e5e8b7fa731581425239374df1c2bb0755adfcfb1e67dd34e2dd359ff69fd54a

Sharing

Copy URL Twitter E-mail

General

Target
MyGift.rar
Size 21.8MB
Sample260722-thz1fsvvht
SHA256 e5e8b7fa731581425239374df1c2bb0755adfcfb1e67dd34e2dd359ff69fd54a
MD5 9f2ccae3753d5eb15eb70ae8b2889044
SHA1 decbc2bdf3e3d88f4be01657f2eff448637513b3
SHA512 d4db0d526b0199935348c904b345c6053da032ecc32ee1b51fa81db7b04437f0b72ef094cf4add2b58f0b86cbce9ece1df69574b4fc90d256450e34d15ce7e79
SSDEEP 393216:OD9K09V/xhGnuWnMlq4SVumO0N0oFkOkQfSZuWnMlqk3Ofm4IaLhFkOf:OD953quAh6OkQfoukgTOf
TLSH
T16C37336CCD097ACDC1FABF0EB717DF035251856CB8ADFE2C117A67AA802155827E1722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  Auth5517-5730/obj/x86/Debug/AccServer.exe
- Size 76KB
- SHA256 fd3b77173a753a9f06a4fc3dd20c9f26550d6027b4f6538be4c18e7954354a2d
- MD5 7325b411424942963d11cd0475f8cfa3
- SHA1 774d6d4ba92e55d4f9f7130f061f15920b871d1c
- SHA512 d262085f2940b24efd4869c914a973e1fe5539e647f88cafadc040bb9239da7fd0b400ee6c1ea6af8a6de274e3c193647d276dbbfe71af1be3c2310957c6cefb
- SSDEEP 1536:o0GB8hvE5+IovlE0SNcpgSWU0pyQYctAVhSM:oLBHhpyQYCAVhSM
- TLSH
  T134733A48ABE85F23C9AD03FDE0718211837AE2155673E36E4FE870B22673361995179F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Auth5517-5730/packages/BouncyCastle.1.8.3.1/lib/BouncyCastle.Crypto.dll
- Size 2.3MB
- SHA256 4a291236c5017bfdfb30fad4c3db4d0614c362c4b53409c610b12d483d7b26e6
- MD5 adde6711b8d4f52d6199a2736bf33cc9
- SHA1 2270db04c9e329b9b2654cb081fbe8db766968e3
- SHA512 52dbc04e56bea9ce78033df1cd6e036a1fdfe20336d7ec6cff4f3f25b6139612795caa8a7cd46145508c7c97ff8048b1da1b46f7610138af83e13e464d019c34
- SSDEEP 49152:xZHQnpArNOBL8DIUTRUuyaJlGMt1hkOVsoukUb3:3rNOBwk6RU8l
- TLSH
  T17BB55A0C6BF44723D6AED7B296F01511A3F0E42EB753FB4B6582A2B90C577609C4236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Auth5517-5730/packages/Google.Protobuf.3.6.1/lib/net45/Google.Protobuf.dll
- Size 291KB
- SHA256 b6608721afec65fc5f6d130be15f7c38dc376899fbded42896c77911a89e8d13
- MD5 b24ebdecd6839e66c79da958e371765f
- SHA1 a1a9bccc6e181d401649271b7f36bc05dedb7f32
- SHA512 3b3ef40d25026da0076742e30cc2fe61e28f3be4c5861f78de0ed082f2c60749d05f5023c9f7c3fdcb98e4444f21055825fffca20e1df5cdd3c7b0a3b39238a6
- SSDEEP 6144:exss6URXybyQW3QrjBHJ6JqVG7zbqqPy:ibMyVOTNw7
- TLSH
  T11B543A141BFC362CF6EBDA79A8E8281587E9B507355AD76FD96231E20D13380CCA1277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Auth5517-5730/packages/Google.Protobuf.3.6.1/lib/netstandard1.0/Google.Protobuf.dll
