e84c20331cd461c99ffd8401a1d6e014ae4d62ecf9ba0f3cb7a8065bb24593cf

Sharing

Copy URL Twitter E-mail

General

Target
RClient-windows.zip
Size 55.4MB
Sample260910-wqfynaea83
SHA256 e84c20331cd461c99ffd8401a1d6e014ae4d62ecf9ba0f3cb7a8065bb24593cf
MD5 f47bd65db234e838e4ba7d0d0f6ef2e9
SHA1 2f4b489c1c82259f4aed901460ace297d14c0d2f
SHA512 57a37d06d137a50a71eac4391b6106ae82ff9db81356f613c46f1f9ebd811ec11e52a4b44f4e3136b30ddcc86f0f0dc42284eb757fcbc3d5a814083c688ccb01
SSDEEP 1572864:Q9rg6y9bRqhR+vpmdI824FaVcerAxqNANe55/p:wrgNy4vd4FD4A8/Dp
TLSH
T1EFD733EDEA806624ED5F0E34C26EC6B6C4A96055730A512CCD40130DBAAF6D3773DB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  RClient-4.0.1-win64/DDNet-Server.exe
- Size 1.9MB
- SHA256 11f778c677767bea7105ef2d3bd11434faa4cb7cf219e6fc9ca8c6a91335f073
- MD5 462c9c285123dfa8719e488392a5ce8c
- SHA1 fe7656ee0da19306ffdca88034687a79e45e12cf
- SHA512 cb8fee9e61a93bdfe5273df6c7f6dce04ae079f21382e087cdcead3e3b6c554817f43b9cd72e830085ff6cf1b455f236f646e4888519cdde5a47545640727967
- SSDEEP 24576:khw0PyB92OS7WrbThMs5XCZFag2GyqCmhPd3M3S2+Li56oDkoNrgBO/:kaayb2OS6rblVmwg2VTmhlgUoDjE
- TLSH
  T190957D0277A620EDD57AC039CF437627FAB17428032076EB16A0DA5B5F27EE05A7F215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  RClient-4.0.1-win64/DDNet.exe
- Size 6.6MB
- SHA256 369cb5d38f6ed3bae4d7fefa6bf698b1242b0988f14c55770364bacfdfbd6a3c
- MD5 5daaef07ce3bbd68d135866752711cfb
- SHA1 2f111bf286d4d7998f5a05f1575d9e7ab4a0d3a3
- SHA512 53256dcf0df8c9a2bbd0c702d431013b3ae33875fd70b536508edf067b05c655f585fd42ca0eccdea1604f7ab0134cce625e69b9e5d9239ed9835b5b503d6ba8
- SSDEEP 98304:sTpu0KlPSBqXQu7lXLp7cIN4XOp1pjjMTDpgeIoDbq:GublPSBqXQu7lXLp7cINLp1RMOeI8b
- TLSH
  T133669E2273A500EDD07BD0B8CB97A917EBB274550331ABDB06D0461A1F7BAE06E7F611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  RClient-4.0.1-win64/SDL2.dll
- Size 2.2MB
- SHA256 d0ac4e209a78ad56d53af2df40a51ae9e4043704efbed5b46bf75a57ec92ab1b
- MD5 9f2509c44faa79c87382855d4a94966b
- SHA1 4474c7d2923dd0a535c01612c6bd2c0e1f1faef3
- SHA512 fb5f407af1020109acdf693f5391cdf7905a99d0d09628bf066f459caa36cd2e296adb623a60950191e4e3395501c332b672ecc219bdc02415013dba42d6ccb3
- SSDEEP 49152:5L6mcGjDqleTVMEGol1sEQf21L1gz6vr//uw0508uLMDpYwvuIBxV:F6QHpQO1L1jvrXuw0S8DpD2IBxV
- TLSH
  T1E3B57E5FF2A365ECC717C031836BE772A93178180254ADBB26949B716E32F904B5AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  RClient-4.0.1-win64/avcodec-61.dll
- Size 2.7MB
- SHA256 58c71baa592da746c9c5e30fdd41814a2736454b2b7168da4ab88585758d4786
- MD5 ae6632db7de61ef9a0e1045b829502dc
- SHA1 e4c9eae709c3b3f415f9183e2e45292c14b9d5e2
- SHA512 37d112a490105d11283fab5a2febb618305919932bc18b55b79bc0d3ef862791d3f6f8cc6dfc57b00ce1fb7dc576c724dafbff84144212b247e51e265904c28f
- SSDEEP 49152:sG89fcQ/HjCDvYceJirwiucX2bpbsyt7U9gkUObKPHv5bW:he0Q/jYv8/NR1TdW
- TLSH
  T11ED59E4AE2B325ECC567C170976FE723FA70782C40247DBB5A90D6312E63F90661AF19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  RClient-4.0.1-win64/avformat-61.dll
- Size 502KB
