ee7f4bd8a6776d839e1f30811fa7458cf7fe09dce76ec9f3e97b653308fee6d2

Sharing

Copy URL Twitter E-mail

General

Target
RobbiecoolAimbotAndEsp.zip
Size 173.3MB
Sample261003-rxrlhssthy
SHA256 ee7f4bd8a6776d839e1f30811fa7458cf7fe09dce76ec9f3e97b653308fee6d2
MD5 b5759351339aa8a0e806d6b9c242edba
SHA1 e7e56d66f829f2e16a3f838da0a15a57a0ddff05
SHA512 1ad3bb61aac5bf6ff34ab340db916552475f651f3b2e9ad4736436f3e8e0bcccd5eecb8359552fc696a948a2e44877583014c048bd3907b6c1fe70cb55062a29
SSDEEP 3145728:JaSIu6gY8msvsYSIntaIQMecJZ9SdWkrsO84bC0oX0eNsS2ulBu5/lZ7j0XhuTn1:4hu6Ax5xEIFBKWy00oXth2UBAlBoR5W9
TLSH
T123883337D8A86807DC1E2470923F4B1997AEE6F0D9D2C4698E406244B5AF4D03776FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  vesta/lua/packages/web-radar/helper.ps1
- Size 15KB
- SHA256 599ec6dc4adb556c08b7c3b0a9c17aa4e16df70f7de00112fa05af21b6adf3f9
- MD5 6bc11dc3ba9b2663b4ce9efb009432b1
- SHA1 e276f54c440415395da9f621ffe80bb87ca54046
- SHA512 b198037d0f9f9382771083af8267566d46794bbad9634a831a74744ec61051006bd682b437c70bcc0e19699d847ee8867095d6e616bbf9df3fc42d3e5e308094
- SSDEEP 192:Wne0iolU4fTsqF+x/QH7f47P6zH/JtZ2iRK5Hh6UknqqS+to2PbCN7eCTEzCONoq:QMmU4KXP+F2i2UbtxpJNxhyL/6BN
- TLSH
  T15B62C79976E15970028A66655CCE874479A5001F500D1E21B6BFE3CADFB4BBCC3ACBCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  vesta/lua/packages/web-radar/main.lua
- Size 15KB
- SHA256 349950505fb3293ae104dd54ae347ac7b209068235d6d7cf247df57e1451ac4b
- MD5 2814badcda6fd364003bf53572c0d87b
- SHA1 6eb6936c07ad76e991ab3000b000e22575f4b2ad
- SHA512 d553a1ce45c1a0c951bb28a719654cd9869bf244f3ce39595dca71145f9e94d70544737bd6888f559b37793d059b5ae71d9061302dd01e4069fe8304bc24e35e
- SSDEEP 384:85JISQmZJCsIUC7Fhw0fU9A5R3RfDdW1FWSY7rqUCbl09dOw1zSdZwEFwNC103zf:85imZJCsn0Fhw0fU9Av3JDdWfXOwB09V
- TLSH
  T1C262771EE60251744282A2C4CD7A8900FBE53523518B55F9B1BE41843F66B3DA2F6FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  vesta/lua/packages/web-radar/package-single-file.ps1
- Size 1KB
- SHA256 f97d282bcddd264d4729513b5c6eaf81ea930bb9d514f305926fb234395157e3
- MD5 b2845902a99b0f9d570d60202c1b8e3e
- SHA1 9bef36f39932c37a24408b148b8169e5caf0b258
- SHA512 e419eea7d66f249021d8ce84c3296f5e119acb0053cc7b40f37c3014ebf2928b83a743ee43004b3ac768b246c032c73d6b5e71443c009823e3afc347d8b7902d
- TLSH
  T11C11F02C34C2A0C4094D490622E6E7D6326E20ED012DA7D0B6EC56CE1FD3ABD1BDA5AD
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  vesta/lua/packages/web-radar/public/index.html
- Size 33KB
- SHA256 cb3347fee7953bde6727d01711f18a7a80f12ba261c706454328c80d7f34aced
- MD5 d119a0ebb33a17621a03dcbc0ef3a06a
- SHA1 e2083f0c309d3bdfcd2c32a40f7394507ed591e2
- SHA512 b9743ad8fc03ed19f92b2a50ffc6b0794363e85a090e963ea89dc7c0c7564e7f314c2bd2ef7f891a8520602648b4b5ccf237a40e7f2aad67095a931e46f67349
- SSDEEP 768:iMr9HS3F44TYY99HtorqrQA2rigwFwBr5i2sdWpUqwSI2uVOxICv4AwRpLhZ:Fr9y3jhcI2svKLcOxIKwnLhZ
- TLSH
  T191E21AA50AF50239903381EC3B975B1E7729A003A50ADEB876ED411C5FC96ECD273AC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  vesta/lua/scripts/Vesta Web Radar.lua
- Size 64KB
- SHA256 207b08e8d300a80d1161ec336c18693167cd69ce0e1096ea34bb91cefe6968cc
- MD5 8b4cfb64c5f06f35004929cea921a61d
- SHA1 0a3661cc33d970778133950da878492a4007d633
