4e5f4f6cf30c57d6d734e2b0f99fadb62c5ed7119c2727f3a57ba7f31b0b0232

Sharing

Copy URL Twitter E-mail

General

Target
clink.1.9.31.8c8e92.zip
Size 3.8MB
Sample260729-xec83adn5v
SHA256 4e5f4f6cf30c57d6d734e2b0f99fadb62c5ed7119c2727f3a57ba7f31b0b0232
MD5 3312e2db2e7572b5a9a9fd2a2c54769e
SHA1 65e25c9243f09bc46da43d9165b544a10679f5a6
SHA512 d8ab680391fa5a665fd63f288ccc9b7c1c67618eb77ed53cbc84bb0de16f8be50c7229a080f66d7541aeb1e3430db47575224bfa17389dd7da7ddd20b33ece43
SSDEEP 98304:QEBn/Ss9Fo406o+hgaluqDFwc8iTh91CVAOXjQG0foILB:QEB/ZYN6hgQ5kiEdzQDxt
TLSH
T17C0633710153D819CEE20AFFD9884203F09AAC5F85B586876A523E49EFF4FDD485D88E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  clink.bat
- Size 1KB
- SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
- MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
- SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
- SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
- TLSH
  T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  clink.html
- Size 1.3MB
- SHA256 b78b24122c916772367ff35c108457b9e859d68ccb8dc827e253febbceed3782
- MD5 14de6578507540a3b6681f4203f5a6b4
- SHA1 92a63adb6239670ae43a509c6d9a28642d83ca92
- SHA512 98e93289952882c66989b5bcd6ff1a93822da8ade907757913fa4e12f85c4156df5c0295f20e9359fe59a20fb49508e1101b37c0747fc88687ebe18d65d7efa8
- SSDEEP 12288:wulukA9gzd1HMcPQ/K7gRAoocYLrDwQ4KOmDx52s+KJB9oVJVtebW8sawvMIw8Xv:wuskAi7HMc4/69ToFDGrv5WkR4gJHC
- TLSH
  T1AE55E87241D4563B416342FDD2092B7AF2EB406DE3120BE4FDFE870B479AD906A272D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  clink_arm64.exe
- Size 16KB
- SHA256 342e47a74239b9757be2366f1e1b28c2a23a13f61042d258bf543b5c32c189ec
- MD5 441a0e00712608067024b29de7edf76d
- SHA1 aa10fcfe8863c59a9c060f8167911cacda5dee32
- SHA512 fc67de4e558a6f0a3beb51c50925a68fac7c1f661d5140c159e0d3f1e279cb824def0af944463d1dc9074911a7003d393685a19bd93bf1bd3a652e5501a9cc49
- SSDEEP 384:Tft2w4Gd5ge2mNDeudWXSofousWu4qVSm:ko5bhzySoQuSBVL
- TLSH
  T129725BA98E2854E1FAA78F3068DC852B9D71BBA10C49890B604805DE6F43B716F3437D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  clink_dll_arm64.dll
- Size 2.7MB
- SHA256 bb31ca54e63a166910925668da61bcb1824bf3dc2fe6dd37638ff4c1a8a94b56
- MD5 2a968eca03acd22c8ec690247e78aff5
- SHA1 09535fe83a364e4abd9ea2b06d24dae59cc65376
- SHA512 e696a00fa54a47b0189827f63dd5a1cc5be281ed84f91f7873ee517c27c6389a616fe94d5fcfbb6e07403b769edd73943ed99f7f885495d106c0f503006d1e54
- SSDEEP 24576:x6ijQ9W9o7joMoY4KHqbfSLDeGl+6EXNv3f1gNKkaLf0BydG+DKA4zKs+1ZQYSSa:xL8E9o7zHLf89kLydG+fs9ow
- TLSH
  T18FD58E92FE5C9A02E3C7D1FCCD934F903126E6658525D98B9212410CEC97FD0AABA7F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clink_dll_x64.dll
- Size 2.8MB
- SHA256 1ed66f6c74b091641ddf2dbc52d9b3b3eda929de1da1cac807a50ef75186831f
- MD5 c58c1869f5686fb8778feea6b67107f4
- SHA1 17abd40e1c1baca1b0eeab2f4d1bdb7da40bb885
- SHA512 62c2d81666c441327e12c565ca73559ca432919cf864e1e14e3de42fd40fb2d2a34ee6fbf7a0336ea8f8382a4b34e503d22114736b5707e5948c949bdf9b6d2c