- SHA256 b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
- MD5 179f9ae9eb9e05411966a0d943e75360
- SHA1 a543163fbea7ba8061da700133cc97e9ebcda589
- SHA512 ca77ce3fb5e345ea6304c9d405de577b164224df01ca25ce1ae560ab82463dfa6b0dacd6880d8d8821b15d3892f8d12bbee76832dee1cfef083b74f127949fc0
- SSDEEP 12288:vHoTMfa6+pLH1SicSrISTE6bj3tZEdEyd:vHp0HnHASfyd
- TLSH
  T15CB45A17D6A315ECC66BC13043ABA772BA31786511307DBE2794D7312F02FA0A75EB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  RClient-4.0.1-win64/avutil-59.dll
- Size 1000KB
- SHA256 cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
- MD5 9f4e1d61cf779052fed243c2142495b2
- SHA1 246b28f23c542ba6f38767ad420fc4b6f716c8af
- SHA512 f3059d52d93731fee5fc03af389ea08f85f449caadc79a0021fe3da2234648ad3bbf012d96eddd2de161bab062bb8be3a9bc98114cb941bb46c1e0117c241593
- SSDEEP 12288:4wCIUQiy/TXud3kOo09O11s5mbxZnBR2XoR6nP3J:4uioXud3kOn9x8fqYRoJ
- TLSH
  T190256C01A6E3187EC16B913046AB7657B6313452CA64BE2F67A14D343F34F916CCFA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  RClient-4.0.1-win64/config_directory.bat
- Size 236B
- SHA256 ac9fd0ac986f58dc46c8e52e36807c3c7c6ae3b85da7f32b85166ef1bc462e30
- MD5 e23d42a6bbf42bbb92b18a90ecebc24e
- SHA1 90ec9fe52626746da5799ebf4305b3f1fcb7028b
- SHA512 d106003e38a664278159e71811430b9fe235feb1f8ba0918a2f49405757c7c12a2252a495f4841a866f6a7f851f7592320510c2a2d481257d0a33e29c1210329
- TLSH
  T1D9D0A7F3400C0025C7B602C83E695997604997E0452F2AED786F91E8B424DFF43C7740
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  RClient-4.0.1-win64/data/tclient/builtinscripts/sayemoticon.chai
- Size 188B
- SHA256 cf491568384e78778b21dd882798a84e7556e40b2bf6323c8364242fd97ecc2e
- MD5 350790b867b3fb4fae0ff38408519484
- SHA1 32dbbddf682e9061f0a35a59efc68ceb0ef15bd4
- SHA512 cdec1138ea9c9c943e2b74458e60b7292007d59de1261d85480c9086c421b9adc15b3f44526c33bc41f5a291a1ff133f2d9437c123ca6a7a8bb3931ec99d87ac
- TLSH
  T128C013211A50576C97C0DDC169C95C0FD4B735B63F3D4C6C531DC56065FD2E475640B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  RClient-4.0.1-win64/data/wordlist.txt
- Size 14KB
- SHA256 bded01753b3137270eaec22800c43a269aa121c5bf254b8f0ae487c8ac4b9cdb
- MD5 c5ca8030f935d6ee878fd41dd6df33f3
- SHA1 78550e86e9eaa25d85fee8e521694f398918fb67
- SHA512 3a1ec234d16254822379afc56a07d08c549b905af07de3b999bee460fe58a3a3ac00651a740bbdae88c0dcc78aa9d616223a20cfd0d9cfe6ffbf6bdd678bf02a
- SSDEEP 384:URFKGC1Mv79nJwX8YqAgKN4kmcDjnZAOflGOF:UO/4FDukcDjn6WMOF
- TLSH
  T1506262986886809258ACF7B0D11B2D9DF12FA76128131D2F8D3ABB5432177BEFF54482
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  RClient-4.0.1-win64/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  RClient-4.0.1-win64/libcurl.dll
- Size 586KB
- SHA256 8d361a28685bdca7f0264f94dca8a8a2d3174465ee1ad5fed69c80120f607035
- MD5 6070f99936087cabff52bafaf04dd3f6
- SHA1 0b7c4d0a425f3d69802abd5d78be984e298d0272
- SHA512 f53809cad876c0a139582f6209d71c886c864208d913b383b6268415196eb1fce0c4d972184787163cdb992a8ad2c7e72ef8452b2aaae7189b8724aed6e2f767
- SSDEEP 12288:tEq4fb+EFEv5dwBSFNsvMt85VIWO7ZIqSE+:tENfb+EFgwKtSSWfK+
