c3c59fd1fb5e32307950b2a7dc7d935b0ba10812386d15b24aa748baf4f41bf0

Sharing

Copy URL Twitter E-mail

General

Target
String Aob.rar
Size 519KB
Sample260727-brgalafp3s
SHA256 c3c59fd1fb5e32307950b2a7dc7d935b0ba10812386d15b24aa748baf4f41bf0
MD5 d03fe114897e120b5203a163168dcd3b
SHA1 e394a2b069ab5eb831943e8b2600bb11a52fd4b7
SHA512 6c84878685998d59a86a8d8797494d903f4ba1957e819b74b1ff82acf9d105cc0a77b2bba16c78ae0f6dc0dcacd805263265bb1e27528f9fb343bad12482efac
SSDEEP 12288:ZoRRC4A/KgHS11z6CFY4rqAkHeWCFLpnM/2/2oHKdq+Y4:ZIwzb4B6m76eWmLFM++owLY4
TLSH
T1D8B412607A8294A7C8E08D549CC372C57E62462CBB71A6F2CF4016CA606FD4778B5FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  String Aob/String Aob/AiAssistantForm.cs
- Size 101KB
- SHA256 d19a477841b4942230ef36abadd66ee408b174491eb10afe14b406dc6b9af5d9
- MD5 9a855c130b8b6162954b21a32c1563f4
- SHA1 87cc5783800613c65716b17b4ff629fa0716d072
- SHA512 e3b727407b7bd0e6996064cae0487ad10b998907acf7107c71a7c8082668969ef3fa1dd6a12627ac15316929c2d8af78adee35526a67df3cd394b0c48eb66eff
- SSDEEP 768:eDZWFoVD0DmrBDAWpuEpb1ccmJlckX4YKjmaux14TAMJ+surNrZUR38bOp632vDH:y78mrjFfJ2K3rNZeurxskYUx0ksVszee
- TLSH
  T1A2A3C84639BFE8544563A07EAF9640193AB5D24F0E54EC12FFFE80504F088AD49FE7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  String Aob/String Aob/AiAssistantForm.resx
- Size 5KB
- SHA256 a122f3e718c7a26b3b21f292ae61305dc66838bb76b93ed6a7669b2ab4ca3432
- MD5 9936438733ca4249fb051cb31fb47a06
- SHA1 db6dfd0c2a0115144e7e78f3e47a1fd1a53cb89c
- SHA512 87ec55a918d7d118e66f3cb7097425a8041019898bcc2dc373993e3341c6274995d8fba2494730b973bd6d6dc3072591cb3dc3cae5d00237fdbc2f8cbec6cd81
- SSDEEP 96:bmjpOiK5k5LPXbac9m5Lv6FzSJdYai3K9UT2y0+SdCbvDBwbjBu3FqvuFZ:qjpZLPD9sLvIzSJ+abUvhFZ
- TLSH
  T1D2C10245B1C5DD160BB34C2DE6523988FBA8913F02346C50B4DC961F5F73985A6B33BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  String Aob/String Aob/Form1.cs
- Size 48KB
- SHA256 a9ab4ffec72518d1e021c847ef2a7766c2dabcd96f8ea3439f3801c652236f07
- MD5 dfd22cd6ca758ab64e778b5f2bf10a7c
- SHA1 d5cdbd89eb71d55286e969b23b4da056f89ed697
- SHA512 b7bcf89c0a7c49ef920986088666d966fe37791b00e57ad4beced4e135cfda029950076a73453c1bcac1d85f8cf31002c42b9dd5a253d10bbf1aedb2c6a02b32
- SSDEEP 384:el0aGeJzXSSFj20Smo6r6zcFJ1U2Bxjcyn7kIRU67YYezSjZlyY0Hav8fL9IegBU:el/LJ4C7kqU6qKJhEHvm6d
- TLSH
  T1C823A308A2EB081882636C3D9FFB0C66BF51600BC69DDC65FE5E42D09F74468CD767A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  String Aob/String Aob/Form1.resx
- Size 5KB
- SHA256 6bf7f2e1f7f02aaa0f3d839e786bcfbf4c42caee266bc4068433abdbd6cda6c5
