41f14d418fc69bdac329b7059882d1478e8f3b332ac127f5ba2c5eac53637f47

Sharing

Copy URL Twitter E-mail

General

Target
41f14d418fc69bdac329b7059882d1478e8f3b332ac127f5ba2c5eac53637f47
Size 96KB
Sample260820-m71jysvgld
SHA256 41f14d418fc69bdac329b7059882d1478e8f3b332ac127f5ba2c5eac53637f47
MD5 265f000c5cd8cbd7f7420d0e0aa6572e
SHA1 5015ea31ba810d9004f92f91363bfe380a11d435
SHA512 c712ba31061f1dc21e8dd0ff19d349d466f0d847c651ade78bde00b085e5058d7d6bd8f1bd7a618f1ff73a10a3d99ee6c5bcca3a1429d3facb4389b6a8126f8e
SSDEEP 3072:PBiu8S4vr75PSgmvQj8kL5Nyr/hdPqvpOsg2ra:PBiupm5PvUkL5AvyvAzGa
TLSH
T12DA3F135C9BAD062D642FDF8C1848D025D9BF0F9318ADB436B5FA7DBD8011ABDA422C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  -Winϵͳ/CLion.vbs
- Size 2KB
- SHA256 0b794ba1241f122456fa9c91882d3c1b30c52a895c4525a0095634386256dedf
- MD5 c6ced3f8f41290b8530ee9c0da5a4496
- SHA1 ac2a077227809eef296b3879b9c96d2646a50b6f
- SHA512 413a6ec59f6938506fa9474083ca8a7d80849571879d723387964982d292b4f7deabea19284aee173002c42afeca2393456cabe5b39bd24edc6ff10041c8afac
- TLSH
  T1375123D6BE225B9101B1934954905C9DFBED62F34212826D3AAC44A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  -Winϵͳ/DataGrip.vbs
- Size 2KB
- SHA256 406f9bb94a5a75803ba8be4117ebe6070714924e1e2de2b7dd9dcac08e511a8b
- MD5 f0664f3e5bff8a6713acda92104fcef4
- SHA1 e230ad86c888f13ca0926c704ee8b65c78204ba0
- SHA512 32ca1c10f2fc4a96bda4d8622f66cccd1262d0a58db4fbfaae220e41fdc0209ae1d0d8e22e782f671404cc58f38c1ffe582e718f19e8374109a927e18105122e
- TLSH
  T10C5157D6BD225B5101B5D34854905C5DFBDEA3F34612816D3AAC04A48F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  -Winϵͳ/GoLand.vbs
- Size 2KB
- SHA256 aefa257c29b187b589d3bd9612838b0de1cb36b1de5a9e380ec8c5824cbe024a
- MD5 eec6145a16c93bf76419ee27ee481508
- SHA1 384a2ede54c2549c20326f1e7061923349dd448b
- SHA512 4dc047f03ac2b5c8c317e720c7c20896b2a6414ab68c54d0d39f75f91b4dc49e840ddf29ac9c891a0f0b14461279532db2c394de68e11ce722aa22ecec27dff5
- TLSH
  T1F95134D6BD225BA101B1D34954905C9DFBDDA3F34212826D3AAC04A88F36BFD86F09DC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  -Winϵͳ/IDEA.vbs
- Size 2KB
- SHA256 1c01417c76f091c454d8dba83c4ff3d13128688f64e6e3fa6fac1dc0a9848604
- MD5 6d3b8124f4a10961aeda20b63566f662
- SHA1 4ac1285a70b39358493a9347809abb5c1022e661
- SHA512 4052605178a503da360b0f5990beb05024c6fe283eaa8c7f5fc6d3c04439c4b9fb54f4dbcd01d26b9daca10df7149851842b3e06b39c73d90238f2299128d8e4
- TLSH
  T13A5126D6BD225B5101B5934954905C5DFBDD63F34212816D3EEC04A48F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  -Winϵͳ/PhpStorm.vbs
- Size 2KB
- SHA256 79299ef3fb6d38a3389a7fcd985ad0fecd0f3f3805d6a93ea480ed49ea2acab9
