blankgrabber | d1b4a8db540ce080d639fcc8339fa63e803441384d0f7828c01a8e95b9a1d387

Sharing

Copy URL Twitter E-mail

General

Target
9f598a-AddonWeaponsBuilder-1.2.zip
Size 16.2MB
Sample260802-vkpg6sdj2x
SHA256 d1b4a8db540ce080d639fcc8339fa63e803441384d0f7828c01a8e95b9a1d387
MD5 be2cfc78d9dd09937aab4c0d1d023f43
SHA1 e2d0a2e01c82239c01ad02cbfe3c3426d1f1fbb4
SHA512 17f3d93ee199c5049442954aae79425a96540af0e9f3512067ea1a27f0072644a601f80caced3fa3e9e3f5e9127c27df0785c9dda80ed4ecdc352ca6a1948585
SSDEEP 393216:DfkfSGJ7qItfcrNfzyeSuhHY27AD+7ec2fE7onLjazbgP45RFVapAWI4nFGzPLjf:Du7Y0fc13+oAD+7ezEo0PWIJz
TLSH
T1CA0733BEC59809B2CD47433194DD1A867E6E7B022A02DCB33465CB62516689CFF3DE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  9f598a-AddonWeaponsBuilder-1.2.zip
- Size 16.2MB
- SHA256 d1b4a8db540ce080d639fcc8339fa63e803441384d0f7828c01a8e95b9a1d387
- MD5 be2cfc78d9dd09937aab4c0d1d023f43
- SHA1 e2d0a2e01c82239c01ad02cbfe3c3426d1f1fbb4
- SHA512 17f3d93ee199c5049442954aae79425a96540af0e9f3512067ea1a27f0072644a601f80caced3fa3e9e3f5e9127c27df0785c9dda80ed4ecdc352ca6a1948585
- SSDEEP 393216:DfkfSGJ7qItfcrNfzyeSuhHY27AD+7ec2fE7onLjazbgP45RFVapAWI4nFGzPLjf:Du7Y0fc13+oAD+7ezEo0PWIJz
- TLSH
  T1CA0733BEC59809B2CD47433194DD1A867E6E7B022A02DCB33465CB62516689CFF3DE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  AddonWeapons Builder/_asyncio.pyd
- Size 70KB
- SHA256 8cef0cd8333f88a9f9e52fa0d151b5f661d452efbcfc507dc28a46259b82596c
- MD5 70dec3ce00e5caf45246736b53ea3ad0
- SHA1 3cd7037d211ebf9bd023c248ec6420f193ad7ed2
- SHA512 eddbeb527c01167fb69d9c743495c868073b5cacae3652d777b6a635c4feb0344f085bdc2aeb6a775ffef8056394ddb4df5cd47e622ccbf974d11c30857fd536
- SSDEEP 1536:TCY0jUiu7HX/9VFkX1FVdIDvnA7yo47Q9SfI38VMnLhM:TCxViHXlVFkXHVdIDvnADIChM
- TLSH
  T1F7638E87E2A4418BDAD7B274C5636F53EBB0F6821901575F91E8C28E2F5339183FE212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  AddonWeapons Builder/data/templates/WEAPON_ADVANCEDRIFLE.json
- Size 57KB
- SHA256 3b1ecbf86ba3dcf93dd836a5d6ba66d5c6e4bdda6746e93bbe14b82df121cc0a
- MD5 18b58edee1c90fd1a142e30304ddb66f
- SHA1 389831bdbd34bc9d051dd9c1eb524692dfcb45e2
- SHA512 74b24e4ffa9a9d7fd65d4edf5fa40d945ad5d75eefdc4fe6de3ef303e6855e4622ddb196c984b00cbff49558614cf7453325c44803f42d8c4ab48a2a812765b7
- SSDEEP 768:v4KKtjXBgEeg6tJukX0NC1jGiJfznB/hxGZw6O8Q:vUgEgJBX0diJf3
- TLSH
  T1114322987EC29FB1D0AA0D089644EB5D2DE1B1DF4BCDD4AB368F072CD362C956D67220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  AddonWeapons Builder/data/templates/WEAPON_AIRSTRIKE_ROCKET.json
- Size 12KB
- SHA256 19d44900df165eacec5043536538eed991d788fb492278d934f961336ca6d124
- MD5 7e1d8f8e68e7e2739cefe0eab87eedb7
- SHA1 d9505a77cf692ee28968fb7682092df309713f65
- SHA512 93ee7badee137b98816783da76b705cfa58fec009f396a7eccfb9f51fe279b5f28e3068428eec054c6455b92e97f57051344179b66692e6eb6733b8d2ad216d9
- SSDEEP 192:0vNwamv1bUKtGn9QzVeRwaG3tDj5B0TPLrGki9IokkQn6lNgKBUG+H+5nI3QgDRx:WNzubUKtGnKxaONGkgq+H+ZI3Qox
