b5f91633257f2cd7fa7e78ce41d867d165c6137e43191070248e7128dfba5c21

Sharing

Copy URL Twitter E-mail

General

Target
E-Client-windows.zip
Size 58.4MB
Sample261006-wmv86set7n
SHA256 b5f91633257f2cd7fa7e78ce41d867d165c6137e43191070248e7128dfba5c21
MD5 8f124e300f63aaa300bbae154068bd26
SHA1 bcaa93c072204806539863ed8c97c94ab6d2c37a
SHA512 518d5113ceecfcf02ca067c55757535be16353bda69d54a4e4ebe1663bfd4edf55796c8625721289287658aae9a77a3d318810ae3242049655a4dd6b9a05a28b
SSDEEP 1572864:6IC6Y+sU6y9bI7hR+vpmdI824FZVcevz63YbZVy7552:hFVNS4vd4FgsziZy
TLSH
T163D733FFE9008605EC3F6E35819CC35F8A9835613481954C0F90835979ABAF27BB66DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  DDNet-20.1-win64/DDNet-Server.exe
- Size 1.8MB
- SHA256 8f62f9dd4f7ae71925953be354aa1e9f6f03917056c03a539dca56d3a4cdee1d
- MD5 599212837f67c85db9f54a8a14dd1af5
- SHA1 e2e528c81f603d69355c8553ef96ef9f19280104
- SHA512 cbebe24ae7a9d5c0c00f7c8e797ad79f347e5a95fa90c1f81006169ab2b6711934c81f1d7faa900910e381b3b28927af882e704c42facc9cc0863b4d577eab81
- SSDEEP 24576:2+dt0qv0PQDdg4glhGHGOpCroEMpZcyXLjzdX9F2IRQXcrDc/eM:20GqMPQJ+2pCromyXLJIcrst
- TLSH
  T13F958C1677B104FCC5B3C07CCB83D516EBB178684760AAEB1B90566A2F27BE10B7E215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  DDNet-20.1-win64/DDNet.exe
- Size 7.1MB
- SHA256 40dcf1662178934e6e6a75e9c8875281a2b15431a8fa9a6c92cf6a478c1826d8
- MD5 84bbce9e0d56d0802b4faa15b4e18d3f
- SHA1 a8d41afa58b412dfd5d5f7938306ac3243f0be71
- SHA512 48b6ff1dc9314a834933205cc4bc0fc32d2105b6166772176eb37043dffba572f7f0a0e61dfd26f0c5752b31b445e1923f5779a0e948fac57ebb2906f25b5d3e
- SSDEEP 98304:eC2LGof2n+nmTbXzGHd1G8iG1gC6cWtUjuCJO3Icrzgy:MLGofi+nmTbXzGHd4rG1gCVu73Ic
- TLSH
  T1BF767C23A2AD00EDD077D078CA569923EB727C5503329ADB21D07E562F7B6E12E7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  DDNet-20.1-win64/SDL2.dll
- Size 2.2MB
- SHA256 7bc0c709cf91b257137e18703032525373ef7c0bef076657a2e1105e25ffe4c4
- MD5 1bdb67747a1ce573a0763f0d44639215
- SHA1 3600b07423a3793315a0b138b0a124e06a0cea39
- SHA512 69253f93415f030643ce8bcc1acf0395a436738e5d1f2fe6cdd861b4c785cdb4c356df4f4e9c064e53c09e5866d3edbafdf91fe7edd2f66444392c0df11d03ff
- SSDEEP 49152:B67hRG8vpHqRA9M/+AHfq23wWlLrBtDKyogIsiTwq8ABJXr6nvLXwSOYOJW:EhR9vRqbXAqLttDKAiEq8AfXr6zAPYOI
- TLSH
  T1A8B57E5FF2E364ECCB17C031826BE772A93074181194BDBB66D49B706E32E904B5EE25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DDNet-20.1-win64/avcodec-61.dll
- Size 2.7MB
- SHA256 58c71baa592da746c9c5e30fdd41814a2736454b2b7168da4ab88585758d4786
- MD5 ae6632db7de61ef9a0e1045b829502dc
- SHA1 e4c9eae709c3b3f415f9183e2e45292c14b9d5e2
- SHA512 37d112a490105d11283fab5a2febb618305919932bc18b55b79bc0d3ef862791d3f6f8cc6dfc57b00ce1fb7dc576c724dafbff84144212b247e51e265904c28f
- SSDEEP 49152:sG89fcQ/HjCDvYceJirwiucX2bpbsyt7U9gkUObKPHv5bW:he0Q/jYv8/NR1TdW
- TLSH
  T11ED59E4AE2B325ECC567C170976FE723FA70782C40247DBB5A90D6312E63F90661AF19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DDNet-20.1-win64/avformat-61.dll
- Size 502KB
- SHA256 b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
- MD5 179f9ae9eb9e05411966a0d943e75360
- SHA1 a543163fbea7ba8061da700133cc97e9ebcda589
- SHA512 ca77ce3fb5e345ea6304c9d405de577b164224df01ca25ce1ae560ab82463dfa6b0dacd6880d8d8821b15d3892f8d12bbee76832dee1cfef083b74f127949fc0
