d52b31709a5a32ebc0c1c4f319c7d69ff367231d0ef10148210a8713d72b5da7

Sharing

Copy URL Twitter E-mail

General

Target
_Getintopc.com_Hex-Rays_IDA_Pro_7.5.201028_SP3x64.rar
Size 401.1MB
Sample260808-dnk6gsyfng
SHA256 d52b31709a5a32ebc0c1c4f319c7d69ff367231d0ef10148210a8713d72b5da7
MD5 da441ea92f7a9553f2c230f17ff74e3c
SHA1 b447b1885ba5832dddce5fa2e6c74b2821815efe
SHA512 524e06af334f9d95378d59bee282835e60d10c20d25cdcaccd2218fabe29e0e0779d6314a90d05906652d60c41f9b30ad6a1553eb0bef9571092bb2485352726
SSDEEP 6291456:g25VuJnKl3urz60jZrp3veqpnVBltFAdeGi9pBRTOhbfpb641eez8+u7c0n7Rf0c:go+Kl+rz6+heqpnVBZE531eeLu5N9
TLSH
T14F19332325C3118EB936621C6FD105D82326B0BBFC753B2C79D7BEB96A70795E04DA06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/dbg/bochs/sdk/bxtest.dll
- Size 4KB
- SHA256 0c959015c28361c05c36ed107cdd7a50fd55c0fd43538372a529c0f55794bdb9
- MD5 256e70b2d93e4b85012a6c542a77e7be
- SHA1 68e001a83bde62d115d6c52c12fcf3987ba7ff9d
- SHA512 eec69f39b5f54033b373f4a406685808c816872f3c90fa7606f84bce76b6a5f0ca2124adfeff71410adcfee716e9da4fe3c338e4942f9183ba6db36fca844017
- TLSH
  T11981EBA2B3A60572F56443BE89CB881636FD7020877746D3CDC4618A2693DDC39BE793
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/dbg/bochs/sdk/test.pe
- Size 1KB
- SHA256 339f1e6eb9759aa38d16babf392f82cd2a8641a5bac19788af23351dfaf3ab8b
- MD5 643508444fb19e70161d3ce6cafe685d
- SHA1 3ae9d6df9071f20d0bc198bb90dd9a4f431e8c57
- SHA512 1d3d94bf66b74778808c28470e6a9d77a42108399455718e0c7e86d014cad5fe1326e9937d14b8e7ffe3bd75b4b155bb2aa5274d866f9c2ed8a164b9f546fc31
- TLSH
  T1B0312B8B81989DB3C2DD03B11AC79006B1BD043C03E386442DEC503AA4757F4A4B8B16
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/dbg/debmod.h
- Size 25KB
- SHA256 5897a7e530b9618ac9d8fd453cd80b2bd0c4aef4659726b56c22497279150d3e
- MD5 59220bef4dd6652996557f7ce2ae9375
- SHA1 9750b2a6c4cb73093cb95a39b340ae72978da1c0
- SHA512 1d71c0c2594b33129d910a2f6e2e48126cd6826e0ef6cf3bc65825685e15e484274a0f2204275527c49f905e5e4e9f5e1a7d13bd5c0f3524f418d07f3689dbef
- SSDEEP 768:WWe9yabEaEb7XDCBabOmhjScSlnaNPoz2MRYCz+yU+hGARO/VI+X9BR9s/IxfJah:WWe9ya5fnhaNPmMjAY1pFGd
- TLSH
  T195C2B54B1D71805336C2D1796F472042E925C2527B98FFE5BAEDD8387F0188CE17EA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/include/bytes.hpp
- Size 94KB
- SHA256 b117666c2d277318089608f7c309ca8315513d1ce5873265d76f1c6c9b8e34df
- MD5 e0002c952406c91111eb812fe6ddff13
- SHA1 476d9abff6002f83f9c0ea9b5385f04a6b64bc8c
- SHA512 dc751ad4299e368618c0ac907daead8351c13a21f4451b6ea763337d382d0970604d7bbc78cf92b17177eb2f2bf36106c7a9ef30a1717f486ac89c76542cf317
- SSDEEP 1536:dgfsbinHHGSERVM45G4pEtCXuLWJrCSChUufUcKkel/ZPO:dgf2inHHGSERVM45ZpEwXuLWdCBhURXS
- TLSH
  T19A9381057EB193120969F1A21B4E2087FB64E451F3DCDB68B4BE8A34770987DE07D58B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/include/intel.hpp
- Size 37KB
- SHA256 35676bc3dee339ec89ba864063755ee6a5153f8272a5795ab76f9258e3df018c
