2b2a23803a351c3f85e68f18dcd849ef362deb6fec3387bb7107e7f780516133

Sharing

Copy URL Twitter E-mail

General

Target
SilverBullet Pro v1.2.5.0.zip
Size 174.0MB
Sample260625-aft7msgt4v
SHA256 2b2a23803a351c3f85e68f18dcd849ef362deb6fec3387bb7107e7f780516133
MD5 4ca22a27de9c1b6a3d997a199d330be1
SHA1 a4692c5adf837fef2716ff9337ee268bbd3e528a
SHA512 4581b5399c04cc81b1553dede14532c6c4a5fdb86f52c3b6a16da4e26643411368c36068e31b9540416b02cfac0251a76ed0c0043b0a02ba5b912d6c280010ec
SSDEEP 3145728:Sv9RPegHHv3VIkSFbL4JXMBG37bHYN0SV2GkaPf5JDgUpFNRvM2diHAXgqG4uj:mjPegHP3VIz4OGLuxJxxgUFRE+tX/4
TLSH
T171983356F7A8DCFAE47FF032A4810CD09C6AD139601BD772A4761EAA1E2B4D40F7A50D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Configs/Join us on Telegram.url
- Size 49B
- SHA256 72e5a8261d7a15d60c3f87fdb4b4c16525480a8d2baf73dbb11e22d137aa5d9b
- MD5 41aa48050b03b4e0270bedefa38e2458
- SHA1 4e7c8d5d054c736c2200061e1a6d9456c3fcfe4e
- SHA512 f4f6e0e980e6325a94479b18c6d3d1982cb5270d00551d5e09c4f7adf19b1774f7501131492dc39fc92facb1290b0b43a4d58813b41abe8d5fd85180bd299228
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Lib/BaseHTTPServer.py
- Size 22KB
- SHA256 c50098b168013e062bdd93be2b5874a1ba56dd478cac40123e612d028e4f25f2
- MD5 a761b77b8dabad66ced0509c34fda107
- SHA1 af92db6b25dc1ab5d687f75ecc8f1fdd42e7d2d9
- SHA512 70ef1f765fecc6fb6cd2f5cdd39e63ef7b0093963d38ed024c70167ef0eac3bdfbe4529933645e7a74af0bd4b083414f5698e90718b8b45c1cc5adf1a3d39c93
- SSDEEP 384:KsbSEvMQhGvdS9K7/uRsIeFxKPPGsS1CElqiQUaa//R/PVwpju+qM3i8uhdCbrtK:K0WQgvdSg7G6PKPPGsS1CElqdUaa//Rv
- TLSH
  T174A2B593DD47566B0673820AFD46B546E32D532732292227B9BC829D2FB0128D3F5EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Lib/Bastion.py
- Size 5KB
- SHA256 a88f46da8a0915b4123348d915ad410fbd481ab16398dd010ad53353d7f14300
- MD5 0f3c2dfdebb329af7eaaf72c6c635547
- SHA1 54907c7a16687a61d2e9d126840aba43b861a627
- SHA512 6b1662701d6b9c1a73b6ebf2265cc2b3ade9cb81698f96be322a836e8db853b8d4c1fdd8d841aa684ca27921eecf400eb68cf1b976852622d264e2f0cc97f4c2
- SSDEEP 96:AmpgpmmTgWhBcKLIe8TWuuMd6UQbvxLRlpqI4H2MoS1LXdnf+MOdnzLcc+6+FOa:AmpglDBQJda1RlN9rYLthUvJC4a
- TLSH
  T194C16517EE0BB67344339669C41EA189E3394227727974127CFCC18C2F3512682B79DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Lib/CGIHTTPServer.py
- Size 13KB
- SHA256 ea6bed82631b1d33a331af2f2599b7a3a716dffffc0923bb35a881f5faca5143
- MD5 5963338d3a93455f282cc4b7c8cc3ea3
- SHA1 242691c117c7e94962ae88973f5ed3e6f0b58892
- SHA512 f297f98449ba555630a842e041c06a2ed53405b1bd2c9aaf27dd8df91a9a21b2f47b98b734192595ef975d316622f5c786faf03553a728bb00bb97c63cccc040
- SSDEEP 192:3QMxfIyuFOmwbA//E8yd27nUxOsZWdHPjyYvOOt3sEJJVFAtUU31kAllz:t+c8hAxdZWRjyYvFBpJJwtU8blF
- TLSH
  T17C5283068D46667182B3C51E8D26F4A7E34A0623322A143BBDFC82541FB155ACBF4FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Lib/ConfigParser.py
- Size 27KB
- SHA256 a36adf6a175997dcde7f658f23512cb9e55bf4d85f7f3d35eb95b63193d9d8a8
- MD5 16ff11a03f00b0cae3b90951f182e552
- SHA1 a3c4f29df044bc7a2b2c625f7ae54918b112161f
- SHA512 ec294ec790e0d135e91c90afc0817d02e4e40a56a259e888d94f2bffa947a89b84c16d4913a143ab411a5ba0dacf5d225e0fd38a36352678ac1a329c88a9baeb
