728032d21e2585f77ee9c3c32776d938508fd6c49d85f3439614d646ee8b22c2

Sharing

Copy URL Twitter E-mail

General

Target
Vpe.zip
Size 935KB
Sample260620-m289xafw8t
SHA256 728032d21e2585f77ee9c3c32776d938508fd6c49d85f3439614d646ee8b22c2
MD5 5c30741fa65d5a1c82cd19b7a8c8c007
SHA1 030af08254830aea4f0245b477d52c521fa5a415
SHA512 f01c2b0ad757368499a262e016b851d5a7c5e4a8c811174dcaed1863e51f9a26e87d28c13a366faad1baeb82509f7b1aba2c05b0f033333d937b92fe093998dd
SSDEEP 24576:DiiepLSPXynREM7bl/B9vkPeM/VUuqZWUfFCSFK:DMp2GRX7bZmB/VzwNCSFK
TLSH
T107150277C9342E01CD1F32F8415E9718CAEE8E851B826C1D1EA56FB93B4DAC827B4B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Vpe/tools/discord/fr.py
- Size 4KB
- SHA256 d9cb3bcaa81590417de23d6f5406a59543554bfe18f6b6e66f3d861f1f7936d2
- MD5 afc92722577c46bf7e40e80d5de5f882
- SHA1 a7ba729a1a46d9ffa4fa96e31f95e73260eb4aca
- SHA512 fd7a95389202bc33b3be3677db956a875a725c6171f6e6acc4b6d586b04bcf952715c735acc124dfa24df186f9be94bcf9682b184c4a23a86d351b5ba0ee313d
- SSDEEP 96:ULV5I+Yo4Vi8dPn3DvMgTkb4QXSl67Ffv63l5pHDpWBVxMrceiYsGci5xQHZp:UzHYoEF1nA4GtFXqlprceeGcyQHZp
- TLSH
  T18DA1748CC6A90C1705E964C276E19A5334A89A930F81F9106B05C9DD0FCDCEF62B7BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Vpe/tools/domain-intel/__pycache__/en.cpython-311.pyc
- Size 11KB
- SHA256 13fdeb2080c6b51b6d857532a62edb7f42366a4dcc94c4a37c6c049da5da29d2
- MD5 0566381bc487cf5f8545b1a653bad2ea
- SHA1 853fc904fe759d5a757d3eee9d7cb9001e95603a
- SHA512 e7a2bdf015b50b8315c9e86aa8e4f44a9d512139f717378cb5ebe5193fbe6b7b5108f85005e856fe0823b0bf96bfb72480e6eb462e0da8e28d44255c019fd6fd
- SSDEEP 192:gIHbXp1zlD0Txc7A5z5IhU0MLaT9BiQdAMbfeIQgPbLGaQJBG222222m:Sxc4z5wogex1UbVQ
- TLSH
  T195322F212682F33BF9196A3150B1FD8EB361A5F4F671C702F7D680AE6E539242D0A5DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Vpe/tools/domain-intel/__pycache__/fr.cpython-311.pyc
- Size 11KB
- SHA256 268fe8c3edad600c460e233619362eb55ecb410197e77741774ca491a4e782ab
- MD5 45b329d1deddf330892d5aec42ef5889
- SHA1 f93d7b9c26a2a2426e9f8aed98280c1e2b994d20
- SHA512 bca0923ec4ac3aaa4d66eec0df5f803b333d9c4bae69f1cdd9b7ed9e657e4650e841ed573931891e08076a251af13ec2a96b629ac82cf4fdc06fe480ff87af5c
- SSDEEP 192:/IHbXp1zlD0Txc7A5z5rhU01VaT9BiQ3jwbCEVt48PsWu9J4b222222+:fxc4z51xOeswbRhPsl
- TLSH
  T13F3230212642F33BF9196A3190B1FC8DB361A5F4F671C702F7D680AE6E639242D0A5DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Vpe/tools/domain-intel/en.py
- Size 6KB
- SHA256 5fb28ef0c8c90b797ddecc697b647a9532e8f025de0fcb377816a50ba657386e
- MD5 3fcb83f414d7664d3253fa86c94358e6
- SHA1 46b314c56706166f2e8ff5d7b26777ce9f889e02
- SHA512 a03a5a5aacb4149df9d0836e2626a6ddddb959ff5d41d3fd9dbb28fd5d8fab8ae485034356e2455eed276884d24e0c0e95bfee653bcb786dc44692eddaf7b30e
- SSDEEP 96:khBSt0ZBXw+Zvpj5bZbXp1zV89F9xlTnVKmQlVKVqFbzV69Pa8oXQyEjZm8+K6KO:kqb+5ZbXp1zCDzjVFWKPD51sOVrl2D
- TLSH
  T175D1AB3758147730A27E9D09A8B2FC6CE76162D3CA364425F0ED81C87FB58748E64AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Vpe/tools/domain-intel/fr.py
- Size 6KB