- MD5 4351724322a217398bd6938852de59a6
- SHA1 7c8aee36411cb51d9b46cba566831ccfcc58a4fb
- SHA512 a137537269f134329a7349f71c348591ce5e54b5cd0da599f574b4f3afaa252d74d48001b7be5c20d39173b3d718b7ae20ae1034df4d714accaf40828d6284ec
- TLSH
  T1AC5113D6BD225B9101B1934954905C9DFBDD62F34212926D3AAC04A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  -Winϵͳ/PyCharm.vbs
- Size 2KB
- SHA256 766b6d727d92ec5a337de110259ef7b80119f29063db6f65a1fd58fc85e97482
- MD5 7559c25867db4a0e3f56528ab272e0c6
- SHA1 a884de5b35354a380a5807eb9bfc80eb10d06c2d
- SHA512 84e448501d51023484b5d6c60e51e3320a98d84900b4ed22c0e54be80b55baad16e00501a35ec2cd6bf8600be782f550dc508aa14d218dbe552e55022d5effbc
- TLSH
  T1B65113D6BD225B9101B1D34954905C9DFBED62F34222926D3AAC04A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  -Winϵͳ/WebStorm.vbs
- Size 2KB
- SHA256 7f7a567ad39328bafc746b2ad63ff8675fd125e2dde93461ef65f7b2e3fa51a8
- MD5 e892e22fc71a7435cd4cff753f6117cf
- SHA1 4856c1c1586b417bb350c9e7c1ed3e2f2edda7db
- SHA512 404611019f80db4ae4b24e72a4bf1f34d54d9f6d146ccdd1f57752c89e6350fc45e9eb7a4b8bba9dd177a26573424b83edea8bde8e7b45629453967fc697240c
- TLSH
  T17F5102D6BD225B9101B1934954905C9DFB9D62F34212926D3AAC04A88F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  -Winϵͳ/active-agt.jar
- Size 47KB
- SHA256 3acc4e9d91793f6909458a4761b75b6da45c8868e75dca33c9fec63659202995
- MD5 2fa1b1364515dce93eb67c423b570deb
- SHA1 2a723c2ef30be4a5c167c6639bf9ec0b9c7e7ca2
- SHA512 0b6cf7caf6d48419251d0aa1ccf280536eb20b1f108f874a9ce86943601c2317833031578fc869366e3bc40dedfabfd64527598ea63b879bc77f82a9a218766b
- SSDEEP 768:Oh7IDIGjwZyHIwcctMtI+xIfo1UC6cB+P9146lp3fbYHfkWvQdptYc4klY:KSIG0ZuIQMtI+xIrTcB034673fbgvYI
- TLSH
  T17A23BF2220EC995EDE056331FA43F4637424DC38D118B4971EDC2D82DB16B76F7A2A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  -Winϵͳ/clion.key
- Size 5KB
- SHA256 231d37a25c0634946849b5db717fdd41b37e41f284c58580981e330828c4ff4c
- MD5 3935af9ee05419ff2d0d724a1e6bc6c4
- SHA1 8b35b8b90c88d6444ee195ea230bf538361dcb12
- SHA512 40cf00c3266fe4f82372879bf1097e10e10f3a0d11e151474b3c7674d09eae2da152d94fd278542ae92cb38a289977ac9f2b2a71deb58f29401643d8304e6379
- SSDEEP 96:4JSJdjjdeRaiFdJn7i/khkcbJ5mkpuFCM92Rpa5cG4kSBxaaH3E0Ikr:21FiMhvykol9L0xXQkr
- TLSH
  T15FB1BC3839FE601DF5F3FF515FE8769A99AFB2322A0B249B109103474612941DE9263B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  -Winϵͳ/datagrip.key
- Size 5KB
- SHA256 270780df92c8d89542c810dbdcc7e5e42d6384b6b699072105295c97e79d595f
- MD5 c3a3e6577ca609451d63ae3d69ef0dec
- SHA1 28ce8c965ed3917ba338973b7e63338210f118fd
- SHA512 84ea91cc336e49bf562fab459cfc0d2ab9c449c81cdd6982df2aa9ae0fe8b9f4bce513f98d6e9333a523a67c3b8f185a2cd60f277c8029bdc22e5eec8855c0d5
