c32cd9ea44d8cf82884de114d68fa243c301d4c4bb96d61c354e7b6d6fa6f1ce

Sharing

Copy URL Twitter E-mail

General

Target
clink.1.9.30.85f10f.zip
Size 3.8MB
Sample260722-argqpas1gt
SHA256 c32cd9ea44d8cf82884de114d68fa243c301d4c4bb96d61c354e7b6d6fa6f1ce
MD5 7597c418a3bacc8274b9d442ea683894
SHA1 de50959f9fdca34f25235f8f55be691364389c8c
SHA512 a12354fd3eb8a56b2a15e37c65bf178c8bf68d734e55d3aa1db5a0c626f25a02b049b118e30fbc8d2b7c1e60a03f0b95f3fa0a1e909ca3ff3e27ad0f1b8a3e84
SSDEEP 98304:1l0HqQ2BVt80gLkKcEMBeK7Ac+dCC2vHU8p7aO/xiuYP/ChtE:YHIBVK0gwCnK7ACC2vH5r5iug/MtE
TLSH
T1E1063391869D8686DB9353784D6CBC01B49B0E7C347A31A1ECFAEE3CBC50B988D4D61D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  clink.bat
- Size 1KB
- SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
- MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
- SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
- SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
- TLSH
  T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  clink.html
- Size 1.3MB
- SHA256 d6dc7734786a77f5a0b1f0871c2cee4b74c6159fce31e3be182fe6dd724473b6
- MD5 fd7c255d9ee38309ce91cae0f7953383
- SHA1 952099d2e9bcd88faa356256923f38a45f63881d
- SHA512 738792488f76f6bb73e49a2c9cfdc0d89c1b8b8eb7d78c5e8990e36f00f2e3b324a9695184cdd23004f7eec7931ac073359a257c80c87fe5d255292b625b134f
- SSDEEP 12288:lulRkA9gzd1HMcPQ/K7gRAoocYLrDwQ4KOmDx52ssKJB9oVJVtebW8sawvMIw8XR:luHkAi7HMc4/6fToFDGrW5sER4JJHC
- TLSH
  T1E955E87241D4563B416342FDD2092B7AF2EB406DE3120BE4FDFE870B479AD906A272D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  clink_arm64.exe
- Size 16KB
- SHA256 afed561d1090e8fe4bf5e360b29636a8dff83116751d11e7bac4c28b326ca388
- MD5 8608aef3280315beeb71ff3b9fb6a0a6
- SHA1 60146359b2796fd18b2fa5b541a5ff73ce790f08
- SHA512 6187198031425626293f287f371249eebe7f901ff25b158289ab2d419e0c521f4518868489aa23b431cccc3be247fe22dbc515d0c00370acc48e9f148b940c83
- SSDEEP 384:omtbwYod5ge2mNDkJSdWXSofousWu4qBSO:Je5bhe4ySoQuSBBL
- TLSH
  T188726C698F2844D6FA5BCF7158ED816BAE31AB910C85880BA00905DA3F437B17F3437D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  clink_dll_arm64.dll
- Size 2.7MB
- SHA256 afa9cfdc610af580c2ca95b31f100a09af1817597ef57a7d3020055d7ad00fad
- MD5 41611df68f1f25709c25d61365262a00
- SHA1 3b0cf8efcbf53fdf9b7f44c0ad96b7c2604ea18e
- SHA512 f4016309b7f546b794d659c28558c3536189e7989a5dd221437c7cf4eb59541d530c9b3ac1e4b855687c140c87617c9acc381018b8cd45f25758c39ef83e977a
- SSDEEP 24576:NZHtCrtgZGQa7q5zmGS9PP7Lub6mu5ZHzdEajXOlboH1Vy0sUf2G+DByYKAGHFSM:NZNsthQa7wzEuEqubgG+FyJSU9
- TLSH
  T139D58E91FE5C9A02D3C7D1FCCD930F903126E6698925D98B9216410CEC97FD0AABA7F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clink_dll_x64.dll
- Size 2.8MB
- SHA256 e693ec47cbb8141ed062e123533bfb209221ecae0112a38483861c3823e8a0ed
- MD5 6db096e0d5baad00464f47f64bf69f33
- SHA1 498290d99a558f9c20100c820985ddbcfac130b3
- SHA512 4d390a680e1e67b80e006e6b995eced8572497cfbd76dd0ae52ec6319165e384a3e00df6c0b5a1964723cff820733377a3c0de9afcf04bfc648250e914a2b2bd