- SSDEEP 12288:vHoTMfa6+pLH1SicSrISTE6bj3tZEdEyd:vHp0HnHASfyd
- TLSH
  T15CB45A17D6A315ECC66BC13043ABA772BA31786511307DBE2794D7312F02FA0A75EB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  DDNet-20.1-win64/avutil-59.dll
- Size 1000KB
- SHA256 cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
- MD5 9f4e1d61cf779052fed243c2142495b2
- SHA1 246b28f23c542ba6f38767ad420fc4b6f716c8af
- SHA512 f3059d52d93731fee5fc03af389ea08f85f449caadc79a0021fe3da2234648ad3bbf012d96eddd2de161bab062bb8be3a9bc98114cb941bb46c1e0117c241593
- SSDEEP 12288:4wCIUQiy/TXud3kOo09O11s5mbxZnBR2XoR6nP3J:4uioXud3kOn9x8fqYRoJ
- TLSH
  T190256C01A6E3187EC16B913046AB7657B6313452CA64BE2F67A14D343F34F916CCFA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DDNet-20.1-win64/config_directory.bat
- Size 236B
- SHA256 ac9fd0ac986f58dc46c8e52e36807c3c7c6ae3b85da7f32b85166ef1bc462e30
- MD5 e23d42a6bbf42bbb92b18a90ecebc24e
- SHA1 90ec9fe52626746da5799ebf4305b3f1fcb7028b
- SHA512 d106003e38a664278159e71811430b9fe235feb1f8ba0918a2f49405757c7c12a2252a495f4841a866f6a7f851f7592320510c2a2d481257d0a33e29c1210329
- TLSH
  T1D9D0A7F3400C0025C7B602C83E695997604997E0452F2AED786F91E8B424DFF43C7740
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  DDNet-20.1-win64/config_retrieve.exe
- Size 533KB
- SHA256 aeb357f7ad501ff73ee29b5b92971d4912bb1fb148a510c129045f6e998ad7b3
- MD5 b9181660c5de90e32abdcaabb08c622c
- SHA1 d2c2e85c1633875b904627dc13b344951eb30277
- SHA512 5b1a50bf5661ef522d80c6ec473b6b78c34556809d0c3c425123c2c570896ef3558564519912f5bc66a3566df319f94ff6beebc87bd3cc7637c52f3cbd716a65
- SSDEEP 6144:p/R8VP70s/ioWstWQrZfT95wPOg6nnbi9z5XX8d+pEGh7z00fB1JVL3Xy1lvZLrz:FOx7//ZbiQbi99W+KGh/XclVMo4
- TLSH
  T15EC4AF16FA511FF9C2BB8078C8868905D223F85547A14AFB23405AB27E237E45FBF356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DDNet-20.1-win64/config_store.exe
- Size 548KB
- SHA256 d37482cd385823472c463c0152104fd1a60795722226227be2f60c1e8beb981c
- MD5 ba84e16351d448f8ddcae76553015a97
- SHA1 b20c575373d75487550df843e796ded8d1480a2e
- SHA512 fde3da61b4efe0a77948f9197673697b889455f8546232434fc6132dc7d9de3d6c993bf60b0f6db404bb59452387ee4a39d059bb02e817a032ad3a1fe0b1c4b6
- SSDEEP 12288:jmtiL3UVYeU7rwkVDqSpgiF7cGhuXclVHoW1:CtiL3eqrwkN/pg+uXcrHx
- TLSH
  T11DC4BF22FD915EF9C6BB8079C8968605D2337C4947A15BF723404A632E23AE44FBF365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  DDNet-20.1-win64/data/entity/builtinscripts/firetext.chai
- Size 1KB
- SHA256 5720be25614349064a91d021784bb319f2f1bb162fe046e757834022528898de
- MD5 b9c2931499f6a522ca843e7fe5ae4de2
- SHA1 f3696b00d0fcba38952075ad165acb14d0af19bb
- SHA512 39dab63163ad2bd1394af8af269761b06bc363dec96bb4f6db43cf3e2ec8c993067446ac72b931130f3bb57384b67429e586230dd49bce247ff232e3facda7a0
- TLSH
  T1C72136EB63C31364A95B705C0BDF241431C62B6716B8DEA57D0EB280CFC51985BB4AF0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  DDNet-20.1-win64/data/entity/builtinscripts/smartspec.chai
- Size 432B
- SHA256 9a78a9956a7be9516185ac2b2e3442b9d9edd84b4fc4a2f6994f3eec3d6f44c6
- MD5 3ac1e4517087a8bc266c09ce32f3fed9
- SHA1 28eeb71319ad9252397b95df617df3a674771169
