bad673e42b307386a9a743f3a78e2bc6ae294a44b17964f64d941f9235fa0f05

Sharing

Copy URL Twitter E-mail

General

Target
orbshacker-main.zip
Size 40KB
Sample260815-t1sn4agg53
SHA256 bad673e42b307386a9a743f3a78e2bc6ae294a44b17964f64d941f9235fa0f05
MD5 3694330d09602718ea37a7a1e9935024
SHA1 f57a84a2d85d4229022a64ee0edd0547381e96b6
SHA512 1c1768063151199969a4cd8487ab48bce0370cf94c5d4862a7b2652e3446568550c66454afee7723e36d8f5823c55dbd523653ad9218b59e48ccdc4456e96eec
SSDEEP 768:yE4VNUUA2xjQ6Gr9oeWMbJGBMczE+rVY3GRWJdXPOJUkg3w:yEGUcpdx3zE+JY3MWJdXPKUFw
TLSH
T19C038E3D0FE64C16E27505BDF365C367A358EE29A90D9E8166CE2C300C2DE651D621AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  orbshacker-main/build.py
- Size 2KB
- SHA256 46b932ad3d32e0c9750280d8b8804d77bdc751504ebf48a04eb0bf01c7069abe
- MD5 7bafafe3c0c57af2fd932fa980d5adf7
- SHA1 da9bbb543f13d2bf4e5bb94d7086f45ea1bd3ec6
- SHA512 07de807c175936500189af6f60e30ff55527fff16fee740c709cf532e9734af82fb680ee035a7b46777c7bbf244d22c86c1b8584a4b8a9d12f24dcdef985db58
- TLSH
  T1354120199A0A4C33AF538B4F9996C171A3B57C132B047438B1EF81441F8E52ED2B65AF
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery execution persistence
- Drops desktop.ini file(s)
behavioral1
- Target
  orbshacker-main/orbshacker.py
- Size 2KB
- SHA256 de81a62d7ea37336a4316b22e509de3c24ecfe4e03b6506b557e69800a3a1100
- MD5 5c67b6af07ad4d5f437d4b3973888ac2
- SHA1 948d10ac58e09598516d111a03af9ee5edc6b23d
- SHA512 5674fc458b791ace0a3f17ec438a10376eb9e78dcd01f7b28d7334e653f7bf84a0540706bf1207905842ebbdba8f90a46741239df5e4c9975dbe49f0edce08c5
- TLSH
  T15751522AF900183382F2C95CDBA1D034372379573942A534F9EDC2592FE9539D669BF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  orbshacker-main/orbshacker/__init__.py
- Size 163B
- SHA256 267d097fb761ad5c8972c7c734f858f0c1eb2d24a31d1c08ee38f40b299cd474
- MD5 ea71b15e0815329d33d081571f38b129
- SHA1 7ab6b068f09b2ce1309ca7f2ac896bc8cfe84bf3
- SHA512 d68c54ae7ad7a74bd225c27691cdf40f6602df94648434961ac12488aea293afc3d11cc2c7dc6d2f7597caaa2a049d0a3ba9a965f159f6d2c2fb2915276cdafc
- TLSH
  T150C08C770E2FAC83A03655FE71C1E1323B50224B4AAB115DA298760DB225A76961868A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  orbshacker-main/orbshacker/__main__.py
- Size 183B
- SHA256 195e079a75c529c26cd772b74112f69b018924828d2cb27b88e7ab778294d6fe
- MD5 421c7a81aa816bdd11faa1270afb2e49
- SHA1 223190be5941f2a76daa1df1ef00c0452019c7e0
- SHA512 393f1c0d924f90f925073acfafe7eb67e94b1104f5b0559680169a43088861833f8a9712fdd65ee40776b8dacaacff3e65525695643a3ef37f65e7d63d7f18a2
- TLSH
  T194C0801D9883952144D4C89D75A451E453E71A5305805130714003339FD57115CE9A3C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  orbshacker-main/orbshacker/_version.py
- Size 18B
- SHA256 335258d6d7ce2c04812c260630e0ad65bcb87c3abecbce03bf369f72214e0afc
- MD5 8882d112fecf146aaf803223c4d5c71a
- SHA1 405e32d2f771d2d93aaf1f76749c5fc98b92f6ac