- SSDEEP 49152:vE+Hra+idUWqfRL4mBMCIyumx6znz4ydG+F1GiLv:7H++uU780hxVwG+Tv
- TLSH
  T1FED59E56F2B906ABC06B8034C9571653E7B1B4994724E7DB13D0927A2F23BF52A7F380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  clink_dll_x86.dll
- Size 2.2MB
- SHA256 3b2118c9f0ef8d481cc91cea2da9ad5694639ec5d0d9b780c99f1c4536b540da
- MD5 4ce86812d2764932d1cf5949114b817e
- SHA1 4cf1b88a2648906abd1a60805afa21549525e47e
- SHA512 153b6bd0208be5f23feee2531342914d5d25a15105ffdea6e12f7bbf7c8945d0cb607e671ea8cfa0126fd8aac0d5ef0b14b7e68af22ba7a82e2eb7fcecc7317d
- SSDEEP 49152:xV6i1ldsKVJq82X1/IOLjiBW+fjeD8EIQLMI:XdsKVE5DLjcW+fgIE
- TLSH
  T13DB5AF43F9D646F3C54B017480BFAB621A38C6A54725DAD7E3802CB958613E17BBF28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  clink_x64.exe
- Size 16KB
- SHA256 f6800952c492c091d072bd95c0c05dcd4fa95f51129c1175167fd3db93951d8f
- MD5 9350daf2d38f9070b200161ead9fb8cb
- SHA1 9abfea34d93ebc003bbcec808a831a93f846e2a2
- SHA512 ae5ef68edb74ae45d45f108df61d7f355356a30ca0e65007fcb15ca4fffadf6f7a652fe39ac4f9c485482ca382b61bbc69b5ee014115dc3003168b6a21b67be1
- SSDEEP 384:77tcwYFd5ge2mNDiNQMdWXSofousWu4qepS66:a35bhUN1ySoQuSBepf6
- TLSH
  T138726B59DF2454E5FA5B9F7054ED817BADB1BBE10C44890BA00844A92F433B62F3432A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  clink_x86.exe
- Size 16KB
- SHA256 c1393c2154b7162173f745cc4ab9566585d715c9d40072990a3c1c8217afa237
- MD5 2ee4f46599b2a83812f73fd2382091ed
- SHA1 84b11b903e0768edae15142a0f4acb9939785812
- SHA512 a6cd1117df14ce6ee2eb92007b2fa193779a2ad747d779d309a884ff46e9445beb43fae57a8740c53489706a2f596b0c9734c23c62626793dec55b84b0fff788
- SSDEEP 384:QnXBKFS4wYOMd5ge2mNDfTTdWXSofousWu4qPSnN:SU95bh5TTySoQuSBPWN
- TLSH
  T152726C955E6848E6FA579F7058EDC57BAE75B3920C84890BA04904DA3F433A63F3433E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  themes/4-bit Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 20b0f61ffe34e3ba8b6422e2a6be8bbe5a58913cb5df12e62b2f0af029216e51
- MD5 ab5d1adddfdee014978f7f2b33f47e9a
- SHA1 bf721dffd4f8bb27ad060e1f39b39d88564bd9c2
- SHA512 54bf42d1422218eef8b7ce909f619e0a5ced18110a3676f0fa4989de7526d52b39bed1ef5ab87956daab803a31ea4a9cc0f49a4b46d87ce26e15449f30310240
- TLSH
  T1FA31DE2CF4C4A8F32AFF0F1FAC28D849506A2D052B32B76971CD81F09355B1650B6B76
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  themes/Antares.clinkprompt
- Size 23KB
- SHA256 aa857b55deab2a7e704d168c6d0c3f97047c2b17cdf216227b69dd783b4113d3
- MD5 54b6f92db08dbf8c2d1e205e534d0a02
- SHA1 1fb6cba9c935fe7cc80c56e8e46f6cfd88342926
- SHA512 44341e6302a07e7ee6968ebd1c6a03e1456ac7a3c85c2d535b71f1dd875565b0e823f1525decfa5c2cfb7bd73a5856a9fc79838b31f78ac63248d900ba86c3ac
- SSDEEP 384:KLZCPFlDD5q1ViEBnSfeKFK9bobC5czBDoTU38mmtY9Qx/2AZRjQYgcK:KEFlD01AE1XkEmmtY9QpZRjQYgR
- TLSH
  T1C4B2CB0E6E024E6894BEC51344AA65F2DA4A3557632D0194B6BC40793FB0C189BFDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  themes/Dracula.clinktheme