- TLSH
  T18AD45B27E2A328FCC16BC27482A79772B972F4251130BD7F6250DB313E51E506B6EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  RClient-4.0.1-win64/libfreetype.dll
- Size 665KB
- SHA256 5da185332bcf920ff8f3d649b536e44105b914118b33f90a631350e6e813277b
- MD5 564ab421c4f3ecce01d087d4bc28e8c6
- SHA1 3b4e992448c47267de0201ef6b5db0979f8dc192
- SHA512 8dfe5bf1a846fc14c837520bcfe02cef124f1ef49a694b507bbe7d5213e3ba3175c11be5e7189db9f86e90e0e14cebd1dfa60b657bff2eed843e5028a71eb85b
- SSDEEP 12288:pRvw8ezpMBHwZheKGhogg4ywbx7KujYoo0ASAcglfEWmXWF:pRvwTFE+cKGeh4fx7Dkoo0nJZQ
- TLSH
  T1DAE45C57D3E351FDC66BC2344367D772BA31B4201124AEBF42A8DB312E21E90671DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  RClient-4.0.1-win64/libogg.dll
- Size 33KB
- SHA256 5187cbb032ccba2ec40f460572576e964d6e089f0b9ec75d975f4a24c7f45ef9
- MD5 5ea985fe0821b513fb4d002514f0be00
- SHA1 d3ddb70c56546d53224e0e742c13e630a86c6f21
- SHA512 2a7bead202c013981bbc5ec505e36f3ab898d88c971a3a5efd21862470579b20769ebb5241e4854a2ed192fb1e9b7a0c8473bf3669cfefd67ff42c780bd88276
- SSDEEP 384:vhge09sMsINs0b4WwuKVuY82NNv8j9JOoXQ8nR0LRRCppImMAYnQcg6FSsTq6dB8:vhd09sVI20vwjOj9JnnGtUplYXosS
- TLSH
  T1DDF27D0F77A3A8ADC81AE13444AFA332F4B7B831A9625D7A0350D7311D70DE46A3DD69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  RClient-4.0.1-win64/libopus.dll
- Size 544KB
- SHA256 55a25a986ef2bf874503e9800668fc5292a9ebe3b011cb3569706c8629d0dd95
- MD5 d1e88f2125d7bd8b1d375aedcf1fdebc
- SHA1 39f1dd204db03aa2194ff07d29a149377b04b9b8
- SHA512 f538b0b192be0218e22847e79c398a2232aa59dcf4a97827511c1d296b8fc68f3988e63123e28d94018cf55c0ee771cbf56958e345ba3762056ec1ba760d478f
- SSDEEP 12288:RYdxjSKUT0qanhlN5FRYTLHED2KX4FKbgYWzzKyfo:RYjjSKUT0qanhlN5ITLs2eDc5Q
- TLSH
  T19BC4F729C7FB94ADC27BC1B84B0B5B775830BC5D5178A43B4AE445C13B761309BEA3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  RClient-4.0.1-win64/libopusfile.dll
- Size 49KB
- SHA256 5f25c3fa2feaae3d6e7c129b043b1a5b51ae4db1bdfc2c9d4f77030e24bd8f74
- MD5 f69a5de7fad79e0cbac3909d71e06acf
- SHA1 03342585c470080703b0aeedd28143cbcb37e8ff
- SHA512 315df87137af0befe212e779a8daab0e1857e18422219bc389123ab2d3b50e2e9f074c57c7d13d61e23ff93eec58e31257d2bce4292e25cea025ed0eb278e208
- SSDEEP 768:lQb9+k5Joapi+J15CJ/l7R/LCyC00JuqV5JRttx8WCDx:l2Ik5Jp4K15CJd1XCJJuGJRX/Ox
- TLSH
  T1C233390BF2A325FCC567C07057EB9733BA71B8214630AB6E4794DB382E64D506B2E719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  RClient-4.0.1-win64/libpng16-16.dll
- Size 278KB
- SHA256 d6b01790f7cd91518436fd84d98a43919726cbf7783c5b6314014e4837fbadf0
- MD5 d67636715ff72454be4439dde2af829a
- SHA1 adfa6cc1b2aa436ab12d87524bc7fe87944ba145
- SHA512 c63332a885364baf8e48b9be23f701682ee4e7b028aeff2f70c727a53ac47cae6451a34184a5ca06e058dcb7c458d9d64c6268668f9a9cc6e4b2dacb40a35c44
- SSDEEP 6144:JrXVb288kcpHH98Ry0zI0mscZ6pRERo/as7I4j36R109m7w8EA0WpEj:5zERo/J7IQ3mXw8zO
- TLSH
  T1B854E73BD7B3C86DC5DB81B17F8399D42570BD381335E44F02846A51BB2B9707BAA1A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32