Overview

overview

10

Static

static

10

Challenge_...m.docx

windows7-x64

4

Challenge_...1.docx

windows7-x64

4

Challenge_...y.docx

windows7-x64

4

Challenge_...1.docx

windows7-x64

4

tools/numb...ing.py

windows7-x64

3

oledump.py

windows7-x64

3

plugin_biff.py

windows7-x64

3

plugin_clsid.py

windows7-x64

3

plugin_dridex.py

windows7-x64

3

plugin_hifo.py

windows7-x64

3

plugin_htt...ics.py

windows7-x64

3

plugin_jumplist.py

windows7-x64

3

plugin_linear.py

windows7-x64

3

plugin_msg.py

windows7-x64

3

plugin_msg_summary.py

windows7-x64

3

plugin_msi.py

windows7-x64

3

plugin_off...pto.py

windows7-x64

3

plugin_ppt.py

windows7-x64

3

plugin_str_sub.py

windows7-x64

3

plugin_stream_o.py

windows7-x64

3

plugin_str...ple.py

windows7-x64

3

plugin_vba.py

windows7-x64

3

plugin_vba_dco.py

windows7-x64

3

plugin_vba...nes.py

windows7-x64

3

plugin_vba_summary.py

windows7-x64

3

plugin_vbaproject.py

windows7-x64

3

plugin_version_vba.py

windows7-x64

3

tools/re-search.py

windows7-x64

3

tools/reextra.py

windows7-x64

3

tools/reextra.pyc

windows7-x64

3

tools/xmldump.py

windows7-x64

3

tools/zipdump.py

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mshtml.zip

  • Size

    262KB

  • Sample

    230326-fa11wsfe47

  • MD5

    75a28db68a020da28cf223010f7c9f9c

  • SHA1

    361aa10961eed91b277ffea70641ed6435550d7d

  • SHA256

    31475717735f9aee20def2a4044b42a52cb92e8cf885b92a042099a273688135

  • SHA512

    6fbe84b932773d0e0f7b12ddcbb4d2b6f802036f71f42f95b65bed7d3a262db3609bbbc4ee8c54a5ee86c5e952da059bba1fd99ac532c07401a3bf98068f3964

  • SSDEEP

    6144:dem485iuNrJhuJGd0AkfX+Yk3xonVBio57pMN+UM8iNuiYwLGZTqUdJP+TDu:dempTJAQd0AmOX3mVBp1MN5Ri/YeGZTl

Score
10/10

Malware Config

Extracted

Rule
Microsoft Office MHTML OLEObject
C2

arsenal.30cm.tw:1212/word.html

http://175.24.190.249/note.html

http://trendparlye.com/wiki0509.html

http://hidusi.com/e8c76295a5f9acb7/side.html

Targets

    • Target

      Challenge_FIles/Employee_W2_Form.docx

    • Size

      12KB

    • MD5

      45e7d6562bfddb816d45649dd667abde

    • SHA1

      00087e46ec0ef6225de59868fd016bd9dd77fa3c

    • SHA256

      679bbe0c50754853978a3a583505ebb99bce720cf26a6aaf8be06cd879701ff1

    • SHA512

      0567873b42eece93787da4f4c3b72ecb0d952450d8eb59b354a5f91ed95395a2662171e05cdcf4a829fdbd0b5cbcca97701fef9b96b1ad0d8728922bbd0288fa

    • SSDEEP

      192:f6ijVmar18H111M05AgPekrFD2h0vsmyVk7PeOJ2wc3rMKkokceeQh:f6ijca6H111/eo1hvsHieIhoseQh

    Score
    4/10
    behavioral1

    • Target

      Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx

    • Size

      12KB

    • MD5

      d5742309ba8146be9eab4396fde77e4e

    • SHA1

      8aaa79ee4a81d02e1023a03aee62a47162a9ff04

    • SHA256

      ed2b9e22aef3e545814519151528b2d11a5e73d1b2119c067e672b653ab6855a

    • SHA512

      37367ea06191c8a949f6c092bc4137736b344cc9892bf8a19e149557919d9276fb1301009a700cede0f2ca05d6827c827992817aee7b8968a5429e433fe0c8ba

    • SSDEEP

      192:60L6GkWglL+bzW6mlHRrZu87Fym3tZknRIhRHNwC3Eo+ETdlexwDvx/jVm9CoDFn:603kpLTZJHm+Eo+ETd4weCoDFLFd