- Size 1KB
- SHA256 8400084650e409302f84629815b7cb0c13e15b81a55fc856a72346fd32a3527b
- MD5 c7617b1643a9189337d407f773e196e9
- SHA1 5819f29fee357b3d71ccb94395e4ac947f146cf5
- SHA512 d5a9532c7ae7fb7a2e0e1d578e3824dca448a065f16a5a42a6828241db71882ab7be19ab87aca0413e482ccd6e57ec04add76be4a0f27dca97101c0ddfc389ca
- TLSH
  T15B31452CC4DD62EB367F0C9F6669D089C961A13421227B3872FD1A78B740B5282471BD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  themes/Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 2c3105e81a4e887a8f00008628a11102f17d3a684189a71aab381614c938ef4b
- MD5 1f7a47e668aa719dec19e32ec0dd4a09
- SHA1 b7e0c56cb99570d095b6fac585592bd91a6cc540
- SHA512 b57cb82d2bb0a3bf9a11ba7d5f0c2fd2b5f72ce6f564c6e72a8fa477cba9f2f5e3d6304aed02b6d1671a70ff4ee3b04ddc1d3f06e135a104e978d397d70cfcba
- TLSH
  T13E31661CD0CAB4F7A1FF0E3E2D19C8489A6B2A292722372875DD71B4534130941BFB75
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  themes/Headline.clinkprompt
- Size 23KB
- SHA256 351581f87fd4e552644026f5ba36f593f09e29a28a9e0d77e303e307584453bd
- MD5 c6eaeefd5e748bd7e822baca66fd9419
- SHA1 d1cadabf472bb6715bef77a4a01a8f0953c57051
- SHA512 4d10b7ccb7faa946d445ce2c8fe8bc26ff864d270d1e708f99f71869dcf7e5d5e5bedf7f11211924dec6fffbd554d41dc6fae219eac5a245c77ec1704f082ddb
- SSDEEP 384:yI/VxfyFCENWJM52UId+3i7kg9wkJ+H+J73aGApwspO51jvG1E:yaFENEGId+H+J73Qw3G1E
- TLSH
  T15EB25F065D06927028B8C6BDB89B1D61FE3550932219C037B4EC41897FB0AEFA6FD3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  themes/Plain.clinktheme
- Size 1KB
- SHA256 6e63901094a309b2e3079d98950d0c488aba00b9694da76bfa3b0768b574425d
- MD5 f91651de99673500b7f49f6f516b244b
- SHA1 8d5349fd5215730e693e25537d4fbdd758685d56
- SHA512 4248b41deb294f1b20d9c8e9540bfab4ece1d880b23294aa485759caff651248b5d727d2040dc91447d41820d4c2a5f8ef64e085adb363108e9b9c0853b3cf96
- TLSH
  T16411E42DD4C491D76ABF4E5FB829C588A02AED25BBB2EB1472D40930A044FA34086736
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  themes/Solarized Dark.clinktheme
- Size 2KB
- SHA256 3ca3ad89fbf8507fc60c025d81239e51c9c244bfdd9bde272ebee904b0ad1d81
- MD5 4271dc349cd8046bafc94082b179d0d4
- SHA1 2e27125e8da3a1d6fbb574e6f58e13a6ee08f25c
- SHA512 1ce30cc32a3fcbee80020e519e59a195064f04d580f63d577fc1b92943d4400be296c6b53879c75d8a5094f4175cde55da30398b47c4d1fc4c9cbb85a70911e2
- TLSH
  T15351DE2CDCC995D726BADAAF2964C9A7D13DE20B34626F5C3AED8C743341B40A24F431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  themes/Solarized Light.clinktheme
- Size 2KB
- SHA256 374bcdcf8de002f843ed7e7f84058fae29a0476cd3e0315c306b229040dc281c
- MD5 0f54e3f5021015fc5d833ad00ee8ecf1
- SHA1 385bc4598a57fa42b4b3c7561f1e209bf462e6eb
- SHA512 f344593f64230fbfea5382a297a3230bb19e4f8a26943e1a36d217e00d3bfa7962a280fb2d73a4dd6623b473e81b0f4da9063a96f62f517efcaec4982028d0bc
- TLSH
  T12651C12CDCC954D726BADAAF2964D8D7C16DE30B39226B5C3ADD88743341741D24E431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32