- MD5 068272ec2dbc36cdd560eafa2ae15525
- SHA1 d271f3b042a630700fc8554a129e307384eaef44
- SHA512 17ccb3fd5429c49da23beb2de1a12639c72e3b3b204d81f4c940efce61200dc7a523756dcc0ccaf62486cf9009189a7a1840d4c4eedc46049300b73b929ad207
- SSDEEP 768:1aOXmULaA4ILkodLkfZj5JLZUAD7YAN0fAujNOJ5EBjdU:oOHLaA4kkodLkfh5JL2ADujdU
- TLSH
  T1590364503CE2B841ED35C326278EB080E51DAC636B8DAD997F4EC3645F4901CE9BE5DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/include/network.hpp
- Size 14KB
- SHA256 8c089986b6bae898c709bb98f7c6a788c2adc5206116b01aaac47682ba709784
- MD5 cd46172f1838ce8eac9771a0c3c5a9ff
- SHA1 9227f868188c2cf1777e1260701d2a9a98f28fdc
- SHA512 388eb6857106b31817ab3a0fbeda998f33547c5d8b0fa7ea4e2e2b8eae45e4bcdfdb4a5b88cb078cdc536a07384aea7d0fc2cc1cc12238dca8cb9ce787ea7694
- SSDEEP 384:xJXtfTv+d7h6o0CpBdZavrsWAqy+eteNAZy0+T:xJXc6o0CysWAqyTfy0+T
- TLSH
  T1B562A3080DF2449111B5C615772E2682F219D53723A5FAE8B08CBB2C9F49508A2FDFDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/install_make.txt
- Size 4KB
- SHA256 fa9ff2520a857675eabc8d6c38d9b0cf625525f290e211140950b47644d19a1c
- MD5 b5d7d8636b8e72c1e74f350af33de997
- SHA1 30c08def1a8a740bbffdb8d6ddc2aee747e9c82d
- SHA512 7b2a5ba75c068691fd5260bfc87d5f2af19d951be766c3b80f7f7c3a9c6a703ca20eef8d29773bd67f0e6b520d9387a960f35a46703b42573b1fdda27ef3f480
- SSDEEP 96:BGjBdf42jgzi7LjTbtFMfGKR8+k48sKWlN:g48g2njPfg8+LzKS
- TLSH
  T1EE9178275F54A6B75161C07167EFC3FBD722557B0AA82929384C0109BB2771123FEAF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/ldr/mach-o/h/sys/cdefs.h
- Size 28KB
- SHA256 a2b74887d3b17f645236af9c8d7a37e2521e03872b4bb5f1807c717237f64f76
- MD5 c7808bca1fd6ac61bea1ccea09e4e2dd
- SHA1 aa3506f0163ea63a4dd1addbfedfe54d7d401f55
- SHA512 c48d904e32fad014e5ff853225f72d1021ecc5e07106b15dc22fee75a07f65aadb065440b1d57e05c776a08fcaca2f6c41d4582efa8eace9aab5dbe9e41713ab
- SSDEEP 768:6x58+dco7/ftrAirb6WikVCk11bgxaxAhOvRxElkfP2EWM0vv720R:wG+C0/xv/TV7gxaRvkR
- TLSH
  T1BDD286F60A9A6163406311A1544D44C7A309C9BF6FA175F9F89EA88C2E0B42472FDFDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_linux_gcc_32/libida.so
- Size 233KB
- SHA256 44abb5b101ae5311691097794982522db2262feab796b2d94667e35f64ec2937
- MD5 8cdad41dd66004a85ca76872857e604c
- SHA1 27e60c65b2d997bc711c27f29504b2282a8d2324
- SHA512 0493a56b3a398f001404461b772e2aa8dc6f67b442995b5609fd539bc5e77c0e609188ebc1382128697bbc3b7981989540a176f4d5b60ff0b13be8a23b7ba41a
- SSDEEP 6144:K69aM0POSmeDyjwcKD4Qe2SSC5VCYP29:K6P2OSmeGUcKiz5wYP29
- TLSH
  T1DD34080B732C8B8ED0C596BE0987D258C378A1A1FC275F67FA47675C6D401A9B6070BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_linux_gcc_64/dumb.o
- Size 430KB
- SHA256 e60af0a2dd37d2c488be37e87b5d0a9e62bb74a908a2fa325e138325fe984b79
- MD5 3442082a023894a1cd0d5a4582dc535e
- SHA1 6477f31c64921185993b307a32dc48c557824409