- TLSH
  T1814274966EC0C976D5984C049A64FBFD6D90B1CB8BCCF4D937EF4A5C2732CA40AA3560
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  AddonWeapons Builder/data/templates/WEAPON_APPISTOL.json
- Size 45KB
- SHA256 8abfc2b988411bb500b8b07323a9cadcc132e0ff02307185c796a525f8bfc65c
- MD5 24b808b4b3d1b1f88618cdbb00a050bf
- SHA1 c7f0fb435aa868933de38904ab24b7b4278fe83c
- SHA512 a989d611c368ca99eb8e0e9d885e456f205769fc6d748af557576cba47d0ebc091312cb6a39c5cfae6a2c30d915a5558aa9e2c75222ff7e81d90d45855f2777d
- SSDEEP 384:OlZ0k07KtH7XXrZXZw++HDa9lGA4SN1I332Ku5VADEpVvhZ+Cr4l0LaL8l0L2dSL:OR6KtbXXwqcA4SNRKqmD0TZCQP/oR
- TLSH
  T1622323847EC2AFB1D5AE0D085651EB9D7DA4B1DF56CCA0BB378F0B2C9327C942927124
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5
- Target
  AddonWeapons Builder/data/templates/WEAPON_BULLPUPRIFLE.json
- Size 63KB
- SHA256 1ec3c14c91601f641b46298273af2bcee22736abc2c4f61d5a6c5b203c664a18
- MD5 0ace43fc6e46f8fb81056801ed6a618e
- SHA1 f717c370994ce13a14ee663eaa7435b628434af3
- SHA512 2b0f6d367424dd7ba1de0e2ec5b69181ad92ba2927ec4bcf776766762f0856e424064fd80564aacf92c470bd0c623270af1c39162dbb6eb5c2f0cd21682832eb
- SSDEEP 768:n9f8KNrq5SNFECqIEd3TANC1jGiE3V5sNXyRn+X+EomW:nlAS/rEBTAdiE3V6u
- TLSH
  T1995343987EC29FB1D4AA0D099A54FB5D3DA1B1DF4ACCD4A7368F072CD362C952D27220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6
- Target
  AddonWeapons Builder/data/templates/WEAPON_BULLPUPSHOTGUN.json
- Size 52KB
- SHA256 e902e94eeac3a752f770e4261a0438ab9525d1c2e385bf026b4932391f63d361
- MD5 bbe9d4cbf0233b6375b21904ce394dfc
- SHA1 d29becd9c9189b92fcaa20a5a2f1150df94ff74a
- SHA512 42a480c28e1afa4aa4307fddad0130e00995b72355a30a665658c94ea35deecd5c647fc3492a7aac6024a4024f756ad0a6911cbd35bed3cbf4476ea417100364
- SSDEEP 768:6kdKtrX8LeO65FmxlNC1jmURzvgEir6gsS6:6+LeNFQlBUT
- TLSH
  T13C3321D87EC2AE71D4AB0D095A44EB5D3DA1B1CB4ACCE4A7368F073CD362C952D27225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7
- Target
  AddonWeapons Builder/data/templates/WEAPON_CARBINERIFLE.json
- Size 63KB
- SHA256 793c26aee0e3c79da05c765d5687bdcc5e78f4aad06483fe22d40f22eadf7629
- MD5 bf0386410a6bb52fe995046bc7b8c301
- SHA1 a98bc2d48c8dd6a8ba2991f72d8231af26dbfa49
- SHA512 33c9b87a4df2357c28b18ab4bf8957bd8e32cfd06b444b3886b729a831d81f0027f91a0efecc88b07d512f763bbeb7ac8ceed9020d00c2dd04da9dfc6d75462c
- SSDEEP 768:N9Sr2KtjXvxll6tY3+hy/NC1jyjYE75V5vBK3qnbGjCkom2:zSxlYYOhy/9jYE75VhBJ
- TLSH
  T1D25320A87DC3DFB1D0AA0D089654EB5D2D91B1DB4ACCE4AB378F072CD362C956D27224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  AddonWeapons Builder/data/templates/WEAPON_COMBATMG.json
- Size 56KB
- SHA256 ec49e2e59bc32bd8a75973f79d633fb9ba06e3e10d6f53c54de06567fd83ca32
- MD5 8cbe911e269bbf1e582066873519e5e1
- SHA1 e83f00481fde95dad7454b38f7c0ab34978f4e72
- SHA512 f02af5a2c73a5f2edbe31027881061921c8e07c224e939c5ef8c957cf9ca1cd8429d3117913d42ea7b04141ead10fde36be13e6b631e350ffc36fdf4e45cbf2c
