8084c500a71fed326cb3b27987571b3b39a5c250fe53f42b0f7e9fb75c645cc7

Resubmissions

30/06/2026, 05:11

260630-fvctsse14y3

30/06/2026, 05:03

260630-fpsm3aez7v8

Sharing

Copy URL Twitter E-mail

General

Target
MagicBulletSuite-2023.2.0_Win.zip
Size 230.9MB
Sample260630-fpsm3aez7v
SHA256 8084c500a71fed326cb3b27987571b3b39a5c250fe53f42b0f7e9fb75c645cc7
MD5 0164837ab9a3e968737f31f79d1f0bfc
SHA1 a8f85006c5b324238933d0460b1b8cd01b582e41
SHA512 02581a7c9baf38293655922aa680e94962bf029034998961d7b7825e2bad599c5c7429dd4622023e4bcc9de7e6794a740b45197cfbdfcda3f40af1137ef18b8b
SSDEEP 6291456:yg3OHBQ258K7d/S7fbGgvUn5JpfVdR902jZTl3vl352yZyILj:y6wV58s87qgGpfVdRdJ5v55JF
TLSH
T101C8334CD07A7AD9E112B6227742514F02DE641FA1E6AD0FF22A07E17F971E28EC970D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Magic Bullet Suite Installer.exe
- Size 2.7MB
- SHA256 19bf9a9fe30120b02bea7262fb04e76435d27828b9268535ace4d24c277adaec
- MD5 6813428adebd53f3e5e23beac5d9a9a6
- SHA1 6cf3026ed25683f0a09303c0bc49338cdb244ab8
- SHA512 2a030b0ff36238842896644967729705ad1ec8d4aa1d29d33cf56be591ed204aebb207d021ff2a29b9755147bc7595cfbc45d8d53aae58f86b7cf92e5299cded
- SSDEEP 49152:Gb2r2OQIeoCuBzAvfICk6tTOHaLqf3O4eD0FUZbwbm5O8R7nH:mTI3Aqfe4eD0FUNwbmow7nH
- TLSH
  T1CFD58E1A269D3C59D02BE0B58A32EF52E2353C06076165DB1BB23E562E777B13F79B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  Scripts/bin/rgdeploy.exe
- Size 1.8MB
- SHA256 e1ba09f34ad6270f39b5de36c4a207e5cd8d9421ba74b9c13a2f0ef55953b89d
- MD5 532dfa9f1d8259199c5855e287d43e63
- SHA1 334a53e25d95f45579ed7ecc94159a479e9c1e16
- SHA512 3c88961df74429badfbb16c380c526c7e41cd3aba9838c91215b437f54f387d582c72d6b320a263e1619c0c777f3f2fc7ca41523ddc9f9ccf97e12abc437250f
- SSDEEP 24576:cuhIdrLpw18Lol0YnUuyb9+MJAbRYtwKsDPpK0PQMQGUilq3D569gHTrUj6JSwyd:cuWjwUbb9+MJ4KsDIwQriwz569gHTwwk
- TLSH
  T13F854A1A66A841EDD0ABE07CD94A5E02E279745B03B19ADF07900AB72F973F19F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Scripts/bin/rguninstaller.exe
- Size 698KB
- SHA256 48371112b424c88bb2499a8de93286d9d5ec29617d0d485d8c0e86f2b195cafd
- MD5 e88c44b1841aebc707a9d7cc4ceaa19a
- SHA1 08766ce3c9a714dd09319d302fbcb214e78ae3f7
- SHA512 d0e783ce98a307a375fdc7125b0cc0d9e451a83ac2beead8126e5634caf392a28aa5a981c2498fac52d9fb4636456f62584ace3a5581c37115a84450852d051e
- SSDEEP 12288:12HGi7rHvzd8LE2khBG8ZnRxIBZ64qq5y/BnyHnioG+BprCV6NzJDd3M65Uq0NBB:12HGinHLd8bBVM6Oq0NB9XvLsFo
- TLSH
  T1A4E46C2AB39841FCE1A7E139C8865A16E3B1749B133156CF53E04A6B1F2B6F55E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Scripts/install.bat
- Size 234B
- SHA256 706b2ab0d12d78592b0f3bd6763f80b9ab31a553bcc26ee2cca54d5ba108819f
- MD5 17c1b044dc24be6156bc9e4309eaec92
- SHA1 40f0d20d97e1e6e963633e0628a31ec555bcd94c
- SHA512 dba4948c47313ac64ba9e821b6b293f8796455196946e52f3bd2bacc5c94a86568d455662f72d478c4ad8db612e393f6487cd74e60d778b87a5f9c6a380a998a
- TLSH
  T1D6D05E72E90BEB909914CF85F46F820D72DCF1966A20E05A3B092325E546D4B044AB9D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  outputs/RGBranding.dll
- Size 3.8MB
- SHA256 cd04ed04dd55b436a2eeac844f95bc5aa99ce9491bd9dda1468013cac2ec952e
- MD5 7cefac98c658ec043af1cb02670f4197
- SHA1 44e985555ef9a7157705cd04338fec79dd57ed9e
- SHA512 fb2ab865791c9c6534546c5a0817eae61cad14483c4229d0a2acb2fee9fdf77c2269e6aa09471ff9729cdcd25cb460e9ff3839074088ecc930d8f0b011b4f8a0
