e25e6fe970d05be707b7f6296ad50f00d190aa3bf873fac7b4a45c2a770508b4

Sharing

Copy URL Twitter E-mail

General

Target
REX (1).7z
Size 47.5MB
Sample260818-ewet4sfc86
SHA256 e25e6fe970d05be707b7f6296ad50f00d190aa3bf873fac7b4a45c2a770508b4
MD5 b8a8aedef89ad02ff9495ce1ecebb27f
SHA1 5d8c56afa97c054f19f26e45bddccff56aa972a4
SHA512 2a04cf033a36d1a04ab0bf1c0cb2110c8925141978409abbbd86d883039d7e7eeabfeb36b56651133e0b1d17a23a9553dfa8bbff8a8b7f552c7f7687417acde1
SSDEEP 786432:ts2rp6eaDjWtuktCMmgOrXbcZlyFptkLnuGVT3VT00UmUHGV1BD5y9ub5zLT69jn:zaWYkYAOTbcbGc7FVT3Vwiy81vy8bZve
TLSH
T185B7332AFA25EC2149E9FD50B89B6FD33F087A54D4D3915E0633152FE18584ECEAD328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  Alexander.bat
- Size 39B
- SHA256 a96f29a254f80d4e4bc3865d663bd32face7f4b113aa562e81085743abd8596e
- MD5 5cecb26595e1d4a9e7ba4dcabad73066
- SHA1 72cc3df30eb44fd129dab1b4e7630db0e526418c
- SHA512 6026b02c00ed2558bc279c9d51802358fcb90cb6876f98fe0edc4a44d991bf8325d9fd9bea56a4693d5c47a385685d4de03c67e7e59be0b3820e9119e17bd1f3
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Barbarian Invasion.bat
- Size 38B
- SHA256 0db11a7fec476477070490bf3cf62a7041d1147a69ec84624b40f01c0c0deda1
- MD5 086aa136ea20a4f15f494063100042c5
- SHA1 f8dcc61e92fa56ab1ebf43d63c2ecb5a8ad54cb1
- SHA512 59c540461341658b0050734a6830cf053c178a6a1973d3969c676a08799007a28d669f53eeb77f0b6c04b475bc1918a7f621aef376542b36a2e8f1c46a0caf85
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  D3DCompiler_43.dll
- Size 2.4MB
- SHA256 a230640cae56ab188fc183f85f5fd0681be6ae2d80e64744434a32e18364579a
- MD5 4cf151c02e5d151aadce9501b68ba518
- SHA1 abb04788253a9de7a43f63a0b590f4d59e1d586c
- SHA512 99675909d09092d77bdbc7529dca0af3c43893b2fb37927d0e50e30fbd8c4d1bfcbfc8f5a55158a3227ec36e3cada4449687a6078b517672af70913d6ba8a481
- SSDEEP 49152:Af59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTc:N2642o7lftg
- TLSH
  T183C56C46B6A080F9C6AB81748A975703FBB0781403245BDB5160E6656FB3FF26E3F724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  REX.exe
- Size 24.1MB
- SHA256 34994dbc2cac62f266f5c3a145ea021ade8460369412752270a6d851f2f55e0b
- MD5 e8577f895347f07805879de5eb255807
- SHA1 17ea562b9fbcb2ce59eab93654cea1e016ee8312
- SHA512 bca4cda224c70c1f23e803b249de90405d7929276b5f3b8d464df91563da5942cb29fea686f44a35d3a2448ae1baa20100dc607043db4c30f9c37fd08edae6e2
- SSDEEP 196608:yLEYx1uPluDiCHBvz7Bn3AO+e722A2688zUtoCJ:ihx1tDXHF7Bn3ATA2t28zUtf
- TLSH
  T18447BF06B39021ECE20EC27C8DA6DA23EBB2B84957311FF75250A9196F375D06E77670
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  binkw32.dll
- Size 199KB
- SHA256 fbd982ac4892ddc938d0c4dada1f969a7ec3c420eae7302f5f1a9b19ef02b44c
- MD5 a6983603af8b4061e3afc4a619df5838
- SHA1 46fae7d148a871f5b48ea02faaa88fedfd5332a2
- SHA512 82203d2a7e6de5de5898ab2e7caabcca35ddbbde77e6b14bde0372dd3252a78e0d06548f1f2edc7dafd1abd5dbc82532152d0f90690db91d52b8409e95302d5c
- SSDEEP 6144:9bwvJHFxfKlPvmXUYU7DV2y6ZD8bjOlHXcF8X:lczxflUSD8bjOlr
- TLSH
  T14B14AF42F5975DB0E4CB2EB600DB2B57DA242F05C32991E3A3642F979B72AD14D393C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  binkw64.dll
