f0575d5e85896a59207580563bb7d3ae769ae68083593f5c7a1d53355a15a521

Sharing

Copy URL Twitter E-mail

General

Target
Void-Tools-main.zip
Size 679KB
Sample260807-arvmjsthlf
SHA256 f0575d5e85896a59207580563bb7d3ae769ae68083593f5c7a1d53355a15a521
MD5 cc1e55f5e1e868eb86abda15e9f96265
SHA1 b9544d86e7d3c7d2c0e98383132a0120c2b32061
SHA512 23c00ddd9a93460eafebc1507d994b6248d70b0b36ef89a0819c5ec8d896fb5a9d004a23ae56ead15c9a42c798b7978401f3242de039500078b74ac38f7ab93a
SSDEEP 12288:H/ljDdZ3/m2Fsri21faNp8Q9D2li8QGEZwCLS8LgeoAJRSHLfs0yWO:H/VdZ3usNp5CDvEZwCe8E2RSrU0yWO
TLSH
T144E42367D312BD53C49062BAE80C87C2F7D7EC042890BD5C7BE268742A9F195DBE225D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Void-Tools-main/Void/bot/index.js
- Size 9KB
- SHA256 adc4b73d93db16e29b0394dea0d3f9525a4aa6c589036cf1896f81910e6e7c1d
- MD5 abbe2160b9ecdc2fe2f363382c73fa41
- SHA1 9819ce6afb5280972dd24f2d94ac462c3af4f203
- SHA512 39c64965ac38895d0fd76d69cfd75cda286f6330a16055fec85cc646f170d9f9db5283ea2dfe2db5c391541744552e8045676d12323773ff71bd1c40988eb97a
- SSDEEP 192:W0WuOgoEPF7g9XS6GhpXslKk0Xsl1Kz9N1sswd2amRh9S+MKTF:W0ISF7g95FV1U
- TLSH
  T14112853D94FB38253183D02E74BB3415576AB2079088E907F5DCDC546FAD95AA8E1FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Void-Tools-main/Void/tools/dox/en.py
- Size 14KB
- SHA256 f77f8a1254824889c2eea3fba55be62a972fb8f9222a52a6bbc2ab4fdf07d1a3
- MD5 9789e0361f5cbe22a547c9d9ef1b5526
- SHA1 530188ff62910c5b2aa47e11ebc8a07f08f65620
- SHA512 ca2e721c1cb2df6a4ca35fbc9bf76ad0c03ea5cd316f10623b4d549e7613b9a1772a91b60d3e5639ae2382b8368ac0cf722a51b41ea238d07d829a2882412c1d
- SSDEEP 192:bfqzhOxXKzgQZiFd23jYwEIjpuA1Z1JKegKWiIdrCtRTiuSkD3GotjS:O4drCtpBS
- TLSH
  T17F6206523076B1358E7A72230B7D4DAB1220609DBA9A05FB75DC70F01B1F658ABDFD28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Void-Tools-main/Void/tools/dox/fr.py
- Size 15KB
- SHA256 03432386cba19a15b84dfadbf2481a1c9ac86643e5ccdae874b68224679e481e
- MD5 0465b0cdd4c5450e3337c120ebb5bfc9
- SHA1 31fc472be5d2506dacc157d41661bbc5f95c0ba9
- SHA512 0b2a834ad2cb73f2e9efb258f22506dc9e9e1ab2873badc745823faf2ed130befd7d0df1bf175b22f815ef42d1fd5630fd1d4a15d857ef14812892da2664df14
- SSDEEP 96:6M2hlUpSgn3o+SEy/id0vMn7j0MS6Tdbg4jniId73JtCJPXaWtviC7grDo73:irDGfiIdrCtRxTuDo73
- TLSH
  T1ED62281070B4B032DE7A71232B3D4CAB652154ADB18A45BB34EC35F01B1FA58ABDFD68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Void-Tools-main/Void/tools/email-bomber-reset/en.py
- Size 5KB