- SHA512 fdf4816dd017bc02e08d7e93d2f8e5e43defbcf612f0381b22fcfb56b39381b465dababfb970420f839d748cb2782ef04e62f753cedbfcc2be3269f4097bd369
- SSDEEP 12288:Fh5fvn3/fcwTcGRb7r0Fy6vfmg9ST/eL9JRSj:dTcGRb7Y86vefDeL9JRS
- TLSH
  T1B594811B6F11896BCA6D4F3154EE23202361DAD7C9D06FD78BE405F88DC3688DF26926
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_linux_gcc_64/libida64.so
- Size 233KB
- SHA256 b2ba4eb7f6a22aa7c6e77bc434740712a5eac5b12500a1a71b4b591811982091
- MD5 c1df66c4eb0cd41e977cb31e2cb31c0a
- SHA1 ad1ec8a6a5262806a72513d6a4ba4c9582f059da
- SHA512 3c3718bcb0df19d5995ea056232d844556ec80ebfb53a433a1b7feaa46c95453f22b847c1b106f5aeb0e84fd88d2ca30d20556b487ba7816e35bcca526aebee1
- SSDEEP 6144:Z69MZ0POSmeDyjwUKD4QeIs/G5VCYP29:Z6M2OSmeGUUKCe5wYP29
- TLSH
  T1D634080B732C8B8ED0C596BE0987D258C378A1A1FC275F67FA47675C6D401A9B6070BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_mac_clang_32/libida.dylib
- Size 115KB
- SHA256 9b768dbb9798c21ed10b0a6008ffefc7d7821595acb66e515f3e77f4c470c138
- MD5 2589bb84c71e4bb0cc9492d0125cceb0
- SHA1 8fd2993c9856fa6d13586a98c57fc1fd4e65be5b
- SHA512 1609c87cf3ea7ddd6637b8317cf698ec4b22515dfdcca5669b1420f55b18a0e2fd008538cdb3846ac0255462fe07c1524a4273291c8fdec60e1b8b7fd2d93494
- SSDEEP 3072:9VaYfKxvhO2uZuxPq7/G8wcRgGOBechGGC9EYUUl:ewKxdQZ/zw1NwGCSq
- TLSH
  T173C32903563EB92EC683F675C8E715247113FA9282436EB6CED4D6F80881ED9BD4252F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_mac_clang_64/dumb.o
- Size 239KB
- SHA256 f6f1f282008a9a2be31807a467cddf0ae9b21f9672acb19f20aa5ae0821039b8
- MD5 88452ec5e9f2e455f5b8b6a3386d71c6
- SHA1 a4607c96bccf1c50421c6448d3ba7f928a397820
- SHA512 8d8a0d3447cb451f7a7b919325feed6d8b814b2a0365671a6305828bb4eaca473d89a52c22e2ef857b79f466980a6acea30e3cac2e736a8440533e0f74879a88
- SSDEEP 6144:v4sIZrKBsRcMA1/zqD+Y/+hTE1w5+2lpdOy/q2vvqNz:gsIZrKBsRcMA1/zqD+Y/+hTE1w5+r
- TLSH
  T1A734C64B1F0AC512CC9ADD312EE6122022325ED5CE843F65DFB0519CDE4AAD97F0E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x64_mac_clang_64/libida64.dylib
- Size 115KB
- SHA256 6ce8e2917ce49727b97558f7e55a77f86806a9f94bc6c3cb90158b800fdc8d64
- MD5 b37f761d1baeea9cfef3bc0501c55de7
- SHA1 bf944e97d133573279742d86d87feefdf86ce90b
- SHA512 bfaa1fe7e4411df9c94ef2f7e3d3b1e3055d6e296d953aec1272f8bfa8f61b92dd6bc1a8ba6de000dd32e7e31e754d04c22298ff615ca0c1269ad1fea7ff65f7
- SSDEEP 3072:cVaYfKxvhO2uZuxPq7/G80cRgmOxachGGC9EYUUl:jwKxdQZ/z01hwGCSq
- TLSH
  T1FFC32903563EB92EC683F675C8E715247113FA9282436EB6CED4D6F80881ED9BD4252F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x86_linux_gcc_32/dumb.o
- Size 303KB
- SHA256 ec949e2677ee8c387a1baefd57d7779038ed19828dd9bccdc09f2c71cdfcf741
- MD5 a0baafba0f2ec9bbe1353b7047ffb191
- SHA1 8e78687b2e7a0bd3200f72bc7c7c2869a9e47cd3
- SHA512 58710748aa87f7e2e1e46ed1148aebd51db55818147cae4853e8c3074295de0f6fcb36a68c627723fe00249b4977420525159f11332d7c0c55eafb386b09d275
- SSDEEP 6144:AYaQDHIl4N+HvmSoR9U5eOfWHn0ZLjaYKV1dS2LUhTGOwApKPBY3JYBqPQ6CJ5Rb:A7USAdS2LUlGOwApKPBY3JYBqY6CJ