- SSDEEP 384:OtODBGtWml9B29WUaxP1dR0LeBVDS3IdjZ7wGIGMw/01XCLMYpXPIyOYBvmf:fDBOWml9CWUaFXrq26GMw/0VgNpJmf
- TLSH
  T19ED21012BE076A2641B395BF7C57A00AEB3543572439105A38FDD2D42FB4824D3F7AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Lib/Cookie.py
- Size 26KB
- SHA256 e23d7dce1943484a0231ffea9417002fb92133e0d4d9f6593b9e7fd182f483f8
- MD5 d9939942f706aa49e4e0ac95c42e9d59
- SHA1 43f3530650b95ae9e46011890dd8a5c61c254cac
- SHA512 333eab540f5cedc48e5c22b501e49e040c1073ae4fd80fac4701cdab36162e25eac457bcb2fe12d2e91bbfe889a76f82e711a463e6e07fca32bd3d6794e3e885
- SSDEEP 768:ShNUZ72OF642iTW0Pwgf4RxnoESFkZ0KB2Jye+k1dCqWzYcuM:ShNsCOUFiTlknR
- TLSH
  T121C29492BDCAB47D0336C195C95ED558E70D3A932EB2125E747CE0B90FF0C4246B1AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Lib/DocXMLRPCServer.py
- Size 10KB
- SHA256 d34f16b30509768d8e2e75b5a9e6416b4b1ea700de0ceb6d3fe8cf72a86c98f0
- MD5 720026a43393188faee8e058956a7e4e
- SHA1 a4fddc64cf0842c19ccdbf26de3585dbae7f3995
- SHA512 b07e6755524de02845f134edd8fccb816bd2f2fb1c13703d597f5c2f77c5f9ed7663f5542f620e5f26e93b201e287a7f9e6416b04dba217770690993d91c8693
- SSDEEP 192:3TimpjLs0Lc3CFdII3IoflSpFe3tDdJyb4u6Zc6h3MQjUKhBx:veyYetD7yTX6h3MuhBx
- TLSH
  T1CA325476CD0354666637C62D98A2F10BFB1A02273A1B24337EBCA1590F74C0493EADDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Lib/HTMLParser.py
- Size 17KB
- SHA256 7f4d9e1690b1b3237eac5d06cf2ec77566a2f005538fb25f0e853553a8ebe3aa
- MD5 75aba54c0a88146a759cb8c62a0a11ed
- SHA1 0e9100b75799ee05d07f6eebda9bd00aede1d8cf
- SHA512 f1fd960ffc13419077b412896f31b4973670df4d6af8b073895bfba6096d2de83ba6187027d99e4209914138b7f85b0a51c67239936c6ebeeb6d7ee41bbd34b5
- SSDEEP 384:/Xu45JrxZeeKQ4mBkojnLvB0Ril82Gf7TJ:/Xu45Jr7eU4mCoj1l8LZ
- TLSH
  T12F826365AD4B50780673892E5C5AF607E70BE3231968C587BC3C80313F784A5E6B6FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Lib/MimeWriter.py
- Size 6KB
- SHA256 b1cfa3dc0b75d34e61c2d79129b472fb9c57cd6f18fe22464be0bd878b4eea8f
- MD5 ae27f020705f58c3e756d9285ec682cb
- SHA1 3ef4bd90c26013cacafac4ba11c4907e1febc0d0
- SHA512 52d08f7e42e09f359a2c584484a53a70ce8667bbef2f2e05bc67371a9026839776444d96b25705cf6591fa3a0243e7e4b0b2e9d37b5b9193bf739d48206c10b5
- SSDEEP 96:In0EicOn5ApaLz0pr0mKz6ceLNdK5ul5QgglvUV5U5CkQLcBrLOaMSdUOjuH/dnZ:HECLfz9evtOsKCTQ9TMCjuH/dn5Osh
- TLSH
  T11BD14363FC866F6006738136B955F14AD35EC12B6579112178FC411C2F76A1A82EAEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Lib/Queue.py
- Size 8KB
- SHA256 91bbf609190e64c25760ae52acb38128397c7169a41b0ede420f12b786595cf7
- MD5 5290265c17dd86a8e8bb5e88d3fcd071
- SHA1 6c805bc9c82d7d8fddbe9e18b99199ade44a414d
- SHA512 56391294b96bd8940e5b5608eb05892b358d9c29ce1452bc83ac7774fb6bbbaf8fb1b355085f534086624c1840f5459fa37f2c2f109826d37e0a9195d517ea56
- SSDEEP 96:z1lVvlOZ0/WOsoHLpwaZbrjzcri0HUVkHHHhBxwrAbX4vUA/s0vPghHohkwZZgBv:zeZ0/WyTZfjCtHUihhbX8YazZZduYU
- TLSH
  T1120264C7DD0F9E626172DD4E5805F0A3E70A02872A188557B47CD13C7FB9411A2F4DEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Lib/SimpleHTTPServer.py
- Size 8KB
- SHA256 bd4ca5e4bd8833f57559a8ae9afa8ecc084674f331bf92f32ff5b45635e8ca30