    Score
    4/10
    behavioral2

    • Target

      Challenge_FIles/Work_From_Home_Survey.doc

    • Size

      26KB

    • MD5

      41dacae2a33ee717abcc8011b705f2cb

    • SHA1

      4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9

    • SHA256

      84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69

    • SHA512

      11f7177dc3c8a804ff6450477e15aadd20fddac98205008db25a4f6ef69a54b7cb7c9dd0d7bdf1b1d317f306482d86ad5ef150530194de7d8dbe344203962648

    • SSDEEP

      768:8HVoVneOa0HD/vb9EVoiJWq8UCei96T8vuX3m86RAFvg5e:8QVvbvb9wnIq8OitP88eY5e

    Score
    4/10
    behavioral3

    • Target

      Challenge_FIles/income_tax_and_benefit_return_2021.docx

    • Size

      23KB

    • MD5

      55998cb43459159a5ed4511f00ff3fc8

    • SHA1

      9bec2182cc5b41fe8783bb7ab6e577bac5c19f04

    • SHA256

      d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745

    • SHA512

      8f04951f9efb5acdad0a625d9f63154089d552fe4281ca53a759cc0a0468b8d9c76af863e34ed6e00802225a4408bcda1110a6efce30357e6173973ea5bf7838

    • SSDEEP

      384:Q6UDg00MWEg9fPCPyH111/elBqhveoNHfn5yAehqbhtgyhdCxi556BjsbIwRq:QcMWE04uebyvNv5yHcttg6dwc5YQb5w

    Score
    4/10
    behavioral4

    • Target

      tools/numbers-to-string.py

    • Size

      17KB

    • MD5

      d139e5574623629a158c7cbd0c47b6a6

    • SHA1

      5f6a403b2c0341d917a8e9c9ab84dc76fc9199b2

    • SHA256

      332822ca13b283da92f399ac407ab0a99ab18df32e5996cee9386be54ba8a225

    • SHA512

      1d4dfee764c3fc0b1d9041599654b6e6dc55df40ab96b0517654abc5bb74f6b707fac964946412ea03892a5d573e61435d958315528a7c0490adbf07ac78bf26

    • SSDEEP

      384:QFU0mcbIZyAFURaIZCYbthrkE8JrnutrZ9GjFa8B:yBmcbIZyAFerAE8tUEjFa8B

    Score
    3/10
    behavioral5

    • Target

      oledump.py

    • Size

      100KB

    • MD5

      73216e54933df59ebcb3c121dc2bb2b3

    • SHA1

      2baa74630f14ce5837383c99c43d55728027d650

    • SHA256

      8902aaf410e4400728817162ce08106048ecb6a4a66a14ed7712426f9400b3d0

    • SHA512

      3ea24d5f3486411ac7ef7c3f443f667dd2c426bc4f42d001df19fef504246ea96ccd4756b7d87ebda6e051dee7def1ebb0a98ddc75ce2aa3d07755943cca6a61

    • SSDEEP

      768:YqGPmgclfTo/c/9FB9RtSUVt9NB9RtSPe1Du3wKHMVmA/CGm4qb+c5tQCOCgjD1Y:E7cJHVhjnQAdtdJ0bC/ZsR4HejU5qKkt

    Score
    3/10
    behavioral6

    • Target

      plugin_biff.py

    • Size

      139KB

    • MD5

      d74fe593741147c60e2a3f7685a3699a

    • SHA1

      9a71d64062338971655e45f06a1dff5a4d599811

    • SHA256

      2031e6a7001c44532cbda669fed36218ceafd2bcc9c2f1458caf21a6e7b08547

    • SHA512

      76e6d4c412192799ac877fc1d3f5adb3f5c074bbce1a0e99c1abd567a0961b6bad6fc123cc1ee08dfba62b7a72c923db5221e05bf9d1c27e2c05c52a73378b52

    • SSDEEP

      1536:/LTuVCzjRet7e1/cX9p9v3BevapX4Rb7bm82lYRQQ8EotT68PllHGLoqDX1qHsG2:/zu9yb7bazjG0qD4K5q6pJwA2K

    Score
    3/10
    behavioral7

    • Target

      plugin_clsid.py

    • Size

      1KB

    • MD5

      e7689a42210d83e7dd9ed36690e06067

    • SHA1

      d7237f8e606a61a77d2d9920838003a42c953695

    • SHA256

      04c0105d0fb3658d47ed73e8958029eaefc23fc9df6d9f53a70a1fb5e2defa07

    • SHA512

      9625bcd63fa28994169d6c8c5d431d719f9a11110a07387612cafe73a168a46d80dd9fdf28669ec2fcb98c4985c5e4e7fa17ed9f3ac13225286fad0c18c85407

