overlord | 9aac3400b1a4b561b46b5fc5c0aff10f68ac0350b248ea53c8b6860143d0a588

Sharing

Copy URL Twitter E-mail

General

Target
bluemagicv6.9.zip
Size 936.0MB
Sample260825-qc2ejsam4y
SHA256 9aac3400b1a4b561b46b5fc5c0aff10f68ac0350b248ea53c8b6860143d0a588
MD5 9ad32e75a5d109e05cfeb3ca6a3ddbde
SHA1 c278bdc31da1e60046eb792090d1711f6fa54d19
SHA512 a05225da228a91b98414a07b566fb81d11579888fe4f020feea4ceacce07afe1aa01b00c33d400eaae200cbed0ac767ab9f9772d0e59ce400d8f708636e1fa11
SSDEEP 25165824:6zWlLPskcLVBAIVhgcMFppozFFeEvOZao4y8XJGF3tsHg8J1FEubK:6OLPsTLVZPgXGzliR4ytF3tMK
TLSH
T1DFA9339842B53256F49DC63333EA472DDA08BAAC7A4341271AADC2391453DC3A7DF3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/floor.tcl
- Size 80KB
- SHA256 791c5f5ff42c7dc1f7d8b8d978ae7408e2909ec251895d3aa721c42e14d51e83
- MD5 2c178b6790dc40f1d3eadd87cecb56f8
- SHA1 93f242ef3f16205fc85f368e25a2f2123c0018a6
- SHA512 5a835bbe6ce8cc4eb93dc8505e29b629ca93686be657656b6957f1318a65425ee6fcf06cca53275a883544b7d980c84fea738509d6a2d51ae0ca07be3aac299e
- SSDEEP 768:4NMYvHXoB+VJgk8Tq1nOUz+9g55QUAyEAj4lsLtJ3T+pZoRiE2:RYPoB+Xf1nOUzmg55QUATlsjj+pZoRiz
- TLSH
  T1A4834D0CE79481EAF46243E72EB8C227CE57C35723E78738B056AD85CB11A1594BEE71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/goldberg.tcl
- Size 57KB
- SHA256 70710bcf16884bdf2c0cf1ea0e50ded94ec05453a89e0aab2af7cb213e91529c
- MD5 705d7e5bb5a112c7ec58ddf13dd28222
- SHA1 c1f6eba76a59367f2951a10d1d09c6ea790a0d0e
- SHA512 1aefb171a7c49d67076eca2bfe35934f6ddfa062a00b45ffbeb814e6973488cf6ef0e8a3022b4b8a6e164407482b582b8cb29404f74edbb61063b8ca3ab80681
- SSDEEP 768:TTzeOOfXy3h+rtki0F3C89jwXdH2RFBi8owvxRyx0bjbodHiIixMV8y8hovepq:TT+/y2thC32XdWRFFoEb3Iik5WI
- TLSH
  T1EB43640AE18542996233D7775571E005FE9B93FB46CFC51CB02E8968AF7060882FDAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/hello
- Size 531B
- SHA256 741bbaf0dc065eb4fcc7b655e0f830bce6c9d9c22cf61ac9f18c17986819f414
- MD5 3136374513ae741007d8e9c1cdb9adc0
- SHA1 f9cfcd8715539908c112101b42edbbe0c86dd595
- SHA512 4f9deb7da46edd2156d716f10ac1bea58a7e215e55a260c796b3816c9a558d9217702507c052f90e66ec63a36e660385057b0506dd343a736a32a30cf9702df9
- TLSH
  T1F0F0C0D141C233F1513C561F331DE1F47606882E25E6D000F4864059B970935822BDCD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/items.tcl
- Size 10KB
- SHA256 46e7c6342f562e002c08fb0b3c316079a477697d9f10bea594983fe1d1e71cf8
- MD5 c75b383f95291d8f490f544b5c7967cf
- SHA1 96ecd044b88f582a235102cdd11f587ad6ba9e4c
