129d22ad48f0078fb46eac05e409e89ded0a01d1df5143813bd8058e27ed96bd

Sharing

Copy URL Twitter E-mail

General

Target
Blackhole (1).zip
Size 4.1MB
Sample260727-m48q6aae67
SHA256 129d22ad48f0078fb46eac05e409e89ded0a01d1df5143813bd8058e27ed96bd
MD5 dfb6452a306ec95bc090c39c19b4a7d8
SHA1 3c5e83bc2b322a2a2d54c5aaa8d3f3de3213b197
SHA512 ee5957305256eb39d298f33e693aa1e2a6b63b74b0f40dce1a04d620285f806370d846a9330b0e7489d930e5a5e7bb7b6048eb12ddc9618ac7b0b433bf3904dc
SSDEEP 98304:nmKhvh/OMvsRuCC7sVZLVm6zXf1EOJaJv6edIqfhoIPByl3BZ:3h/PURuC+HWNEOkJvVIWhfOBZ
TLSH
T1C01633FA97108016D9E2973DBA0CE969C2AC023D5E72345BAFA210451CF8DCD6F5BF85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Blackhole (1).zip
- Size 4.1MB
- SHA256 129d22ad48f0078fb46eac05e409e89ded0a01d1df5143813bd8058e27ed96bd
- MD5 dfb6452a306ec95bc090c39c19b4a7d8
- SHA1 3c5e83bc2b322a2a2d54c5aaa8d3f3de3213b197
- SHA512 ee5957305256eb39d298f33e693aa1e2a6b63b74b0f40dce1a04d620285f806370d846a9330b0e7489d930e5a5e7bb7b6048eb12ddc9618ac7b0b433bf3904dc
- SSDEEP 98304:nmKhvh/OMvsRuCC7sVZLVm6zXf1EOJaJv6edIqfhoIPByl3BZ:3h/PURuC+HWNEOkJvVIWhfOBZ
- TLSH
  T1C01633FA97108016D9E2973DBA0CE969C2AC023D5E72345BAFA210451CF8DCD6F5BF85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  IonCube License Fixer.exe
- Size 710KB
- SHA256 e7c1e13bf8d4f66a00a18939c42dcbfd5470d2a6f58c3790cb8f6bdbabd26808
- MD5 197e79d8058e35bcd467c21cc4d0387c
- SHA1 b865e70307dbd5737bbd8ce86e22b27b8c4563f5
- SHA512 30be64fecfacbae077f11737c0657228292f143045b89f346f79e33f76107d26bf27d57175c0567fd733a7d01b4e9a60f5168462899e8f6c027907542e6c9649
- SSDEEP 12288:vV8yz84oDqKLLW0R1MYlex+IXIzU+ThTFFWOrSgSyJpaF6RdvUda2ra:NvZl10RaYlYRVyhTyOsEoVra
- TLSH
  T142F422A23591EACAD12144BBDA4AC4F1133C1D6ACE1836BB71837F57B835293815CF76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral3 behavioral4
- Target
  bh/amounts/kcaptcha/fonts/palatino_linotype_bold.png
- Size 15KB
- SHA256 38b6a1d4a4bd1d0c056205119c5e24176913ac0d898371f53a0339952a319365
- MD5 fcb8e04936cadbdda3deca77373f5e17
- SHA1 6a12261623e0f128339a42c7c2bb65116d251e09
- SHA512 1c06233dfd5cdd3d2dd644b1fdd5b31a35c29d635a2f78f13805919d9049aed116e7f04efb75e80a150f206cd02c43527c5ac4baeffd96a4262713166dd75594
- SSDEEP 384:CLb0vH2p6MRNPrQGhSA75XUfrFALDq3BkafR:vvHL6NrwA7pUfrFEDGBvp
- TLSH
  T13462C0DFB552050CC1DE62BEEC89EEE84D74AD74CF942CB6152AD252190172A71A1BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  bh/amounts/kcaptcha/fonts/times_bold.png