- SHA256 1789022d3140dd22283015bf960ecb678aee52d059391b03c318fa8b45949578
- MD5 68becf915ef3e7abc80e052e710ff968
- SHA1 9d33922d2651bedcab3ff5e3a18097727306e665
- SHA512 55ae57a40a9f772e377dff0eb9e8784e1010cd1bac3c8cab0f24ece6e2a1c34233ed4b766504e75a8e6f1da1b18353dc420685571f227196d1a33a38e74d5fb8
- SSDEEP 96:khBSt0ZBXw+Zvpj5bZbXp1zV89F9xlTnVKmQlVKVqFbzV69Pa8oXQyEjZm8g+6KW:kqb+5ZbXp1zCDzjVFI+PDu1lwzZp6SyD
- TLSH
  T17BD1BC3758147730A27E9D09A4B2FC6CE75161D3CB354425F1EE81C87FB58748DA4AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Vpe/tools/dox/__pycache__/en.cpython-311.pyc
- Size 10KB
- SHA256 ff6997ec841b103912d3509ee479089c244a668535f0780bace27c0b29678863
- MD5 334a645c08e97aa14e8e2e73fe25b95c
- SHA1 10bb556075480cfa34bf55af40b3a4ab3852d8d6
- SHA512 179aa9f0aaeab27c3416f98a95b8abffd7ce35db7ab973fb0a36ce1866a20758ed1fda7b12c8e63beeadd5e7b86851c1d2f32c28c9fd54fe90b596fd8eea5ae7
- SSDEEP 192:q+EE5xJf4LjMNxkK5MI+/2GtULd7xi62wbS2:5NxkjI+/2WekwG2
- TLSH
  T12022D9B16E02A379E9685E718433EE1E27A0A6F0EA358706F5DDC0D52E37631EC056CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Vpe/tools/dox/__pycache__/fr.cpython-311.pyc
- Size 10KB
- SHA256 e9bce4968c32f0361fa4f97f0cc5d17e8cc4e13ba962cfd724077b0216cde250
- MD5 9b426a046f98c0ffe7a30d1baae7183d
- SHA1 e72cc8bd0fadb099fb07a1b590b2bbf3cad21e3b
- SHA512 587c9a15c1237f311ddef94f401a42d667c48b7b6be2e441f5bd77a117d3744f6212a96d124b461c193a5c6419ccc6f2325435ba134c8d54610d23c226684399
- SSDEEP 192:B+Ez8xJf4LjMNxkK5MI+/2dtULd7fq1JZc5A2:aNxkjI+/2re6v2
- TLSH
  T1C522DA71AE02A379E9685E318433ED1E63A196F0EA718B02F5DEC0D56E77631EC056CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Vpe/tools/dox/en.py
- Size 6KB
- SHA256 d794910c58504f4b0301fa4ad41702537620cd2357d3bfe89f5aea0bc623a58f
- MD5 3aac902c51e2916aef823df5f934ebd7
- SHA1 0dca57caa52817da0473b721f017b7080a4e1402
- SHA512 d7628425101ed68d93ada8f3801e31dbe37566829b9fe03d1942801f489234339f2132ab662df8dcf590a2f3c0bd377140977e43badebe12b800865512928173
- SSDEEP 96:klttBXw+ZpmJfBgFhYQZWSDPn8oXQyEjpAfm8M4qbfW0JNBmDNACjc7/:kDk+WJfmUkB6VtAfE4qDVJfmRACj6/
- TLSH
  T1D1D1883269443722527D4E2494B3FC2CEBA1A5D3CA324924F4ED81D46FBAC31DD549F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Vpe/tools/dox/fr.py
- Size 6KB
- SHA256 42befd8c829b6d4e2b98a7f01d8263bab9242572e7f2ef8b6245e366db121a14
- MD5 d7647d1b009ee08f69b8de2bd633b5c8
- SHA1 a871fc0e86791eb123f3e0c8f8726ec6dc280f9d
- SHA512 4aaeb75ba5171b3a40784263c797041d75a76a37e339e40758a32f0aee2dbe5237bd27c16af40620386bdc994fc776ff55abd20ff1ec97e53c971c0e3dd4bd98
- SSDEEP 96:klttBXw+ZpmJfBgFhYQZWSDPn8oXQyEjpAfm8M4qJ7fYCNB7dQt5+knq7S:kDk+WJfmUkB6VtAfE4q5YCfpQt5+ksS
- TLSH
  T1F7D1DA366840772142BD4D1598B3EC2CEBB2A5D3C6328924F4EE81C46FB6C31DD949F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Vpe/tools/email-bomber-reset/__pycache__/core.cpython-311.pyc
- Size 14KB
- SHA256 1ed678ad70588bdf96f9c035881035c27f6f019c0480927aadadb41cd31839ff
- MD5 520b136b340bef7763e2612fbf0cf99e
- SHA1 82162c66f14ba16c926a0af8fdfd1b6aec270e17