- SSDEEP 96:0BcodadlGO/nR4JM5JPQnIkpuFCM92Rpa5cG4kSBxaaH3E0Ikr:RR4JiPQnIkol9L0xXQkr
- TLSH
  T170B1ED3439FE601DB1F3FF956FD875ABD99BF6722A0A25AE109103074612C42DE9213E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  -Winϵͳ/goland.key
- Size 5KB
- SHA256 0867f6987f9686d53047c6e282ea1b7beab30d526be724710e3ad84b5a04cd49
- MD5 d103da072d4d297da16fc64bc3eb9da5
- SHA1 fd8462aa891ee21ba2454ec2a2534e5f3351e6e0
- SHA512 56dd72d54ed3332d94aa9cd25c1db526729ad1d9ff432bb982edd93695d848647f2cb229c8f8878765fb6141a39f6b9b34fe8ac966128749e721a6bffbbe43e7
- SSDEEP 96:WxJSJdfTQZRappyealPvhUvGEtpuFCM92Rpa5cG4kSBxaaH3E0Ikr:W/ATegGEtol9L0xXQkr
- TLSH
  T186B1BE3839FE501DF1F3FF556FD87AABD99FB2722A0A24AB108107474612D41DE9123A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  -Winϵͳ/idea.key
- Size 6KB
- SHA256 688021363a39fd5bf77bc210d4e209359cb57ae8263b9f724adc036464603b54
- MD5 7c514522b1b9aa2318f4f2e343c3c06b
- SHA1 6f7383fc25d4dac7de2a14267a7c979008b6d017
- SHA512 e726ec261bd1d015191036442455dd1ca5ea1c0952531e7a57e1885dbc2350ab7a9c5c4ad562facfc852126eb8dd04dae96a098802cc8cd783640064f8f5a8e1
- SSDEEP 96:XsJS60d53rnLdGRrdZGpXOKRg2X6BgNw+2g22puFCM92Rpa5cG4kSBxaaH3E0Ikr:Xi8+ypX6Bgi+DBol9L0xXQkr
- TLSH
  T148D1B0343AFE6019E5F3FF416FD876ABDD9BB2726A0B249B108107478612D41DE9123A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral20
- Target
  -Winϵͳ/phpstorm.key
- Size 5KB
- SHA256 ec724bae22d104665f83f055e5971ab5ea4cd309a39f534803dc97c1fd744975
- MD5 0f0b2ea5a28c07230e785202895a9fd8
- SHA1 6f8115ca19bd9b2b41cd36dea8cf297748e3d321
- SHA512 e46290e0e805ec50c2eb5fbaf39f67e5d63f7e8567a5d6f98b6e89ec2410b46327bc2efbbdce8ad007806ccf4a325ab09b4350f922a979f1d068b7d09bdcc008
- SSDEEP 96:lwdNAqd39R3KmHwMCGf1apuFCM92Rpa5cG4kSBxaaH3E0Ikr:+6mQ3Gf1aol9L0xXQkr
- TLSH
  T10BB19C3439FEA01DF5F3FF456FD475AAD99BF6322A1B20AA109103474612941DE9213E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  -Winϵͳ/plugins/dns.jar
- Size 4KB
- SHA256 d1150b1831b112b93d74a34a10ce6c11606e0d2255d532c29f91f1d92b40a552
- MD5 4f3c516c1704a5569725246d57dd1ae7
- SHA1 4e8693b5a7a3837cf7f6db0c4f1316f376d34721
- SHA512 f885fc751e9035944489578bb037f05521c6258c377c0c7bf8b8d10b799063e6e529c715ecebf9729724f0497f588803d7d463fbb70f5efbd73952624f60d08e
- SSDEEP 96:LSyBi1RBhx1yI/OEEKXejuu9lSx/xowSpTz7g8nJfTfTX:LSx1RBhx1y0OPhox/6fpTvgeRTfTX
- TLSH
  T17BA10673669C58CDE8081672B30AC243640F4E7940A9944F31DD65C72E37B2EE9735DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  -Winϵͳ/plugins/hideme.jar
- Size 7KB
- SHA256 fa14c735ab9fed3f3a5df0dc78a5d38ae0a146099ddc858197e9f528bd996c40
