8cba9020301f15965ed05095a8e12df7da02ba67e1a212e26337e27f20b25c6a

Sharing

Copy URL Twitter E-mail

General

Target
BestClient-windows.zip
Size 62.9MB
Sample260726-1t9glasarg
SHA256 8cba9020301f15965ed05095a8e12df7da02ba67e1a212e26337e27f20b25c6a
MD5 386ec0462642baad89b5729335ce6f5a
SHA1 e8310693639f4545dcae9b564ebb189a519f8675
SHA512 65b506bba3ef5576cb0d42c5193b5ded81c12d56f37fbdef29957965b8de6fbae4ba419a352f83aad7ef1aa83c42c52e9c5144825c2066dfa8085896c305ae0d
SSDEEP 1572864:SFoJ6y9bOhhR+vpmdI824FZVce9Pq1cb1DoB55ZF:SKJNC4vd4Fg2P4s1DkFF
TLSH
T14DE733A8DE601A14ED1F993E9354D19188BC22B4E70BB50C0E55030DAF9FBC9B37D79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  bestclient-2.0-win64/DDNet-Server.exe
- Size 2.2MB
- SHA256 9bef2a576bac04962c35f6bc9ec0dd4f39034eadaafa3c91072a8ee667b49d4c
- MD5 e41a06719dfb10723e716795c3b6fce3
- SHA1 38f18e250191c50c987f2a0617774cea901068c7
- SHA512 ebb0e54f8cc37ce1e150211fed4f4ef26ee81a3f9c951868cffd0145b6907e8006e8d5ac82d8a5a12335b9965c9437778bd08ef1363bb46f10c799e9038ed716
- SSDEEP 49152:MaklB7CAHjqc8YMCpbzN0zIwR4H+oXiA3KXMXJlkMZaeL3CZ/fpcEoD:4hCAHe75oD
- TLSH
  T1F2B56C463BF060EACA6EC078C5439A12D6707E1D83287BFB5DD409171F2B6E65A3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bestclient-2.0-win64/DDNet.exe
- Size 24.7MB
- SHA256 9253c426a151f235993c68901cf8d9c32dd50e371a21a0ee0e27bfee211ebef8
- MD5 17b693c2293a9c312bc18bcef56c2df5
- SHA1 3891adea5be98218a71c5ea19526510107d915f9
- SHA512 b5d7b9a8700ef1b0b13b5055ccf98b82cc1ef84e06cd451403c5394cb35461214505dcc7f32e04650cd0ca91900cddc1b8edb702fca9ae272384685237afbb14
- SSDEEP 393216:wrD0EHAoJpGyv73TkIoRs4LHTtV9qVd8feg8rTKcM283DvCKn:lN/o5u7DvCKn
- TLSH
  T1EF47AF46B2E115D8E57BC078C6569A17FB7138BE03206BEB1AD096652F3BBD06D3E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  bestclient-2.0-win64/SDL2.dll
- Size 2.2MB
- SHA256 d0ac4e209a78ad56d53af2df40a51ae9e4043704efbed5b46bf75a57ec92ab1b
- MD5 9f2509c44faa79c87382855d4a94966b
- SHA1 4474c7d2923dd0a535c01612c6bd2c0e1f1faef3
- SHA512 fb5f407af1020109acdf693f5391cdf7905a99d0d09628bf066f459caa36cd2e296adb623a60950191e4e3395501c332b672ecc219bdc02415013dba42d6ccb3
- SSDEEP 49152:5L6mcGjDqleTVMEGol1sEQf21L1gz6vr//uw0508uLMDpYwvuIBxV:F6QHpQO1L1jvrXuw0S8DpD2IBxV
- TLSH
  T1E3B57E5FF2A365ECC717C031836BE772A93178180254ADBB26949B716E32F904B5AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bestclient-2.0-win64/bestclient-updater.exe
- Size 169KB
- SHA256 fc45048e79002f948b93a9bc50f676c8feaaf1b45f3150aaf6fbc0748407cc59
- MD5 195cb688adbfc13161c2ed81c78128c6
- SHA1 d8d20fd96c113c70d211a9eade2dfbe77c1a1bb8
- SHA512 f58d352f7aa45fb1515ec2db37918d8a8bb78f87db8749de10c5e87b71bcc828db93ae8e6a8eea141c108f8318d515bb90bccb7f199abe7c868ddd9f873cad4f
- SSDEEP 3072:DCS3uzC7kLthHMtA3mfkl8DUO4YTaU8iyCfIW:DCS3ajstdfkLVmaC
- TLSH
  T191047E56B3A511F9E173D27889961606F77378220B609BDF03A04376AF277D09E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  bestclient-2.0-win64/config_directory.bat
- Size 236B
- SHA256 ac9fd0ac986f58dc46c8e52e36807c3c7c6ae3b85da7f32b85166ef1bc462e30