- SHA512 f4c1b7eb21ca00bc33a5d4352a5234b32ef2f7a2a554f4fa9db91d57e5a8219abec6d580abed18f4bbae25fce2a0e4ec0ef06996b8a9c435aa6a534b36772a51
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  orbshacker-main/orbshacker/config.py
- Size 7KB
- SHA256 0edadbab20f58b07615a781aad769f895ed6526be466b6bb65df9b9d2fdeead4
- MD5 046f6096b082a0cf34e7c43d4003485f
- SHA1 2a862ade3eb7a5b312b5ce7be4e90bc034b50730
- SHA512 7928a3298112a208e1441e86ecf2b9d4e9205ade767fd9c142f0a581f8032422bc529e40617bd1e71295573c45b4a1f8f51703465ba6ae08b577d5c07f36dbb3
- SSDEEP 192:Epb3XKM/QnZYOnBoARmAoSKPRvWkf2u//WAH/qxo1w0vJ:Epb3O1ntsVWu2pwqxh0R
- TLSH
  T18DF183339811A876F346C8BC885AA601B766BE4739416474F8EC32502FDC9A882F17FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  orbshacker-main/orbshacker/discord_db.py
- Size 9KB
- SHA256 f8a54e7ca85d7b81c5a621890becd853a6163ce8620f14c85732a3c35212ec0f
- MD5 3e2482afac291ffb8ab19a11ea69c17a
- SHA1 3d3a5eb19ddeacd9087945e1724b709b6b966016
- SHA512 16f024159578f011b703a04e04e32fe6ac24117df8310a390d8f44d2a9e049c113596fe2d240bef0937a4203f03894a9f85bb11b7bd2ef55a1337f29dcfd20ec
- SSDEEP 192:s5BGyyujhsIC0SJ/PhPthf6ZgrLwZON7U7JrMMzwyiLMvZP35iYM0ewMh:sDeujaoQXMwLQG7U9c4Z/5dxewMh
- TLSH
  T16812FF3685616C2ABB63C93E8C82F281571B781339182136FDACB2442FCD46ED5B5DB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  orbshacker-main/orbshacker/errors.py
- Size 460B
- SHA256 7ffaf00784121d444e8f80485eb413e7dbc796e5766f745192414afe1f9e7434
- MD5 3b2bdf273ffc16ae66429d226841e09f
- SHA1 247a1f2de6c6c4c87f6154c9885877d33bdf7e03
- SHA512 266e3d49befc38c4964a0502ea277a1835f31b008972784870bf21ef0f1fd7fbb9a56370a74c9ccf6ed01e8a16e748bdb76a0a0f61cb97382d04994a1097c8e4
- TLSH
  T1E5F02E2ECF6A0D370173056BD224D0F01C6BE5575A211DF639E642072ADCD50D84254D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  orbshacker-main/orbshacker/faker.py
- Size 12KB
- SHA256 d18e85289436a3f0fdf216993b33f4e8006b461e9a2a91827ecae75360ec053b
- MD5 13923d2ee52d7bfce180d70fbbf49a7d
- SHA1 c3ac5bb46afd8784303d28c19523703832ab9ff4
- SHA512 ad0e001a28191a91c6e6245c95f152fa3c95ff0283b531db1199cff0eba8d738177715ec666c2c97f9dcc64583745eef216cbb3073899ea1477f69c99219c8c1
- SSDEEP 384:Ol2JHC0Jx4NNz3+ni2AmsZZy1FX0m86jZ6:KsHC0J+jH61j8
- TLSH
  T190426516E9181C62C783CE2E5D92B463666F7DA7170A1038FCBC92981F4993DC0B5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  orbshacker-main/orbshacker/main.py
- Size 2KB
- SHA256 9ac10739bc5019afb5dca1f11475f0fdb9b017205b0dd388232f9555a3c6abe7
- MD5 b0e9add5dd3090e3554f294b9d4475e8
- SHA1 bd30b2f40837e57e07e619507697d5621696186e
- SHA512 a337be0fb92e896846ff4215a87f301bb294b9aa5dd3f9bd1f5de3d4936ccb7682faef3a9be64b871ad8b4cb1f78e7f22a664f7ac3c4391883b625ddcb39d794
- TLSH
  T11351D3178A601C258F83806D9DC5E4D406273C275E56353AFCBFD30A0F9A578DD92D29
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  orbshacker-main/orbshacker/net.py
