bd4204db4c58bc6f354c7badb6809cab3d4813e6b3447b0f02c9d14cb88eb222

Sharing

Copy URL Twitter E-mail

General

Target
dbd.zip
Size 8.6MB
Sample260807-zshrtaaa68
SHA256 bd4204db4c58bc6f354c7badb6809cab3d4813e6b3447b0f02c9d14cb88eb222
MD5 7a2cda087395dde1e6d3971d5cb6102d
SHA1 cb882b1d8d6d4a4bc52c2670ebfa1fce1bcbe84c
SHA512 b27e9b6f8c1fbea71c691efd2c0ac31942555e85b0462fd98c4b06c974005fbde44d4b2e702c23d810716d7cb3335eba55e8b5ae8dd020aff8ee2ae0b3a241ff
SSDEEP 196608:VZVAWdPBeglSr0397FfDqbWwRvnIayIEmIhA0CXZks:V3JAhr0NJEWYfIHInd0SZks
TLSH
T19D963308F7CDD3876E8992A5BE146E57711400C9BD0743C62BF2AF648688BD5A0EF4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  DBDCheat/Launcher.exe
- Size 171KB
- SHA256 623c3cf78cc838f742863f0b644b2fbe81c07e11e4f0a20228a8d2936c830538
- MD5 ca1bb431fdf1693706349ff742797e13
- SHA1 b66e7dd2b7c35987782fdf6ae0cb27bef5ae277a
- SHA512 01046720b107e70fbd2609ab177adec161fb541148de3a41ae41d237314fa2dd7527a6f7e68c79c3dcdb2634689d8bedb3b67eff363f4632e76b27c5f279a88c
- SSDEEP 3072:T5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULC3opO0n6XpfS6:TBKjK2LFzZNfIULap06ZX
- TLSH
  T1ED04F70662AB31A8D177B23889BF8522F7763C15473186DF13904A7B2FE66D0AE77311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1
- Target
  DBDCheat/StoreAppHelper.dll
- Size 33KB
- SHA256 8478a6638377e9f05ce39295b03cbc6767cbe222e83f9dc5dbf65c39cca09860
- MD5 7b8188e01ece44836df41025dca570a2
- SHA1 714d2f752a74cd07288381c43a4dd752f8cdd0cd
- SHA512 e4fe173017bb696aca0d2d02a0ac497327e40d991913944d7bd85e8e8fce0a5cf67abbd57c9de00b8c69528bc258df9941ec1c9a56aaefdf1d59c103a6a3a1d6
- SSDEEP 384:04wJ5hywLkB3ACUua7KnPbEqKKCFeMARpqJjiPodXG2nfJU5nZz1OCzYcHe2v5:0PowLkmCU9ObwX5nfJCPzYcHe05
- TLSH
  T1CAE2A34023EBB225C9753635683FC171463EAE415D318F7A3DC86C7B7FE66008923A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DBDCheat/System.ComponentModel.Primitives.dll
- Size 73KB
- SHA256 96789fbde342be57152e83b20e833bcc33f12cf30a7b5c9c0790990cf5886d48
- MD5 c735bd356e654447d20b566d06e9eb40
- SHA1 ba0a395ca66fbb3d9c2ffa7d2d4da5401847e64e
- SHA512 a5a5e334919d101b992ace420d59764e75317828b6a1b5b4c77d065e7718c88e2d83308a011c9dd7eea16dc64b0d1daebc20e5ee3647dcf92f5b566f1f04b576
- SSDEEP 768:PxI98FwPKQAtTKNI6T1mb1yF0YDC2oKQ15h498Q8a7QhDGE0nXBNEuLSoQuSmC:pITuP6kYFlC2oKQ6y8QRGvXBpL7SF
- TLSH
  T16F7339197BD80322FAAE863E91BB5851C276F5872723C8DF4901E5CE1F93BC26630579
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DBDCheat/System.Console.dll
- Size 153KB
- SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
- MD5 71138847373d2be68fd4da8e56552bef