- Size 13KB
- SHA256 d3d32ce1f418e3c3c3b1afe3b6acabadb36207bc12368f5e86420cf1a529ff8f
- MD5 f71f784bd780a515659b0017269c6b3a
- SHA1 ecb5997fa48a86d717bd6caec906619b1508807c
- SHA512 571f32d21782d572970c660321f5025e88071d0311abe7e1baf5d6d00303eacfcd5cea7270c922d1d5dc6c91cc4cb1f3f6b145469647d297b390f8ee57662ea2
- SSDEEP 192:4Q1AbQ07S/fbUAzKAMu/rPuQRdm3EoJVm5GDaIy39/ZaZA2towT6i0o+UXrzaTtp:LAs0S/rzxicdxhYaN3GhteY+UXrzUHVN
- TLSH
  T11752BF23EEED10D37F4EC552DE1821F4A4BF76670BC3BC54ACE2A98F1496A8D7800855
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  bh/amounts/templates/js/datepicker.js
- Size 37KB
- SHA256 ceaf5e778d18c70218f4d5ff0b120e195975bd188b5f01540ad4a3f276c6e84b
- MD5 3549320af6e8a5f6c9a0e695cac1d9f6
- SHA1 3bcc7137a3f9127522b1fd19910e78a345243422
- SHA512 d9d1c2fb57acea090f737e370d206f1509957d7e601769f29aaf62bff40a7d46d50cb45dd29a125c0aec606d396e63cc6c1e06f3c61bf3f3f7ee663a9366a279
- SSDEEP 768:7Uvbk7e/A3PoHtPaGe+q0VL4uXsBURIihSJzmsNVGS:7Uvbk7e/A3PoNPaGjHZ4KsBUDQxmsfR
- TLSH
  T18403B74F6020092E8ABF11A1487B27176D23446F5A429225FA9D91CD67BCC46A0BFFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  bh/amounts/templates/js/form.js
- Size 37KB
- SHA256 5a494d0f26784d1446a45e26fcaab4c6d174305f0ca1e2c5d37834ab967faf58
- MD5 a102031c82b4ebae8454f7f82a60bba4
- SHA1 2fac860e00414b54bf75a65f2db191ad9d0c924c
- SHA512 3f191f011ae55c60275afc87f0be68ac9ad9158d064ddfd7b5466b618e11193c49012b5695a1bc7a8974c072c9cb42771c6b30d97a6cc9c61f272db94d4ae078
- SSDEEP 768:qK+dRGcISiLRVWXrf/joIypzwAkAK1vyK3seXcOS4+/tCVM1zn+VwWlWSW9UYbwn:NiRGcISiLRVyrf/3yRkAKpRceMOcCVMu
- TLSH
  T1BA03B45A7D9B21B2591B74B98BAB9109773B91240209D0A07D1C73D02FB0D75A3FAFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  bh/amounts/templates/js/main.js
- Size 165KB
- SHA256 14458718574551bf80541c3027150de9f789195f02aeece9c2052f95224e758e
- MD5 ebdcceb540208b839cfd2fff7f10cb2d
- SHA1 8e6b15866a1cf1b390835eda2025ecbc9b9e782a
- SHA512 ddbdcf0f53b7d737337c34ab224e3da8c9499e5962b5e6f452ea281038b866cfd79da271941f399cfa698bfbc033e9802dbc13d1ad2cafdc4f705746614658b6
- SSDEEP 1536:sYRKUfAjtled3TmtaFyQHGvCXseeOgRc9izzr4yff8teLvHHEjam7W8X3yzSiLnj:FUbCGvCh0952o2skAiesDcmYD
- TLSH
  T1C2F3F8CDB3963523C2A77178547F520BB23698A6B5088868F078D9E47D78E48607BF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bh/amounts/templates/js/wysiwyg.js
- Size 11KB
- SHA256 f56284e80d81ae47a5afcbb8cf3c48dfc4f106f072c523e6dba8185597f3e694