- SSDEEP 49152:eUY7ndhDy3JAylW9R7CCXdiCk6i4DOG+FyTibi8WXnPjV5c+:JYjdByjEBCCMCFDOG+FIiKXnPjV5c+
- TLSH
  T162D59D56F2B906ABC06B8034C9571653E7B1B5994724E7DB13D0827A2F23BF11ABF780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  clink_dll_x86.dll
- Size 2.2MB
- SHA256 b32cb648698f57dbb7d2af3dcd9c49757001d6dfb72566e87b0d31b9667d0136
- MD5 b3b09ffb2e4e885e2657b42f2947c0fa
- SHA1 a88e8d7b5c1d872c1763e941b01b0dcbe8709e49
- SHA512 a82f235b5bffb6debae51b49a4fc730ef2fe2c491ed5a68ebdc2cc6c730be7dcfb50e678efb8181233525f74b2cde3b04f6e4a050580014c69b7af7d53539521
- SSDEEP 49152:+0sdh7VKacjM0p1r0uZ0eW+pi5d4w1f+Ml:OKaKX19KeW+p21fv
- TLSH
  T1F7B5AF43F9D246F3C24B017091BB6B621A3CC6655725DAD3E3842CBA58613E17BBF28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  clink_x64.exe
- Size 16KB
- SHA256 fdd15db5a2a7b565296d2aa914bdb17079d1fbd8f3743a25400c8561e22f2af7
- MD5 5e6d609445878de827bac545b94e1471
- SHA1 d6e4688e37737fb1d0827eded5e0c959116e572d
- SHA512 4e7a20e141c6b9b3f9631ef068bf8ffd14017e66d05330fd7db67a3c1158198b21f8719e3f9f47d16dfdd6b6a1329c68f55f0874357cb4464dd98a7fe71add34
- SSDEEP 384:7RtBw4Dd5ge2mND7xdWXSofousWu4qhS5n:NB5bhZxySoQuSBhOn
- TLSH
  T1EB725B998F2444E5FA5B9F7058EC912EAEB1B7A11C54890BA008449D2F837B53F3933E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  clink_x86.exe
- Size 16KB
- SHA256 73156cbc7ef950e04f090da412dfff926f798105a57985b9512114d53e04b3a5
- MD5 7ef68227999fb2a3afc237818ec52ddd
- SHA1 26333a289beef300f719ef19d36e6544b41d63f2
- SHA512 c322e60a85cf7cd64accdf0481409b437f9b1c744aaa15a22e99a9842ff5f29c0c3c00d72fbd7477f78e92bbeed2e7082c6e8821dbd1427398855dc458829f6e
- SSDEEP 384:BXBK6Sdw4ukd5ge2mNDtdWXSofousWu4qTSE:lAp5bhvySoQuSBTd
- TLSH
  T113724AA59E2444E2FA579F7058EDD06B9EB1B3A21C44890BA04845DA2F433B63F3433E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  themes/4-bit Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 20b0f61ffe34e3ba8b6422e2a6be8bbe5a58913cb5df12e62b2f0af029216e51
- MD5 ab5d1adddfdee014978f7f2b33f47e9a
- SHA1 bf721dffd4f8bb27ad060e1f39b39d88564bd9c2
- SHA512 54bf42d1422218eef8b7ce909f619e0a5ced18110a3676f0fa4989de7526d52b39bed1ef5ab87956daab803a31ea4a9cc0f49a4b46d87ce26e15449f30310240
- TLSH
  T1FA31DE2CF4C4A8F32AFF0F1FAC28D849506A2D052B32B76971CD81F09355B1650B6B76
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  themes/Antares.clinkprompt
- Size 23KB
- SHA256 aa857b55deab2a7e704d168c6d0c3f97047c2b17cdf216227b69dd783b4113d3
- MD5 54b6f92db08dbf8c2d1e205e534d0a02
- SHA1 1fb6cba9c935fe7cc80c56e8e46f6cfd88342926
- SHA512 44341e6302a07e7ee6968ebd1c6a03e1456ac7a3c85c2d535b71f1dd875565b0e823f1525decfa5c2cfb7bd73a5856a9fc79838b31f78ac63248d900ba86c3ac
- SSDEEP 384:KLZCPFlDD5q1ViEBnSfeKFK9bobC5czBDoTU38mmtY9Qx/2AZRjQYgcK:KEFlD01AE1XkEmmtY9QpZRjQYgR
- TLSH
  T1C4B2CB0E6E024E6894BEC51344AA65F2DA4A3557632D0194B6BC40793FB0C189BFDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  themes/Dracula.clinktheme
