d3e74a3838970e1272d58b01f140f4088d94669e44406bbb67f5cee07da19ff2

Sharing

Copy URL Twitter E-mail

General

Target
BB465 menu.zip
Size 230KB
Sample260729-bm46vs1erg
SHA256 d3e74a3838970e1272d58b01f140f4088d94669e44406bbb67f5cee07da19ff2
MD5 84c8d321a3f04be242b21b419c0e398d
SHA1 0c8c0011828330e73826c74bf32b60f28f019201
SHA512 072fac11a3e44373e0f8de25174accb59d0ca219f17c58d1c2acf705c91394b5785de7b99871d972e69b52bd16f5c32119b38cc2bc1172b64cd70ad0e5a46682
SSDEEP 6144:ytm9rk30l/Sim1hcd7DBgOItECOLGEok3SGVJ:+X+SCBgRECO6xgSGz
TLSH
T177342327B12DED34C98C9475D4F3175E70C37BA5B20E3EA468019BC53E5B9AAB482CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  BB465 menu.zip
- Size 230KB
- SHA256 d3e74a3838970e1272d58b01f140f4088d94669e44406bbb67f5cee07da19ff2
- MD5 84c8d321a3f04be242b21b419c0e398d
- SHA1 0c8c0011828330e73826c74bf32b60f28f019201
- SHA512 072fac11a3e44373e0f8de25174accb59d0ca219f17c58d1c2acf705c91394b5785de7b99871d972e69b52bd16f5c32119b38cc2bc1172b64cd70ad0e5a46682
- SSDEEP 6144:ytm9rk30l/Sim1hcd7DBgOItECOLGEok3SGVJ:+X+SCBgRECO6xgSGz
- TLSH
  T177342327B12DED34C98C9475D4F3175E70C37BA5B20E3EA468019BC53E5B9AAB482CE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BB465 menu/1.4.5.1.2.version
- Size 32B
- SHA256 fd92c74ad43b5211c790531b62a1cb52d240ffe8a2600946a6e67d0efee527ae
- MD5 fbae160c2ef28b35eee86f3bb52e6d1e
- SHA1 52d92ac31eca06817e963c0c1662af38cd0a3dc2
- SHA512 9bcb30aff528e1eb6a047e4a9a28685742383538e2f4e1d0be60552c314725f38582f1cfc3055ba9d6bfe113b719dea5818ed76c5adc5e190ec7c95ad48c62af
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  BB465 menu/BB465.js
- Size 1003KB
- SHA256 a64de149817c21fe6a71da30c8e29ead0b3121bcecef87cd2bcce4a876c0eb7b
- MD5 c1a7a83303938c70d312779d7dd9559c
- SHA1 feff451c1fb7f0e42d3784699fb6377afd61bc98
- SHA512 ebc955d24016ca358db13e47cdcb603a5c10cde180659d444c1a0835d6132ec598239cba44a3f510eac09aacc291be9e43f2aaf16d0c19dc4750c7b922761efb
- SSDEEP 6144:SIJufF7NTx5zCqRuXdjCcYO+gYUFdaBR/aLrsngKZ33zlAvpK+NXyOaskKqXgzw6:ZJufLx5OqRuXdCcQgpxK+6FkwxPUeOx
- TLSH
  T14725554A15FB10B88567F17D4B9B94493222D9137E1EDEA47E4C83202F4A13897F3FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  BB465 menu/BB465menu.bat
- Size 2KB
- SHA256 4a0f509c30e97c85e6718f4c895ea97469ef5639b4573b787fe200ebd148be5a
- MD5 41b75f93683a615dcbd9e6d87726451b
- SHA1 c2a67ca33cde2c416e464f2afe0049f4eef65b06
- SHA512 4394d15475d7cfd9c7995650d369c4373ff10d80e1daa7be446597b1313c0dd363467f580a1272d6f144b06aade71ea7e76b7b77e698b1150d6b981676a9b2d3
- TLSH
  T13B41B713305AA0134FF150B2DD3C58443B2BD087133168F9B9F27470AD989F9AA9F18B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8
- Target
  BB465 menu/README.txt
- Size 203B
- SHA256 746907d69a7e4eb068d9f6c0026b177b5890a36f2b70c9c9880595be32db24d2
- MD5 1e1af801ee5806beafc69e976cba6e4f
- SHA1 8eccee5ec51d9650f6043f547a177ddf28921524
- SHA512 8c7a033ed19f2a3b9ccad382536ac6a95d5c86a87afe7401cd88482d97768fd45684713a060a3a180ce24d7b9ff1ba4f47389247429e36e401c48c66bdf918d7
- TLSH
  T12BD023391960D3BFF60F51E15F1770C1F768F0F82330514AC444680013444F80A1BDD1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  BB465 menu/__pycache__/bypass.cpython-311.pyc
- Size 13KB
- SHA256 e60dd15fe27771cc18891da477d1a5813236ccf8eb642955ca53c508b188e1ae
- MD5 2681d0e3716d2d9ce550009335458878
- SHA1 1e393854e0318b8c9ef98843ca8f2ffcede639d0
- SHA512 d92408d2e490c94b13ade6a5c9c8683eafad21c58896f02f98b966e22fa4475558b8440e5afc9a51f828dcb67c257679ce7671628943adeab244fa3874167ad8
- SSDEEP 192:WkMlyuJ2hKpoePcjavfATMofRp5RCG1r5JbTYVmz8vntWTGrOOvhim:6+hKpoeDfA4sRT9RbTY/WGfim
- TLSH
  T1B35261653386D27FF954937C98A0595B73F4D9F1B3288713B2EAE0152FAA6103D021ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  BB465 menu/ac_bridge.js