- SSDEEP 768:ukIKt6XIMFEZwnJ+L21H7Rx2t3a4e/nsfx8koG2:uoMw7LiH7T2u/nZ
- TLSH
  T1B94330987DD29F72E4AE0D096644EB1D3DE1B0CF8ACDD4A73A8E073CD366C542927225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9
- Target
  AddonWeapons Builder/data/templates/WEAPON_COMBATPDW.json
- Size 56KB
- SHA256 2bcdf8100e9d799079e100a42e7b5b9317784398dee5d3932f9042a02e8ba8bb
- MD5 fb33dc0a1d2279ff5d783acdc0918c75
- SHA1 0f20ac2a67be65924122f57f56646e393870ffb2
- SHA512 f82d03e7136e10794036e30130e142b6d82d49fd6e9bdccf7a303514982748ea220cfaf4c0b3e3a380f5d57ea22f526ec24c0bcbc9f42fb7d7af2edb5701e602
- SSDEEP 768:bSXuKN8eX1V6snKTHUklst/NC1jaA/yuR3C0CcLIrw:bMV6ZHJst/LAY05
- TLSH
  T1FE4321987EC29F71D4AE0D089A14EB5D6DA1B1CF4ACDE0A7378F073CD366C952927224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10
- Target
  AddonWeapons Builder/data/templates/WEAPON_COMBATPISTOL.json
- Size 46KB
- SHA256 41e8a2ad7b9172b2fd0ba4c657a32c3da3c5b0c61eb4f5c64ae07aa47b628b9f
- MD5 e6bb106980c63b7784c53b5e4248f04a
- SHA1 8f3e4aae465e28530aa17de6e29e84b7a0616e74
- SHA512 9802cd534b4c5546ebe281465f41b19738a5f8c34e580a1f17fd9c7a9888c5b30e1543a945de6a5e6afba2126fea9e055b11c32037ed305e496554fed963c814
- SSDEEP 384:ulcG+DKtv3XtEAXZwnG+7a7ZPQA4uO/I33Axl5VADEpVvYVsdC9eo6zZMCfIrrll:ujuKtvXtsaYA4uORxrmD0iVRtCrPdWmW
- TLSH
  T1712332987EC2AFB2D0AE0D085655FB5D6DA4B0DF5ACD90BB37CF0B2C5322C942927524
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  AddonWeapons Builder/data/templates/WEAPON_COMPACTRIFLE.json
- Size 54KB
- SHA256 08535b427ab18ee569f3edeb05e748bfdb30396bf2f36f3e0303a3b45af51d3d
- MD5 49c717dd57cc7c8576f8a7c4b71b840d
- SHA1 f4ed8142c634742d241bf8def20714e7065ed51e
- SHA512 59f7088e3dfa4d57441f48f115de91bde1007cd472016415204af1ae671d2201aa4361dbc4b315cb7d7dd81ef86a1005c11d803aa83c0e8d46ae8afc93a157f7
- SSDEEP 384:CkCtZR3oKN1ZXC9CXeGqYHZqjNxgEq6sENIY3VI33HYXCIAHhTJSr9hWcHhHBPrW:CLR4KN7XC4exqrY3yYXCIove8zHXxFjl
- TLSH
  T1B94310A87EC2AEB1D4AE0D18A604EB5D3DA1B1DB4ACCD0A7368F072CD352C957D27215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral12
- Target
  AddonWeapons Builder/data/templates/WEAPON_DOUBLEACTION.json
- Size 41KB
- SHA256 d6ad3d4f9f6e89e391647f9a41caf4b713c28f5f57843f132bac664f337bac2e
- MD5 a9f4f845c5515f22e360fd51df35bd4d
- SHA1 345e5c81ffba9e30b485f0d2a464ea16ba8c0e12
- SHA512 c2867d1dfa8b260392a82699c4e86ba967654bdcc25700e95ac51d650edc7f1987401519cfa8039c8fe0b4c7cf9e9e435b2c530b7e67d59c167faa345426b21d
- SSDEEP 384:5lFSoF2KN6MXpvP0RywXKlYtoehAhpo/I33LtBn1rzl0LhKHCAr6l0LhtnVrdl0D:5CowKN3XpnK/JAhpoKtBZH3qok
- TLSH
  T1C713DF987EC1ABB2D5AE0D045A45F79D6DB4B0CB56CCE0BB37CF0B2C9316C982927125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13
- Target
  AddonWeapons Builder/data/templates/WEAPON_EMPLAUNCHER.json
- Size 39KB
- SHA256 6505a0fdbd1132b056d7b8b7b3ad1cd6e3b7822fb82416f35e925a27ae4fe181