- MD5 cdab6a30b0949a741f13935f5483c303
- SHA1 729d00e4fa04ca49c00b5b6aa60706dfadd5644e
- SHA512 bf155c0b062fe9c7c237f9b0329a155387b7294fae7c7ed73e41e9528f119ccc513855329f6e91e62106b589c8b215d981ed11f2f89c7e13c06fbdcf7d6d1ee8
- SSDEEP 96:ohFTqRYuFhXQ5GeiCGkeFUgbH44yY8NVFubQLwNUmvHh18OiPKwChme:gFuRDiiCSbH4u8ZuvOMBGOiEme
- TLSH
  T133E15D2220EC24EFD076E5B3F368F413ABCA15FC9508B183757AA2054D7572AB2234DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  -Winϵͳ/plugins/power.jar
- Size 11KB
- SHA256 26db4a54482189dc989e59734318d5c12d656183d5394fe3c0fe5b33313cb785
- MD5 cdc01ec1abee702c535da143fb3947d9
- SHA1 0f73e2cf797ee4b25a73bc6f78cfd7d41952d294
- SHA512 72c26a50a1f1ab9712808a218cf8026c6540fbe6ebc28eb3fee3eddf011f8566e82446630731a559c2ad0ca684be486bd991fc46149f6412ac692218e4e1d354
- SSDEEP 192:W5aTR3/R61EZoMxX7GQyJ7UlcOgUN/5/9a1bN/:6c61PWX7a70V7N/R92R
- TLSH
  T17D327C33187C2D1DCA52A375F3D9D083BFDD0EF86993622B356A68052802768F673A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  -Winϵͳ/plugins/url.jar
- Size 4KB
- SHA256 ce5a83aee31153cca30274ac94467b316edea8cb28acf72f52f5a72d455b1b43
- MD5 6b181e5b8255db4cd9beb1c6af5f420e
- SHA1 b1bebbee8d98218db5794f596001b8b7427ae0c7
- SHA512 26dabc145da4a987744ab86d600ab81482771fb8fc99933828104d4698f4dc407eb97281a36f01d5852fc2209d0092f10b7d23d62db8f7e456f8d2d0a108ce7a
- SSDEEP 96:KPP4+DT0nUeKLB3pWsWJMN4j4pbxYQcTxBWUw3/6ws3U:IPLTLRZWsN+6xATHO3iN3U
- TLSH
  T1E791F933249D285FCA372633F7815487B05B66F4D08A3297354E11976C3743B2A63AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  -Winϵͳ/pycharm.key
- Size 5KB
- SHA256 18f78c8fc649c9c0204dfa2f1944c7350dde1c47d49a2d5f63efd286a5fbc744
- MD5 ec722d4bfe7d46a7a29ef598b1b774f6
- SHA1 7e43f483522f2b773dda1f6c8e32847969075a07
- SHA512 988eb036fd76d3bb9fa28e79dcbe372860e46389d04c0d16ba34b33936146183ce334ca2787fa2e0a3698c55ece67fad0aaa0469ed21043e7465c0fd4a40c52c
- SSDEEP 96:hJSJdBwrRaPvjMKGoGkpuFCM92Rpa5cG4kSBxaaH3E0Ikr:v+IoGkol9L0xXQkr
- TLSH
  T1EEB1AB3439FE601DF5F3FF412FD876ABD99FB6722A0A24AB108103478612D41DE9163A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  -Winϵͳ/webstorm.key
- Size 5KB
- SHA256 d5f76319c48410c55b36aac223d78a324330caaabd82df9cad67ca40e79cc66c
- MD5 465b55f3b990b08f156a6dc41e1ddb7b
- SHA1 3e544989fab836ed44764dfa434990db52bedb47
- SHA512 0edeb1dd1d44cf61ed640e3f6b7a53b7688f3cfa5e8b7bb8dc8224b25db30be7826a73f9544ca475a42e818aae941d6cd6a7bd5a174e817978bf8c04e632d22a
- SSDEEP 96:E2JShQwMdZGpXKNFyA53XR43puFCM92Rpa5cG4kSBxaaH3E0Ikr:7o5A5O3ol9L0xXQkr
- TLSH
  T156B1BD343AFE501DB5F3FF916FD879ABD99BF2722A0A24AB509103078612D41DE9113E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31