- SHA512 f666582777162da7fcd3abce2dccf762558248cf5fc290e9681b8e7b4c66584081aa5220c38f29c0dc28b7adce846b754290aa046f3d3c213a1dd7afc37e22b7
- SSDEEP 768:rHgvMr9HS3F44TYY99HtorqrQA2rigwFwBr5i2sdWpUqwSI2uVOxICv4AwRpLhxK:80r9y3jhcI2svKLcOxIKwnLheZDn
- TLSH
  T148534BA966A21134415392D86D9B8B0477A86003510EDDB472FE814C6FE8BBCD2F7FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  vesta/src/app/map_loader.cpp
- Size 3KB
- SHA256 c8522461df023a37971883f3e08d5a62b677c14583b8508c099bdef28299be16
- MD5 b208809107f636b1eeebc299f0fa58c5
- SHA1 579022a56fda7f98b7c4ef675a89e034cd05338e
- SHA512 c0ca6df11bd283ba17bd4ef62c7b0650b708de24e20b3217000d347e2ff1ad43c5444e1d402b771d5fb8a0efece2e9359031727082026c3a0831ca6c4ff3a746
- TLSH
  T123719543D53CA53A9071C0A946E6B661C83DE0B37A1CCE72BD5CE36EA7D658D80D8CD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  vesta/src/core/input/input.cpp
- Size 14KB
- SHA256 c9381256a9c29ac31c9035b7382e023aabe3ca2f765515247d160febd8cb0b79
- MD5 ad853168b545b5ae41d8fdc12ca76c9c
- SHA1 b239885b10631a8f207f9f8a9ceadcec4c618ed6
- SHA512 c0768558f1e1aa3e1f969360ae9e675511fd76cd27ebd1164d304256b9a19710fa7d5b8e434e045724e571130252f00788f35187c15a4a12975556a8818555f1
- SSDEEP 192:ZVA3FKlwxnc8uEnbIA8xRomjkWnYD4CGCilh9mxIf/xUKmENKPM68L3VSPTCYC:ZG6/YQtlh0xlBEIScTRC
- TLSH
  T1876262C1AA3CFD1E1676A02DE56218A2743DF022A3414CB2FF8D816D7B5702D96EEF45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  vesta/src/render/chams/animation.cpp
- Size 14KB
- SHA256 b518c5b3274df9b65fd3e0b7fa4c0071bc54a2cff662712692e88406e88149cc
- MD5 6d779e359ad7f93362cc878fe696ad71
- SHA1 740e7e89da11a57fbc2055278fe5a673c83d2c42
- SHA512 e1e34fe11de350b4ed4834eb77505aa7b61d77a515feb16657f97822386b4f79d1ad697dd1b51a42acbab470db5d1758366fffa02dc316f754eac0c43d2848fe
- SSDEEP 384:Dm/OgCySgJk/fpPLjXahlXKGhlkc8TxQdzV83i:6S1MkX1XglLhlkbux8y
- TLSH
  T12162A5CA6FACF55E15676141E621058D762CB031FE2189F9EF4E022C7A2101BC7BAFE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  vesta/src/render/chams/material.cpp
- Size 2KB
- SHA256 252855f11c2fa649bb93a5bae3a5589bd218d8a28716772311e27f243305c153
- MD5 61da86d79379c9ec234513d0af06c9b2
- SHA1 f5c5b616d2c058830249b4228c3fef8a81cb2944
- SHA512 3020f6b22c2dd34db2057297c27739f73b367c60605aa7e0700800fa64996382681ec83eb08ec92428663c4b31170b2586efcd82549346f48426e36216ffa3c8
- TLSH
  T1B2510E88AF6DE64B4A6662C98D1A1085B05CBEBB7740CCD1FC8D5664789941FC32FFD0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vesta/src/render/chams/mesh_extract.cpp
- Size 21KB
- SHA256 92ccaedb5a7a4a49a3bac61eb883a221b0a02ba10fbdd572a927226d4119d4d0
- MD5 4a4eaa5df8e364752116ffff57c3d01a
- SHA1 6d51bc011eb6a34bcd713018d8b3fc40445044dd
- SHA512 f94507ef6ecd8f748124f5f4d08c329ed950dd3881ceb7a481b1da9dc43a20f481fa26534075ef63a4d056bca3418b8fa920d0135607fe28ac224b1222f5f848
- SSDEEP 384:+UROyHLwNQhFAfgJRTrwqSAPvMxH2CDy703UNvuFdh/ZUmVtZRJ3FEOtYpYQPXlL:xROyHLKQbAoJR/xCyzYjUsE4QNPQXc+0
- TLSH
  T128A294C19F7DF99E1A7711C8DC252689B25CB532BB4489E2FD6E472438A105BC33CEA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  vesta/src/render/chams/texture.cpp
- Size 6KB
- SHA256 d6f3468505e205891b5b1a18dde0e94c77abd07d03360aa388ee9237937a3675
- MD5 808d63d6a3b3b4a68345632755903645
- SHA1 42a8336bda47e300c71a49ef5db06246a8027a70