    Score
    3/10
    behavioral8

    • Target

      plugin_dridex.py

    • Size

      8KB

    • MD5

      8156ba189ffbfc5670cf2144d7c60402

    • SHA1

      9396e4650c5691ec94f57c96811599abfc3be6eb

    • SHA256

      abcdd7d762d083e381c8cc8f9b6ab30499fbd87430c4acb4a9805a14d7b91fdd

    • SHA512

      a27fcbce8ada58d820c308f63fa5c80a4898260beeba60af1c77426e43781e4ba847d7b4d417c3b62022a4640a106c83aa8b292c28a14ec0e15049fbfea52049

    • SSDEEP

      192:BW9kTWpO/21vZChCW43Z/sUH+DJoBSDI+uPDq2F9Dha08pWaGgWH:I988I2ChGiJ5czHJ8pWaGgWH

    Score
    3/10
    behavioral9

    • Target

      plugin_hifo.py

    • Size

      864B

    • MD5

      e4fc3406928f74d0e023cd29d861caa5

    • SHA1

      d885483940c776fff0f971a86654117636e20bef

    • SHA256

      87a4855aca7e3d21219b88d1843386396afc94b6e8fd581d86f752110f760b49

    • SHA512

      b9d3839379868a187f323663ee24ab2603f2a2acf2819ce0cb46063cd92c344d1f009355b202a9a79696b0f2282a0e9e3f40741276c2d2b131dbec0c81fac866

    Score
    3/10
    behavioral10

    • Target

      plugin_http_heuristics.py

    • Size

      6KB

    • MD5

      123156303a908de77489423551402bed

    • SHA1

      91f66c84ddc36918d7f01d1d757dd3a8d616abf4

    • SHA256

      d750895bec1d57bc786db545b767f5c5064412ab86848ae744e8c60b4648aa15

    • SHA512

      c14416d161f3e3b4f8a45abbc4cde9c9aaf9e3c5b0dabe33dcbc0d9ad529bad6033390e2dfd313e2daa833065f7168997cc818f1e0bf4ccfc46891c565de1a06

    • SSDEEP

      96:uGGPb9+vr9+fRlixWcXLiYxQDSIZiNaNSIXmQJtdxtX8iAAoP:9Ogvr86WcXLiYyilKdsAoP

    Score
    3/10
    behavioral11

    • Target

      plugin_jumplist.py

    • Size

      4KB

    • MD5

      1f6040ce94acae29d2785f9e056446ef

    • SHA1

      eb6465ff57027a7eef8bcb775e886b853fbb54b1

    • SHA256

      875a7e66cbc42318f800f3294e877b7e651311714c093509937f0e8c7ad3cb9e

    • SHA512

      96ba32a23cb17ec564bdc9126c8709b6d17ecade50852b61c5adc8685ee8c9b9465012a1e1cce414b8c631b67eae31401dc67ebff3971688f3bd44e3096010fc

    • SSDEEP

      96:Io/mj0lBxnEbh3EjyZpFEg43liSITibiEijbyHWpMhn:I8mIlBk3EjyZpFEg43liDibiEE5pw

    Score
    3/10
    behavioral12

    • Target

      plugin_linear.py

    • Size

      1KB

    • MD5

      44d4f8a8a8312abeafa84aa86742b087

    • SHA1

      1860a9cda98693bfae05198e13f173cd4fe6f661

    • SHA256

      eb9a5f530476bcb83e1802fce8d47307172f2d5753cea0331baa48f692f46373

    • SHA512

      0cabb085152b86bf7e29aed09539f47bad778150fc2364c42f5c52c97c2e3c4f95df34ed7ee5f1f47d6dbaa16f54e93357b1d7d27baeefe5a587cfbcfc880283

    Score
    3/10
    behavioral13

    • Target

      plugin_msg.py

    • Size

      5KB

    • MD5

      38ed999a69cfe537c0645c6b014ce34c

    • SHA1

      de486f3f23cacadfc57c74da34cdd4f34e7c2deb

    • SHA256

      29f904dd7401b624e47b088bb8a238b5307263ac355a920f16596b98b08e8ad6

    • SHA512

      499cfdd6a7b44e3d6ac2b341469b1205cc0e0110873be822849d9123abd27b124a9dfff93256cafc6d35ada13fa0abeadf2986e5ea7ea53f643c5c501cedd66f

