4788b2c6b8cf9b3d070829bfef4ad4ee373c2d2097ebd05483bd2cec961a03bc

Sharing

Copy URL Twitter E-mail

General

Target
clink.1.9.29.fc1e8d.zip
Size 3.8MB
Sample260715-wpzdlsav8k
SHA256 4788b2c6b8cf9b3d070829bfef4ad4ee373c2d2097ebd05483bd2cec961a03bc
MD5 acb9c2305927c085ae11cead04f30d0e
SHA1 9e07db009973cf6966b1642b47a145be14d3e80e
SHA512 76a6cd206e5cb785b06fa81de0a7ecb83acf75f9a341800596c75d0d0847fb9510ed429020f9909851419f4ada449be0cc5109416259c54029f8a551f7bcce19
SSDEEP 98304:Qr5BFN2popgpxlxKxKDb4P7i7PCEnHU4185ShQe7QMQ0vOEwi:Qr5BFS7RKxKDGyzn041KSu8OiOEN
TLSH
T162063395BF226755D88436F284787269C22B8BAD79FC8B05C7DCDA2FA37094F4C04167
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  clink.bat
- Size 1KB
- SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
- MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
- SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
- SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
- TLSH
  T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  clink.html
- Size 1.3MB
- SHA256 d78b1ae3684e2f6aa4712cf71f6fd984467753225dbb4c89f20bfc22ac615ed4
- MD5 11fb34e375e6745aa71ce810aef6d50c
- SHA1 9e0b0b0156af4eec02dc5ce10394169c5506a238
- SHA512 446cb98761803951563ea7b5e61437ccb9cb7d046fdec90669a0422f84b0179dfa2138ec1a688b6066f1b89f9e6b6d973d2b9871d372b0eadd24aacc171f0b00
- SSDEEP 12288:buljkA9gzd1HMcPQ/K7gRAoocYLrDwQ4KOmDx52ssKJB9oVJVtebW8sawvMIw8XW:buBkAi7HMc4/6fToFDGrL5p/R4LJHC
- TLSH
  T19555E87241D4563B416342FDD2092B7AF2EB406DE3120BE4FDFE870B479AD906A272D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  clink_arm64.exe
- Size 16KB
- SHA256 6297fe8ac17701d3fe2cdbba752da5542177fe4d7ee1f4fd9268238a0092490e
- MD5 f1262b1fdea6f21080265efd457dfaa7
- SHA1 b53aed2916aed7683f037ffe7dfca7151950c4c6
- SHA512 cc6a48ef824b1a249d378a8b488c3abb09f9a81205e80c2d2e43dc0d3d0a64288e3d4a24b630818b73713426143b7a50dbc78d4a851c243679b3771b7d7ceb9c
- SSDEEP 384:Bwtlw4yXd5ge2mNDFJdWXSofousWu4qzASoTIv7:8yt5bhrJySoQuSBzA3kj
- TLSH
  T167725BA98F2844E2FA5BCF7068DD856BAD71BB900C85890BA00945D92F437656F343BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  clink_dll_arm64.dll
- Size 2.7MB
- SHA256 f3f5e2955a2972ced4b22333ded172620e8d995b57eeb79e16a0d75b6ef5526b
- MD5 3d8a7f8e311460e0b785e997fe4fa165
- SHA1 200f2481aba38f39d2dfb25a42f6c958fa9f41e9
- SHA512 e0931abecd924c57e6004b0d07eb3e90097fe1aa2ac5dfb40ea2621b7912aad6005347fea5cbaa02ccabf162ffb809e7f41986fe87b6d4c290dd3340a5931b1d
- SSDEEP 24576:3hzvNJmlq8cJ7+Q+CSeqxRbNylDZCYGJc5uWW20eTmHFAGKTofABydG+SKAGuJSc:3hrbt8cJ7gHNE1cq7ydG+2S+Au
- TLSH
  T112D58E91FE5C9A02D3C7D1FCCD934E903126E6658625D98B8216410CFC97FD0AABABF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clink_dll_x64.dll
- Size 2.8MB
- SHA256 4f12765514492c3a204edaa5c34637d3b7d187af4442dd3ebc377d37332e8983
- MD5 a53eeb72a2648e8f4b631b94db143892
- SHA1 3906f00b43618bbb5013a6d9ea71723851b8fa79
- SHA512 378038099a2fb96d288c8057711e7f259ffae164b0d9459bdde4fc2bc37a9965763bf53f5f5f73c6742839c6ed959f301257ef67a9cfaba17cf8110717a9f81e
