924eb9f9635caf808b07ee812690732eebd231d84bef09fe25b385733bbe4cd3

Sharing

Copy URL Twitter E-mail

General

Target
CS2-Orbit-Resources-main.zip
Size 44.8MB
Sample260802-vm3gtattax
SHA256 924eb9f9635caf808b07ee812690732eebd231d84bef09fe25b385733bbe4cd3
MD5 5034ef59cb543058711a3eee6c23e624
SHA1 eeede253eb438f3e6d9c6c5ac3e3e9776ad3837f
SHA512 2e58da44cb69536ef6a2b8fd7b243de9cb0a1e87166e61c4f0197c42846016e4aff79df103d9f34c935b56e0b49e089a9caa897c42b1dc238d90270c9af746ac
SSDEEP 786432:aaRHpJa3TOO3MGIorMSO89nj64fxWzt/Y09xF2I6GKSyHiuxuUGPl1RzAwq3UQ7y:aadpJa3TOO8yrM92j6+oY0DFdJKZiT7z
TLSH
T15EA73385E5C29EEC87765534FA7CA82F23D3A39220BF04076A1596C562CDA250F3FF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  CS2-Orbit-Resources-main.zip
- Size 44.8MB
- SHA256 924eb9f9635caf808b07ee812690732eebd231d84bef09fe25b385733bbe4cd3
- MD5 5034ef59cb543058711a3eee6c23e624
- SHA1 eeede253eb438f3e6d9c6c5ac3e3e9776ad3837f
- SHA512 2e58da44cb69536ef6a2b8fd7b243de9cb0a1e87166e61c4f0197c42846016e4aff79df103d9f34c935b56e0b49e089a9caa897c42b1dc238d90270c9af746ac
- SSDEEP 786432:aaRHpJa3TOO3MGIorMSO89nj64fxWzt/Y09xF2I6GKSyHiuxuUGPl1RzAwq3UQ7y:aadpJa3TOO8yrM92j6+oY0DFdJKZiT7z
- TLSH
  T15EA73385E5C29EEC87765534FA7CA82F23D3A39220BF04076A1596C562CDA250F3FF25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CS2-Orbit-Resources-main/Airhorn.wav
- Size 776KB
- SHA256 eeb4ff25976f46e026139c47062f139e13fadfa804c1d5bea297c42d718345c9
- MD5 c842a4c8ecdbeffa14f924e331b28aa0
- SHA1 006c3911b317d40cc6443fef4a78fad1d8b0f788
- SHA512 e837476c9f800ef0301acd1bfe273e6d546e91f9f3830c330721dea6e5e2df886adca10472b5889f5068d5afd3284f791705180441ec63fe6e6d65f0f9b05964
- SSDEEP 12288:eNTuUDwqCCf4u1897oqAVHhgDcd2Ac8Hs2Mi:SkqCY5hxPnvMi
- TLSH
  T191F41296B341C390C9EDAB358DA2DBE55276BF196E0716133139BB573E320832E129CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  CS2-Orbit-Resources-main/Death.txt
- Size 308B
- SHA256 3bee736aaebe54097a86850d4f0d593d42e64505e7dc6e06a5dcf8c8b2a045d5
- MD5 f4cd5b8792a36bdc5bb1a8aabf3c4885
- SHA1 6639de6fdcca7594f7163ae6836d7e5b39065c15
- SHA512 712ffb2df1d7daacb190382155dfe027d79b96f1977827024900d6fff730a7d9f3045f5fea86cff7e099a6bd3502cfa2f403ce28e162b7c5dedd25982f1ccb6d
- TLSH
  T195E072A882B683CBD0F1C1CC8006B23CC249887F6024808A2C3FBEE650A1628E073092
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  CS2-Orbit-Resources-main/Default.cfg
- Size 6KB
- SHA256 c048e238728e9dfb1c12b2dbbed30f480d836ea7ce6b851ae7750f14545ecd10
- MD5 cd6687919413360141b9b596ec652cd6
- SHA1 ea0e91918d1770b89feae2968154eaddd13e77bc
- SHA512 625ab18e602e8d4e5d7350ad02876df0044cf2bd3b8b491836861dbd9a97d269eac36fff2ce282d2e39d9a935df0c3d0445662bb9df36e3bfc15d2326b1480df