- Size 1KB
- SHA256 8400084650e409302f84629815b7cb0c13e15b81a55fc856a72346fd32a3527b
- MD5 c7617b1643a9189337d407f773e196e9
- SHA1 5819f29fee357b3d71ccb94395e4ac947f146cf5
- SHA512 d5a9532c7ae7fb7a2e0e1d578e3824dca448a065f16a5a42a6828241db71882ab7be19ab87aca0413e482ccd6e57ec04add76be4a0f27dca97101c0ddfc389ca
- TLSH
  T15B31452CC4DD62EB367F0C9F6669D089C961A13421227B3872FD1A78B740B5282471BD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  themes/Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 2c3105e81a4e887a8f00008628a11102f17d3a684189a71aab381614c938ef4b
- MD5 1f7a47e668aa719dec19e32ec0dd4a09
- SHA1 b7e0c56cb99570d095b6fac585592bd91a6cc540
- SHA512 b57cb82d2bb0a3bf9a11ba7d5f0c2fd2b5f72ce6f564c6e72a8fa477cba9f2f5e3d6304aed02b6d1671a70ff4ee3b04ddc1d3f06e135a104e978d397d70cfcba
- TLSH
  T13E31661CD0CAB4F7A1FF0E3E2D19C8489A6B2A292722372875DD71B4534130941BFB75
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  themes/Headline.clinkprompt
- Size 23KB
- SHA256 351581f87fd4e552644026f5ba36f593f09e29a28a9e0d77e303e307584453bd
- MD5 c6eaeefd5e748bd7e822baca66fd9419
- SHA1 d1cadabf472bb6715bef77a4a01a8f0953c57051
- SHA512 4d10b7ccb7faa946d445ce2c8fe8bc26ff864d270d1e708f99f71869dcf7e5d5e5bedf7f11211924dec6fffbd554d41dc6fae219eac5a245c77ec1704f082ddb
- SSDEEP 384:yI/VxfyFCENWJM52UId+3i7kg9wkJ+H+J73aGApwspO51jvG1E:yaFENEGId+H+J73Qw3G1E
- TLSH
  T15EB25F065D06927028B8C6BDB89B1D61FE3550932219C037B4EC41897FB0AEFA6FD3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  themes/Plain.clinktheme
- Size 1KB
- SHA256 6e63901094a309b2e3079d98950d0c488aba00b9694da76bfa3b0768b574425d
- MD5 f91651de99673500b7f49f6f516b244b
- SHA1 8d5349fd5215730e693e25537d4fbdd758685d56
- SHA512 4248b41deb294f1b20d9c8e9540bfab4ece1d880b23294aa485759caff651248b5d727d2040dc91447d41820d4c2a5f8ef64e085adb363108e9b9c0853b3cf96
- TLSH
  T16411E42DD4C491D76ABF4E5FB829C588A02AED25BBB2EB1472D40930A044FA34086736
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  themes/Solarized Dark.clinktheme
- Size 2KB
- SHA256 3ca3ad89fbf8507fc60c025d81239e51c9c244bfdd9bde272ebee904b0ad1d81
- MD5 4271dc349cd8046bafc94082b179d0d4
- SHA1 2e27125e8da3a1d6fbb574e6f58e13a6ee08f25c
- SHA512 1ce30cc32a3fcbee80020e519e59a195064f04d580f63d577fc1b92943d4400be296c6b53879c75d8a5094f4175cde55da30398b47c4d1fc4c9cbb85a70911e2
- TLSH
  T15351DE2CDCC995D726BADAAF2964C9A7D13DE20B34626F5C3AED8C743341B40A24F431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  themes/Solarized Light.clinktheme
- Size 2KB
- SHA256 374bcdcf8de002f843ed7e7f84058fae29a0476cd3e0315c306b229040dc281c
- MD5 0f54e3f5021015fc5d833ad00ee8ecf1
- SHA1 385bc4598a57fa42b4b3c7561f1e209bf462e6eb
- SHA512 f344593f64230fbfea5382a297a3230bb19e4f8a26943e1a36d217e00d3bfa7962a280fb2d73a4dd6623b473e81b0f4da9063a96f62f517efcaec4982028d0bc
- TLSH
  T12651C12CDCC954D726BADAAF2964D8D7C16DE30B39226B5C3ADD88743341741D24E431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32