    • SSDEEP

      96:ef8rOUgxo3JBlqFUNnC8MKmozjcfDVuMiOy9Xudc4b:Y8DgAJ7qSNzjCDbinp+

    Score
    3/10
    behavioral14

    • Target

      plugin_msg_summary.py

    • Size

      4KB

    • MD5

      eeaef5f8f40cc223319980c28e403775

    • SHA1

      f444ffc3e6e67206bc13321bb8d6595ef335239d

    • SHA256

      23aea8a82f12450c3313af8b156ea6271ea9493c9b8c35577bb118336744e66e

    • SHA512

      eadd5397b3a917b28a1ee2e52d7d12ddfe11bffd939eba2d6f335eb756d8aaa790c2e7fa807e8327766215926e2a4da9e157a22d6a31bfabe3be178b1f13c51f

    • SSDEEP

      96:C/SxeukxxQuUPOtxeXSo+6VLOJQXCdLTt58GvkGzZYBCq3twhJ1UGxAz:CS87QXtXbLOJQSVTt58LGzNQ

    Score
    3/10
    behavioral15

    • Target

      plugin_msi.py

    • Size

      1KB

    • MD5

      ddd1196436f5530d64fff6663549d48f

    • SHA1

      5a8bbca552d4bc01d0ae6f6dc29cb8a20a45552e

    • SHA256

      0c8d0422062b0882ca41a7b4ae3b2da0d5653486e95e79d57e65feaa5f5d7f61

    • SHA512

      4d8c20edc7a11e9fe64ae2c50ff4ea27c2723c422518a29b52f7faab599fbaa6d587345c72fb37c48300acdc08f4df936bf706e635aee71fb878d88744140850

    Score
    3/10
    behavioral16

    • Target

      plugin_office_crypto.py

    • Size

      1KB

    • MD5

      f7df12a6b14c24856370c1e3608f997f

    • SHA1

      fa399fdb82786d464fda96895d8d781331376dc4

    • SHA256

      5fe51dfe9392fbec45807198ee2367d562244751dc351eb82eef58e1b6867015

    • SHA512

      d946032e823f74f2e2c9982a841185d5fa4e6bae75d5a3a76ebfb576817b2d7761bb11b99b5a9474c10a9c4777acfe8e905e6c139f7fa1263a044f93a78e2415

    Score
    3/10
    behavioral17

    • Target

      plugin_ppt.py

    • Size

      14KB

    • MD5

      f5350cc7255aec33444995900bbae0fc

    • SHA1

      d53b9258dd4782eed961ebb41ca22af0ae8606dd

    • SHA256

      8f4ca9d7e30afd102b9358a4877ee973efdf3289df2fb629b79e3a538e8613eb

    • SHA512

      4f487fdcee8e50f6fd76e69ea361c308259f7dd944f33e519419c2acbe29e5209f1a758d597fe6ce68f505c923af94db2840376bc435b23603581c0070fe82fb

    • SSDEEP

      192:qUEpxjzg40+OIL6UmYosNGvfL/9Syd/U7t:yzsXUzoK+D/3U7t

    Score
    3/10
    behavioral18

    • Target

      plugin_str_sub.py

    • Size

      1KB

    • MD5

      d2849595b5af40bd722897b470d3ac8e

    • SHA1

      d8ab979aa95ab8630b8fe8528009a4041d99409b

    • SHA256

      dad916af9b1828f85aa633f40eb520ce33ff004e38c2c06ffc2c8b4d707a091d

    • SHA512

      931e0403867a3b12fbb5865af84c8cc23d9c4872dcaa1870c6c8116e7003516ffae999916b50616a265899836205cc12cfdc857aafb3e360008c27897b617f0a

    Score
    3/10
    behavioral19

    • Target

      plugin_stream_o.py

    • Size

      2KB

    • MD5

      c69680cafb49ccdf6384a9ebe9f875d7

    • SHA1

      cb03a07317336f0ca08d6fb4c7335c4ca2cc5dfe

    • SHA256

      76a8c36e232fd6246ea28a792ad48f6b99377276553f4cef8e866715174b1309

    • SHA512

      f289a1ed58decd11c5fed82e6f22d5f7c35157c5b0d56708d75ee499677e2a0cdd1976fe13a7a68addccf99547d7c8d0ba64eec1b88238bbb93031ee1a34ead5