- MD5 ba2251f63195de3c51fc55a0a8acb73d
- SHA1 a14ca4012ad112bef765e76394c971ea7fa7b244
- SHA512 3ce2118e215172c5045e7d7a223d6beb202deb86f39442576496375ceb2ad2c625946941b2025606014ff902d674b7e88fa5a586291f5e31b0ca515f25c9c651
- SSDEEP 96:bmjpOiK5k5LPXbac9m5Lv6FzSJdYai3K9UT2y0+SdCbvDBwbjBu3FqvuFzSbawM6:qjpZLPD9sLvIzSJ+abUvhFmbawn
- TLSH
  T118C11145B1C1DD160BB3482DD6523988F7A8913F02346C94B4DC661F5F73885A3B33BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  String Aob/String Aob/GeometricParticleSystem.cs
- Size 12KB
- SHA256 e8c1c2831c610726d778d76ded657e48dc34244347ad612215022a85c9c1d8c9
- MD5 fa24ce67fcc9521bf771401c7c594bc7
- SHA1 9043ed233c1c6c32ea0f83bedd030fe5de006a5c
- SHA512 f8b595c256579ba09768806a00d5de852c3fc034fc01402ce5ef4094a508a598f0aac8d6e3b4df8fb5990059a2c780a5f5557d83188203316877b892e4cc2088
- SSDEEP 192:t2rSXcz6JvNyU3G1yBSoQWSngOjXdigCSEKaVsrik+m4+yiSOBxXqwcBVtSxEL:t2raB0y0gngCE7rik+m4yXqwC
- TLSH
  T1AA42630B02D76914B653B43DAF9B4A292F66D00B068DFC357E1C6121DF410589BBAFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  String Aob/String Aob/MemoryViewerForm.cs
- Size 81KB
- SHA256 5bad8db34956130bba7f1bfcd6f68b7de998e0b6dd90905c17afd9dba51324a7
- MD5 e21e834c0d28e3777aed7503134f2c68
- SHA1 7f1337c8d515e9624085f589157adf4a9a9835dc
- SHA512 12f87933ae399bf2a636d8c627eb35b85541c817ad5ffe0fa26ec421ce1dd19c73cc61a0a85e7b9bf11ac081fb709ee12d0fa32a4425bfc40fb3b121c0839ac5
- SSDEEP 768:R1MzzgK8QYyRS5jbnSU2favl7kdnlnJJhEHsS626E:H2B7YyRSY+lAln/z66E
- TLSH
  T1EC83C40961AB0114C223AC3E8FF74D62BF61A00BE6ACDC65BE5E49D45FB442CCDB5768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  String Aob/String Aob/bin/Debug/net10.0-windows/String Aob.dll
- Size 231KB
- SHA256 95b057b69b8e51b07330e065cafee3de723a3ce2543f8fc224032ce221214e58
- MD5 d8f22eafad2850d401ccc5f39d0b5221
- SHA1 fa31db35c0e6b9aeb0f33f7e3a5df13cc3c1f7d9
- SHA512 07ac5f89c6e8f8bf1f0d41eaae6a4ce814f2aca1793691407621510dfcdd450b37d60d799e81973d31950b6449926631779a5e5460cee77d8b0c73c48fdfd6c5
- SSDEEP 3072:CqNdkrAVEGUUYEvgK+P5HV19WV8c8A4vFdid7A47TG22W/+ODFR1gfPNME/w7GCm:CqRVEXrNKE1fHHt2/FDf18ME/Vny
- TLSH
  T11B34B35037FD5A16F2FF2BBE48B151000BBA78575931D30E869568ED1E72BC0C91AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  String Aob/String Aob/bin/Debug/net10.0-windows/String Aob.exe
- Size 158KB
- SHA256 995c0a36f7a1339ea109b4923dc5d69f92774a650ab7e7b96f0446cc3f93e2d2
- MD5 c1370fc98fbf237830d2a8569883cf8a
- SHA1 943130a8273c595b7ced74da3485dfab044b47bb