- Size 760B
- SHA256 d7ae1650b9772e99814243b90f6b731b437b006e1c9c9f828c8b3e00d6f81722
- MD5 d647c3e88e824d4eb358ec871fe98c56
- SHA1 c25a2f27381c43238de3f5a9ceb72249885d9036
- SHA512 3eb3582effd32e3e9546969401b6c27e68a91e88f7a280e55de139496c45f675e66966454c0dc4de86272f3af3b3ad726463335b5ccab90340a1b9a416dc791c
- TLSH
  T16001705B4861B413C2D99A58893A62B10A5265273F4139B678EC62382F8D83CDCFA589
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  orbshacker-main/orbshacker/steam.py
- Size 12KB
- SHA256 2cdd2f0307303a18360b2be0d65858e9d601fbebe107cb91dde633e4ad1cdb42
- MD5 a4a28f32c050a71865be800ff635e096
- SHA1 2c55f4d8c80d87eea3abfed07388046c6f465045
- SHA512 80974c6e7dbd7f14fa14d5184ad79121e7d0f935accfe2874a71bb8a56bfb6b0ea2b45831211a2e9910551dfea844a83d78efd35129d4d7e5b51d590c4384e95
- SSDEEP 192:N354X0YGuNwStB2ZCt/e+ap1yq+9k9D/47KzgCyHWNTpy2b8+Ie4YS/GS:N34NAc/e+aHyq0k02e2bB8xuS
- TLSH
  T15B423132D8216836BB57CB3C9D96A213536B792734162835BCAC73441FCE43D89B85BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  orbshacker-main/orbshacker/timer.py
- Size 4KB
- SHA256 8b976f6721cf3b9f9759d4286801b4afa8d580303b8bb064a9219e28e9ebb7fa
- MD5 40cc83b5e074dd8e450af7b3b482d161
- SHA1 0880c66f6fe788c1555fe8954859ff7bc8274abf
- SHA512 8096cf107e2a1e3a20c308a9f1495407bc0c5a935be6895c6cae8aa1cc2910d0887c7cf687930ff8470dc5e39729f39240ba7737f728d53379d97ef744c9d744
- SSDEEP 96:XR3IQQcpB4KMRGO83RaQSJSPSjjVy+SapS2pZY0X:XR3IKpB4KMRGOsaQu8aFvpZ/X
- TLSH
  T16381441FE7281AA182D3CD9B9A92B853158F6B5307492838BCFC66C46F5513941F0EFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  orbshacker-main/orbshacker/ui.py
- Size 6KB
- SHA256 7190dd12d3d1d1ddda855d0725892b2006ca1fd1a482210923c9237f0d6cd506
- MD5 033b0e2dc4c255ca369cf83493ec62bc
- SHA1 f7ab2fc94be8ad92ac4f823e51618cc8a9492686
- SHA512 d5b21e80ad3785e956c0ece3b09084157f38da5fd8963f4e658ab1c64da470ea755043e62b120cc7e849b991830f9c07a572d217f150f6e7b0c9793f70574413
- SSDEEP 192:jAIPlg5zfkWPy9Q00V0000Y9C4Yp7lFyB:jer00V0000MC4ghFyB
- TLSH
  T18AD143A3E8602D2ADF93D73F8DC3515E1B777A0397A6193ABCAC42484F8501E85B4877
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  orbshacker-main/orbshacker/updater.py
- Size 6KB
- SHA256 0bda449b3de4e2a2c92b1e4c6736135ad16a75f750fb61c64b569997f883f868
- MD5 9d4fda0889a4ecbc12239ad832804b00
- SHA1 859fdff76fd2bab9fcf32bee59b3334f8c02354f
- SHA512 dede80eafe531e9819ad33c969a7667675246234ea714e385d6eff5655e73b28a872f466e8975fc254e9e470e858f8cf721e6bf2bccc5f5e92a8b9ab3f4f8783
- SSDEEP 96:Dubjm+xwK5nMMuJ5bKmuN5rROrG5iAC0mNoJXzlciDJYhRnf/9g1CDKxadIRQ9D6:Duu/gkM7r9O0iA36MRciDJIdWCiqpk
- TLSH
  T1FCE17227D4012CB2D783C66E8D1691A99717B9073A02A43CBCECB1046FCE53D86B56FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  orbshacker-main/settings.py
- Size 862B
- SHA256 998a0bf70da0bf89d5be98ddfdd0a4c382ecd8af96ed45a3361110cadacf71c1