- SSDEEP 49152:xpL537ebx70I0YfGU7o6ut7+oTydG+mo3X:fL56bx1FPuvwG+H
- TLSH
  T1D2D59E56F2B906ABC06B8034C9571653E7B1B4994725E7EB13D0827A2F23BF516BF380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  clink_dll_x86.dll
- Size 2.2MB
- SHA256 3cffac6fcbf2c9bb814fbcd1819644d26855d80c260bbd500a4a56c302973c86
- MD5 912eff5a9b1f03f2db6a74e00ab59566
- SHA1 85aff59e7b5f13bce15f516a380f5cd7eda991e7
- SHA512 046efe6d6d28aedb2fe071a35e6709bef13200f0b802bb22a71a677e2aa2eeab558599ace4ba9b8382f66d81956dd079b9fef032f7444516739872d3b776d368
- SSDEEP 24576:1d0UheeZVSU6Y21SssjsGB8L5afxYrjZept1D7WSQUBV/juu9hnUS7bdzpK3Y6B5:rTk8gnafrB+Zmk3xeUiBW+8LcujZMU
- TLSH
  T14AB5AF43F9D246F3C54B017080BBAB761A38C6A54725DAD7E3802DB958613E17BBF28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  clink_x64.exe
- Size 16KB
- SHA256 58025e3ec7b1932f43558f7a6003d1a6b409f67071ec21baadf7e3d7be66a53f
- MD5 d9c93f471332eb9c9f05a331b8b41ebd
- SHA1 ba0727aa54c9d7e2e40945bc019258b8242a7e41
- SHA512 e2ec8a9f3b4c3c07059e533039bedcd4881537717219e96240d1e3600d9d52f8a96c1c5d244cc02c498d0bad1a54d9a0d51f6a5cad105f4a16d43ca71783daa7
- SSDEEP 384:rgtiw4Zd5ge2mND5qdWXSofousWu4qyS4oU:lj5bhHqySoQuSBy7oU
- TLSH
  T16B725B999F2448E5FA5B9E7054ED827BAD71B7A10C84890FA00844992F837F63F3537E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  clink_x86.exe
- Size 16KB
- SHA256 351114af22f94d4b03fd5c20cfebd04b02f786450e1b95cbdf58e4c2d2f51969
- MD5 251acdca95b5cd71aa61c06ab563edb6
- SHA1 eef9eb010835b04140d3cc6bdb6e15a2e13bbf26
- SHA512 7f3ccb0d243298fca416a6bdfa7b81307edf927fcb8e4438d7c96d893d01be73f03ff7f7ad8e986c9e18a055e4fac1738c4664e79dfc2d0351c250cd5fdfe17e
- SSDEEP 384:zXBKqS+w4+Md5ge2mNDy6dWXSofousWu4qIS7:b/95bhg6ySoQuSBIa
- TLSH
  T140726CA58E2848E6FA538F7058ED816B6EB0B3910C94890BA05904DE7F033A57F3437E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  themes/4-bit Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 20b0f61ffe34e3ba8b6422e2a6be8bbe5a58913cb5df12e62b2f0af029216e51
- MD5 ab5d1adddfdee014978f7f2b33f47e9a
- SHA1 bf721dffd4f8bb27ad060e1f39b39d88564bd9c2
- SHA512 54bf42d1422218eef8b7ce909f619e0a5ced18110a3676f0fa4989de7526d52b39bed1ef5ab87956daab803a31ea4a9cc0f49a4b46d87ce26e15449f30310240
- TLSH
  T1FA31DE2CF4C4A8F32AFF0F1FAC28D849506A2D052B32B76971CD81F09355B1650B6B76
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  themes/Antares.clinkprompt
- Size 23KB
- SHA256 aa857b55deab2a7e704d168c6d0c3f97047c2b17cdf216227b69dd783b4113d3
- MD5 54b6f92db08dbf8c2d1e205e534d0a02
- SHA1 1fb6cba9c935fe7cc80c56e8e46f6cfd88342926
- SHA512 44341e6302a07e7ee6968ebd1c6a03e1456ac7a3c85c2d535b71f1dd875565b0e823f1525decfa5c2cfb7bd73a5856a9fc79838b31f78ac63248d900ba86c3ac
- SSDEEP 384:KLZCPFlDD5q1ViEBnSfeKFK9bobC5czBDoTU38mmtY9Qx/2AZRjQYgcK:KEFlD01AE1XkEmmtY9QpZRjQYgR
- TLSH
  T1C4B2CB0E6E024E6894BEC51344AA65F2DA4A3557632D0194B6BC40793FB0C189BFDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  themes/Dracula.clinktheme