- Size 311KB
- SHA256 fe45019207f213a9baf8c381ced5e057a105685e5e7a5a64f17757f71d5d3972
- MD5 8b6d6a0cc466028c96353a461e4dc949
- SHA1 0ef154ec0dffbb60bb27b180fdefbbf9b77c01ed
- SHA512 580c79e4116337d62f25614dc86f3e935716ee4300d5ed3426faaeec168dc203e5e60856e640acf43dd105dd1bedd62a7c4065c27cb20fb8c0452e923bfafa1d
- SSDEEP 6144:X+FIRbaVDXYM0xRt/lo07SYLZHP7N7YPYQA7svT1XYwHG+R:XZbsYM0xBo07pLT+9m+R
- TLSH
  T14664AE02FAA054E8D467803485A2F667E5713C090B6446CB1796DFAA7F33BD06E3F792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  concrt140.dll
- Size 367KB
- SHA256 397d7cab8542b07ed5d57972e20d5f315d6fc5c57775d8fb126cc31a82095f7b
- MD5 7e16ea18e43b6ac78f8e7604eb6e3af4
- SHA1 4468e1c2f658ab05500c266a4dedff688563c392
- SHA512 68794c6faf18c232a2accdd0c0a02b42218e6e913062ca75c83ea15b3b4c2a8ffeb18f604330aa5f3ae7aa482f232ac41ffd43a693722f20c909fd3b8ed847f7
- SSDEEP 6144:fMsdTEdfqnofVgA1K0rSU5HSjPxJpcYRrmdFNwnWzgZWuF1wD:udxfVgA1K9U5HSjJstzp
- TLSH
  T1C9845A9AB2A808E2E522D03DC653C50EF6F778406352D6DB1250875E7F27BD4D93AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  d3dx10_43.dll
- Size 510KB
- SHA256 bb5a06d4167ec54ffba7cdf1aaa3ca924d887a806d0777a189a60fbbdb75e523
- MD5 f6ec4b9894f7e7ce9f3916f0b605f20c
- SHA1 d4403efa96b9ece891700532f5c1f9f39a1152af
- SHA512 e90d7fa7027bae6e8367ec24f0d88282d07f2ec5fbf72edc662b50cff945a485716ebe52bd712c7f70cb759d1ca8ead3b02c34b00675264460b8b0a935a96c9e
- SSDEEP 6144:gIHyAfFvQet8lzb3f3+UHWIVPfkKS7GXzeARN85BwC5uhFcuiZyoO2uwpapnlJRw:9NFoet8lzbv17VPfkKS78zBN8LgIappw
- TLSH
  T112B4584132B8D6E6F13D653CB0AAF60BFA7135580B2046CB56B48069EF66BC44EFE315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  d3dx10d_43.dll
- Size 566KB
- SHA256 5c3dd909d1e0d2e1312b895dba23c6a87d1ec520347be4a7565cd1974fc09c87
- MD5 f512b3ac323f02bfcdcfbb1fd80ae8f7
- SHA1 883cd7ef782563fb4fb6e1c4036c72206c25e1af
- SHA512 b8d8f73257cc8d0a1e406d4ebc6246e24494e7c68d2e304300b6a86599ed6151add4693300291725f05ca93ab5c73176eaab1c01e61c6f105484fe3ed36ed66b
- SSDEEP 6144:+rONe6geY8qq+ne6S6tsZsuvGnBfSmSQB6GtNWuzxDyKKqWru48ZEz2GPicFP:+UeU+ne6S6tsZNenBLSQB6SNWvqWb2GN
- TLSH
  T1E4C46B1172B8E7E6E139513DB09AB64BF97130180B2082C726F44869DFB6BD45EFE721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  d3dx11_43.dll
- Size 281KB
- SHA256 896cbfdff00ef1576af09cbe7b35d19307911ebc600616ed025a1b2ed2d02aac
- MD5 1edd71ea2395a7e8e63c10638771fe56
- SHA1 d8cc16a5999064f90329629994ee91c10a82ed2e
- SHA512 9aa14cc2731427d520a152ac425188bd79a7016a55efd0506ca2381c7dae8345fb1e8c342581b6a47f736101db54dc0df3b0f8f529c022684e2b52d36378f814
- SSDEEP 3072:pCWVWFOaVgP7BzvjYlTc91N6Vkg4eK6DvDBcMqpcJbMYBu1+Iz54+vJ2s:LWw4gPdz7YlTc91i1DLopYMvIIqs
- TLSH
  T183546B5237899CDBE4B9A83CD0EBA603E3F1F5950B60D6CB0260855DAE777C09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  d3dx11d_43.dll
- Size 311KB
- SHA256 c4ebb01bb069b8f815cf3e146052d3dec8989691e1a9f5e49088f9a2178e4a93
- MD5 afce9742377b01d6f710cc44540ae5c2
- SHA1 87fdc5f4209e54ab3f84bec5fad540902ea96a9e