- MD5 6ad344708f547a95f24b59499c4181af
- SHA1 5caeea9b8781cd70f3ba69afa9f69aa1e1d900c8
- SHA512 cb345658ac16a2ed664ff0ec32823466c7c88c63d4d96d9409994c2ad9642a53ba301cf905c682fb1ef98ae3b0d62f5b2d84495117d7ab9546c74dbc65a782b2
- TLSH
  T1B811846A5A017510BE00DEACBA386D0BB77EFA28E5065020F44C64C24FF5924EE83DB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  orbshacker-main/tests/test_config.py
- Size 8KB
- SHA256 da72a09c126528cc9251f5293a8caadb6f4a0bc8dd760cac80748c89ecc49a78
- MD5 e77273a92d5c7c112a3d77a29d95995b
- SHA1 e61a7a29baf2c2862128d02a018685f92bf69acf
- SHA512 702dc3279c857af2a500be2132612c087968b3a52a32edaf88d556bef0536996b01baf6770da017c0abaf78d04df2ac8e5fb42fceeda13118e6e608469695279
- SSDEEP 192:kQRloRYR5RhuRKR3GRKixRyGRIfw3IfgpqBAwpRMnVED87BAm4aLlRajwkYRN:kcjnDfgpqKwpRMnVD7BPDLAW
- TLSH
  T19F028427C8785E228294B239837BA532AAE3EEB30A4060F475ECC5446F09B7545577F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  orbshacker-main/tests/test_discord_db.py
- Size 2KB
- SHA256 ff58e1f55b064c1ca57f4aba32eae1b67d20fdd4387afdde45ab395d32576848
- MD5 b5828b2d790967a8363ac25b5bac1b6e
- SHA1 94852e43301ab143519bbb91e863d1aecc81db47
- SHA512 ba7e21396dae89ed18eb0734c388710add8f1339d409867ecef61519954814b87a9506503a995eba3dadfabfbd58fe41dfd2f0f16333b2e53ae927cff2cc5920
- TLSH
  T1BF510048D1E62CA656AAB9702427B98263275477CC9C1CE0B3FC82D91F4C83CA0EDD76
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  orbshacker-main/tests/test_errors.py
- Size 622B
- SHA256 1c58e55983eb572c897a5d48e96ff4dbd7c981450de8149d1280ef66369f68bd
- MD5 2330373a75c897470cc24a64bbd33476
- SHA1 7e75c168fc86f361b66872c57fa2c1a46eb7a643
- SHA512 e6abeebcdbe5f84e5ff202461dc1b3df61570a62a697f41ca4ccb3c0c5b04496c4c0c622b1cf18ee10c7ddf1bb2b6764daefe77b26e2e7361eaac648a5de3c8c
- TLSH
  T1DBF07D2E8F224C1B8126057C9326C174528EADA314206CED37D5C16707DCA86EC57266
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  orbshacker-main/tests/test_steam.py
- Size 1KB
- SHA256 204ff34d96b5c56f671a978f19cac5fa8beb653b371eb6af5ba6cb2f61714812
- MD5 2298c5b7a67587bba3fb2772f6b84d81
- SHA1 0c838ba473e063d4ef67ef31e85c4ffb92c9daf2
- SHA512 a5f4c20c8b7ac0f5b1067a98c7393a41bf44f27b36d46dc3ad98ec43e73a5ca6ddacc25c86f9a27175fa159f4a0b033e79ab9f69636179aef557a2810fe718ea
- TLSH
  T166317B29C1914C1B05718934D22FD6E3B25BA8831824BC7574AC918EBF1E82F90E86FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  orbshacker-main/tests/test_updater.py
- Size 615B
- SHA256 bd557a94ee3b10487d281f836737fe9e4d8409a76aed51e8e26130906cc3eb66
- MD5 5eb8884be7ad09456ea4f50f8889e856
- SHA1 1dbf63de1dcdc2d65acb79314741fc9263786518
- SHA512 d96fe89961d6d5c9a2fadcbd50354de2d8c0cc0f5cc2d566e7a83ba5683971c60d50a38439c1a5a94524ba3d060283529cffdb6b7aa5c65002221c591d034810
- TLSH
  T198F0F056E83319A1C33BA2789722C4B9E128E5F782055961B0DE66C61FB2BB068F4138
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21