- Size 1KB
- SHA256 8400084650e409302f84629815b7cb0c13e15b81a55fc856a72346fd32a3527b
- MD5 c7617b1643a9189337d407f773e196e9
- SHA1 5819f29fee357b3d71ccb94395e4ac947f146cf5
- SHA512 d5a9532c7ae7fb7a2e0e1d578e3824dca448a065f16a5a42a6828241db71882ab7be19ab87aca0413e482ccd6e57ec04add76be4a0f27dca97101c0ddfc389ca
- TLSH
  T15B31452CC4DD62EB367F0C9F6669D089C961A13421227B3872FD1A78B740B5282471BD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  themes/Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 2c3105e81a4e887a8f00008628a11102f17d3a684189a71aab381614c938ef4b
- MD5 1f7a47e668aa719dec19e32ec0dd4a09
- SHA1 b7e0c56cb99570d095b6fac585592bd91a6cc540
- SHA512 b57cb82d2bb0a3bf9a11ba7d5f0c2fd2b5f72ce6f564c6e72a8fa477cba9f2f5e3d6304aed02b6d1671a70ff4ee3b04ddc1d3f06e135a104e978d397d70cfcba
- TLSH
  T13E31661CD0CAB4F7A1FF0E3E2D19C8489A6B2A292722372875DD71B4534130941BFB75
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  themes/Headline.clinkprompt
- Size 23KB
- SHA256 351581f87fd4e552644026f5ba36f593f09e29a28a9e0d77e303e307584453bd
- MD5 c6eaeefd5e748bd7e822baca66fd9419
- SHA1 d1cadabf472bb6715bef77a4a01a8f0953c57051
- SHA512 4d10b7ccb7faa946d445ce2c8fe8bc26ff864d270d1e708f99f71869dcf7e5d5e5bedf7f11211924dec6fffbd554d41dc6fae219eac5a245c77ec1704f082ddb
- SSDEEP 384:yI/VxfyFCENWJM52UId+3i7kg9wkJ+H+J73aGApwspO51jvG1E:yaFENEGId+H+J73Qw3G1E
- TLSH
  T15EB25F065D06927028B8C6BDB89B1D61FE3550932219C037B4EC41897FB0AEFA6FD3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  themes/Plain.clinktheme
- Size 1KB
- SHA256 6e63901094a309b2e3079d98950d0c488aba00b9694da76bfa3b0768b574425d
- MD5 f91651de99673500b7f49f6f516b244b
- SHA1 8d5349fd5215730e693e25537d4fbdd758685d56
- SHA512 4248b41deb294f1b20d9c8e9540bfab4ece1d880b23294aa485759caff651248b5d727d2040dc91447d41820d4c2a5f8ef64e085adb363108e9b9c0853b3cf96
- TLSH
  T16411E42DD4C491D76ABF4E5FB829C588A02AED25BBB2EB1472D40930A044FA34086736
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  themes/Solarized Dark.clinktheme
- Size 2KB
- SHA256 3ca3ad89fbf8507fc60c025d81239e51c9c244bfdd9bde272ebee904b0ad1d81
- MD5 4271dc349cd8046bafc94082b179d0d4
- SHA1 2e27125e8da3a1d6fbb574e6f58e13a6ee08f25c
- SHA512 1ce30cc32a3fcbee80020e519e59a195064f04d580f63d577fc1b92943d4400be296c6b53879c75d8a5094f4175cde55da30398b47c4d1fc4c9cbb85a70911e2
- TLSH
  T15351DE2CDCC995D726BADAAF2964C9A7D13DE20B34626F5C3AED8C743341B40A24F431
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  themes/Solarized Light.clinktheme
- Size 2KB
- SHA256 374bcdcf8de002f843ed7e7f84058fae29a0476cd3e0315c306b229040dc281c
- MD5 0f54e3f5021015fc5d833ad00ee8ecf1
- SHA1 385bc4598a57fa42b4b3c7561f1e209bf462e6eb
- SHA512 f344593f64230fbfea5382a297a3230bb19e4f8a26943e1a36d217e00d3bfa7962a280fb2d73a4dd6623b473e81b0f4da9063a96f62f517efcaec4982028d0bc
- TLSH
  T12651C12CDCC954D726BADAAF2964D8D7C16DE30B39226B5C3ADD88743341741D24E431
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32