- SHA512 b97663e3cee794e7a96e1e7413da803f5bc4b4e80cae524ba0d96ccc2b68e07b56f6d3f1a3699fb977f89729514fa721eea947a376f8de512351b4223e229ec5
- TLSH
  T175E092EC9DF3586066F6A4248D8FD4A0F0ED4D03584CCD527CCC61ACAF5826286FCAE2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  DDNet-20.1-win64/data/entity/builtinscripts/str.chai
- Size 4KB
- SHA256 80bf2ed7226baf358697068641664fdfbf942832ebb67d1907cd32b877b866f9
- MD5 3e3e2f094e049dcc8ef1d90d387a0192
- SHA1 3892866c667186caf2282d5cf488af399436745d
- SHA512 3437ff2ea1d4e1192d8beb321b46deb872d60eead38db1769242d3f52c4644be749ca1e0eb5b9d3acbd85427b6e695b14b2dfca919abebcf53bd1e0b34487166
- SSDEEP 24:G2C8vO8GMmQXOrAuSx2R3rfTvpN3DX2YPLffLZBzXyC/jHv2YBPxD39rwYrvjVKo:azPOaDh+HGQ/4OyiQBbRX3Bz
- TLSH
  T11991385E57E2122CEEAB74C8074E9180606B906315FC8D597D2D7BEACF5213316B4F8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  DDNet-20.1-win64/dbgcore.dll
- Size 162KB
- SHA256 db947c07167069d3de9e8a637baf01298984355d775ec49801115d7e5f2e47a3
- MD5 8bb7fa4422c9ddc162051d8b7e5522d7
- SHA1 07a01c2ccffd3d27f2a0d0ddf38dde1dd10455ec
- SHA512 7bfbbae884fe9f2235dd24ab9b0f5d35bc6af28bb6e562c000e36962be47de53bf9adc44e8b2d75b1c911a51d1e354ff94e216e66089269e6c7dee8085b98a60
- SSDEEP 3072:XBvYv24Qwk0uHtYN2ZrO3p5oKKASB0ddOQYgOxTsvmbtIahY2rAW:XBg2VWuo3554ASB0ddOgahMW
- TLSH
  T19EF35A62A3A800ABC9A7D23CD657C61BEBB3B00023115BDF0164869D6F57BE17E3D365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  DDNet-20.1-win64/dbghelp.dll
- Size 1.8MB
- SHA256 3d92df0984662298a09d988aff0bb7c3081a46bf48177b7af02d3552641f77e9
- MD5 3fbb5bbc320109a3adf8866289a81211
- SHA1 543b936a89fbdb0220381eeff0824b3968390e82
- SHA512 e4fe89ffa2b723a8162a7eae05f42639a6cf86bca77495d2834fa0f58131ab8fac8336901f8bdce19c5b5b49aa6c5c4b0056febccf42b8fe395401696d0694cc
- SSDEEP 24576:VOTeT88eTQhAWiJhXsg/537W7rDLIVn0a1pCVBz2P583pdj8DqF2gIMYT5q4NZrn:gCTwOkh37W7zI1JDUA583pEqF2gIr5vb
- TLSH
  T118957C5693AC01A8EEBBD23CC946851AD3F4740517218BCF21A8879E6F13FE7577A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  DDNet-20.1-win64/demo_extract_chat.exe
- Size 560KB
- SHA256 a2c70970b909ddfe30077e0c5a0e653c391127d51da667439eb3229ffe87f670
- MD5 645d139095c7cfca1fae4952059b864e
- SHA1 23ab0333da59423f1442ce2fb250e6612908e9f8
- SHA512 bce6e69064493bcdd9d3978d5c40f082a9b3b1aa98e9ea38b5da5aff769a7c1bf2d8419c7a6215bbc35c93d197ebcf6a2ea1e8ab55baea6ce85bfc9811eafc1b
- SSDEEP 6144:F8AyNRk2ys69zeFOkOEaVPZJpfl3GxbvzH8n8PZyBCUR0fl1JC5LiXy1lvZLrB/K:tyNRXusdSHfZGxT88PZnXclVVoM2
- TLSH
  T132C4B026F9951CFAC6B78078CD968611D233B85547609BFB23404A732E276E44FBF361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  DDNet-20.1-win64/dilate.exe
- Size 488KB
- SHA256 18ec1515c40e6b15ea619666a02bb2e28f49387a067c927d55701374bfdfa460
- MD5 89bd776386cf4c9ee3baa2ad4f124228
- SHA1 0e8d8660e0d0245484f02ff2a58b6297b00fd50d
- SHA512 787870f0a6aeecadfc2d3bbfcd3514b31e223c281af662ca0f969be5670ca679861a958bf56faa859f3948307eff60f027af9c1ce2acd6ed7df583a0b3a4ed7a
- SSDEEP 6144:FJnnnhhOvSXEa4jGD0N2wcU+Lw/6necQs9PZyk7X3zVL3Xy1lvZL6EVno70MxYnY:3nn9XEa4CQqU+LwchQKPZfXclV/oFOY
- TLSH
  T11BB4AE52FA555FFAD2BB8078C8868905E122BC4507A18AF723508B713E236E54FFF356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  DDNet-20.1-win64/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32