- SHA512 ad9fdf825e1f57619974daa899aaced66a7970741cbaed310a97ee2b1dbad2bcfafffea0370d1a05fefacd16a8526fa0d9604055e5585934c751a466c85a37f6
- SSDEEP 6144:B5H9B3WaqxYp9ZxQJ5H2FxPDiXHUu7Hzgq:BZqyLxQCcBHzD
- TLSH
  T140647B113798E8A7D0795039A1EBF223F67279441B6892C77BD00E8D5F76BD01B3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  d3dx9_43.dll
- Size 2.3MB
- SHA256 0462477891ef36fea66e0e79157721ee989f47edbd2aa75f5ea31662faa81424
- MD5 e1aff84b4a850a79bfae452d864a2d4e
- SHA1 16f99d2db0dba56d79cf60abc09d4155d3017ca2
- SHA512 c558d17bf3d9cf51c99bb3b9a8789fb31c258526b45bf19f5324541f1ff8067ed80fdcf1f6beac2050966777096025e2d318b09dff0aa64b37c389b102126f7f
- SSDEEP 49152:RbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64n2:EIIBn2
- TLSH
  T12EB5486172F4C1E4E3269039B597B20BFAB1304907188BC793E04D9A5FE2BD86DFA355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  d3dx9d_43.dll
- Size 2.6MB
- SHA256 ea4e8d7ee330fcf0e7846534c85c3663dc0aaaf7cb393ce1ffc663cf5b518350
- MD5 d57621e7881f778c2cfbdc3a1742ca2b
- SHA1 736f70dd16fc2f995e293d5067aebd02f197e44a
- SHA512 a5222f804cb09374ba10efd02d5c20f3038bcb9b8bf4cd6d0336ccc491aa580b63e45afce657e795c75b0dbf55d5d64ded114659cea5e18c233807d24b02a84c
- SSDEEP 49152:LL5W79bCsT6TA69r9R6OGykEzWCFC6mkAWb2zCeeYBKyCvUM7w:PSCONiE
- TLSH
  T1E3C55A2272F4D1E4D7268039B59BB307FAB4305913188BC353E04E9A5FE6BD429FA365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/descr_caps_ex.txt
- Size 7KB
- SHA256 3bd417c76568b91ea17697a17f9f8018ac28b5acd3dbf2cc1d03438b920e798d
- MD5 8eb6c31a7210f3a52b56c9cc930adffc
- SHA1 cbae4050a36459b115c4e463ad12158a47fb937d
- SHA512 c77d17a325e40b3f8f8a565fb873835bfa4414de5f5719ba74ce7d73ec0f676c8b7ef55ad309c768138b2eee89eee8caf83ca84b7d0f17e0d1410ddabce57506
- SSDEEP 96:o928SxUKGUPgAdag4PrktMCBRwju//f1q+T1h9chorf02l0QjnwpEB8p2omaxFWt:Gcc8OkGCBGju/VqA/bcxSwGBi9WbJ
- TLSH
  T101F1C7262A52A238917261A063FAB585E351413DD7612261F89ECDF833B6DD8C173BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  data/terrain/aerial_map/ground_types/swamp.tga
- Size 768KB
- SHA256 b9bc271114bb0c4b8646e82e4b679d6d9b9360945ae5083149f2151715b8df55
- MD5 f499001bf3b3a875a9140aedbd12acb4
- SHA1 36058dbf06fd3542b6cca332b1c454194fd7c2cc
- SHA512 4fefd222916bc55a62f272ab03848beac40842a2bd748f7eb670e21f4195c4a820f6616eda1513452bdbb071f278ac94f483a01cbc75a524c1ad1002584ef536
- SSDEEP 24576:1gfrIx1bC2pUeucHwQ79L5w/R2ZzATxLZaRarZ5nrx:1kKZC2QQJy/c1kx
- TLSH
  T181F4C05F203F1CD5014A7ACA2D186CDF8F9C8F25A976D13C5ED3656691AAF390AF0832
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  granny2.dll
- Size 447KB
- SHA256 e225465a88a066734d2b425f620ccc63cccb8b3defc6f0cbde26745650bee419
- MD5 73962de2cdf25f591f56a6597c2c0218
- SHA1 4af98946a31b504028d7fa316478ea6d4e9874f7
- SHA512 a8d9101c305b74d48fab04d171a496a8ba9c6d60b21d4712fab54a2b7150ee43e8366181c9e8c3ca607ee8dd234e2838f23385d45cc7ff2dc690658bb83d5986
- SSDEEP 6144:I6nLGIYkZi/3NEsnelym6D3q45vpL2yWtwHcQvoIu2y8fQCEJP:rGIY1/3use96D/5l2htw86orRP
- TLSH
  T1A0A48DD3CA9B09B0C595B47A30C3357FAB351B578606CE82D214CCC6AA66B91F1EF187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32