- SSDEEP 96:MWNwShxCpenF+6sRo4v0BcAlz6EHnfJQIfFWTaqLrwoloOcLnUNSDV7kFoLonI7n:MWNwvenF+6P4v0B8kxTNg/wIFNShgxC
- TLSH
  T1BDE13185570CC87530F9C52FFE76659C8ABEB61ACA3427B3E3B9BD968784088456CC18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  CS2-Orbit-Resources-main/GlobalDLC.txt
- Size 30B
- SHA256 07cce9d5aae15fb328ac372a25e16273b3d881d2b24f1e3f958fa0f534a1ecd1
- MD5 220a8cb00fb6c0a03e07a7c19be5899e
- SHA1 95cd7bf065fb9bf14ed7aaed3a75758c6d9a967d
- SHA512 a38ddee4d8fb5cf7f3ab819e3438949d076acb83436eb32da39593fcc0b59d56163cd9b9f9beb835e131e5291acdffce9034ba880efbda8ffb56ee80f3f10e97
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  CS2-Orbit-Resources-main/GrenadeHelper.txt
- Size 69KB
- SHA256 36affa1097c829983771fc8803df1db514bdb8e20db98bd83dfd80184ace868c
- MD5 2c8b54c17eced604654b14bc6e1bff09
- SHA1 0b6521e23a494aac31c68114d87781a01c54f532
- SHA512 36a368c60159594ad0d1eb2ad1244422918c5077151963435c419e14b12d6036174758ef2f04b14960aae544d200598d30488674e334babd78967c81afd72f6d
- SSDEEP 768:4T7KXAnd4XFWG+Tj0yLlP55yXw5E2aDjs1hSZADoNwwt+THzdIcaYSStTVMIflPk:4n5Q5gWSn1iqTpfSYnXnJgq44UW6b
- TLSH
  T1A463B7D186308E98DA641BC9D8EEA80B17F40CA5E57E20E6BF34D1A6800DC61757DFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  CS2-Orbit-Resources-main/Headshot.txt
- Size 187B
- SHA256 e2be3917d4ffe95663a85febee8d9af7e3acd2f43123224b811b211aa26b2f32
- MD5 09f2480fdb9a5efabfb18da9b36e81b5
- SHA1 656e43ccd980b36cd1f863efae727f0d13be1350
- SHA512 594cde169e270db44210c0fb2fddc3e916bf0271824e555c7de4f95958c6394fbca393cc7b593234759b16376e5818ceee5ef64403e3780736a7165f3ff0869a
- TLSH
  T128C0229E4AA6082B81110141080A58E2F1263DDBD2939950A220200BB0C98AE62A0C8D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  CS2-Orbit-Resources-main/Kill.txt
- Size 130B
- SHA256 f3efb39f0ae8f804f32bbd12126bd18c93024985f3ee94e27dfc240c1c444b0d
- MD5 f7eb3cfaa46bad87e183cf53f124d173
- SHA1 f2f2fc7a9deaf6f8c5f9556c8066413c42dc32c4
- SHA512 d49fad1e453d5ce5201723a50853c38344b230f490598e5d4b5551a028aa7fcc4dffc5e3a175f851cd9750185d7b461d5029915893f14d89503a82a5c608c80a
- TLSH
  T1BCC0222EF200C30AC823023C8008F02AE00082B000B0AB2082CAA8C2328C0082A23ACE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  CS2-Orbit-Resources-main/OrbitAPI.lua
- Size 11KB
- SHA256 20b36d249a0f68ac0f203a5e336aba393f30945f47ad696731a368efb39839f0
- MD5 fbd847f94e111dc29a2508519d65dea1
- SHA1 daa415cb3bad64e0b9f580211eea4c9bd5385ea0
- SHA512 f916261bd6d26048a7f0242c5d57e9344f814fa0ef746ec013b164563de600082b060da8b7b29e50b95d73818080dbbb4a1aad899d82fb42f485d5f212aa488f
- SSDEEP 192:l1WcOTnKzL40l4q2tAJh5feNKQXOTlzq4JgPUXBC0:ecOTnKzLHl4q2tAJh5feNKQXOTQgg6BX
- TLSH