- MD5 cc2bb6c885fac8a3070603bfb84e784a
- SHA1 3170fe7b7d254157a222d43b4eaf81d0f02427e0
- SHA512 f1762dab3f6feeb3e2a5449257c2e247fab32e997ca4c37245e2e75647257972d520a96c94a04b3812a677e20462583a63547b4b10288307bfba8158b77a99b7
- SSDEEP 384:XNThpzwZKNo4qRc9H1wyVUDBCr7OhIkfRpiZ1ol1I33cyBzIgirBl0LhtPTrCl02:XDpzkKNHqRMXCDPR0olMzIemUbm
- TLSH
  T1D503E1847EC1AAB2D4AE0E149A55FB9D6DB4B0DB56CCD0BA37CF0B2C5317C986D27024
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral14
- Target
  AddonWeapons Builder/data/templates/WEAPON_FIREWORK.json
- Size 40KB
- SHA256 f1ae7f079a519186fac876aab0ede22bc13c4b02e74f9160df8c496bb44facca
- MD5 6cbbf6104b3b01ae470aa28ea18eb762
- SHA1 6162374a1d698d5bd211cb9f026199170cdec2f3
- SHA512 2f9808dfa043db50f0123895e3b67175e9741484f600ca60eeccd007219530db1227eb4437b48bb53d2350099adc46a66b2c3bb7422281a73d9af5559d7b19e7
- SSDEEP 384:bvNo6B8bUKNBoq74L7mWjwnKKXxRDsHgC00rZrBeeGKOI3wuG0HhrKr6hIRHhHAo:7IIKNmq7vbBnCJr8HKbGUm/v2t4D3JN
- TLSH
  T16C13FFD47EC29E71D4AA4D09A604FB9D3EA1B0CB4ACDE0A7368F073CD356CA52D27215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15
- Target
  AddonWeapons Builder/data/templates/WEAPON_FLAREGUN.json
- Size 37KB
- SHA256 679a7a1dc8d7ab4ad4eed00a3079b469f93b60eec7f5e856bdf5a75f8601d340
- MD5 e7bf6824a62cc521978fbb7bbec2164f
- SHA1 edbf2005f6231c1ee8abfec10d70e8eca28838a6
- SHA512 be1bdec47172c9460eff88772b0775a21eb3b927d243642a858565b98b2dd57c887796c64c6ff5de8f4ca2dcccd6eb49e021c23156fb51d002de4a89f19f86c3
- SSDEEP 384:F4lbN2qWHKNioqO4lX5wnQiKXm7jbreA4KJ/uWI33lGQrel0LNtG2rTl0LNVGzry:O7WKNTqOhQi3eA4S/uftWCgp
- TLSH
  T1BA03D0D47EC2ABB2D4AE0D045645FB9D6DB4B0CB5ACDA0B637CF0B2C5317C982A27125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16
- Target
  AddonWeapons Builder/data/templates/WEAPON_FLASHLIGHT.json
- Size 26KB
- SHA256 e68bc0853c16bf6b9fae62a42932a0a6cdd45980fd0022d5aaa9a2ad0886cf6d
- MD5 76ab5e499042fef28d1592c5322be7f9
- SHA1 9e3cfd598fb1e96bb506644f8a5e47669fa6e347
- SHA512 ca634dafb4d0f6731499da855e9068efc459ba8d91308f2824ada30c491b8465bcfc3efb40eb4664f7e407cc78072cd8a1309508c8d465aff157b7977300fa0d
- SSDEEP 384:uTCmWd+KNaJq3FVX5wFKXYto/Ap06oR81I33v4kYA91OTt2rIl0L+hrflMLV:uJWcKNIq3uDyAploeqv91O51k
- TLSH
  T1DBC2A7856EC18A72D5AD0D059A14FBED2D91B1CB4BCCF4EA37EF0B2C6322CE11963465
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17
- Target
  AddonWeapons Builder/data/templates/WEAPON_GADGETPISTOL.json
- Size 43KB
- SHA256 faa53991e9ff2cf6ee0317ab8b94a59f73bb586d2f20abdac1ed0662402362e2
- MD5 710bf60e873f28be623751164ea78cc7
- SHA1 bfc4f579aa5281a42e0cb745c3f6c4b6db377a89
- SHA512 737bfb49ec923b373621ed8cc079088b8bbaec36945d06f42451c56166753105422ab88e1a94929c21deebab3b986b9896e0fb81874475f5aca3476ceee57e5b
- SSDEEP 768:DiDjBcTwya1KNQX1Q/y0AP0gdyFP1z7wsgDtwtXtztrt8ts:DiDjBcTwzbuy70gd2P1z7wsgJUd5hAs
- TLSH
  T19713E0847EC1AEB2D4AE0D045A45F79D6DB4B0DB56CCE1BA37CF0B2C9317C992927124