- SSDEEP 49152:Kjmp9bQyBPtYiMM7xkSsxXQoHUkLn0g6CNCXlJXuO95kz8uVLv1Dq75B7TSjpNW8:K8PdVoHUkRNCXuq5eX1voTajDWFWj
- TLSH
  T144065A0672ADC0A5D5969038C9178E0BD3B2BC112B3283DB71EC7B6E1F777A10A7A355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  panel/com.redgiant.colorista/colorista.min.js
- Size 20KB
- SHA256 5dd4e12bd20f8c04a5994ad66adbff46d82cbc63ec8b458c1d91852fae3b3b30
- MD5 1077d93b7ec936846d44d22aaa3a19e7
- SHA1 ceeb3a36e1072709cf3fc8d32b424a1ce25a5a6b
- SHA512 10b0dcccba81743a37e432199152fc391670628595bf9077415e90fce01157ca7f228b7efeaa82153e5cb49c27ac9f2334f2cc8b14c31f096888830fc40f461e
- SSDEEP 384:v3PED7WeB2VynN5lg6Y5Z+aWAiiOSzEQuoAHh8P:kD7Weey26Yj0z8P
- TLSH
  T12F92A60DB2F1A9F1C2E7A059212BAE0971B62537D802844572ABDCC98FDDC49241BF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  panel/com.redgiant.colorista/contrib/jquery-1.7.2.min.js
- Size 92KB
- SHA256 47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
- MD5 b8d64d0bc142b3f670cc0611b0aebcae
- SHA1 abcd2ba13348f178b17141b445bc99f1917d47af
- SHA512 a684abbe37e8047c55c394366b012cc9ae5d682d29d340bc48a37be1a549aeced72de6408bedfed776a14611e6f3374015b236fbf49422b2982ef18125ff47dc
- SSDEEP 1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW
- TLSH
  T1B393E7D9B2D67123C7B731B850AF510BB17698AA784C8C50F068D8E4BE74A48907BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  panel/com.redgiant.colorista/contrib/jquery-ui-1.8.21.custom.min.js
- Size 202KB
- SHA256 da8edc2a2b29e48e48480a779d36a1eeef6ad155120bdd1b7eb36d4d8fadd32b
- MD5 03afe455536a9c44ad82cf1425e354b6
- SHA1 4d6a5f3a7e2ff4bcdabfcd3fef8b2e8e05197480
- SHA512 97c489156a2617e58e5bf7328207060c2983d053b27a22276a4feb96123545d0bceed554af18cef3c51fa8936ef32e20bb173100dca0372277445655004466c7
- SSDEEP 1536:vSyztmcZLU8jyf3oqhJ5mXM+FOFFJADbUuPLEN94Wlh16vE6Q119TGImwo0WJfto:qgZoH38BuRP9T6wo0YpfltCtcrgf1Wm
- TLSH
  T15414074D7202363692AFA2A9503F160B72379459E600886CB43C8ADE9F7DD5431BBF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  panel/com.redgiant.colorista/contrib/rgclient.min.js
- Size 449KB
- SHA256 45adee58bf6e5c0f4de5ae892afeba266582dd199cb08c1ad4ed875f976c67d0
- MD5 b51973d7a244bda94a011c35777581a9
- SHA1 e53878c4bb360ea4add8257a6aaf4266e1050ae2
- SHA512 f3e0e0a08936baa7bf4750d0309505a4f2ee89b27126d4513114c90f703e81de0e8b792d855db4fa6b4291f1b712880c7f086215d90b6951b64a6d6b20f796b0
- SSDEEP 12288:ucwlaoYanG+DxU6m1sNmGExIWkzVXKpNPkC:u3laoYanG+DxU6m1sNmGExIWkzVXKpNf
- TLSH
  T180A4F99AB2E175B242E7B1A9102F420E52371819B80B805CBA39E4D55DBCD8E707FF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  panel/com.redgiant.colorista/contrib/rgcolor.min.js
- Size 87KB
- SHA256 2886f62537f2f602c5e4bc0eae7ebca606b467da751b0a72f9c644c24374c2ca
- MD5 8978f71e3f006f70257117c25ea6d3be
- SHA1 acacc3f185b99e6ef69695bf9537dcce23cdb59e
- SHA512 40cb298b05bffdfd8ae41fee3e3225de950ef15b011857f704e21fa22cdb57d54344e54a624135ee0e5d70b630c058412f4da440c52776c3525e1f66285e4158
- SSDEEP 1536:F2kib5RjzvTfkF7PwamH/XP0VvVWf6Gy3PZyBS:F2kib5ZvTuPwamH/XP0Hi6nB2S
- TLSH
  T18A9319DEF3E1B15281A2625A013F954BA23374497506994CB378E8CD7EBC889747BB3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  panel/com.redgiant.colorista/contrib/rgpanel.full.min.js