- Size 155KB
- SHA256 3541d714e302c3a45cef908c3bcc43552516b62db9dd969345b949f955b59a35
- MD5 a9a44382b69df113801cb81248b2eb96
- SHA1 dbedcb4c21593991120833ce51bc84f7cd1f5d4e
- SHA512 bf7df4803a3a2068ea710f2e0283f3f907b45b045ca9d781b7a41f190f118413f9210eecb5fb2639fcdf294f5e0526e43b2e0986e51e747fcc909eb8e7925a00
- SSDEEP 3072:xCZAupvzOY0rQSYrFQxAqXAaQdczvQg4BSFOokQpg3FwiwgpB0lINK6jx5E3Fy+f:xgAupvzOY0riqxtVQ2zv14BSkoHgWiw7
- TLSH
  T1D2F3734929F7C262812BF46C2B4BE048F23991036159DEA47CECC364DF5A931A6F67F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  BB465 menu/bypass.js
- Size 31KB
- SHA256 a19eb24623093ae0efba5f7b3c29ef5c9b7dd8d86b77f0a1d8e3c20710f13cb6
- MD5 dcea7037bf1f59d60ef2e4c238ce1caf
- SHA1 2af3778fd69fe0bcaeda878469694586f498ba45
- SHA512 ad4c98798bb52883a409df713ff6964d86d6c602dd1e7dbaa645059913ce085257ad43e44c536947ea9bfcc2c35bb7d14c2c72d931000404d70616b98ff42f75
- SSDEEP 768:Pfh5vXpCdgUVs66tSUSWi68H7zpJzW0k6tNUCicg+lPzh:HjvXpwgUVs66tSUDihbzpJzW0k6tNUCb
- TLSH
  T134E2D09332509BE7E9390485E9E8879E34A00EE70328EFF5F5BEC5FD44A085891D67E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  BB465 menu/bypass.py
- Size 5KB
- SHA256 4b5e3c18ad4db150a8ef06fab4d8ba2f3dc38dbc2ece14552e405e7218cb60ea
- MD5 c781dfea9f903f9b23f072327b4edc16
- SHA1 8310eed1a98fe106a9a66f5c9587033a0ad6666e
- SHA512 6e108ecaa21d9a6ccb6f5735f953e22fb7b0e7f81ca7db50fd2da75afb94fc73ba06d0db6103e5491b0beb57032bef4a7959c379bf697a9de084999dbaab10f3
- SSDEEP 48:ZNm9G2KXGkZL4cefM4XJGw1Z4FyS6RTcdC3hetj+hBLs80PxD7qwNCCi:ZtXXGkZcPhsMCytTcdC3hsjQa8uBNCCi
- TLSH
  T111C17AB238043B287753D60ECA46C0550B7ABED3B2B93528F1ECB5C06FCD47692159BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  BB465 menu/devmode.bat
- Size 596B
- SHA256 00e1945531c0c20fd7d6111fe9fa3ac07d2f11417c91cb113a5c437d27abc4dd
- MD5 3db479207afd3928af48baccab49d48d
- SHA1 34d25faa54f5112eed4309cfb39f2ff49a71ed0a
- SHA512 5c4e6fdce092f80a93ec8e055d4b041b27d707743188c74402187226e73f8d308a5e00b68821fc7ed1bb17f44a3fb6950e02b8901d5d816d6c0a529ac5c10d1e
- TLSH
  T1DCF0021BB2E425FA037C40264EB56091F887002720362DC334A1F0107F6577ED7EC5A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  BB465 menu/m4literallymadethisinaminute.ts
- Size 318B
- SHA256 03e291994b3c4a021e0140c4c8e2f52a79c96942e581cb46200eb6f93b6c8db8
- MD5 13a9e6d368076db6853718c544f18715
- SHA1 119878c43a8169d2795b5ee90a33ba798059040a
- SHA512 53a88380e9c03cb59eb1e874f40d8f44a70796cb990a6893ee550a2304ef3e7deec74da2022b0bd2ebfba31b5401086a5819b8f07c967ad17fa2c2e2d7114c15
- TLSH
  T17BE026251A27F8A946FC95063A9F228F00F49F2239AF9D1498781B36A297110213BA21
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  BB465 menu/symbols.ts
- Size 19KB
- SHA256 1dd714145273a833a38467204318182a04f1c67c8b0ad5a0d616cc47cd065bcd
- MD5 ff82a58d5dcf25f455752468941b3418
- SHA1 cfebbdf4de09f1ce98148645a3cdcf75aeb1cca2
- SHA512 68ca475dfa1f19467d85a6b6c7cb2c7277364626b7c349c2ca92738846de157a818fbee5ac2610e8b90b84de948261652d55793987d0bfd800902ad479407715
- SSDEEP 384:+BPHJPfWaqag5SYP1Ub3UEHHmIPVS0uC4HdgbYVs66tS6hRRzD6:4fh5vXpCdgUVs66tSUa
- TLSH
  T1309244923250AFEBE56D0485E9F886EF24F00DB15318FFB0E56DD5FE80A0858E5D2AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  BB465 menu/tsconfig.json
- Size 233B
- SHA256 95ff4431b600b63e0fd6ebfb43826ed79adfb72e631db827b889102fd998c438
- MD5 94a4d7c67df3cebd3c6c54206ec8da62
- SHA1 1b4e3bde1f17ac1fb38b7908319f4311635a23f6
- SHA512 c9e304bed7c06c734eae03adc704f71e8b9bc50316dd6614ca1044370962e3850a390df1c3f333ee8561624d3f72551cf54853cb8c0e81b4914715f3321987c4
- TLSH
  T1A1D05E21C4240EA201D909589C4C9203596091830A443C15B68A120D5B1C63F5AB66E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26