- Size 292KB
- SHA256 923be9abdb271ed7766fca4c520954166ef56cdf347219f175d1b70663155563
- MD5 f35a413a99752bbb81943be081c610fb
- SHA1 9aa62c88be4777d55698d2a9ce768354150309bd
- SHA512 6c417dd606bdc66316c1b9bd9207b1655bd5879e6c27949229a3b1f3e077936732438ee23767df26127fe0908117ec899c7437553dc4f120da27658256deef29
- SSDEEP 6144:3kxBgsrAFWy/Wy6+wzsCGZ8sLZoV7kYJcXvvRYlyo:y0FWdytwudekM4
- TLSH
  T1DD543B5626FC762CF6EFDA75A8E418148AE5F56B751ADB6FD90035E20C03B88CD4023B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Auth5517-5730/packages/MySql.Data.8.0.17/lib/net452/MySql.Data.dll
- Size 748KB
- SHA256 4a624eb8effc554efa632258541cb0467472fb7697f9d91aeda6acb69c0a45e9
- MD5 16a532d26f7be4f398cb8acfe97d8949
- SHA1 f90ed7dd5da4f629eaecfdd36c7b498754f6646b
- SHA512 2646319aa7f44ff7364efb20c659584fb5b65c67e527135e606001501d2306c23a13f3f3a4aa14a71d0713dd8184830a4f9ce36dab9e983b9e1730d448c524f7
- SSDEEP 12288:LBDvVCEUhK9vQUjpG9hja8Tr4+Ga/TO7MAxWRaw8Pqoc:LBjV5vQUjpG9hjacEMO7MANf
- TLSH
  T194F45C607BFC621EE2AF2779A4B4401E87F0F9572192EB1F5900E49E1C92B92CC517B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Auth5517-5730/packages/MySql.Data.8.0.17/lib/netstandard1.6/MySql.Data.dll
- Size 697KB
- SHA256 01c73bb663aedcf8d16715e3c1e55569e5958a90c0e22df465b138d6ada94156
- MD5 a0aca8c5d3fc6562b7e684cc95cecda7
- SHA1 589dd102ce2d5687d9f1746a91611e8de6d20e07
- SHA512 e1c5ddf79b7a5fb82644a9a38468fdf8fd5da901551ceb68fe3cfc797f8f31403cecfa7a74b0ace8f2316b121d2b5c95f854ed60ba61d0367f5931a934ea7038
- SSDEEP 12288:i5UIr/jjnMLf83IOBt/xHOmUN4A5cgyt9wjsTef0:KDYOBtdgdcgyLTec
- TLSH
  T1F8E44A1067F8DB2AE2EF6734A1A444089BF0F5966199DB2F5840B5EE2D93B41CD423F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Auth5517-5730/packages/MySql.Data.8.0.17/lib/netstandard2.0/MySql.Data.dll
- Size 741KB
- SHA256 c364f50ba8d20c1f1c35ffc01100f0db86032b9529d4f987e299967aa0d47698
- MD5 92eadf89574fd83269065701c4e3bdac
- SHA1 9648b4c421ef6644c9dc8748fca67206f471fd56
- SHA512 d86b9781cdd9c66e58ec3ab1238a0a21572b343aa68ebaae9c815de284b2e9c41e77c32e4095e4b059c932bfb0452dce1ab745330502dc19c7ebf7d256728526
- SSDEEP 12288:LFRDxvmmPpU2gwg/vWMJgSF2r5GMJgrtqnmtzzjt6OgfkqtaljnZzzyptzggMgoq:LFR3U2gwg/vWMJgSF2r5GMJgrtqnmtzb
- TLSH
  T165F45B2237FC162AE1FF5737E074505986F5F95B3186E76FA900A49A2CA2B80CD017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/net35/Renci.SshNet.dll
- Size 413KB
- SHA256 d3a1c40c6f31d6b4facc153b5b1af46bc991aa7c3228c9af5e92e39c773a85d5