- Size 112KB
- SHA256 19739f54245fb1b11420f762fc64023ff04ed1bda58c94c322b977d2c2e468c2
- MD5 c19c0f07909deeb5bfbc4fac42cda528
- SHA1 ef960ec090af8c097361e2a56c80aa409674562f
- SHA512 a17361129c9862fa4ac5250c90d7a26860a6d4b4e6814c8d4680ce8ba481884ea815937f318d87df9cb589c8874a1b751865ff85d2b0fb68709d25cb28cf4011
- SSDEEP 1536:xoIuqQFUkMKmprlIZPW7a9GWFWHXDZxs4g6n:5aUvJmApZ
- TLSH
  T172B3E68D72D5BCA542D3A1A2242B2D02727708593409505CB62AD8DFAEFE94F3137F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  panel/com.redgiant.colorista/contrib/rgpanel.full.min.jsx
- Size 32KB
- SHA256 5322a9fad7144c2cf20d7735659f6c7fd4d59dfd8f11340a84665c55b8162043
- MD5 42a6e833fb9b83883fff4c93f35f7859
- SHA1 bf08a2356e808f1cafc2862a8a9ac13a095330e8
- SHA512 ef1f417731654f7034cbb4ad6579d41c1038b838b698848193e53593115dca534dff64f48166ae2922e43b756460dc5e093e015924bd74d4939c5ea738b60d8d
- SSDEEP 768:p/dNRrsOV4QKE5fnlTJ/mKdg8U3RBbtEtdOZHaCaZVdRVT4shRbRDrypU75T+:55+gtIZ1pek
- TLSH
  T129E2E7CD72A2F920D3DA6518087B2806F13E0D9D789C9094F792E6DAAD69446D07FF33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  panel/com.redgiant.colorista/contrib/underscore-min.js
- Size 16KB
- SHA256 a1b6400a21ddee090e93d8882ffa629963132785bfa41b0abbea199d278121e9
- MD5 543feb1ecaf06ea516f8cec5f9f3f279
- SHA1 2a515632e0fd8ffdeb8d94cb25e44cf287feb32f
- SHA512 edf361ece5066bb6dda66490f3588dc60072c2ca4d4f15710717db4f58129d0d76e1519f92c8f7011fd01a175868ef192c704b4a869af95b150e0c3bf797816b
- SSDEEP 384:8ZAA6pB56II70uUl+V3TELHNqR+F0mbmwOwOX:kApB5IHtTY5FrU
- TLSH
  T17D7271C839D2F85A97A3B1B5003F009BF23E6E652CACA958D195E0E97CB484DC427F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  panel/com.redgiant.colorista/index.html
- Size 1KB
- SHA256 985158c0102de1987227278411c1d0a99b85a7f17670d1550d8afdf2e55db55f
- MD5 e27b4eb9639f20309eec711c772dc1b3
- SHA1 ce042cebb939407f4b6ee4dc48e2f922c8442390
- SHA512 198786f1fc951718460f6e5c37f195a4e3264c93e29b407810d023a00131d3fa2a286bf356699c58aea1b8cf79a5565bc2439d77b926ccebb64aaa84aaa51708
- TLSH
  T12B31AC161CAECF6241C106D9E421E72C8079EA31D321CCC5AAE386995BC4FCCCC4B498
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  win/AE/Colorista-IV.aex
- Size 23.8MB
- SHA256 31e3cd77924c530246e84ccb17fcb2652af0a780fb54edc9393208f32feef8b4
- MD5 dc53d4e4590b548cbac3dc098c02cb19
- SHA1 1b98e7db25f882351f6b307e2b14190a5f9cdc20
- SHA512 99c30ff6a10224740dd15aff25b13ad64fea85ed5acacaa5d96c3fd96c561d39faf5afd34c981f87165cca7a12a6f2bf169a791e09184d6888b3c4e98f9915ca
- SSDEEP 196608:gA8i5qq89AOa5VUySwv3VoQMNhFJvbDtP1iLlQi:gA8l9y5SwvNilD//
- TLSH
  T19247ADE5A14954D4F809AC7CC83F769D658E79BF7ED0E1C13AECAF2DC3239994622900
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  avx/Cosmo_II.avx
- Size 2.8MB
- SHA256 59afffab29dcfa121948c89483f66517ed40bfefb8fcd11a77cbefb9d0f02adc
- MD5 45c4d2dbc433aab18d2ff34495e87ced
- SHA1 1b848863907cb3d35ede006a62e97051cc467dbd
- SHA512 ac79783bdbc7f5ca96fafef58d75451f4abe291d50424844b75802aaf8d0f93d9f906c9e14646f842b63b1bd2ce6b43f0042c477fddef7df6ecf95bd737aaf44
- SSDEEP 24576:t8hTdm/UX/Ois6P5Zg9CEr3zh703tKaQ5Iv3SgyA40jYVFJTMy8N8zgK+x8Q9+g:HUX/I6PREr3zf5IvCbSjYVvgoQ9
- TLSH
  T142D57CC2A1A501E8D0668038997BAF17D739F59513324BD7CBAB8BEF2E177C51A37210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32