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral18
- Target
  AddonWeapons Builder/data/templates/WEAPON_GRENADELAUNCHER.json
- Size 50KB
- SHA256 c479cbab624807d2eabf9cde1c2577797c9625cf053c9ab1872d00eda11c8c83
- MD5 9e495a9dbb75ae99e03e27521cbcb8bf
- SHA1 19d54075f7908729da18a6005ca2c228f9622119
- SHA512 c541c3a11c227de0afb5162a0d4d46f75034d3baffb3c9b4e78dd6873277cfd6b072d48dbeb9ab1a2d2ccf8f4c7e8ec2377c37c46d18a63ab5509581357eb82a
- SSDEEP 768:kaEKtOK0hUaJ5kiOqNC1jaAtvbeGwQHcg++:kThUMklqLAh
- TLSH
  T1783310947EC29E71D4AE0E499604EB5E2DA1B1DB4ACED0A7368F073CD367C953D27220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19
- Target
  AddonWeapons Builder/data/templates/WEAPON_GRENADELAUNCHER_SMOKE.json
- Size 47KB
- SHA256 7fa73e1708e7d87adac2a4cee3d3803779a5dba705853bce577032b14155957f
- MD5 dbea30898d2f46f97d4635739a0b2388
- SHA1 bd2e88a8a04d8cdba383d6bbbfd00952780d2bc0
- SHA512 2c6fbbbbb8b1b7bbf3cf74a18d1698d35fbbbdce93eb14eb87e5ade953f236c455a9b86531623a6cc5b6efb2b60c2a16fc1090ae6150dc51dc9ca816062d50c8
- SSDEEP 384:iNa7ObYKtWIK0lqXZwt9qmP70LkfsvxcI3QQdOAC1jTmAGrHhrTprhhwqHhHAZrp:itEKtLK0rQCsvXNC1jaAGZyIYTKyy2cw
- TLSH
  T195230E947EC29E71D4BB0D09A604EB5E2DA1B1CB4ACDD0A73A8F073CD366C553D67221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral20
- Target
  AddonWeapons Builder/data/templates/WEAPON_GUSENBERG.json
- Size 53KB
- SHA256 f9505e7b28b1ac130c87611d0d8f2eea05f0db03e509651016a95a00ca71c4eb
- MD5 b5b2834c044dd9ec682cc6e0d524d241
- SHA1 ebc3c9860d8754f4a8ac1e532c6cf7dcfb735626
- SHA512 9a232d64c4a2321041b6e2a54eba8631d32915e6738d32c9f9c39a4d0b893396b513e4ec76f61bcdba448e1d99f6b05b813e274dd653091b775e8c1ada2dacf2
- SSDEEP 768:dMRtKNnqrPkwqqp5Nq3KItyhHTJZWmzghR6/CSLuqI0:dwJPkm5YKfTvWmMhReCSV
- TLSH
  T1533320947EC2AE71E4AB0D09AA44EB5D3EA1B0CF4ACDE0A7378F0738D356C552D27215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  AddonWeapons Builder/libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- TLSH
  T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  AddonWeapons Builder/libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH
  T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  AddonWeapons Builder/libssl-3.dll
- Size 774KB
- SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
- MD5 4ff168aaa6a1d68e7957175c8513f3a2
- SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
- SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
- SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
- TLSH
  T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  AddonWeapons Builder/pyexpat.pyd
- Size 197KB
- SHA256 b93e6083eb06137cc9191dac0d9cf4483e47192113d3ac2228b4549f737bac85
- MD5 0351dc34c06a7e74e977c142a8784da8
- SHA1 1096bc9b3ae3a57dc7f684d53191df5365889164
- SHA512 92caee00cc0588d30659d4b0bde38bf229beab0fc07d9aac362b84814b6ea541c39c03aba936124cbfd5d60c219d01cb09eba8005dd2236774503094cbdc609b
