81218ebc88d24f100686106542ac487fa9b2755f905539b450e0eb87a5364f9d

Sharing

Copy URL Twitter E-mail

General

Target
rig-windows-x86_64-0.11.0.zip
Size 8.2MB
Sample261029-2rwcmacf52
SHA256 81218ebc88d24f100686106542ac487fa9b2755f905539b450e0eb87a5364f9d
MD5 eb1d9bc45c6a00e6c7da9de7f5a2655e
SHA1 09e0161e6a70c57ac0aea5296fe7a46c487951af
SHA512 cffd435ab7c69f171b9b74af6f5f3017859eeb3a0e451395511d848ed78f35c98ee2c5f68b78d4d1ba69ce7bec9ed9a230fec2161476f6eecd207ca06615b6f8
SSDEEP 196608:DlJFdsWQBc0Q5o/YQGkObCz/PIsG6OcY14Rk/BbNOQy7lTf8+E:rFdsvBcL3XC7AKY14C/BbsqX
TLSH
T1B5863318EAED6A4FE90C3ED47F8BA1B4E029392087115BAB7CA51F575DCF5A04327027
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  bin/gsudo.exe
- Size 4.1MB
- SHA256 80429dbaf959263030c87fc610c2f1052b08c63575e1dad56cac5e502eecb414
- MD5 cd9ca49714ca97c78a1da84bf1e58e84
- SHA1 64ea3ee312922774c74d2a8a77170217521eac7d
- SHA512 cd55596402ff1578b2f054cea34435a74f91f7dcf1ade8578fbd561d46eb760b627b34590d09c7f17011b0db8c2b594646482c3c51067aa723943ab0f16de860
- SSDEEP 49152:IsOTyIe/mfHR9/zVFlheaNJ88/hQzKNg2V6SpaOkGscSZ231DIwz99c3hV3rKd2y:KBVFDhQx+zLzE
- TLSH
  T17F169E1593E900A9E437EB38CA65D233DAB07D925734D24F0698F6062F73A508B7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bin/rig-shim.exe
- Size 281KB
- SHA256 02f624394cdad3b4cda7fd6b61acda1c0854feec121e76bf340e3d42f22449ef
- MD5 4492e7f34a77fd08036743fb392efd28
- SHA1 c9ed158058b7e845b987fe474baec1ba551b4c4b
- SHA512 ed49c1afc7c5cf958fc6cde8f0378b7b2d91f434357eaf30088071a0ca0c5596a827c2a4466d3033eea5ec4a1dffc05d98701b21a2bd47c1acb75d59f77b27e3
- SSDEEP 3072:sL/RZ/p57Sk/JLxQnE/C1CQn0mNsFw6l8vY1IJ3RBo8zfgOp+X3wGSyEi3v:i17S+JLxQFCQdNycvY6BB3cOp+nVEi3v
- TLSH
  T1CD544A21BA555CA9D95AC47882468A73B63234C71B32F9FF02C442383F6BAF65F3C654
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/rig.exe
- Size 16.8MB
- SHA256 1ad8e5d80b55399b37080e35c3b20677d77fe83c70a13b726a2ad38e240b46f0
- MD5 b90afb6a5482b2db902b2dcffb2076cf
- SHA1 0e86081ebf562c52fc5ec2d262c07c1ceafe132e
- SHA512 e6d73a72c0758f4cae6fefcd9c618a2e36382249bcd0023c29f3d70348358c485677dcc07c4a136848798b4d80426fdcfdb0a5fccb3308e4cce9c57dc290453e
- SSDEEP 98304:XMLPvO7xMF+QE5i008kg6jtISO1xvdwkFx2hf9iQ5wm+tEX38woOyuzoo6Fl98Du:y35Dg6jtD6xvyVhfN+tW3Fy1s3xhW
- TLSH
  T1D6071915BB9A58ACD15AC870834A8A735A3130DB1B35B9FF44C486793FA9AF45F3C318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  share/fish/vendor_completions.d/rig.fish
- Size 153KB
- SHA256 7e2bb88be8657af7ddfd0ed53c46171fa5faf80d5e8c4e34614e92fdebb41d11
- MD5 1ec19ab3b176c28085dfe939dd97b88a
- SHA1 084ca0850e1ba716e73f478a94f74c56d2318615
- SHA512 4e63872085b95fea99ccb80347f5faac040b79ec17a899a971c746287c453865fd831b6a818e200394f045e6c61ba237638fd219babb8a6fb383b963b950653a
- SSDEEP 3072:bjcVJCYmR0pUrS5qpVUBWZalWcS1yQQfx6PWqwRNJYgWp2wCiuqOIpmCcS3:bjc8ZalWchNJYgWQwC/qOIpmCcQ
- TLSH
  T17DF3362F426FD53343385EBDD299C4D38B260BD323D36A0A3F6BE87C9207678A564654
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  share/rig/_rig.ps1
- Size 187KB
- SHA256 f49e8a54d24ab26615aef37d69eedd6114efe7f176006b2b820ed814cc508cad
- MD5 aab84de92fc72f3e66c5e7f941cbaae2
- SHA1 993487489c322cb9d9d25ecea60298b91faf1e58
- SHA512 c9fdd7b62de6c417e587ab503963920c68c7b7cc710f30dedb411e41877ddc25a6a3e39cd280835ef59563f7a412190f4c23ed90f7c757d92a0de4605b5291e9
- SSDEEP 3072:fw2AQWgXE+r8E1su/4CxcH6wuKc6XU4x4RxWAMRJbiFa4Of3W9:o2AQ5XE+r8E1su/4sqQq4fWAMRJbnE
- TLSH
  T1AF146D15135BC24723430398D39F94366DF9A1F26ABF29063DDC8A24875BF76E04A6F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  share/zsh/site-functions/_rig
- Size 170KB
- SHA256 ccf0a448f971713cce84a84f0ce587486171b2ec17eaffe87ff7729d2a94577f
- MD5 1ecaa9d9198534b8c6658cd7d761d199
- SHA1 ea1045de6c6620013f87112acaed7332363e7ac0
- SHA512 94f96144043b866816f9e543f34aadd1cccdaff0e99de398d6f7f2548a9823d583331f5505feee27453c6ce83553ce83d2eadc6695c903defe23e9ba973fd039
- SSDEEP 3072:qfw2ZGMLfntoJ5QFwIKb+HiczgxBdnTBN+Z:qfw2ZGcntoJmGIKb+HiczgHdnlN+Z
- TLSH
  T18F04214705FE393798C903D0EA9AE3139F379311244F261372BCBB99835D5AED1B2686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12