- MD5 2084cf446ef82e7c858e7866e737480f
- SHA1 f381cfd0c9577353294818dec83047abf6647c26
- SHA512 c80029b859305617b02fe006db5643eea8098e9b7821f01cd9e5ff7e1e512d8ea4c6d3824906c7bef577d8d3f25cb1c222abf453cf82a984d6a871e4ef768e33
- SSDEEP 6144:gMYhhsmFnrwsfKY/hgTLWFirEoBq6FNPTzsZZwQNPcc8Dns2UH/WEj8bqePD/+:gMGh/lFKY/2XrE4tWSi
- TLSH
  T16E947C0033ECD92AE19E87B4E0728430DBB4F544676EEBAA4E65A4BE2D53759CD01733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/net40/Renci.SshNet.dll
- Size 413KB
- SHA256 f6315ed146438f7702033681043f8fe9690ed39a2abc9a192246424944a3a27a
- MD5 2fd9f99d4994d428e8bf93e9eb02ded6
- SHA1 04fa05a8ad248cd5a151368454ae821e05fc9433
- SHA512 b5f551b9dc134a82f84b1b800e61854f8d79da44751b164b1836930fc9de1d1a4161e9b05ab69c46bb78fecf87e6708db4599864d6d4ab80a1b7226e2cedfc87
- SSDEEP 6144:fz/9FXMZ9XUe2CrVGTAlHkNfO0XTG6kjNNgpOgC7F42U2sZZUQNPcc8DnsxU+/c0:RNgUaVGTAgfbS5wOFWSi
- TLSH
  T13E947D0113DC695BD1DE8BB4EC308464D3F8E264E26EE77A1E5A98BD6D53B60C801B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/netstandard1.3/Renci.SshNet.dll
- Size 414KB
- SHA256 e1949727a43d24f2a722ea2db0d6bd9ac74c0dc4cb3b7d41d2f4436939fd321c
- MD5 5db999bf24f92451c39f47362d61b164
- SHA1 a248ed781127a3dbbec5ceaa246dd352fd90be25
- SHA512 88c5c513add9fbe842bfbd7f15a1b5baeb67125a16c48ffa172470aa1094659a05cdc5d4eeffa8833e95603d786b2f155417e9f7607b46bfaef905ed79186458
- SSDEEP 6144:14Nfvf3FT/Gnzlv2bVpIS3o5I6r8rxj1K4qDwkQQNPcc8Dns2UH/WxP/bqePD/+:GNfvPdm2bomo558fHWSi
- TLSH
  T117944C5813EC5D2FD19ED3B4E03084A2D7F0F589725DD7AE4EA5B8BB1DA2B18C508263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/sl4/Renci.SshNet.dll
- Size 401KB
- SHA256 1886da4e903ef8d85a200d704f0d774789768af1a2b2ab33d025e349ff171cbb
- MD5 54e3d923a4c5bc478cfd64c24e051aad
- SHA1 3a83523bcc2245324a09e69d248622b6830a8f3e
- SHA512 c2eca4d53269e2ef16282041c75ee84d621644f5096915253059cbbe4d1851429d705288833961a92602473a3a561078e2d544beb258423f4e69f4f0ef8eb364
- SSDEEP 6144:u0feNvc5YPLVEi7pbTed7EmCM4RBu9SVIiJhLZQNPcc8Dns/U4wWoS5bqePD/+:u0f4FeF5WSi
- TLSH
  T1EC944A0113EC853ED4DE8370E072C92DDBB1E488665AE7AF4E85D8F92D637759A01B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/sl5/Renci.SshNet.dll
- Size 401KB
- SHA256 fc39bd6f1a44c087a710a2ab7b57845ad2eeeed3b8772ec257b373bc9bf96dfa
- MD5 3f0bba062ed790f02c96fdf38bf8ad12
- SHA1 41c2f0509127301e7674298581adf7b0af95cda3