- SHA256 9ff8a61da8387a2d6021d389dcf0997ec26cab84578d2410c028009bb303117d
- MD5 ec119017e12fd90298f31f63ba30ff03
- SHA1 36e5bb026c553d41f776f9bdf101b5aec0765248
- SHA512 6587ee73ff83bc6bdabe4edab70e004fc8aaca4106281c0e5ac4adc3032eabe59a1a27a15221027a6ca50bb84b1052d90f9ccb4e27a57ee75bb10985cb40b26f
- SSDEEP 96:hvg3cMBfgN/qN/7N/SZ0IJNzUNz6gDN8NBNv3GVNMNRNDEZC+NfNkNMr+N1NYNl:hvg3boN/qN/7N//2NINVN8NBNv3GVNM+
- TLSH
  T14AB1566484441C47CBBB907F2C0B104A73D679EB2CBE59B6F69C43C15BB193EED0622A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Void-Tools-main/Void/tools/email-bomber-reset/fr.py
- Size 6KB
- SHA256 d916790997fbad434c6417ca9fea793f717760022579fdfe9931f815ca3dd3f7
- MD5 3f4f1990032d1406959e863a7e626f4b
- SHA1 daf87e28cfee6039bb720718730ee34cbe8d4158
- SHA512 1a2128d43308b571a556d504b4a5a2f483d33c98bfc782c13f582bace17824756ff828c17edf3dac30f5321205a6140ba724d3bd927b81bd96bc73bfb0a53b08
- SSDEEP 48:h+gpz0ls97o1MEUf4Pozov5Kqm4JsnZ0IE02NPA9qaaw3G/yoEZC74Cr21pcDih:h/gecMBfH/4SZ0IE9No53G1EZCrrK
- TLSH
  T168D1FE5988481C57E3FB843ABC5F104977466AA71CEE5FB6F28C12C10BB4A3DAD4D22D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Void-Tools-main/Void/tools/email-bomber/en.py
- Size 8KB
- SHA256 a235d061592fec925d9d25fda3d776d0bf3825230cd531c0a718d89401b7165f
- MD5 f26980fc58f4364a2943ea19c25fe2f1
- SHA1 1f8704416538ee3486535ba7f27406435602aa10
- SHA512 4ecd6a207a0b6793eb715a92632d6938e06edaeb381808b707caae4cad635de247ab6bb728042970195ea8df3cb28ed846a02b903d9d507b5f7c10a119dbfc3a
- SSDEEP 96:ScTB3DhbPL2SsFn58TIIKVHDVmabvtXky0Eb5s5P5X5T/UqnDK2bkakKkYxeUL:xTB3DhbPi3N4Dy0Eb+hV1R5kakKkQL
- TLSH
  T1E002383256442725431A8C169CB0F82E231A7AE3CA3E703CF9EC50D52F25E7DAD959F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Void-Tools-main/Void/tools/email-bomber/fr.py
- Size 10KB
- SHA256 d497daf2c5b56aa388ba4362278d60454e6181bf735e3e7cc8db74a634618013
- MD5 bc288a7441beadf929eabbb76039ab7a
- SHA1 769b6eb3c5903fe883ef35f8fc121d7b5afe229f
- SHA512 6047c50a978226c8882bdba775506cccb7f3ad5158e31f3e006e8ef9b368a0d16d3b492655ca140013a0852ab608e9d28c8078dd63779e7febfa205ee0f1dad9
- SSDEEP 96:gkxNsYzekMB3DhbPL2SsFn58TIIKVHDVmabvB3B1gL5s5P5X5TfEeXja2LkqkKkS:93sYSxB3DhbPi3N4wSL+hVVL5kqkKkwV
- TLSH
  T15422C93266442725434E8C1698B0F82D231A3AE3DA7E603CF9ED50D52F25E7CADC59F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Void-Tools-main/Void/tools/email-info/en.py
- Size 5KB
- SHA256 f1e788f7402e3b66a7f187441dc17c64b6506343711927cbe5e07f42a6ffc573