    Score
    3/10
    behavioral20

    • Target

      plugin_stream_sample.py

    • Size

      2KB

    • MD5

      0e974d5394c8f2474c8bb56abb18f9d0

    • SHA1

      b52e7f536cf5598a1beaa9fcf973338e24760c07

    • SHA256

      9d20540318899a7550b4e7648c5d31bcd8ff875c7d50c0798356629278ca1b42

    • SHA512

      03d49d5ea3d02db0861693c18a0bfc10dd8d6c0dd6925c1e626bc6174f9338198c3ddc39637ca9fda9c4369e7c9b01df9f2f374a1c3615cf49a676d303b75ff6

    Score
    3/10
    behavioral21

    • Target

      plugin_vba.py

    • Size

      5KB

    • MD5

      be725a147c8a1adbb0a5d9ec89b72d36

    • SHA1

      e9490ab9f70fd7ca773da72ed0cf4bdafbbc3bbf

    • SHA256

      428cefdf92996358e2edd154f124bbe4b411ee04b1e2618eed5020287794950a

    • SHA512

      d9a30e3cddbdcb9755b62bd5d5c0def58ec4498a3139f4715864fde4507bb03870444ba8b3dc323b582743f17f50df542ec3027cc763b456d9d9fd1e7c891bff

    • SSDEEP

      96:AyqZK7R5lMrzUgi34PUg09N7QUTaUp6Uz7c8Wx2U7HH0WvUr4NPDX:tP7RIUY8Dr0d8WMunDsrSPDX

    Score
    3/10
    behavioral22

    • Target

      plugin_vba_dco.py

    • Size

      2KB

    • MD5

      77e69457bb1aed6bbbdbc4d6ad1adc3e

    • SHA1

      d60593a12f2ca2f394a8d3c55b24d912dea7b4b0

    • SHA256

      d0b385f64c596fea19d21cc64daf38d60d10973d08dc2ab56f2ea65d35d4cf85

    • SHA512

      4d19c7cfe828597df44bc0594396d4e6ec85bbae271a5b2273aadb43e856f2a2fd23409e7a2a5308160ae6a0b5f99891c3c41c209ce09e97dbc2c073002c0017

    Score
    3/10
    behavioral23

    • Target

      plugin_vba_routines.py

    • Size

      973B

    • MD5

      d1fa73e4a982ca72b8a334e350b9c73d

    • SHA1

      bbc623631a9d11728e092095a88ec777d6c4929b

    • SHA256

      766e89a98c22207a9c10892525d42b2577edc50040152da073ce3964c4064d8f

    • SHA512

      9e14e3542a4d46746f827c57b8d83eccb626b633e47c72bde310842139eed99a8e366c54f391dd47d83711e68b4cacc724903f891429607d172493ddc360ee20

    Score
    3/10
    behavioral24

    • Target

      plugin_vba_summary.py

    • Size

      1KB

    • MD5

      7ea3be570a678566d2529d69badf8f45

    • SHA1

      20423c759b416f2ec0912034d45b86dff6404c10

    • SHA256

      d3b2b804a5992de17935dc43bd38c4cf371789c90c81f359eb61495b208ec071

    • SHA512

      d3630f75be52a4428e8d31a0beea6d1a6955407f172359ff2a464cf6853c0c91164ddcc33fbe1cfb6ad18f0b50ecd3c339b0331c23800372cb41c4f9133f4010

    Score
    3/10
    behavioral25

    • Target

      plugin_vbaproject.py

    • Size

      73KB

    • MD5

      7e913e5e1a798cb40ad331ece2be1e1c

    • SHA1

      20fd112918542100aa6c4eae355ddb466bbecca9

    • SHA256

      02cb4e8fb79e9437145473d41c59dd2ab04d55d069085e57e898daa0f2ee77b2

    • SHA512

      085428f72a04b2786b810c63ccf3fbc3135bdd5647e064b71473e66e04d1e9aa2fa192f7132ed12d39b9f91dec15d6e389696ecd67b9896d71bec66ee1bf04a2

    • SSDEEP

      384:zSGaF70iUZ6l2dgyrZa0obavtGKvJEoMw8LJcTt/vf3yRTVBY9IvLWV/ds0snW2R:xi/2lYRbEQ8EoMkTtiYCvKmWPEMtK

    Score
    3/10
    behavioral26

    • Target

      plugin_version_vba.py

    • Size

      1KB

    • MD5

      634509790970174161c8c05d04160a4d

    • SHA1

      eb1ebac727c9d103d9c5ae607bdd69129f34c37e

    • SHA256

      11b54656aa85b70eabf8f90dde2e2d119b116761bd2e17210538368896c8f869

    • SHA512

      f0a08e930be0220b9a6de0309d6f975d3b58bcb44e9589cd2c6b81b7bd32d4266e5d15855ee1480b2004afcdfa67c61a9965337a0c39bbbb8a64a2928ec331a8