- SHA512 233121c44231d1dfae95265f79d5ceb0b6a334eb836ba7f6eb16717c3048c20f88eab5a7f46dac95d0a152854eebb30ac74aaf86689363f2183ceef3b5fb4f11
- SSDEEP 6144:h0feNvc5YPLVEi7pbTFJ7EmCM4RBe9SVIiJhLZQNPcc8Dns/U4wWYS0bqePD/+:h0f4FfB0WSi
- TLSH
  T1E2944A0113EC853ED4DE8370E072C92DDBB1E488665AE7AF4E85D8F92D637759A01B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/uap10/Renci.SshNet.dll
- Size 415KB
- SHA256 e27ccbaa387c392ec18c383ccc5aa596d7489f33dd4486c02624457baba1e686
- MD5 912460572e0a522294c4869988a2cfac
- SHA1 0b81ba52208437b8c4be93a25729a023a8569543
- SHA512 d691a92230d7d95807d271fb5af042d52eb946dea736d56819deb75b48ae0715aa4cd1fc387ec0d346c8c1d04185150357f0ea3a8ed0a266e68c0e6b0faed8c8
- SSDEEP 12288:cjcfVAu0uWMRTtvJLFHhoOmCS07Hq1EyYlNWSi:LAu0uW9glNW
- TLSH
  T143946C0423AC521FF1EE87B0D4708431D7B5F545B25EF7AE0E8798B92E23B658E1126B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/wp71/Renci.SshNet.dll
- Size 401KB
- SHA256 b08dab6873722ed02b56b06230a71cc970b3801b510a74e60ae173be6b6e81f5
- MD5 b11fb5a4272662660f2740bb0e8df228
- SHA1 a0d4b591a26d5f84cea687e224a38ccd76b0609d
- SHA512 617d0beb53dcaa68a83ce312e7b69f1736741d3d5ce51d452baf3e9a9b4e3ff89739b94401db7b1e36a2242ece30b773faf95172b3791d41df0243c0ecb2dfda
- SSDEEP 6144:wRtrQ3RpjOJjmheyyVHflklSnObrW3VuxShNHQNPcc8Dns/U4wWaNfC2bqePD/+:wRJ33XjnJrWSi
- TLSH
  T10F947D0123EC953EE0DE9774D0308C21DB72F948A65AE7991E49ACFB2D537A58A01F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Auth5517-5730/packages/SSH.NET.2016.1.0/lib/wp8/Renci.SshNet.dll
- Size 405KB
- SHA256 696f0207e5b91014e376c32e8713021b271f79ffea0f7e0ed1e7046805f3a317
- MD5 e64579f57cfec5219519233d38453dc3
- SHA1 8b208c988385e5c2ed5dc0be87d90a8956f30bf8
- SHA512 a5ff3752f409632433b5419a07fc7ed89155b7663fc27e6f0df12984312865c0998ceb60ff10a6fe2be9062b14e0991cc3aa3b04284bab2073023aaf884490f3
- SSDEEP 12288:gTPvZNOxHdzZPV7xHdzZPV7xHdzZPV7xHdzkSofY8YQdVx/WSi:qxiEL/W
- TLSH
  T123946C4CA3EC991BF1DE43B4D0318421D7F4E589669AE7EA5E8CBCBA2C06B52C501773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Auth6609/Extensions/Counter.cs
- Size 939B
- SHA256 9de7a55010d00d6fb9a0829678d5c73d37cfadab6e5c09ffebf51c0f32f0d45f
- MD5 990363136df6b054d97a0572bbf7e61e
- SHA1 512a8625e7eb263c4db9b11359e1763799b2ac58
- SHA512 ada8f927693f773a6657f873c08f1217094615bbd85ecd0a0c2494db686808fda888ecad6440c05c7897755213b85a0e7acadf9690e61e786eea0116dd1d7d12
- TLSH
  T1D611AF5D2203861B5B37AB66AB02F255FB6B523305C546107FDD5210DF37039A9B0E6A
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32