- SHA512 489a480a8f61a07338ae86454537f789d8f4efe145b378d68c7f626ff29742e249c6435d4eb3e2fe23ff48f4a4402e126fa291b3eb8c9d94d13118819e7dfb06
- SSDEEP 3072:+VDxk88wN1xL+x7dL1Z9QnlP97E3swm9uzaAT56+:CRax7F1nQnhcUJ5
- TLSH
  T172F33C13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral8
- Target
  String Aob/String Aob/bin/Release/net10.0-windows/String Aob.dll
- Size 22KB
- SHA256 fbf3d2a6d515e8435a7148878f76f7f2d02ea64bf8ef9aa98d6b405ead0c6e84
- MD5 a0bd9651338baf0880cf789a821270d6
- SHA1 adf0bbc27e8bf87c3f4b1e3fafe6c88d5c81b3a7
- SHA512 80d06858edca55e4d5fa46d40e256605c07ba5854ac0b528d4375afed6e14bb4bbd0ce1659821dc48c11138b0152e357b755332805dcc656949c3a7262eb2ef9
- SSDEEP 384:jprj9C2WsP/3jXN2Imny2pWBA/DMSYUqtYHS1Wy+07WIV68HbDAZhV1byWWjAAff:jprE43jXnk8ZYHoWyFN/em92e
- TLSH
  T142A21B2277B85E2BD1F90BF159F2824107F9A4191533EBDDACDE11DD06EAB200263B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  String Aob/String Aob/obj/Debug/net10.0-windows/String Aob.dll
- Size 231KB
- SHA256 95b057b69b8e51b07330e065cafee3de723a3ce2543f8fc224032ce221214e58
- MD5 d8f22eafad2850d401ccc5f39d0b5221
- SHA1 fa31db35c0e6b9aeb0f33f7e3a5df13cc3c1f7d9
- SHA512 07ac5f89c6e8f8bf1f0d41eaae6a4ce814f2aca1793691407621510dfcdd450b37d60d799e81973d31950b6449926631779a5e5460cee77d8b0c73c48fdfd6c5
- SSDEEP 3072:CqNdkrAVEGUUYEvgK+P5HV19WV8c8A4vFdid7A47TG22W/+ODFR1gfPNME/w7GCm:CqRVEXrNKE1fHHt2/FDf18ME/Vny
- TLSH
  T11B34B35037FD5A16F2FF2BBE48B151000BBA78575931D30E869568ED1E72BC0C91AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  String Aob/String Aob/obj/Debug/net10.0-windows/apphost.exe
- Size 158KB
- SHA256 995c0a36f7a1339ea109b4923dc5d69f92774a650ab7e7b96f0446cc3f93e2d2
- MD5 c1370fc98fbf237830d2a8569883cf8a
- SHA1 943130a8273c595b7ced74da3485dfab044b47bb
- SHA512 489a480a8f61a07338ae86454537f789d8f4efe145b378d68c7f626ff29742e249c6435d4eb3e2fe23ff48f4a4402e126fa291b3eb8c9d94d13118819e7dfb06
- SSDEEP 3072:+VDxk88wN1xL+x7dL1Z9QnlP97E3swm9uzaAT56+:CRax7F1nQnhcUJ5
- TLSH
  T172F33C13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  String Aob/String Aob/obj/Debug/net10.0-windows/ref/String Aob.dll
- Size 13KB
- SHA256 44bd03999473d70032f866aec7153712ef2f53ae34db99fadb4f71811a07fc8d
- MD5 479b23e21c381fff6c6469809752757a
- SHA1 1c9bf3c8dd10804a26da53fdc022feef9d358570
- SHA512 a687bc36b32157fc47d4227ea32873064ee0c7d69dc387193a6ba5137742ca4bb55986f066f45134b61c84d54801943d90a485328860692c87ebeb9d33d2e886
- SSDEEP 192:wqgGNO4+3XPO4+Iip/s/A8u+mY4vDHVMJ5Dir8ykiiK59:wrGNO4mXPO4Q4A8uRHDHVkmr8hiiK5
- TLSH