- SHA1 fa9d9f20101f231c20e4d5cc5e05457ceebc2b2a
- SHA512 44a10b1babaff18db7a0cef316badcaeaa8e6f22aa0ecf1bb6a0570e19e4c1b697ccaa8c3cd3b315dbd072e4cad7041375c91c4aab922d67909833074ef6e202
- SSDEEP 3072:f9SMiIGbCwq+p14axXwbK80tmOaYMGr65pfSw:fQj9Rcclmzp
- TLSH
  T15BE36B26A7C00557EFAB86F990E32701C237E8A60B0293CB2545D6B82F47BC77F35595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  DBDCheat/System.Diagnostics.Process.dll
- Size 283KB
- SHA256 8ab493c640c85b298553d27db03244c4e76044c2a724fc896bd5085ce4046563
- MD5 6aef81c8bf5378baa131e86f5f340a11
- SHA1 0bb730b547bcd6025996d1a43d8717b8999d7044
- SHA512 f2e7c42990a746f0a8e3878a26a909ef1e58ad50917a928d0f946fd03a1ea0946ddbb7475496373451e53bcc25086501de8c8c79e91a0550528cbd8dbfe6e710
- SSDEEP 6144:W4vmEeveJQADJujgkju83yxs9b3NX1PkxEqCS7s03Y1KRRMB:W4etveJQAdSvju8CjWb03Y18qB
- TLSH
  T126548C1A738C5615FEAA9679C067C022D07DA1971707D7CB0364E6893FABBD79B30223
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  DBDCheat/System.Memory.dll
- Size 169KB
- SHA256 71590855c91416c5c0eb0b3eae631ac0869de17242435ca82e0b4e85ec5d0200
- MD5 c3aa1f663b6051e8ca14af1c00fee134
- SHA1 f143236c74a32dfe3208be3f679c36a5b42c9e97
- SHA512 323b91fafa6d846321513d5205dac5b9945bdfd6d4758c7820043b5d47410e7a1e384020f933c78fa8e827469b797a3fece3402e27a779eedb95e59d215a026d
- SSDEEP 3072:O0RPN4ab6HEuCKvSwOy6fM/vfovpPh/h/tmlIYrA6S1mUgMF6EpfSL:Ft+GKjtGPh/hwlU6EUka
- TLSH
  T145046C1AE7CC4727D82FD6BA85A68662C733204BB701A6CB45C4E5D80F63BD0BE77065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  DBDCheat/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
- MD5 762482bd3d55ca4e4e5296a64ecb7d0c
- SHA1 c95b20296bd8004422f655c2bd85eed436d410aa
- SHA512 bbd71857c3140bc0c5d34ea6a44c57bf73c47786229a83cf5aa098ec790719c4ab8457098fcb52b7c8570ae9b7ed5cfa39f535edddae8485b60b8a2b772e94e8
- SSDEEP 98304:pKd1eeIoZQsU+fRIwvUVvJS63bXYPrLAU4n/0v4/PyGvjb:UCoSsU+fRI/VvJSyXcOyGv3
- TLSH
  T14DB69E25E7D85B1BD01EC6BDC463C226C671E8A62313D6DB0018D7982F53BD6A27F263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  DBDCheat/System.Runtime.InteropServices.dll
- Size 50KB
- SHA256 cab4e96d3ddf225acfb610a53ef299fb9e7deb74ab374e3976d799c77dfa8770
- MD5 8a6c9b36376252c6e6051e8a8c102a15
- SHA1 9a26de4bc0309dcfb301445132ec2de1721cc02e
- SHA512 97a3cb9cf801da36b75b92a00c6236d8aaaf9d819fcc8b8f3cca57b77426ccef692a17569c35ff6d59a631ea71735aa7d0265889bfb69f6ae2259e36d3e9be09
- SSDEEP 1536:34oWJIP8z2r1GqhwF3FMjyPPkmW9Iz0meJB:34oWikmgqhwNFMjyP9J9eP
- TLSH
  T1CD335A216B989326DEE707385677EA910DB6F6C613239BDF90A0D94D1D9BBC80331335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  DBDCheat/System.Runtime.dll