- SSDEEP 3072:DQ38C7XURBox3eNAe5XxBpiedxMmiuXTB+qEEWB062lBDG4gPKR5uECuZIDyhiYY:w7XURBNAeyQxMmiuXTkazZldGPPzOEBf
- TLSH
  T129145B9A71A2C1EBD8938038D6D78E07D7B2B865038097CF52D4EB7D5F27B423A29315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  AddonWeapons Builder/python3.dll
- Size 70KB
- SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
- MD5 98b008be9834bfc362b4c2eef4e8cdb9
- SHA1 a4a50ced1329c3986e3c1576f089b25aff5ffdf2
- SHA512 d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881
- SSDEEP 1536:fotssyKcunV8P2ZIDy0Q7yo47Q9dfITzp:AtssyKlZIDy0QGh
- TLSH
  T121633CC25B57F8A2D6F669FC78DDD9CE242B02CC57258C9FA47993920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  AddonWeapons Builder/python313.dll
- Size 5.8MB
- SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
- MD5 501080884bed38cb8801a307c9d7b7b4
- SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
- SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
- SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
- TLSH
  T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  AddonWeapons Builder/pythonnet/runtime/Python.Runtime.dll
- Size 435KB
- SHA256 648e6b415be8f45018af71f377aa3a97772799b353ac3a5e8612a99313de4907
- MD5 edf72c42a4f3844f079fa1ff0d597c00
- SHA1 0377ea493aa17a11ce19a9e43b289c69dfe29bdf
- SHA512 e61db09828161f22b2c3f2e23ef1e8db3179619559f35486e163d31cd4a900efd37c873e8100ae9f11e6c1a6e8d42d07809704681008c762e1254ed08d609d59
- SSDEEP 12288:ZvpWAHM8dtycsmH8PLUppD6qs5PxxAXlh:KACIppGqQxA
- TLSH
  T19A942B6163E8CA6FE5FD267490341C774AF3F4436462D79EAA98E8D62D127814C02BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  AddonWeapons Builder/select.pyd
- Size 31KB
- SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
- MD5 2663e22900ab5791c6687a264473ae1e
- SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
- SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
- SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
- TLSH
  T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  AddonWeapons Builder/unicodedata.pyd
- Size 694KB
- SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
- MD5 c0b4c55ce3711af914b2015f707e4452
- SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
- SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
- SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
- TLSH
  T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  AddonWeapons Builder/vcruntime140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH
  T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  AddonWeapons Builder/vcruntime140_1.dll
- Size 48KB
- SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
- MD5 68156f41ae9a04d89bb6625a5cd222d4
- SHA1 3be29d5c53808186eba3a024be377ee6f267c983
- SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
- SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
- TLSH
  T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32