  T12C322E8B3D87E11108C22A35550F7548E62C523873A4A2A5D4A8ECEB1E7BC7F56FF94C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  CS2-Orbit-Resources-main/Source2Viewer-CLI.exe
- Size 48.7MB
- SHA256 1ef232ccbc4c7e319db8c2467f7a3afe493ef86821aad0c6e6470b06787c1ae9
- MD5 8e8b2512849eccf99cb330d6cc1c85d0
- SHA1 e016064809e4f114fc4d590be02116e386b23441
- SHA512 ca030a81c6aa76b7ec12efe6bd46b3ddac7c7efb5f74259e88610f964b115b567093ead68380ce7360db45fdaa74e9cd849dfde1258753d3a3902691bf155434
- SSDEEP 1572864:PHO3wvHivBA2PmWBPf1ROAWeJUO/p7UFlDudgjzg:PO3hvBAeme37puDudgjc
- TLSH
  T14DB71256E2F900E8D57BC0B8C65B5527EBB23855133097EB56A08A692F33FE16E3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral19 behavioral20
- Target
  CS2-Orbit-Resources-main/Version.txt
- Size 4B
- SHA256 167918ace289465acd4dd6ab6587fe10bfe54bc475ad8074b049ac358f98f9e2
- MD5 12fd838288a9836dcb33694479b34c4f
- SHA1 5e7f14b30cebf64666152c96ab1e31d30bcab383
- SHA512 6701f72d34a6f291b2eeb46adba515911bec360e67c991f87d40dbe0c6b010ce7d51c2843f8d67dfab5324058fbd4bb324e7f6148f335393fa7934bc0ef2694b
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  CS2-Orbit-Resources-main/Website.txt
- Size 32B
- SHA256 405fcbdbe4ed6576fc6452c0190a42302a774b8f420039023a7e5b5e6e7d1ea2
- MD5 0e63c7fe1a7f9b63bf86b14d5b0f9b52
- SHA1 a203debe8ff707f566183d5a38a84367d6302540
- SHA512 f51f490081f6d15cdcd251733f7ff9dfa4618efc9c3737396cce8116e18577b75ed11fdb67244df86ce9db072b3e2cf7546601bddb8b6697e49d504136854726
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  CS2-Orbit-Resources-main/cs2-dumper.exe
- Size 2.1MB
- SHA256 8544d5c7aecc083f5ed0c17a8274d676e5a058a5cae5ade4344df680f6904568
- MD5 64bad0e1bdd67f90caf74d03ebe9fb46
- SHA1 fe3704153dd6cfe257169617677cab0b66f55d3c
- SHA512 3866a63d3fbc4dc761a4714603dc26dd73379cff93afc1525d76fd32e336b28db7bdbaff55209cb7609f4738d9ecb3458a943703101a93755d059036761684ee
- SSDEEP 49152:i9txrsfMjG4WrIItZCXw1GLsnVwI7EykGDPFHMEc:a9sxXhHM
- TLSH
  T186A51716BAAEA8ECD2A9C474C3464A732B2174CB0B367AFF40D455353E69AE41F3C714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  CS2-Orbit-Resources-main/flick.wav
- Size 148KB
- SHA256 6115f903005dc34586981af698043fb67b3b33553daf95cdb502b563413e9f83
- MD5 80ac1c1391243f225779e637cd66b963
- SHA1 ee1ee672c864b66fcf46c06f6faa8ff8a49942e4
- SHA512 cc022e2593cf37af8e2f22da0ce26057e9dafa6db271694509bef88c0ae834c2fceaedb944471d9eee66936ebd0ac66065e85b280bc7f0015cd9f087016f0a90
- SSDEEP 3072:j67zQd2hNc6lxqYtFvTel6eOygEHQsZprreK/2Xeo:j6XQd2h+6WYtFvTebOEwvJX
- TLSH
  T120E3DF47B321D760C6E8D9768D96CAC80760BD4B5E03AA23B075F75FBCA12536E03399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Enumerates connected drives

Loads dropped DLL

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28