5d5e765196
- SHA512 faf45923ea98ebc6dbe596926eb5f4ed54f1b58ccf2f5ceb66b4b82d5aa3bbb2fb9e2c457b8812a5d1e939a49ed23c71969ebb4ae3e78f13c9c1c84f530befd2
- SSDEEP 192:TrFS/Crgks5dg5hoDnAf83aVYinW+osChKTC:3Prgks5dg5hyP3aVYinW+Vk
- TLSH
  T1C44234F9E1595491AB47391AE16973C2A2119DB38B018253B1BC93542F0D2FC68BF8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Lychee Fixed/src/misc/library/LuaSys/Makefile
- Size 7KB
- SHA256 d945aee4718785b5bbdbc575d76a16ef60bd65cbfed47ef53e7ced99b580371d
- MD5 cb951dfd92bf057dab4d54b755dcb364
- SHA1 89d0cd58d7976f31acaab1d22017900bdf6e2d54
- SHA512 ff96568ab0e60584727baf384bb35e25c4935bf6005d08fbdaae3ff32989b3e5e1d3a991d1166a99bc998efbf8b799093622fedfa830530c29f7e408e6b566ef
- SSDEEP 192:3tfSfES/HJ7Qu2k2QW262d2+2u2Y2H2D2E2QY2j2ak2Y27V2u2e27WX:3IfE4JEu3HWxKbfR8sBHYK0L2VzRjX
- TLSH
  T138F120DF180D6FE46440C4A4A88968077AC24FC59F3E92ABED474815F4BC39F60B6A36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  Lychee Fixed/src/misc/library/LuaSys/ldo.c
- Size 34KB
- SHA256 bed5e9cb2da0bf4d47ffdd9d47c7065589caa3c1f7ac4b41d8e5659e59c63ceb
- MD5 35b06ff630093c7216aa8a2cc145c813
- SHA1 aded4a16799aafef7ba35123297f4f271fe080b4
- SHA512 7712b991820f49c550a31b7ba34faa178990e29c8b0ccb6e68c7e80b4ef8faedb017f01f473018fdcf3fcfb7c9f1c869baccb970913dc6ef42c832f4da28687e
- SSDEEP 384:p1e56dzRx2jWo2xdZlGVuwwrYO9OkdSZk6D59Wt621gOZ7gVGgVGEMr3s3q:ptdHdngwcOOqSGx62SggVXHU3s3q
- TLSH
  T194F2E94F9CD1361345923B34A64BA3E89B98D96B5365D8C0BC8CD1643F1077ED27EAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Lychee Fixed/src/misc/library/web/web.h
- Size 4KB
- SHA256 fed0828bd572690c1101d4a39bb35142d85a588ec876ef2beee7279d3159c22a
- MD5 6c4b00ebd75833c057d253156d3dac77
- SHA1 bda1ca69e111c5c77506c971bf4fc35a568862a6
- SHA512 02fba7d57dff2d16f4974808480408e80c17f71975707539a89c63204160a7292458688faef748eb7527b7818dd9353ff7c89036a151f3d8c253ea2447fa3a4a
- SSDEEP 96:ugBVcdGmFn1cg50JtQj0iFQXURJMDlU7fmCNyqA450WJLo8K6JShetbgyuWdb:ugBaLB1b5SQYiGUlmWc45hJLnvJEetbh
- TLSH
  T1B3A10E14D8F33D1692539866D3BA8107A9468003DB75CF60B98F12C6EF9B256A4F12B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Lychee Fixed/src/rbx/3D_api/3d_plr_api/main_api.cpp
- Size 15KB
- SHA256 5e20ec9e94153720949676e446ef938a47948abd690bdb0d0e2715cf0d48bab3
- MD5 b7cd0e23b7f7ea4cdae4837c0dc78925
- SHA1 e9d19b2e6549fabec3949f0e53614a3bf2c5dbae
- SHA512 104c7cc753899ad49be13443a30726d83573f5011120520a022c0624dc8cc60564b8d7517286a3b637c01358be7112db0d94d0d57979a7d884eb91bbcb7b2451
- SSDEEP 384:t2fd5nWAnWjfCyb94NcNBNLffUOl5rxolgEOkEiAzLZjg6:wfd5nWAnW+yb9cwP7fUO6yR3iAzLZjg6
- TLSH
  T17962625872FB68AB09377095CF6B52483128F4136748CFA0BC6E9344BFD5178A2F9A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Lychee Fixed/src/rbx/cheat/cache/cache.cpp
- Size 18KB
- SHA256 1531d4cb923cc7b383233b3fc314acdab71653ad8cb6f0968f764e136d3ba0ec
- MD5 e6aebc3378dc97ce384a3ca00a8aaaaa
- SHA1 a1c397972d2c314d4afa95b9093da2bb63290db4
- SHA512 c23b46ef3614be2b840b54a858b5ce84e1a8e0c1ab1741dd5c26a394683801371c4c8faef06da74c72017b9eeef660ebb955c3b15f56d74bb199c9164dab6c1e
- SSDEEP 384:GL+BX1gxve0+sG1YRtcRzMQfjOSED2LvEbvEGMLvq:GLc1S+s0YvcRzMAjOSEDIGMO
- TLSH
  T13E82824642E77460C8A6216C6B733004F072829B3A0CDB38F91DD65D8F5DAFE9BF6186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Lychee Fixed/src/rbx/cheat/features/rage/modules/fly.cpp
- Size 6KB