- MD5 e23d42a6bbf42bbb92b18a90ecebc24e
- SHA1 90ec9fe52626746da5799ebf4305b3f1fcb7028b
- SHA512 d106003e38a664278159e71811430b9fe235feb1f8ba0918a2f49405757c7c12a2252a495f4841a866f6a7f851f7592320510c2a2d481257d0a33e29c1210329
- TLSH
  T1D9D0A7F3400C0025C7B602C83E695997604997E0452F2AED786F91E8B424DFF43C7740
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  bestclient-2.0-win64/data/BestClient/builtinscripts/sayemoticon.chai
- Size 188B
- SHA256 cf491568384e78778b21dd882798a84e7556e40b2bf6323c8364242fd97ecc2e
- MD5 350790b867b3fb4fae0ff38408519484
- SHA1 32dbbddf682e9061f0a35a59efc68ceb0ef15bd4
- SHA512 cdec1138ea9c9c943e2b74458e60b7292007d59de1261d85480c9086c421b9adc15b3f44526c33bc41f5a291a1ff133f2d9437c123ca6a7a8bb3931ec99d87ac
- TLSH
  T128C013211A50576C97C0DDC169C95C0FD4B735B63F3D4C6C531DC56065FD2E475640B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  bestclient-2.0-win64/data/tclient/builtinscripts/sayemoticon.chai
- Size 188B
- SHA256 cf491568384e78778b21dd882798a84e7556e40b2bf6323c8364242fd97ecc2e
- MD5 350790b867b3fb4fae0ff38408519484
- SHA1 32dbbddf682e9061f0a35a59efc68ceb0ef15bd4
- SHA512 cdec1138ea9c9c943e2b74458e60b7292007d59de1261d85480c9086c421b9adc15b3f44526c33bc41f5a291a1ff133f2d9437c123ca6a7a8bb3931ec99d87ac
- TLSH
  T128C013211A50576C97C0DDC169C95C0FD4B735B63F3D4C6C531DC56065FD2E475640B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bestclient-2.0-win64/data/wordlist.txt
- Size 14KB
- SHA256 bded01753b3137270eaec22800c43a269aa121c5bf254b8f0ae487c8ac4b9cdb
- MD5 c5ca8030f935d6ee878fd41dd6df33f3
- SHA1 78550e86e9eaa25d85fee8e521694f398918fb67
- SHA512 3a1ec234d16254822379afc56a07d08c549b905af07de3b999bee460fe58a3a3ac00651a740bbdae88c0dcc78aa9d616223a20cfd0d9cfe6ffbf6bdd678bf02a
- SSDEEP 384:URFKGC1Mv79nJwX8YqAgKN4kmcDjnZAOflGOF:UO/4FDukcDjn6WMOF
- TLSH
  T1506262986886809258ACF7B0D11B2D9DF12FA76128131D2F8D3ABB5432177BEFF54482
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  bestclient-2.0-win64/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bestclient-2.0-win64/libcurl.dll
- Size 586KB
- SHA256 8d361a28685bdca7f0264f94dca8a8a2d3174465ee1ad5fed69c80120f607035
- MD5 6070f99936087cabff52bafaf04dd3f6
- SHA1 0b7c4d0a425f3d69802abd5d78be984e298d0272
- SHA512 f53809cad876c0a139582f6209d71c886c864208d913b383b6268415196eb1fce0c4d972184787163cdb992a8ad2c7e72ef8452b2aaae7189b8724aed6e2f767
- SSDEEP 12288:tEq4fb+EFEv5dwBSFNsvMt85VIWO7ZIqSE+:tENfb+EFgwKtSSWfK+
- TLSH
  T18AD45B27E2A328FCC16BC27482A79772B972F4251130BD7F6250DB313E51E506B6EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bestclient-2.0-win64/libfreetype.dll
- Size 665KB
- SHA256 5da185332bcf920ff8f3d649b536e44105b914118b33f90a631350e6e813277b
- MD5 564ab421c4f3ecce01d087d4bc28e8c6
- SHA1 3b4e992448c47267de0201ef6b5db0979f8dc192
- SHA512 8dfe5bf1a846fc14c837520bcfe02cef124f1ef49a694b507bbe7d5213e3ba3175c11be5e7189db9f86e90e0e14cebd1dfa60b657bff2eed843e5028a71eb85b
- SSDEEP 12288:pRvw8ezpMBHwZheKGhogg4ywbx7KujYoo0ASAcglfEWmXWF:pRvwTFE+cKGeh4fx7Dkoo0nJZQ