- SHA512 d960a36209132264ae151066e35a9aae08914b97af599ba3dad8176b7199d961d3d2bbd62d85cf6da40a0f362fa0ff45ac399bed91bcf278de29ccd8f4cb31d7
- SSDEEP 192:JOxVzNFg6FAemaYLDP+Qf5ylrJfP1t0f+BUSf58l/fIdIDJutF1SnKYXAfJ7I2nb:JyVxFPFAemjLPukO+Q9+KYwh7NbhTL8O
- TLSH
  T13C22466EB487726AD022BB3372746104EF86C5A393AACB043149C16CA77427E41F9F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/ixset
- Size 8KB
- SHA256 7ddeea934b567e8e5bee08e2a3767ddf40f015ab251bddd79a841cfec548e694
- MD5 26b62da74709aacce5ab1ad531de978a
- SHA1 fce5e60972c03adf2f9500abf597d9e379c5e474
- SHA512 449fcd4e27f6c4d5f409eebfee74378548deddb2b8124121dfee72e7bbacaee6172bb535a166036b68789f70d57d6ced2c437c5714143041e802c325ad3ac9cd
- SSDEEP 96:dFKJ/NVGt1NCH3KhnHZnV7i6IP+0isnIVIUmVvbWi4sIqpL3xck3E6gw8goVU/NA:/KYHyUhditI+L3xL0wBoVUJ63ewCit
- TLSH
  T16E0220D043876649ABB94F73C6B66211FB7A829388D3F01DB09CE1B41F71E198049E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/knightstour.tcl
- Size 9KB
- SHA256 8b4d0e72f828ad3a5420bf71f05a212ec32bd500c4645ca12a48dec4e0486a05
- MD5 919bde5468c187a2f3fc2b4f55ac4203
- SHA1 f8e16424160d88c3abb128587c0c3d952705d0b8
- SHA512 5809eb325ebd8c364e7e6a371487d1e6c72d1f284c06fba91301258b11f4a1d10cd29272c905c16d788ede6e337930d9203595fb6d0d5d40e566b1ced2852779
- SSDEEP 192:M26ZJk8klzh9oUOCk2YTCHqYpeVRJADASp7lPnqiTvTL/OTaO/:M26ZYzh93YWBcVRODASNdqgvPhg
- TLSH
  T1BA125015304525A8A5B2C13784B5A655FE13C0FBC5849918B8EED0FE1FB2022C7EEEB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/labelframe.tcl
- Size 1KB
- SHA256 fb7f34effeff03dda13c4088fececa6d266ffbd87d3dad075a424c89305889e0
- MD5 883b9dc598f25366d7c6865ed1416603
- SHA1 1b5df87eb765b803d02fa1db4c43a9a53d1bc7fe
- SHA512 c07cc2d7dd8f01ea33a04a4882f61be848306e37cb1a06d178e15468010ec2b365219b824ed1e0f22299ff1016989017501c889688ef7df5c3eb258d9adb77cd
- TLSH
  T1CB41449334423646E2B619E013975120EF30A1E5A397E489786FD97C47A0547CBBFE8D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/menu.tcl
- Size 7KB
- SHA256 52aae46cf874d84a8acd8d68842da19a93a7699cb5ef0ddd4d20b619fc274f7b
- MD5 3d483f49668e50d1e255a9ee5c66c375
- SHA1 c5cc1ec998775939f8a716360fdfd0edc6c09e10
- SHA512 789772a87b1f6a142cb3f8b2e034c71afd9699743561431176029600c375a14a6dab858d2344cf9234f36b2e8b299cc4169e18911e5abe4a8ba3a6d3de0d1099
- SSDEEP 96:60Ong4o4niP/viWy9CHCRQkGTb/L+lV7LQuLwKce4pywQdlUpy96a58OA:60Og4o4UXBy6hzcQuL34Eldgpf
- TLSH