    Score
    3/10
    behavioral27

    • Target

      tools/re-search.py

    • Size

      29KB

    • MD5

      c5e8b679df2ae7516901d2fb84ee5bf3

    • SHA1

      fdc13bdfeaba47e1e95d5267037cbe16045eb8c2

    • SHA256

      33d5060802555b5d197200fa4759a24ba2f3daad02e6255ca2f9a1f0216c79c0

    • SHA512

      c0ad29bbfee157bc031742ac62aee18f40799a0fa42b61a2e1184d25927fe2a5bcd794dcb672aa721d6577093df829e850267b1ff111af69f08f4f4e2608d673

    • SSDEEP

      384:rKt3sv8fJVyUY4PTsvHlwJJ257xfU5KysH+cQcQ+OrexCJp6RDRN6FrcRDMjccEq:rfv8fJVywTU+J25VfU5KVQ0xCK9bh12t

    Score
    3/10
    behavioral28

    • Target

      tools/reextra.py

    • Size

      48KB

    • MD5

      6eaae98129246db6647ba4ee5da2bfb4

    • SHA1

      486e0d6269f7f4d3fb46c3b3fab6fb277105cebf

    • SHA256

      5112741782616616362dda4870171280c053a634e48b7f75e28396909303f0c3

    • SHA512

      8ae6d5e8f392ae827963d2555af83d306ab90df5aeebcabf3c8140769350b5007c5447107192a229d91ee8c9798ca8bf8866476b8da7bd1adcd1a7eac50bfad8

    • SSDEEP

      384:06VzQdo5F4fDQAC16aHVAAXdrpxuaFBoC4qeyNRSZ4kY+XIpk8WmI0ULjRlhnGJ7:bVkdjfMACXVAuxOOs4PBVUxlgl/mDg7

    Score
    3/10
    behavioral29

    • Target

      tools/reextra.pyc

    • Size

      51KB

    • MD5

      26d816e7a66a9b755be98977fd7ec94f

    • SHA1

      51fdd52e8a74b85474655673c933d1486369f0c2

    • SHA256

      d824866160ef3e11c75e798ac67e6321f8904dfb8b7b13f1271dfafd4b1e9c26

    • SHA512

      0528a624b7bf595f26c5e6ad6b22709088a378f3e831bce0ae1619dfe9b0733f26f5cebed00613605357610ecd51046af8a9c83e43e8493247b5197e7c645f2d

    • SSDEEP

      1536:wDWEbOQgsZwoSlKyxcQQkQrqws4PBV4al/x85e77mr:nElZLAKicCAqbUxse7Cr

    Score
    3/10
    behavioral30

    • Target

      tools/xmldump.py

    • Size

      16KB

    • MD5

      faea5080eda9431825f548b4dc695287

    • SHA1

      c875f855cf1ad5284172ae36fa1fbee6d3c5c795

    • SHA256

      f6cd518892efc087899eb99b8545d0ff43ec555052925f99d4a513ce2f1a8be9

    • SHA512

      e733e28c684e9ddd8b781be170dcb06ab5bc2758970bc0d063120f9adcd503c96471d6512e3218e983badb3cc95f4f0dbf51d0b48e2f7e389b2bbb35bee5f59b

    • SSDEEP

      384:8rkmbboYy8PScqY4SkVHpEbH5VItDOMaTwJRFjDJ72wxrKAnrENdtFJq67SObltp:8rbbboB8PScqY4SkVHpEbH5VItDOMaTn

    Score
    3/10
    behavioral31

    • Target

      tools/zipdump.py

    • Size

      148KB

    • MD5

      28461ac0e66c71823e5881994c24680b

    • SHA1

      58763ec56cc666e99f422a7ef93f25a4a95cc24d

    • SHA256

      f05726b382054380b0559fa9f44017b505fab9ab6272f894973a31addefa695c

    • SHA512

      9af0817d4a3ccd6f46e00db97c8c27242c26a06533dc535447028821139629d82a53354bfd3435ea3d492d034d957bb19d30cb4fd6374b0735223aef78d2867e

    • SSDEEP

      3072:bzogKBH5YS2dbcWHXyw8HozdJEAoekieCFg:vogKwx8Ha0ekieCFg

    Score
    3/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

28
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks