General
- Target Rift-2.2.1.0.7z
- Size 6.1MB
- Sample260730-nbr4dagd69
- SHA256 0a56f19beb69a490dd6a4a86c6318f8ec14c18237a1ab1c35e1f13ca9ca05ca5
Malware Config
Targets
-
- Target DiscordRPC.dll
- Size 80KB
- SHA256 acfde5b1463c95832dd7757a0407d7b81584d1f2aa5175095ca88a47535b2557
Score1/10 -
- Target Harmony.dll
- Size 1.2MB
- SHA256 53b4a612f1702155cd098f8b6fcaca5814d46ef788cbc51debbf7559300e6c32
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target costura.dll
- Size 4KB
- SHA256 3975ee530518e33e76ace8f6f31e149aca43b2df2935c901d07c975729bdcb9e
Score1/10 -
- Target IniParser.dll
- Size 29KB
- SHA256 3f22348a211d53eaabbe819a7f66e8426ac7df804ff6a14547bc4120b7558019
Score1/10 -
- Target Iron.dll
- Size 15KB
- SHA256 08be63719ff41a57d9b7617330a9117ef0309b94a7e65dc76d152388a9f5605c
Score1/10 -
- Target Jaguar.dll
- Size 30KB
- SHA256 140d73530978fc521a183581578627bbc5475967af036389687a4f986750d69a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Microsoft.AspNetCore.Authorization.dll
- Size 40KB
- SHA256 6fdafd3a7721ae25b9dc08e7efe90bd09f63b4a45af698ecb2bc9d33549f5a97
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.AspNetCore.Components.Forms.dll
- Size 28KB
- SHA256 94c403ecde85d2f120fa0212b6ab08f1e5da53c22d3844195b4d93b1056fa0e9
Score1/10 -
- Target Microsoft.AspNetCore.Components.Web.dll
- Size 58KB
- SHA256 a851b1a538b419c645e1556f0a71625f14d2904dff23f8a1c43d556b951a4082
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.AspNetCore.JsonPatch.dll
- Size 51KB
- SHA256 8e4ad97b1a7ccb53b7dfe80ff8caccfddd41704ede455d97b1f0f6f6f7150733
Score1/10 -
- Target Microsoft.AspNetCore.Mvc.NewtonsoftJson.dll
- Size 60KB
- SHA256 8b95a50253cd1ac8ebcec7f374eb21e7d01e8f263e84dfa034381717edef8c67
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Configuration.Binder.dll
- Size 24KB
- SHA256 933a8be0195e250e52b7e6981cd68399321e461e2d531d2478e6981be9ba9e7c
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Configuration.EnvironmentVariables.dll
- Size 20KB
- SHA256 752801ebef81190a4204f84815a949b27f21660adf1b096848ddd834ccf153a0
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Configuration.Json.dll
- Size 21KB
- SHA256 6e545d33c20e4a5620dc98e1df5f04265eea3ea8d221e8b292c1c60ba3fde47f
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Configuration.dll
- Size 26KB
- SHA256 2be740723868e68e83ad8e30979eb2735b251e552b013a069f5e6d08a456efaa
Score1/10 -
- Target Microsoft.Extensions.DependencyInjection.dll
- Size 70KB
- SHA256 af778adb511e525a5082ae3de5a18e9eb1eadbc4a65990b348b335ff329d5a5c
Score1/10 -
- Target Microsoft.Extensions.FileProviders.Embedded.dll
- Size 30KB
- SHA256 047fd5344bf45c32c6704b9e825dfd2b155e03d5cacbae36df078d6f253ed543
Score1/10 -
- Target Microsoft.Extensions.FileSystemGlobbing.dll
- Size 38KB
- SHA256 3ced0338d1fbb7f5eeaa34777650873af59826f1c196c059a53e96644873de91
Score1/10 -
- Target Microsoft.Extensions.Hosting.dll
- Size 40KB
- SHA256 4fd6af6ddcd4c9ff7e23ffd9405910663b51824e1efbe71dcc1b2a14f6d4ab2b
Score1/10 -
- Target Microsoft.Extensions.Logging.Configuration.dll
- Size 19KB
- SHA256 d9067402f3522049930d116b3dedb2a8a37f02ef3f55a85bf321bf040ce22b2d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Logging.Debug.dll
- Size 17KB
- SHA256 f72f07e27bc8ce988ae5962929ca01686dc74fbdbf5d6574939b470420007faf
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Logging.EventSource.dll
- Size 28KB
- SHA256 3746b1cdfbfa3235d2daa26b25df5c539aab43c3df92f372da0ec6f2fcd3e4b6
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Options.ConfigurationExtensions.dll
- Size 17KB
- SHA256 6d182bf4c1a195dec0b86e0e465e1af0936a0e712c718c17ad62d53606119f27
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Primitives.dll
- Size 39KB
- SHA256 c4a6e972a494a937b2f81a287f7fbf70271485e4c3861e9437a66126f3100137
Score1/10 -
- Target Microsoft.MobileBlazorBindings.Hosting.dll
- Size 299KB
- SHA256 2c93391b8be5bede8d10c866e4f6a9181b42006bb81ebfb6b029fb74d91b5522
Score1/10 -
- Target Microsoft.Toolkit.Uwp.Notifications.dll
- Size 140KB
- SHA256 865de778f7884dad42e9746cf8de5600836151b2dfa7b836281c354a3db2820f
Score1/10 -
- Target Microsoft.Web.WebView2.WinForms.dll
- Size 26KB
- SHA256 bae99d5352d13a99b0624e68a644f15dc150f52aded49fe9b6f4a96469e74098
Score1/10 -
- Target Microsoft.WindowsAPICodePack.Shell.dll
- Size 501KB
- SHA256 567d1afab390852429dd0c34ee5e8824d8eeca9c171898f7ca94e002ffac4247
Score1/10 -
- Target Newtonsoft.Json.Bson.dll
- Size 95KB
- SHA256 f3c56166d7f90296bbe6b03f64335623c3165ed25948288f1f316fa74dd8327f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Rift.deps.json
- Size 163KB
- SHA256 b714b8a39ef19a8f4f5ce773017337b06b8896a7acb401eca05bfd7f86c46a60
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Rift.dll
- Size 391KB
- SHA256 c67b30b311dbfe5a816b3192c4cc77a93805fa7f6f8a82794fc36578bf93d1dc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Rift.exe
- Size 279KB
- SHA256 9b2661b1eefc555a5ccacc9eef7285d3fe288e71d75351eb2e7b4f4fcba9b945
Score6/10-
Drops desktop.ini file(s)
-
Network Service Discovery
Attempt to gather information on host's network.