- Size 41KB
- SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
- MD5 79d8b0685cf2d323c7cadbd276e435bd
- SHA1 ac74c0958d691b4009f8c8657639e4115a03729c
- SHA512 eeafe9cc578da300dbaa4190a866dfcd3d65ebfeaa0484f6595225d28cd713fab347f7b3f00af1f1ddd02adc83f83a2d03087a77ab374dfc905f1a88b3f74c6f
- SSDEEP 768:U0BV0jdpFKYl5f4bGRi2xVbcVT4pftdhDGE0nkpaNEuLSoQuSivU:UIedGYl5f4bGR3G0BtdRGvkwpL7SP
- TLSH
  T11B130660AE4B5273CE8E9772C8B3A08109F633CF64B7CDBA541E8546298F244D3B3759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  DBDCheat/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
- MD5 2e2fb3d8fb17d2b9f858cddd8cafa12f
- SHA1 4d4c81e30bb1c91dbce44c2a6950ed47bab7c938
- SHA512 fc1b6f58c966fccd78024edb2add0edd8d37dbdf919e2ec1e1396d0a431b52fc0bae1d80755ca06a441b0192341afc7047325858585eddeb9babd00d69606d47
- SSDEEP 384:7Iv0XhW6YJWa2mNDE2GdC0nWQgmHdpNEx0LSofousWu4BkCw8+:zUnhDGE0nSmHTNEuLSoQuS4f3+
- TLSH
  T114725C798F6496A2FE669F31D8EAC611ADB5B6C0AC42DD0B204805CD1F037A86F7073D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10
- Target
  DBDCheat/System.Threading.Thread.dll
- Size 15KB
- SHA256 047dbd73dc9a8e7a4d7e516b323877d2a538fd525cab04d1d42fb5b2a7f474b3
- MD5 749294770b03a880e845c9b205369654
- SHA1 ec4b53c4c59fee60079e329d1c323652d99faec8
- SHA512 b02c8b58acd4c059abaeaabb674cfe1e67785612db8397952d4b73e65007d113a9794bf3f2400febc5e371ee61bde3299a8213e09cc0de4eb3163b70ba2bbb5c
- SSDEEP 384:Jz2EXZVPD2Wc+7WJ2mNDE2GdC0nWKYpNEx0LSofousWu4TOMk:NPFWhDGE0nmNEuLSoQuS2M
- TLSH
  T1BA725A654F6486E3FD22AF3094EA96566DB3B7C1E852C90B205984CD6F033686F70B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  DBDCheat/System.Threading.dll
- Size 78KB
- SHA256 6e646460ac549ca63883e78e739590f4a400f8d2e00bd9e99b0f02102dbb812e
- MD5 08c6efbb7c22876c4b43dc64c6764a1e
- SHA1 d7845408d8e700df1a78421c3872dd451a1d9a41
- SHA512 6f2f37d0876263a68e957961a92a668fae0ee0d6fb1a9e6d64732c6fec80c8305630ab966fe5d1c8cac2cb96e38a179fe544afebac46fba53ad6a9edc4439b33
- SSDEEP 1536:2k5RkjKu+ydo98uGxdzJERH7AveyRGv6pL7SBd:2k5Rkdo9wxdzGKvey66pfSBd
- TLSH
  T167735A11B3E88666FAAF8BB9D9B22911C071F5DA1B13D3CF1058818D1E97FC19A71273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  DBDCheat/clrjit.dll
- Size 1.4MB
- SHA256 cc9c853642c185b17d18f189c5e80928963bf485b0eeef7714e94339c5858e88
- MD5 c83270c072e51d37928ab8d4d42be464
- SHA1 4c0431bfb73e070180efa4d302e2cba57ba42ff5
- SHA512 37c5addc0583e1afd612fe375057f2ef07be4fc434b25b8eba79c3e10442e4ff1c0957b48cc0dc204f9eaaad13cd017ba6ee110b4f18d0e3ad752a32c8e7ed1b