- MD5 00f8a8a4b1235d5751e843cd1d913811
- SHA1 79bc348769ea5a79fcfdfe2faf8cdc724333be5d
- SHA512 84ab8c0cbfa1b438b4951a1ef5fa875da052a519701c3f43e6bbace5e77096e3de4245ddc4a6b072d5985b2cb1a211a24cba808e4817be7599fe2309c3ff7d81
- SSDEEP 96:LUs4i52okLx5D6rpG6erNjzrIovWmtg9Q+Q71DOQPTxs9zWW1SbgF:LUq5iL7WrpG3r5BbPOzWW1CgF
- TLSH
  T1C2C12139891428865383D408B89BD4131B6379030E4D78353B9CCA68AFCDE77F5BB6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Void-Tools-main/Void/tools/email-info/fr.py
- Size 6KB
- SHA256 bed13b3deeb273133d0615a6884943536d40b2dc222bcbfe2792c08a60eb8c5d
- MD5 3a024b603501860f87211ce531248efc
- SHA1 8f15bbc98891150bfc73a7014a01fca47ff38307
- SHA512 ff7ea906e339ad94357926ae1941e664154156b2743706a0be63995d3405cdb2bb694a85fbdf45f076135eb4623c33be38709f42b9a7b695fafdc8617ea1a7cf
- SSDEEP 96:LUs4i5I1Yf76rpGnder88qLSmPRPH9VUZO2ldOQPT0s9zWpGHha:LUq5zf+rpGormNiPTzWUBa
- TLSH
  T111D1222A891468825383891DF95BD1171F63B9030E4978327B8CC6785F8CA7B61BF7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Void-Tools-main/Void/tools/generator/en.py
- Size 4KB
- SHA256 a7119282e193127c800c4c9467679e620624478552cc95a643764d1aa8ace41f
- MD5 599da25536a610296fe0ba84453b4c90
- SHA1 a09e4068cdd0339e0f733e59e3a3ddb061b8a37b
- SHA512 7894a539ec471c4ea7c26ada5e6a65d4a53724800d65bd9f9dbe838bca0e7eaeb281983228844eb18456d95221039dc3cdce7ad04c58620518ad94bdd4ff93f4
- SSDEEP 96:eWl+5PaN2oytc4KZldPFjlV1f8/nqzWmIYfbjTwMnCwV2jcPUKb/i:e95Pa1ytvKZldthLdWmIYLRnnt/i
- TLSH
  T103B1F061C870086242C7EC58EC8744692A7119434ECCB9793B9CC62D6FDDDBA87A63ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Void-Tools-main/Void/tools/generator/fr.py
- Size 5KB
- SHA256 9974b3f8ecd1141dccb4201b5d32f10f8fffa3304e573371a721708367238dcd
- MD5 9c00cb47ca931cf049186b73e5274b04
- SHA1 d460cf90e4bc8f7e6828ba7fc95105a5ad5a67e6
- SHA512 468779ab66a982361833750b9dfece841dad220f1f7a5f7d32fc31c17631b8ba0de5f89ef7a2c2d529c112278df18aa94fbfe308839a6224798e9d165554ef0e
- SSDEEP 96:rWl/2UFA0TF/IIf8/nqzW7BhfbjTw4c/VhPAsA3Ui:r50ZwIdW7BhL9EYUi
- TLSH
  T1A8B1DD61CD70086192C7DC49EC8780292A7119134E9DBC393B9CD72C2F8C9BB9BB66DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Void-Tools-main/Void/tools/ip-all-lookup/en.py
- Size 6KB
- SHA256 705076f5cc11a456f3492a068f9fbb5728e68403eadc3fdf7af5709ba2e3ae1c
- MD5 3618a0742f80ffd89669738bea5cc00c
- SHA1 988685f5688c68caaf7fad1331517d8e6dd622bf
