96f99d2443ece91c5e0f24723466b18537e4582ca13becaf70c513e185350cf1

Sharing

Copy URL Twitter E-mail

General

Target
add-in.zip
Size 3.9MB
Sample260713-esp6nsdx41
SHA256 96f99d2443ece91c5e0f24723466b18537e4582ca13becaf70c513e185350cf1
MD5 2970987625b9a1f44cd08e40088c2d97
SHA1 b973acb5a966e8f7a725c8e6421713714c4d1432
SHA512 9afe817d85ec61759a5a805eaa4c5743dde418e32c016d5c7c7d5694432b307db4feb42785786f57d39cbb35ca3585755a9469ae88d4ef1ad287433ea164ab99
SSDEEP 98304:j4nh5xHS+9hTyPn9N6noYuxzaw8WysXfbZSuEEQDp9s:i0+9lMr6nCNamRXw5ls
TLSH
T11D1623E1F0395D1147B4B122BAD47646B677CC22DEEFFAAE08AAE1F4D5836103434B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Language

xlm4.0

Source

Targets

- Target
  DotNetZip.dll
- Size 449KB
- SHA256 698e4beeba26363e632cbbb833fc8000cf85ab5449627bf0edc8203f05a64fa1
- MD5 11bbdf80d756b3a877af483195c60619
- SHA1 99aca4f325d559487abc51b0d2ebd4dca62c9462
- SHA512 ad9c16481f95c0e7cf5158d4e921ca7534f580310270fa476e9ebd15d37eee2ab43e11c12d08846eae153f0b43fba89590d60ca00551f5096076d3cf6aa4ce29
- SSDEEP 6144:WuCIjULqwIvFC/scNRmglrCYc9vnIJtrGtSV41kJDsTDDfiSLe6XOxLV/f:kDLZrPtLWn7S4csHiSe6+ff
- TLSH
  T1FAA4AE0427EC4B5BE1EF5BB5D0B6A191C3B1B526A53EDB8F6D4024EE2D17380C911BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Newtonsoft.Json.dll
- Size 683KB
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH
  T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  OpenFin.ExcelApi-AddIn-packed.xll
- Size 698KB
- SHA256 751a7ff68e487957160ea44e0ecb37cefb4f95c701b01f3bec124df4f1f171cc
- MD5 a8bccbb978d997a27520c781540537a9
- SHA1 985fa0eae6861af48ca3bd579ceb5650d617d2ab
- SHA512 3e470ce4b78e90a9b52fe50e2bf7c0fc8b9f8edccf76a97069740bc9709c19296017de4b84d4251bb085bc4830820eab72575bb76f6eb7ca6ace52e2c6abb1ae
- SSDEEP 12288:VHB8k2IlwP0iruRPlOF8bzbBSreSNlKVWf9zX6ZamHyP:f8mO2X1Ssgx64IyP
- TLSH
  T1B0E47D96BEC66EA2EF7F51B7C360EA391116736D03A09ACF760305993915FD2403EA07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  OpenFin.ExcelApi-AddIn.xll
- Size 656KB
- SHA256 6859fed45060cd9d9e048357da0994275fd29d420155b51bee1ca31c5d0eebbd
- MD5 c8830db2be273341fa42d764db626b0c
- SHA1 912211661d7e07e124c815c7c4afa0d19f0f6865
- SHA512 cb21c6b126460607c651ef89e61c8f097ba95e67f55e869eb59429effa7de0d4db16bc9cbd00bf3fe6ce5cd1cd8e31ff333a3208bcc1411a9360f36c19d19c44
- SSDEEP 12288:6HB8k2IlwP0iruRPlOF8bzbBSreENlKVWf93am+mN:g8mO2X1QsgAdmN
- TLSH
  T14CE47D96BEC66EA2EF7F51B7C360EA391116736D03A09ACF760305993915FD2403EA07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  OpenFin.ExcelApi-AddIn64-packed.xll
- Size 616KB
- SHA256 e020fbf9b08715eed69b6f4884d250d621aab9c7a07d6671bbc86ba285266075
- MD5 4e9b077e10f9690ddcaac28be1caf0e5
- SHA1 398887231c3e11322eaa66e7ae8ec120645200fd
- SHA512 bbc3963f7037aab1f6cfdde1d62f388cd476a40044352baecb6639fe853975e14fefd64d11aa95d6183b475f992689f1da0b34c0b5fc2b66869a33603d471616
- SSDEEP 12288:sHzhL3/Z3+AZXkOCH8bzbBSreg48kcNlKVWf9zX6G3Cg:sHzhz/ZOABkjcX1Q48kIsgx6G3Cg
- TLSH
  T12ED4AE53F6E7BA61E6AB82BAC6F1C92D66B3349202B0C7CE774055892D13391483D71F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
behavioral10 behavioral9
- Target