- SSDEEP 24576:pLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGyqfs:pLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHg2
- TLSH
  T110658C06A3E805F8D4BB9234C5934B1BDBB3B8161371CFDF57A04A56EF237922A1A315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  DBDCheat/coreclr.dll
- Size 4.9MB
- SHA256 58d91f3c88293ac3b9761362c53af32520ca42f8be14244c0bd7a8e6d1c95564
- MD5 6f84d00e152bc64261ac7a0f6d4dc3f5
- SHA1 3f130aee6c3b5684d9d601c55b76f85a1576cc92
- SHA512 29f87baac29aeb092cab368b4c7903d6fdaf36c521efb960535f98c97124aacb4a39bd41304cbb382f1bd8d2ebd368aa144e5dd8d7106cfe264d8d5ae277fa13
- SSDEEP 49152:rRRteSC8CjfXq6EoB/SEsRfoSakEd9c6oWUqCJ0OTVRepih8IdCdTWOVxJYaHmnX:1RqXB/SEAKJspr8wKQXl
- TLSH
  T107369E56B2FD00A8D4BAC078CAD74917FAB178491738EBEF02644A552F27BE1A73D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  DBDCheat/hostfxr.dll
- Size 369KB
- SHA256 e2486fc6dd58db5a55db18547459c0b160ba1b2e824193ae0dee0e9a0673d8d7
- MD5 155e4d45f02a4f7a2a228b44fa4791ef
- SHA1 14cb85f0d506b87bdad63dbec75f5e3206552592
- SHA512 25dfa7fdd5f3508ebe642c55330f81f7ad83d3d7bb20f4a3179e8d49805ce0dcb56f20820319a073a23d582b9b72e3ae2e646b92744d667717ee4d43bfdf6480
- SSDEEP 6144:CGr5uLf+w7dEtiODC3+Gr4iAOs2dEAh2gcmgrW09jcg:Zmf+qdEzD/iAOsVVH97
- TLSH
  T156844B16E2ED056CF1BBE23896B79905E6763C494770D6CF0390456A1F33BE09E79322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  DBDCheat/hostpolicy.dll
- Size 385KB
- SHA256 def634e856fc681088c8833fc43962772d59b47384fe73d5fbfe689245974146
- MD5 12098df5d600e8d952fd43f07fac71e0
- SHA1 0a55613ecef2fdffcd55066400372f25430d8287
- SHA512 31ed39da9c9074f585d6586dd71137083375f2ebdedf91ae33d28374dc9dfc02b766b7456f4735f83c19ab01613441873c43ff15ec159383fe1c986d539d838b
- SSDEEP 6144:ZBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BU89GhOfBE/XodO:ZBGjtNlU/rsQy8XyxzNCOeXn
- TLSH
  T158844B16E2ED056CF1B7F2389AB79902E676384E477096CF03A0516A1F77BD09E79320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  DBDCheat/mscorrc.dll
- Size 143KB
- SHA256 a231d44280d7044fda539b85288fbbadaba4830da421f0f28fd0444a05c2f107
- MD5 5f50c1cf588dd6f882ff5a329390fcd4
- SHA1 99ef8b69d4a299d87f373d24fe4523e4a81954dc
- SHA512 0279acda155406e371997dd7840a23f055097442b08dd666dc93739a1af7041fae7f889e782b119196b6409cd40d55e1556cd9aa2bfea676ab6ffbf1efa4a0a8
- SSDEEP 1536:7ODZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXX1RGvcpL7Sw:7ODZ/aSKlZ4ZGnwmUS4Sc16cpfSw
- TLSH
  T158E37791A7F95218F6F73B74ADB95AA00E7ABC96FCB9C21D1240805E5D71E408DB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17