- MD5 dd2a3dc8a83d6fd0bc2c940e994aebd7
- SHA1 3c74e70d68b1c24de0d1dbac1e82a1ef7fba7bdb
- SHA512 e155055a6444f0d25316b355300a125571f12a6a5612a5de0b6b0509b63dd651a44507c13d6632de569c2189fb3e26981ffd7814cbe855c8c9adc5d7fb7c1f56
- SSDEEP 192:I9mNSFEopUS6He7m6VulJG7CVqkOugVs42+rKQNaS:0wSFEopB2D4YOnVs42+rKQNaS
- TLSH
  T1D3322E6A5E8A2D36873792B6AE874644F6B5912FBD029048BCAC50D56FF083104FCF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  bh/amounts/words.dat
- Size 37KB
- SHA256 ab7de2dbd762e47473ba04bdb7246f28674271914158f27aaa80ef918c7cb6d5
- MD5 07d4bb7998066793acf86890403bd765
- SHA1 551a39c0cca0268aa6ecca167876d823d9519ee0
- SHA512 7752e32372266ebcd17175809929ae00f19f910bf75f97850d2e52d61dfc20b1377c08c93d153df749afc508fe8b0c2d01a3270a66e47005ac437df584d91425
- SSDEEP 768:YtzY+G3F9VqXICgvd4zK7G6q+gaEeQkedYLCUEEVP6q8u7mHi:Ye+G3F9VqCdi+BEejedYLEZHi
- TLSH
  T1300361F4A5D2D0EB9DEB6BC55025A152F1A880D29F67358C5ACF71ED300BC3C6B19A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  bh/arrangements/getJavaInfo.jar
- Size 587B
- SHA256 780b8d91d38ae11faea80d8d2ebfa6bb4bcb8c6057dac2ac827a5f3bb32c659e
- MD5 fad89bdfdce9322767944f0e1f15a009
- SHA1 bdc22515198b2a15482f3a6f0efe66c2baa00f3a
- SHA512 9e8367607343ae4fc04e9560a64648b7ccdeb013f4a702728f0b62f5d5647823995fc659e99ab8317f96bcc0e77643f50b9e6f46c1094df4b6570e0672d86354
- TLSH
  T128F0411129B25E50E40701F16BF28BD9F044AA95E756C1CF227830218A510A50F04BF7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bh/arrangements/spn.jar
- Size 23KB
- SHA256 dcb87472aebdd993bd0c2179c9b5ce930fb1836121bd7aaec5f0b167602fff2b
- MD5 483b40f21a9e97f0dc6c88a21fddc1ec
- SHA1 21d4ee5c2b2e7a1ecac80f8d89393957c0d3e7b7
- SHA512 6fe23e72e4a10cb361c2108f34693812226ab1184af731fc66ac688608c14154fdc066c7b99a1c9fa1a8787ed9d894e40f6e786562fb9d2daadb943d279a128d
- SSDEEP 384:GvfqcSTAR6QKj+v+uAge9iBK0zb2xxNylVKaQP9WYuWlmM97qoREDSxjs7vf9Vm:ufqcXAV4sa8xCY9pcC7qA9A7vf9Vm
- TLSH
  T155B2E02B5636DEE0C8274E7716E02A3721344591F09E8C2220B55EFA79879424FCD7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bh/arrangements/spn2.jar
- Size 19KB
- SHA256 e7f8017b58323ec338fcbbd3a000f10f490cfe1dc7465ab45dc20ef09a24e548
- MD5 415f2f76ed59c774ed16eb1e24d5d666
- SHA1 bdfb949375a6dc45433d4ca455e042249b63067d
- SHA512 d6cb1c465dbebc0452accff4e417f6cb4b7e0eb44a7a07658b28df6ed9086e06b3208709118cc112d92027374fa1eb35b8a854b5e61255d2f8f6911fcdd8ac94
