General
- Target Orbit.zip
- Size 69.1MB
- Sample260903-2hb8dsgm3t
- SHA256 0519c2e32e5525669129bbe38a202584a8c4823711c2d6155038ca83d8e11f2d
Score
8/10
Malware Config
Targets
-
- Target Dependencies\VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
Score4/10 -
- Target Orbit.exe
- Size 7.5MB
- SHA256 d0971b0fd9c27770ce9e4d7da1bf1ae5d9b170d92d9f68ccad8cdb3a87a02646
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target OrbitLauncher.exe
- Size 5.0MB
- SHA256 f1c3ce4c1254abb03235e23710a771e3f515597848df51c81847b3ef0f44092b
Score8/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Resources\cs2-dumper.exe
- Size 2.1MB
- SHA256 95d0390cd4962a9eea050d6ed6d2717d681e1d76b7972ea0991348936e172c9d
Score1/10 -
- Target Resources\ffmpeg.exe
- Size 88.0MB
- SHA256 d31fe0802eadda669786f88c856f590beb1277ab0bed61a1f4d959757165ca3a
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1