- TLSH
  T1DAE45C57D3E351FDC66BC2344367D772BA31B4201124AEBF42A8DB312E21E90671DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bestclient-2.0-win64/libogg.dll
- Size 33KB
- SHA256 5187cbb032ccba2ec40f460572576e964d6e089f0b9ec75d975f4a24c7f45ef9
- MD5 5ea985fe0821b513fb4d002514f0be00
- SHA1 d3ddb70c56546d53224e0e742c13e630a86c6f21
- SHA512 2a7bead202c013981bbc5ec505e36f3ab898d88c971a3a5efd21862470579b20769ebb5241e4854a2ed192fb1e9b7a0c8473bf3669cfefd67ff42c780bd88276
- SSDEEP 384:vhge09sMsINs0b4WwuKVuY82NNv8j9JOoXQ8nR0LRRCppImMAYnQcg6FSsTq6dB8:vhd09sVI20vwjOj9JnnGtUplYXosS
- TLSH
  T1DDF27D0F77A3A8ADC81AE13444AFA332F4B7B831A9625D7A0350D7311D70DE46A3DD69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bestclient-2.0-win64/libopus.dll
- Size 544KB
- SHA256 55a25a986ef2bf874503e9800668fc5292a9ebe3b011cb3569706c8629d0dd95
- MD5 d1e88f2125d7bd8b1d375aedcf1fdebc
- SHA1 39f1dd204db03aa2194ff07d29a149377b04b9b8
- SHA512 f538b0b192be0218e22847e79c398a2232aa59dcf4a97827511c1d296b8fc68f3988e63123e28d94018cf55c0ee771cbf56958e345ba3762056ec1ba760d478f
- SSDEEP 12288:RYdxjSKUT0qanhlN5FRYTLHED2KX4FKbgYWzzKyfo:RYjjSKUT0qanhlN5ITLs2eDc5Q
- TLSH
  T19BC4F729C7FB94ADC27BC1B84B0B5B775830BC5D5178A43B4AE445C13B761309BEA3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bestclient-2.0-win64/libopusfile.dll
- Size 49KB
- SHA256 5f25c3fa2feaae3d6e7c129b043b1a5b51ae4db1bdfc2c9d4f77030e24bd8f74
- MD5 f69a5de7fad79e0cbac3909d71e06acf
- SHA1 03342585c470080703b0aeedd28143cbcb37e8ff
- SHA512 315df87137af0befe212e779a8daab0e1857e18422219bc389123ab2d3b50e2e9f074c57c7d13d61e23ff93eec58e31257d2bce4292e25cea025ed0eb278e208
- SSDEEP 768:lQb9+k5Joapi+J15CJ/l7R/LCyC00JuqV5JRttx8WCDx:l2Ik5Jp4K15CJd1XCJJuGJRX/Ox
- TLSH
  T1C233390BF2A325FCC567C07057EB9733BA71B8214630AB6E4794DB382E64D506B2E719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bestclient-2.0-win64/libpng16-16.dll
- Size 278KB
- SHA256 d6b01790f7cd91518436fd84d98a43919726cbf7783c5b6314014e4837fbadf0
- MD5 d67636715ff72454be4439dde2af829a
- SHA1 adfa6cc1b2aa436ab12d87524bc7fe87944ba145
- SHA512 c63332a885364baf8e48b9be23f701682ee4e7b028aeff2f70c727a53ac47cae6451a34184a5ca06e058dcb7c458d9d64c6268668f9a9cc6e4b2dacb40a35c44
- SSDEEP 6144:JrXVb288kcpHH98Ry0zI0mscZ6pRERo/as7I4j36R109m7w8EA0WpEj:5zERo/J7IQ3mXw8zO
- TLSH
  T1B854E73BD7B3C86DC5DB81B17F8399D42570BD381335E44F02846A51BB2B9707BAA1A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bestclient-2.0-win64/libwinpthread-1.dll
- Size 55KB
- SHA256 b08e275950001e5743c7ceb2dcf74f7026994423f7d5dd786971d58c5be34644
- MD5 328445252bab42fb5a44fccf48e69ae5
- SHA1 3234bbc717fa215e605eecb3c00e27b3501918e1
- SHA512 c9ffc5fcd9a0ac57757261238198253aa1c031164b5250602d2c2e7a97a44cc11d0f8d4ed4e6c3632331cf34a666737772c8cbe87d4f7ce2836e3cf6560cbb6f
- SSDEEP 768:UN/utyFl3DbNnsoG8AxZBwKTDR7ILp1hjxxQGc1icim3Yu///nBacTzZ3T:ahFJFGVxwmg1hjxU1dim3YuHQcXZ3T
- TLSH
  T171431A3E76A648FEC52BC23485FA4332A572B0103236DF1E9734D7752E78D709A2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32