  T1F952A53397B4573FD9A20A7EBAB743E007B7E2256C06DB0BEC6DA1064C122551EA3365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  String Aob/String Aob/obj/Debug/net10.0-windows/refint/String Aob.dll
- Size 13KB
- SHA256 44bd03999473d70032f866aec7153712ef2f53ae34db99fadb4f71811a07fc8d
- MD5 479b23e21c381fff6c6469809752757a
- SHA1 1c9bf3c8dd10804a26da53fdc022feef9d358570
- SHA512 a687bc36b32157fc47d4227ea32873064ee0c7d69dc387193a6ba5137742ca4bb55986f066f45134b61c84d54801943d90a485328860692c87ebeb9d33d2e886
- SSDEEP 192:wqgGNO4+3XPO4+Iip/s/A8u+mY4vDHVMJ5Dir8ykiiK59:wrGNO4mXPO4Q4A8uRHDHVkmr8hiiK5
- TLSH
  T1F952A53397B4573FD9A20A7EBAB743E007B7E2256C06DB0BEC6DA1064C122551EA3365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  String Aob/String Aob/obj/Release/net10.0-windows/String Aob.dll
- Size 22KB
- SHA256 fbf3d2a6d515e8435a7148878f76f7f2d02ea64bf8ef9aa98d6b405ead0c6e84
- MD5 a0bd9651338baf0880cf789a821270d6
- SHA1 adf0bbc27e8bf87c3f4b1e3fafe6c88d5c81b3a7
- SHA512 80d06858edca55e4d5fa46d40e256605c07ba5854ac0b528d4375afed6e14bb4bbd0ce1659821dc48c11138b0152e357b755332805dcc656949c3a7262eb2ef9
- SSDEEP 384:jprj9C2WsP/3jXN2Imny2pWBA/DMSYUqtYHS1Wy+07WIV68HbDAZhV1byWWjAAff:jprE43jXnk8ZYHoWyFN/em92e
- TLSH
  T142A21B2277B85E2BD1F90BF159F2824107F9A4191533EBDDACDE11DD06EAB200263B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  String Aob/String Aob/obj/Release/net10.0-windows/ref/String Aob.dll
- Size 6KB
- SHA256 b97312ffc1762d0fccd82aded67643a5b81a67121a85cf1c4f91a3899ff50c0f
- MD5 c89f6f0263ce1dd22f8b57c3f3a645de
- SHA1 e48d7aedfde0f5bc808a23e5623ffc8e21f6261c
- SHA512 9f0e9c69f681b1904daa08715f9536f220a669c074e83d270ef6ca4714c7dc4968e26309bb6714db800fb12c3854476af0fcd33825479ac3b7a07c1d9341d870
- SSDEEP 48:6rBphJKUhixkbavbXGEGj2lOfM1RKDfKdq3zbfRK8HjPThnJbPA9hlXQ6q3LqpfG:6TnavT3kCBPdqDbfY8NJ4lQ67zNt
- TLSH
  T191D1B431E3A0063BEEB20B35FC9357802375EA605D6B9B7E6C89A2172D352090A23775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  String Aob/String Aob/obj/Release/net10.0-windows/refint/String Aob.dll
- Size 6KB
- SHA256 b97312ffc1762d0fccd82aded67643a5b81a67121a85cf1c4f91a3899ff50c0f
- MD5 c89f6f0263ce1dd22f8b57c3f3a645de
- SHA1 e48d7aedfde0f5bc808a23e5623ffc8e21f6261c
- SHA512 9f0e9c69f681b1904daa08715f9536f220a669c074e83d270ef6ca4714c7dc4968e26309bb6714db800fb12c3854476af0fcd33825479ac3b7a07c1d9341d870
- SSDEEP 48:6rBphJKUhixkbavbXGEGj2lOfM1RKDfKdq3zbfRK8HjPThnJbPA9hlXQ6q3LqpfG:6TnavT3kCBPdqDbfY8NJ4lQ67zNt
- TLSH
  T191D1B431E3A0063BEEB20B35FC9357802375EA605D6B9B7E6C89A2172D352090A23775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16