- SHA512 2d7bfbdf597e8a6cff383c2ee8dafc22711ea9f1925f7483beae719474e7780c0f471fa58843b056815ad72d9c39e0ecedabc9b023e49a8d8e283ab4fed2e52c
- SSDEEP 192:lBnKaLSmAy1U/ysX2B1nhuhKeYhWcWRcaTF:ll8czB1huhTYhreVF
- TLSH
  T115E154298C702402E3979448EC9754386F616C131F89B9393FAC83682F4D9BAC17A79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Void-Tools-main/Void/tools/ip-all-lookup/fr.py
- Size 7KB
- SHA256 ffbfb37bf06589a81067c0afd3dfd9d7bd19d8b8120f83537e91db9953bad22b
- MD5 53f3c57560367bcd364de18aecdfbfcc
- SHA1 9bc9e7a573e717962d83d6678425eba62fae4242
- SHA512 674872c0b5bb9e4c010532d1841da8d564ecb374e01df8cb830e582fc0b9beb843d2c348e9cb7c56ae44ad099f65dd39ea42c95fbea71a62ee939db5370cbfac
- SSDEEP 192:1BBaMqZvAo1U/hcpUcsK8ZiNU1yVOrM2g9hw0FWsWWscUHf+a:1Zceh+jl8ZiWyii9hwoo3rHWa
- TLSH
  T1FDE1846A4C603442E397A44CED539034AB656C231F89B83D7B9CC7242F8C57B81BA7CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Void-Tools-main/Void/tools/ip-generator/en.py
- Size 4KB
- SHA256 b44a4aaffb94d037b23bfb8a71c1565a8367a6522c4fd36347759a71fc949680
- MD5 3da5da41d1c45e9c47f0b3fc3185006e
- SHA1 8403e73ff2b107c6364bc569acc148678738da7e
- SHA512 e3f8654a7282f91c40a9afb1f72414413b34c34cfb52baf8f94dbd01049ced8270ff5db249c7fdd6a1876b7a7c16d39aa664f6bbbe94f9e7356ca8e1d48213bb
- SSDEEP 96:sikp3j9KLLyK34CEsvn6hzWmib3HZsgGBbF:sJxKLLyVCQzWm/7BbF
- TLSH
  T11791ED220DB0142182C7E814DC8780296BB128534BCEFC7A3A9CC57E6FE95B59BB539D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Void-Tools-main/Void/tools/ip-generator/fr.py
- Size 4KB
- SHA256 3d7851820aa4deae15b03b28e524ce71ed264b52267b316424e541d1fd304c6e
- MD5 05f5e921ba3e1b0ea96752642b99e71a
- SHA1 549906ddebf9913a1ed3a4e4404244b8b0e910f0
- SHA512 2e5f9306053097ee214c18aa6c93cf16d7be2d285dc472a83e90f86efe72c3a16654d02bbae90c9a4b6a13c115d6c02df4a1054b1729a38c1b7aa05581a4b198
- SSDEEP 96:siOpaj9KLLAPGFJsvn6hzWNzEbWHZv/ba:sdyKLLAOFZzWN1/ba
- TLSH
  T131911D620DA0142182C3E814DC8B90186AB128475E8EFC7A3A9CC6392FEC5B59BB57DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Void-Tools-main/Void/tools/ip-localisation/en.py
- Size 2KB
- SHA256 7cb06d8a5c04ec33dd9ff0c09ade669272adb39eab5cb25ef4a83c403583b0de
- MD5 6b24cbd5afee3764a613314fb1e7de58
- SHA1 793442c715070d74efdb77bcccfe368b8661b2cf
- SHA512 9a1350fdf8fbd4b99c61e885c372d1a046b7d371572acbcca4ac99c4a7053d7e2c1dcff1596beebaf145ebd1597b7ac216d960e865b7cfe21c2711d20163bb3a
- TLSH
  T1BF51EF2D4EB41811E3439844EC6744281AA1AC530E8DB8253F6C866C3F9D9BB967939D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32