  OpenFin.ExcelApi-AddIn64.xll
- Size 574KB
- SHA256 8e0d3b67f5392ddcbd973322bb6051f21aa7f434b187be2a03341c29c0feec37
- MD5 40bc35b1a0b01dec5133e7bb1261871c
- SHA1 541cb49240879b3cf8059a0e5a1d9dc21829b9f6
- SHA512 b19912eb89220c61dc4a6687aa81f4f4233dccd6fe9727a308bdf548aff40b10a194f19d7e5028a488369d7c6238959f3f1d43ba79daa13bc01952b06dd686f3
- SSDEEP 12288:iHzhL3/Z3+AZXkOCH8bzbBSreg48kHNlKVWf9jZb:iHzhz/ZOABkjcX1Q48ktsgtZb
- TLSH
  T1B8C49E57F6E77A61E6AB92BAC6F1C92D66B3309202B0C3CE774055892D13391483DB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral11 behavioral12
- Target
  OpenFin.ExcelApi.dll
- Size 84KB
- SHA256 88a015f1ce334f5698c179aded25ef54aba9aba064efc5d660a3def16910021a
- MD5 4e4ee3061773eeb50c6e0f9bd6b3c9f3
- SHA1 65654feac9114d8a07d34778ff5991c91a7409a8
- SHA512 244edda5780b1566d7b706bbd8703fbbfe3f7de92b5e63e6cdcbd02fcf038db138e5c838c2cdda21198c2db3645996260f765f2216f3a59a0ce1329a12e9861b
- SSDEEP 1536:VQj4JYvpxY2LNSdWaKzwCm9zOgDEu1tLwbioQ+t1wyucQ+8iAh6U:VWqWpdNL5m9BDEYOzTuDDYU
- TLSH
  T1E3834B15B2AC5E03D9EE0A7428F1B7214EF8F59A25D2E34F4C88D5DA5C97380CB117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  OpenFin.ExcelCore.dll
- Size 62KB
- SHA256 0c1ccc03b0a238829daa150f2bafbb5804e4267fe5a3ac0a823faf62dd9405c8
- MD5 2efd1dc63ebee04b9ab45f0ea9c4121a
- SHA1 703ecf856822f87b5e0d2b60acdc9114de97dbe0
- SHA512 025af79fed8e56bbef14978fc6ceb15b9d28115413c34505d1a6a099018cdfbc20b611ca1af06c7295a6941f4b0c6c9ffd227b2cd4a71f63c0fb1f6b10a00322
- SSDEEP 1536:+U4u/h44fAzpU1LVzNPkxVknj+w/Wy4duwbioQ+2T+wpjQ+8iA7W:z4I/AS1bPk3Gj+w/Wy4dD+ODi
- TLSH
  T18E536C421BECA212D7FF3B3596B442268BB1FE417AB1D69D0E9090DB4D13BC41E21367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OpenFin.ExcelRpc.dll
- Size 31KB
- SHA256 f7f9b22b620c5dc622d4e2eeb96695d848415d5755149c9e5d15d7ce2c07930c
- MD5 a68781233c0e48f88426457275e52377
- SHA1 327e77b21207471eede29ff6af5a0483d31a13a0
- SHA512 0eabb82c2420fd752e7fd64578475141c3050ab38d90e544040ec01890af9770f689b03fd239b64590c2f962a10c05a4bcb0f67bfdbd159558e72bbe171d38f6
- SSDEEP 768:kbpFRRulvZwbiRGp9E+Nn6ZwDw2p9E+8iROPrAvi:kPRklxwbioQ+N2wDw2Q+8iA0K
- TLSH
  T1C7E24CD12BEC2215EC975E30E5D68733CCF0BAA17E5041EE1AA8D45B1DC27C63A2252F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  OpenFin.ExcelService-AddIn-packed.xll
- Size 670KB
- SHA256 e520fd9100be6b01ee7b8e29ac656cb363b82f3ddfe0f973d9532e1b8ae32952
- MD5 57daf355cf0e1cb9695066ce9cf0bd69
- SHA1 112d0024f7a39299f59742618533b6bcba3179d1
- SHA512 a0414082aa8ef069c9e3eeb38862a052d81bac8340113137ac47ea30fbe9b3c86cab8e63e0c60f01932cbe24cba7dd8d1bdf0240d9fd1f3c566716541066b731
- SSDEEP 12288:xHB8k2IlwP0iruRPlOF8bzbBSrerNlKVWf99amssR:L8mO2X1JsgyLsR
- TLSH
  T15BE47D96BEC66EA2EF7F51B7C360EA391116736D03A09ACF760301993915FD2403EA07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  OpenFin.ExcelService-AddIn.xll
- Size 656KB
- SHA256 0c47ae181d8edc3d66fc11c90b22cff5db506d340a810166f3ebc8010dd45950
- MD5 82911cb983c00c24992a568c153ac3ab
- SHA1 33a5bf30812c49acc7b269ba522308a982c7c327
- SHA512 89f87a8793d264c9ffeb58e4e8c970d858536573bc8b5c83306145607a1e92251c4758e3166508b972528ae50460cf14e8c003e4b37c7929452e844d447c4dc6