- SHA512 986ed04a68ab34d32f7a3f9decc2bedf44c81ee3ed1f72edf3cf8de77d3af68b4002898b13dd142ee6db16acbbb0ab861b41dfa1bac9db82f2424b0b7e166be0
- SSDEEP 384:/7lK8Md11wxarIU1yZKngDH5wu8YtOQjrHoxGF:/7M8I11wxg1Yfwu8YtOQjrHos
- TLSH
  T1C96231716742E37AF418AE7090B2ED4E736189F1E675DB02F1DAC4A56EB26247C101DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Vpe/tools/email-bomber-reset/__pycache__/en.cpython-311.pyc
- Size 1KB
- SHA256 b624846199d7fcdd05510f85efc7f974638c5d2b1528170e5f3a2c710a1ba935
- MD5 692bc7835ec541b3cd1d111295cb7714
- SHA1 ff51451957837d2985eec96ce103d737c1e32175
- SHA512 f9e9625c27a36810728b584ef148a17ea06ed07632caee378c569839b605ef60e33146d78550272ea7f5616c15ced2a006c013f14cb9a59d96c8a68d4cd746bc
- TLSH
  T11931A6B2C74AD0C8E67F4732AB71805A5DF1ADFA506359B2547F0AB859C8C0058831DD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Vpe/tools/email-bomber-reset/__pycache__/fr.cpython-311.pyc
- Size 1KB
- SHA256 5ba1cef0c9f05af770980dd8aaf353d34ee7b1cfcaf10b88aaa63b13a4178905
- MD5 86f5c71115f2ebebf9eb507cf4fa1f5a
- SHA1 091d018622fdc38f7024b99307e98c13ce182688
- SHA512 5d2e8f97869f8aa9db87ff3557cee3ab8bb0e4764d070b4f1d499a23179aa9c13c84262c3a72777fc518ac9133f770d3464fb32b9cc05531333d4ae859dc58f2
- TLSH
  T19431CA77C38CD0C4C9BA923A7FF1512559E168F1546BD233453F0DF644C48105C424DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Vpe/tools/email-bomber-reset/__pycache__/http_util.cpython-311.pyc
- Size 8KB
- SHA256 fe0d0bdab7b1e598eab142d773ead66217b7a871dd879f0b070cc5a3e9b447f8
- MD5 8fddf4edbb6dbd45b5da1160952d6a43
- SHA1 5f21083b5192c6941aaabb6eb81a5365ae1c2084
- SHA512 81f8120d323b793148fe12777bcbec4304e01a1686911bea91762c7d1111ec4dc95e2f182f85f277a53083fd09c2540cfa20ca5c48527a3246268de325586110
- SSDEEP 192:VAhVOP5IXAqPIudfE36YOn8hKrYprNX56cAFpyMkr+MV:VAhV6IXAUfE36985rT2kjr+Y
- TLSH
  T19D12C5866BC08D3BFD68F3B5511B2646F3528CF1B614CB1332A681A65E17398BC025DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Vpe/tools/email-bomber-reset/__pycache__/targets.cpython-311.pyc
- Size 2KB
- SHA256 3ca91032967665ff2589df277891179b106ce17186f20a6fdcaac64a5c156fe3
- MD5 c70b76d921139c232a1c932218422d26
- SHA1 ee700d2d8af6e765d9f672dd201a2024df9d0330
- SHA512 ce6ce23513ab240233e1c8191fb2766c02721f9749ae46e79196ab367d409b21ae03a6cb16b9ffc59346171ec721474478b09d61eb7d91d3910574c13eb2d986
- TLSH
  T1B241D7D68D50DEFAEAE8E3F0A0E2622E530648B8BD1C03B77B6102697F1758814311DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Vpe/tools/email-bomber-reset/core.py
- Size 8KB
- SHA256 a2e216486efc7dbe6190752af888339e2e437fc30c518161b8688144afe7f66b
- MD5 fcb2180c59786e010d5dfb327704abef
- SHA1 c1a3ffd6c2636d521a7741d09f2e32a63d19630d
- SHA512 03a24b46fb212e56c1a8436af8e894e9987d54b0c5c3b00e70ecf54dc3431b86e2a2f86e315ade2e7fb32742a86aa6d582262e03ab3a467fea5f8bab80e8986b
- SSDEEP 192:A8Ek+rgVRb3ZMEWD9SEAVFAVeYhGY9UAT0d9V2TJ3ydGi:A8eYbVFAV/bKzMgX
- TLSH
  T1C902DE765C163760923ECD2958B2FC28D76113C3CA351663F4ECC2D4AFB6C219E649E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Unix Shell

T1059.004

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32