- SSDEEP 384:AkOFu2ERAiFpVuzCEtjcpZ0MvJS9tCsYPUSJ3/DgCgzW1BZNVLa6q0alEDFN:AzFu9RACuzCEtApNvJvRMuL3z/32lmN
- TLSH
  T10C92F1BC8DA68534D5DE5A360011C3546CA4D06460D7F6175C9F3F596E23DCF1FA0AC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bh/arrangements/spn3.jar
- Size 16KB
- SHA256 c033fc6a7d1cdf070cc8559656bf657d62d5738fa43969c07880037307fd73c6
- MD5 ee4930874422c818267b44112ac8f29b
- SHA1 a703f98e883971f206262ac58825b180e103a7da
- SHA512 918f9482bb1b5de8992192464d637fca18cf579a03db7c5ee5e2b6e3184ea1658f7f2b41837f97d595823c98bfd02146254dcfece5f13dd1137c7d9979fbe8ab
- SSDEEP 384:yQnOn3qspzDntHnhBd9esMG96Zwi1IbZDww4Kx1RBNo29OM3+B:tOaspzhhdF96/4n46RBNonJ
- TLSH
  T1BC72D11CE69CD8A4EA15DA3013A10D79B5FD2255BC288F7217836EF24C037CF53601BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bh/autoupdate.php
- Size 3KB
- SHA256 89cedc710454d8ee78dd0ebca6ef99746d6ff269e2cab35b30836a2446bb8cdf
- MD5 dbebdf03cdccb1b982142815d152e9f4
- SHA1 7c87deba84091931df54dfa906938375fed32b7b
- SHA512 2fc2c45ac436a1851c7244c5dc074edb319fc0ff2e474aab81ab81f366e848e26b7e1c25e12b7c2ad0c1646abcb5fb63e5a3e2b78a258d1478102da97adb3683
- TLSH
  T146511045FB9C25E3C31076614A0DE40F6C6FB8B745818EA3FEC9D108A8D491EB8EDC98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  bh/hole2.sql.gz
- Size 683KB
- SHA256 46cebc46f7615d0f27fa423036e7110f20879da1c64728ac4c7901a15f8a7e8b
- MD5 83bd332ad508ca070e31d084bc289a4a
- SHA1 aade085ce8395beee8d2dea68ce6b6b5dbd25554
- SHA512 7e1b69024edea0b17da875f4857512c0c5f5ae01fd0ae566de6d5ff4817bafe68d1e473a2b14756521cb0805ae1773e798ae4c64f030bfd30feafcb02502ff57
- SSDEEP 12288:+gexN+laqstCiyX22NHLoD2PPvWsmfrye/x+Nj4AcYlhn1vm:+N/zqstQ22NkqPPvVeJ+NjwGn8
- TLSH
  T181E4F16B29371F71343C0BA3DA75CE7D196A9AC713272E38857464C84A28A2177D7F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery ransomware
behavioral29 behavioral30
- Target
  ioncube/USER-GUIDE.pdf
- Size 66KB
- SHA256 3bcedab3c1b5699aceecf83c853bb70f02f63ec1394e2b2f629d8ffb2464467a
- MD5 fce5349af012243f98a0ae7346170d25
- SHA1 c1579e1f1c615945f2df31a116f07ffc6e0af915
- SHA512 a2fab8d6a6dff8208a72998fbf205a853883ef9968f28d679486c66bf5319826380649303aefbb926026258eb65fe06c23bd129de67c600fee7c6ed5bd481193
- SSDEEP 1536:XmLTe8yj2OZ18Z/BaNJdSp8Xm6pJ3Lu5SzT7X00:Xm3Q2OH8pBaNDSp8npJ3LuK300
- TLSH
  T17763F161DCBA7C1DF842D6B1113D7C4E4809FA1FDAD8288205FD029465E8ADA2F664F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32