- TLSH
  T1E264D5577B569861CCDE8D3450FA1310E322AFD1C9D4A767CE9056E8CE86B8D8F0ED22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/lib/x86_mac_clang_32/dumb.o
- Size 236KB
- SHA256 beecb0f5a0954a094128eff6ebda8dab2d243de7dd7a8c7cb426f1746a60f6bd
- MD5 c320f0a29b0fa18b76a16588af8d0238
- SHA1 ad321b614800a528f83235d53726093b9f032333
- SHA512 68333d38e3357d8e1cfeb617ce3a00ad0b7b36331cf60cff01ee64f2b2cac4fe051d652cb7837c12aab2c091ebf23faf802dc83b5c191d72dcda1c6dc7f74f4b
- SSDEEP 6144:xTYSw/lu7D/AyWrqD+Y/+IBl9w0+7zHEZUqMPnmOnlPbTNz:xTYSw/lu7D/AyWrqD+Y/+IBl9w0+7zI8
- TLSH
  T15934C8470F06E457CC5A8C312DEB122022B25EC6CDC86F95DF644598EE89BE47F1E26E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/makeenv_vc.mak
- Size 10KB
- SHA256 b821399e9782159a1bcd7a8b7777ca564b6bbfe3a07de010854e0d83e070562e
- MD5 d36380fd4e7e07f298d58c41e1446ffc
- SHA1 afd83748196427d6b525bbc0c71d6f013ab1a965
- SHA512 416f6fe718b89a11a9d56f9128f3e9c5c5215cbd9d909d425513059cea5ac11dc01ced99dcc7a10b528981c401b2d717ebaa32a8ab2ca2e00f5284aee6900a8c
- SSDEEP 192:135KMRSV6qkXje0Gp4Z11I79wsMIUgaXWXwU2Xhtx:1M2eXKZ3IxkftXPx
- TLSH
  T1E322C725381114904E2232D6853DA1D6A3BE38AF2F934C9870BFED58D70855763BEF7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/module/78k0/emu.cpp
- Size 2KB
- SHA256 b1b2acb3f71c5f6e2e778c7d4aef05ef23d7ed11542d1840e364124888e9a607
- MD5 7bde405c6290e8a3c1db88c6f0047384
- SHA1 56057fa4d068ee31caf2afe2585a5ddbb10eacb4
- SHA512 706a15698ba6e8c7ea9e1a0519dd13cb2421a14f17a39e35809b8ecc14c0be64778ed2e8ac093613aebcce4b5800b3d2c9481c38db454c265690cf5f430ae968
- TLSH
  T18151FD8E4CA10457BB33D1F44B9B2C54EB8A89930340E8D83E5DCDD4AFD49A161BDEE2
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/module/avr/reg.cpp
- Size 22KB
- SHA256 81d8515074b9e7fc69c2977308693795649552c9e3705d18ac4ba54a7b93715a
- MD5 d5258f91a297898c0f3b851db724b714
- SHA1 bcf6f15f5e59bc5812062a1e5790594230a3a156
- SHA512 12878d74872abd1eb4f6cf0c11ad5721d4111e6189e1af01aed69f7b4f9915a7b272ea38d2cfed255bad92acf07a76c9e73961780ff1b52ceeebeca7b85cc173
- SSDEEP 384:e2oR2xHkFd96Udl1Fo2yzfRk2EpIAi2XWk:LoR2SFd9X1efRk2EpIAi2p
- TLSH
  T165A26549AC6354921EB3C97997537802F6848A132324ECD97DCF9790AF8D09A81FDFC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  Hex-Rays_IDA_Pro_7.5.201028_SP3x64/DOCs/idasdk75/module/m7700/emu.cpp
- Size 6KB
- SHA256 fd6562b6260d1813cbcc32d4fb6b39d51e843a33b8b9a91130fae1fcf7c234fa
- MD5 88bc7359bc5683e28519c13fbd00c404
- SHA1 65cd47008250abf286932a0b2e97ade3872a4c14
- SHA512 aecf69dbdce0a065228d34fb268003cdf7e864f6c971a9bbba240101f31950cbd7dd9108c5f477bd941f24dd6209dd6efb234c8427a84cb16b9998da37596acb
- SSDEEP 192:kLT2AsKsXRtIknZeBCyZeMNdpGaL2N+W1PCPZ0ooCWh:fIkKPB+d16PY
- TLSH
  T1C1D1EB8A6C75245BDB33D1750B8BEC05FB0158072384EAA97E1ECAC4AFC4078963DF94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32