- SHA512 040b0765b4130ea81b2ae44758573d60bce2aa52d3f67cfe7284de6f23cc275ac19f6c5bae969248859a1178abdf08bba50e4e6d91721a917ed3188a5d78514f
- SSDEEP 96:gMRUPGda2Ww/zQvipxG5usZspvmcgBec0crK/lT16Lx8RFfQ9c:gPc4w/zQqpx6utvevu5iY4q
- TLSH
  T1A2D140C29FBDF58F57372008A99B04E6A15CFD316B04CAD2FE8D9218745C02FD369AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vesta/src/scripting/radar_asset.cpp
- Size 12KB
- SHA256 74c8fb774031160c8995a63c48f344a2bd68d9618fd7edc0d9ce5ead6a5106fe
- MD5 02b6a35bdbdadf9a87d2412602509870
- SHA1 18d988d82ddf4fd8e9187e04b6b83ff10a582b5a
- SHA512 2af3454d791870d8f3de9c1ff72e1c02690e88a70922e6744092a2f87e150eea0c4fcc750bf4a4d010e77c3b1dd7c6bca4f45b17eb467ef462e0997054a821ec
- SSDEEP 192:h3DuNCmGNFep9Ij5GOWg5sCIa0VjgiU7zmbKNem5bO36KsPsqr/LjvP3wun9yN5h:hpFep9Ijw07lNGsPsiHDI5kZS+k
- TLSH
  T1A642A4C2DBDEB56B6793009CE815044A715CF67BD354CDD8FC1D8A28B4E8896E2B4FA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  vesta/src/scripting/runtime.cpp
- Size 120KB
- SHA256 cd4d54242b96fe17ec6e069dd90112574590c78760c95e0ebb7f7ca3200e2cfe
- MD5 e8208b3de10ea3a390e07c4c24879655
- SHA1 6743412e34b714b78ff59b64e41ea2e3f5a2e24c
- SHA512 c5318037c6d148864595fd8c9736023358c29f2f31654bfc289a75e9c8b7e61dfc4971d486a9bc09f4ddafbf16ed4a28dd936eb743ea323940deade8d9f115b4
- SSDEEP 3072:yjYXhQTvRPbJHcmIrYcV9xow8WfWUgP5U/zN0Zet:yjYXhQTvRPbVcmIFxow8WfWUgP5U/zNd
- TLSH
  T1E8C3428EEF3CF48E8CAA6095883C8931349D68B177999DEAFE9E4954604005FC5BDF90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vesta/src/simulation/hitboxes.cpp
- Size 12KB
- SHA256 9e7a8f4bbbe17731a5dcbfe56f56f6100ed0cac5fa9733bd77b6be06a4bfa8b9
- MD5 52523ab61a9689310bb0234e5873fa06
- SHA1 d24838222f6ac3755842b459f4d15913aa8f6d65
- SHA512 421073e0f84275adb083c00e751d8326bda408fdc63937afce486103ab06a3db06359b58bfac7b73aaf72c3bc6c3053f139ae8f9f08404c4e0e70fd9e34260c7
- SSDEEP 192:UJnDu+vzaKJoRaERIqiugCsrXiDHnYtygDroWMC0gj6pzpH:Uha6aKJoWCM2+poWYJpzN
- TLSH
  T1424284C45F7DE55E1B29609DB92428D938BDB8322794A6F3FC0D8258B9D101AC27CFB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  vesta/src/simulation/map_collision.cpp
- Size 41KB
- SHA256 d3a9e2071bef105b0eea5f3e389af1530a4a2fe877b66d778a78eb2d55c43513
- MD5 2f968190835edaf2686eedf3cc8cc1ea
- SHA1 2e9736f38f7eecf16a144d44d4bd5e0b0c7b48e3
- SHA512 d5a930204a8ba0fd0b9e62cb6945220ac761252a0a29a2a63758b10d5c3d407b993723cd8aa82bd82bb6a03b6b7defda153bbec75a1d9eb0b62b08c014580025
- SSDEEP 768:/6BVqz2Mrh5cQwQG0lpNQmlqu1VLfC58z1hDzyi7n0B+l+faGoH8myG4Qn+mcpbx:/6BVqz2Ml5cQwQG0jNQmlqu1VLa58z1q
- TLSH
  T1BE1355C69F7DF41E2AA61188DC121442F06DA833BB4549E6FE4D42687B8215FC3BCFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vesta/src/simulation/shot_trace.cpp
- Size 28KB
- SHA256 ee11f50be591876044236f6c929f97c2e8ccdb58a90c8058bc9376d5bc929366
- MD5 32e62334faf10dfafe1731d25e664b39
- SHA1 7b54f6ecf3089527d23c86cc626f0a6db860c5e1
- SHA512 948c475359c79f11a0d679228b707b98674f8d507b00311462f84346f9f043903c3f7a28bdfdfa181defa4fef2c53fe137fbbab9f78c5a00493d940369d1b323
- SSDEEP 768:+qy3cPrpxT3BZGvCf++X65q3zBURlHLnI:+qhygyRl8
- TLSH
  T1D8D2EAD8797F9827082776A91F97461930B164C331C48BD5BE1E43847F9A8C993F2EAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32