- SHA256 a2d8ebddbdeed08b3c3eaf7942c25e14b512edee0c4c44397392c00b5fb8c349
- MD5 bdf80a4d05dd1bd0da004cb8a49d314d
- SHA1 268c01c6ca5ecae4f07292690ee42f5369812a73
- SHA512 6ceaec67121b7e2b2fe59c724292f0f2f82deee48600939abd13df42a575e9fc080270cd43fd3b2f2b6b929aa8ab1d457dbe26a11ac42602829ef34135c92624
- SSDEEP 192:FLvttyzQ9MIMNwM+mMoMjjCgC3aC6CUCyi/SMtYk89L:HKQ9zNE1gQSi0
- TLSH
  T1B8E1046022F575120423B67EEF6F5004A9B880D3260CDF68F90E5244AFDD9754FEB95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  Lychee Fixed/src/rbx/engine/Classes/ClassHolder.cpp
- Size 22KB
- SHA256 dadc1f538dbb560d58803f2c4d954db28837052baeddbe60f74cb5eae767cc9d
- MD5 bd2eec2dbdcc3accc1e1792bef281728
- SHA1 ee97738c3710dc9aaac9beff1f77926559f78e64
- SHA512 eaa52a51ec46858ec3a7bb2e4bc5c5311e289d9389c29310d262ea96075005f1965d826755498b7a29a81ab947d5d0c99081614361710b157439811f1777ccca
- SSDEEP 384:OAO3G280GsJ/9mqTHH+Sn+dp7Nj0As+nx1J/3BQn:OAsG280GsJ/1THH+SnGp7N++nds
- TLSH
  T190A2634A0FF27E4A150B165EABBEB503B46950D3920D87A4B46C82416F88837DCF57EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Lychee Fixed/src/rbx/engine/Classes/offsets/offsets.hpp
- Size 35KB
- SHA256 0df4158c1726b2ee8b8a19601efbf838a9798954c2dcc57eaa094c9538a8a218
- MD5 95991098c4bbdc1dccabb2370b8edf39
- SHA1 c6e440c01e597ff1b92e9ae50b78dd74914fa7c1
- SHA512 66f94cd46e76292b60dc02b66f2af50ec464eed8c8f8de233b8ad1dd3ddceb494b40351b1d63a0a50502235fd330b599a94bceaab979b580ec0fb2b916975bbd
- SSDEEP 768:2/EKc2xj65ltncK2uyncJCzPJlTI9+Aywd7jv9W87zRKtyahcDU4bYn8VaaePLoZ:2/EKc2U5ltncK2uyncJCzPJlTI9+AyeP
- TLSH
  T1F4F2F35E210055AA7F379BF36A7E3206F999143306A44A09FC7D84F82FB580E7F39625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  Lychee Fixed/src/rbx/engine/data/data.h
- Size 6KB
- SHA256 da65fb79fcd05ce92a23a62cf8c58e603c35afe53015a4d8fa49ece743b4582f
- MD5 8d08592152598daa4526ada8b748afdb
- SHA1 2e1f7570b5f98c158c908641153ecfe2e5227398
- SHA512 8ab6802c05908e7ce400dbd5060357d10862ac2d26598e80c5cdf7cda02d26d383dd18c0c1cad1ccf37675a76289c052312c8e9f961453c8b02bb9be2eebc736
- SSDEEP 192:tl0gz0wpwFZSZyirqWdjrNh0oJF8jjmzi/QmDjS:H0gz0uaShh0oJ2/mzi/bfS
- TLSH
  T10DD1112485BF9942583719AFBB53910578E1C483430DAB30F45DA284AF8C7BDADFE64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Lychee Fixed/src/rbx/overlay/framework/gui.cpp
- Size 57KB
- SHA256 09dc886035dada414806c1da40a53d1d35fdd904ca4c2017d62a5a014ccc64c6
- MD5 6d9cd614798a59d472a8244845a0befd
- SHA1 1be0a856e939250a0e2d1392a4b2593b720ece42
- SHA512 ed9cb5ff129ac29bb8ba0a0dc0095af402feea1c25b39d6488dd98bfd1fed2a93ca4587b597aa7a1f8032819554bd506bf905b9d11e2558fc94429f66da5e625
- SSDEEP 1536:Ez9gSjitj0NNxip4bHBv6dM7IKxQ6D4vCO4/uk:EFLiGbHB5Dp0w
- TLSH
  T15D437586774FF106B9B3404C86756108DD9CD8B2AD2C07FAF48D212867EFA8546974FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  Lychee Fixed/src/rbx/overlay/imgui/examples/example_win32_directx11/build_win32.bat
- Size 621B
- SHA256 e51ec8807f532ecc2e40b6309942304e9946fb12caf6788c69824fe6b44b90f3
- MD5 5f21ead814c9d3dace3671cd3ba1c7a5
- SHA1 48eef47e3236bd60d71e7ecc0036cdc2f33859df
- SHA512 ac29b34441b5c830969eb43e98a2641cb6fdde34186c353a10ce2b8e50f30141b8dc7ce43dae1588980a4530ff656cd9bdcea3ac303337540d0cef2fb9840726
- TLSH
  T152F0D32B5CEE3D4253783E2E1A9A8B43A150A40B0FB0D85D14C0E469A15DB43503E5A3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20