- MD5 a08a695cc2e6a2fa4545f0af980799ec
- SHA1 73d6d94a532ad14710bb1f4629b66324787983e6
- SHA512 3fad1c3ba288094a1ccaace472824acdc252959750b950240ab027f2ba92785f1f6823d25d44a5c12ba01b01e630da578761bed451820ad8b7059e9d3a6cb176
- SSDEEP 192:AHNABPqWDW0IigV37OK8z568ZO8cwadYCVs1IHrOj065luEdFnshQdoqhZVRiz:AECuy36hO8JEOjB55dIjq/7y
- TLSH
  T13C025F57DC4722455373CB1DCA07A6EAE31981A7663E152A7AFC82181FF0815D2F8EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Lib/SimpleXMLRPCServer.py
- Size 25KB
- SHA256 9c6412e07867f0b348b697f9d9c7e6a431ac0e240f7c2be99b68770aad7bfc24
- MD5 0a4ef4370f70875ab814090620404105
- SHA1 1f77b6c46b62b4b57b257d24fe9f0f4017350697
- SHA512 f793f944ba94e0df2c86a9cb2ce98953ccb9c1d97a55078476f13d43d3c13d9dfdbd5a21a7828025229c5a5c595c37bd8f381b57c4b23b634819954a30a5bf19
- SSDEEP 384:UDa1edURyDW3udNMUUwNn7NhOhyN/c6Y2LGQpnYxAUK/Hkp:UDa1ejDWqCwNxhOyVRGTAUK/Hy
- TLSH
  T166C29467CE436016557AC75D8813FA8EE30E51233A6E1863BDBC92181F79420C2F1DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Lib/SocketServer.py
- Size 24KB
- SHA256 b40cd075e87a3d58910b88f24f9f6bee3f9414a1f6210e04e183762e1240ee7b
- MD5 1d9ed6a583b37c7cce74402100e3ac38
- SHA1 90e8ae0850efe81b24e883a5c819b941f8a057f3
- SHA512 65591bed5fb69db448caccd33564d6189881e558578683ff15fcf8be3dff9b9f8925934c262d7e1ef5fd85abbf369dc9d178fec74344662aa8ac86ec3e2dfa16
- SSDEEP 384:140jl1mx6Ms11G5XtNYCQQ2oXRKIk2bC+N1xGApYHHOGQ/NVh:28rH1y8ZoQ2Cur7
- TLSH
  T1D8B22183DD5B61AAD473C5069D11E227F31BA197762A19B339BCC2DD2F3202481E9EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Lib/StringIO.py
- Size 10KB
- SHA256 7eadaa5c624394bc3841f145d65ee095661f2c0a6cd6defc00798ddb4448d978
- MD5 8e8e2ebbb66ae9842d90ef5417c7e4e2
- SHA1 5a7213503d185ee037aca06f6a7e5b95d30ee4e4
- SHA512 e47a53350d0c931de576878aa3d88ccdb42c70870f8ef255bc00a8226029433a21de329508fda5a9d3c61cf5a26b8c127f1742129434699cb2a51422a53f89d6
- SSDEEP 192:B3nf7/MFawpmhXHzE6KgW//7wyys8MERXMYCsLCOz:B3nfzwpC8tyfMERcYCsLCW
- TLSH
  T11B324213DE4697A9E577945F6B4AA002E32A862B172C2251FCFC90983F74419C2FCEDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Lib/UserDict.py
- Size 7KB
- SHA256 b1a10c13ab35ccadfc441dd8378b97e51cae984bcfdc19ac62e8c163c8b91da5
- MD5 b8895d91fbb8c9d67caeba8c4d5ba884
- SHA1 84cf9913d50b9dc2f803bf3b914bdff61ee2a15b
- SHA512 50b31f731edda5471bb3a3643ef8ecb22e59af353b4c7cbdc76a692bdff107dcbb68b248e0792ace5795e76467f547d40abfa4fd10cc9dbd151739ea53be6c86
- SSDEEP 192:mw63NEnIhpEkzVwxXKGywcwc2uEMhYlNurWNe3V0GdCc5/MTXuqS:mw63NEnIhpEkzVwxXKGywcwc2uEMhYlc
- TLSH
  T164E1CF222D83E4524277D83D4D99E803E71D5A03A45D7257787CE1607F73828D6F8DE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Lib/UserList.py
- Size 3KB
- SHA256 4bafbf42cb4b168079fe95954082698c4d91e1601c027d03c9987dd79dd7db59
- MD5 9a33fc8abc40097f9af49750259115a6
- SHA1 b380fb89a134f5f49e53d62ca438c919a5569abb
- SHA512 ad43f9f1df4f48a58049537a792af4dd644f04d598b694fb532cd32bf2499f8e1e21b007cc66b64d2afd6e56b883b08747bf3f7f9d161ae7a2d9008d3cc6575b
- TLSH
  T1FC71D1D47E4FE8A181FBE429049EA887DA0D355392AC91077C7DA4642F73C15E2F0EE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32