- SSDEEP 12288:QHB8k2IlwP0iruRPlOF8bzbBSreENlKVWf93am+zw:O8mO2X1QsgAdzw
- TLSH
  T185E47D96BEC66EA2EF7F51B7C360EA391116736D03A09ACF760305993915FD2403EA07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  OpenFin.ExcelService-AddIn64-packed.xll
- Size 588KB
- SHA256 6ac68825a39a3b5093c803e00238479a5a97e24b697ae0255c1b9c2964d7d831
- MD5 bc23d37ee61656fea626469997fd7880
- SHA1 36fc8445558d93f00e56ccf3d360400b6f2e0205
- SHA512 8b19fb6687a3117dcfeeafaf9724ced979b8ac6dceb68ba3404224529a5ba3edd0dab1e107469651a46175b1413c5fc17a6418845da44a4fb563e328a254597f
- SSDEEP 12288:VHzhL3/Z3+AZXkOCH8bzbBSreg48kANlKVWf9KP1:VHzhz/ZOABkjcX1Q48kEsgEP1
- TLSH
  T10DD49E57F6E77A61E6AF82BAC6F1C92D66B3349202B0C3CE774055892913391483DB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10
behavioral23 behavioral24
- Target
  OpenFin.ExcelService-AddIn64.xll
- Size 574KB
- SHA256 fb566e6d43834b30e9fd064894216a6eb58b19defb02d8ced2a6e4d4b5f757f0
- MD5 44db52a8d1b8308e917cfba24cf0715a
- SHA1 609948b34724cec9cf65ea6e26b8e526f507b77f
- SHA512 6ad66ffb13480fcabd16139de4bb7c96962a334087e2b3df62b318b0c6c54931869afab619649297d0040bc5b9baa2e0db0acd273ffa6e7f1d77bbfb063b3057
- SSDEEP 12288:dHzhL3/Z3+AZXkOCH8bzbBSreg48kHNlKVWf9LUWj:dHzhz/ZOABkjcX1Q48ktsgRUWj
- TLSH
  T128C49E57F6E77A61E6AF92BAC6F1C92D66B3309202B0C3CE774055892913391483DB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral25 behavioral26
- Target
  OpenFin.ExcelService.exe
- Size 44KB
- SHA256 afa060a5dc49e409f51b85411cae003196c32258cb436f145eaa1e4e52c2f642
- MD5 690b812cde89ab2251131e4a3f6e2a97
- SHA1 19e9932c6eb3783c7e7fdc3d54e78f0852fd935e
- SHA512 54d6d85c177de0bb2dd198891e371d73a56e0d7ebb44ce09a7426ba4955be4885e954dec12fe136b6e07d50de72c79c915c07c6668efda06b5b525f17f915591
- SSDEEP 768:vwAmx/sZcGDSiMiX0ia4gtZpGyIbyiLPZwbiRGp9E+/ZwWZwN5p9E+8iROF:vasZ7Dz0i8n0yIJRwbioQ+2CwfQ+8iAF
- TLSH
  T126136D4137DC1212E9E71B70A9F2B7338DB1F996ADA0C29D19DCD0AA1C937805E5173B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  OpenfinDesktop.dll
- Size 426KB
- SHA256 2e27e9667a3ee1e4ceaddae74b6818f640b876a63e4e6f8bfcfa1130e7cf9129
- MD5 c3a0809127297418a4a010976c6d4404
- SHA1 b52e6ee6c043a3b89933da37d39ace4307736775
- SHA512 3bf85f98a258c37ea3600abc1bf66c9f0496adae063d23457389b775f1fe7f34c2616c4faa5669d914175287de9c13c8dbcaef60ae821179393a551f5f79016e
- SSDEEP 6144:wU28lcgHWku9yiR4HPrlh7Rm7sbxVs0qohwMJPEN1iQu+UWK4GZ4Tfyb7qpRYiA7:TxxwMJPEiQu+UIGKR/gmc
- TLSH
  T1A1944A2D33F4429FC1BE0633E271462386B1E9067565D7EA8A54F61ABD9334F4D08BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  SuperSocket.ClientEngine.dll
- Size 48KB
- SHA256 a632ed6e1037b8d1f3e8981cbd748823f78ea09497bd61d27dde31c1efaa2309
- MD5 9e195e5e177ec9d98155f6f294d35de1
- SHA1 a69110ed00319809d6186ac96d0af8db41af90ee
- SHA512 653f9ce312a746cee510f9f52aa95cb7537c263b7be4b85fb5fbcc45749a2b35b080ae7220986f1431204affe9431c1b989bad6d1e4c549f1a33f50e4aa100a8
- SSDEEP 768:8CQjFJzLzS7ATZDyFsasvEzgPtf2fijL8Ipdd/yO7i7mLi:/QFJqAxyFx9atefqpr/yO7i7oi
- TLSH
  T108232A21A3FC4727D7AD1734E471212507FEFA053623E7994E8461AE2C63BA156B43B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32