  T1DCF12113E9DA2217E0D49373628B8270DD7583F183929DC6B0EBA72C165104AC9F7EE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/menubu.tcl
- Size 4KB
- SHA256 727e4cc64e3cbe1c1ec0676f581bf884df66c0819d8434dc854fbc211dccc3a2
- MD5 c1c5ae7ab232167841be6074bca56e38
- SHA1 18cd79a2b27e0d24378701beee611921a8cc0693
- SHA512 eb2b769a32178ea09907f1dd9e9584b2f2b91fcaaf4c2cdb81562bf9ccae98b96e8234919668091331cde9b0a951829a3231fcf1494444db20e53992250bf5cb
- SSDEEP 96:l3OMqaBQJm55CJumrMLHfw5aGmb504Aq/EqKG:l3OaQECdMLHfw5Q04AulKG
- TLSH
  T1E1911003599B7313C272A2C79DCF5180FE7DD190428BEC98745ED1985BE801A8AEBEC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral9
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/msgbox.tcl
- Size 2KB
- SHA256 652e236850c86d7f924514255174738ba71a1f7a7ba739aae6734ebd328d5428
- MD5 fe18cfaa87e0c1d700e918e361b1c259
- SHA1 fe95521ed2ab1322cb6fb28583cd59545efed96b
- SHA512 556ebe6bdfb39abdd684675b275acea76cb1a5615d595b27fc54db245887ef0b8d3fcd5a75ce08867e5c15bb437a87dccb9b88777dddd9b8078a22eb3f5820de
- TLSH
  T1304100812A96A758C2C581F7777E7058FA2880D1D7E27E28F0DDD078C76405F89887DB
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/pendulum.tcl
- Size 7KB
- SHA256 14de2ef0a3d1df88a406cb6c64d2d031e497e0469b72fc4734565fb3f22559a9
- MD5 4504fd21d704f7d1a5540bc05f526ad6
- SHA1 2c9e0a201eaca386d058ed75cb6a22b26f258da1
- SHA512 e44451ab8dea28236cae003d3655508bb49d2c8b541e554c7b6cfb516a0a4e2d244516bc52b2ea20c71eb85ca2cecc603b4bd9647f83328768dfe5e554018d07
- SSDEEP 192:F6OiJP+LJNnbSzfBDjPcGBauZmm6uCLA5FB1w1b:kXiNnbwJ/HBJ5F0F
- TLSH
  T1F8F161476256032D6132D2733428E192FF29C56AA3C3D31C74AEC1A88F7052787EFAB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/rmt
- Size 5KB
- SHA256 dbd680e536b4eb2a2d733f96bbf3b5712e66a4a9e0a49f440f4668c6ac1b719a
- MD5 b29bd430cbd38326898747067f58094b
- SHA1 723df35cfc666e471780e9801d3be4b46e993c8e
- SHA512 2d29070aff8b7f2fb3d4c9220e36c00bf804c678c869a53cdf18f9cc06e09b755e4fbe984941467137fb0f76485346387771889a8888e4d6aef3496463c0afe8
- SSDEEP 96:dec32sxxwyPNxz1xrdaLrdL5daG8daQdamdaFdL0dLZRSVe1pfhqwa/wdRRxcuc1:QcLxnP1xrdYrdldUdbdhd+d4d2ejZqe6
- TLSH
  T1B6B19437E04B2EB962371A3B93BE6190EFAE42BB27D881457440C554EB68018927ABC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/rolodex
- Size 8KB
- SHA256 f03ac5089e4d325a3aaf2fe94c72f371cc271dd3e362e0465bc020407397bcc9
- MD5 7e0be9d46da1eeb0adfb9ab9bd722b6e
- SHA1 e29501e781bea987c200277a2f33c0052a4923d0
- SHA512 4930d5dfe3013e5c7e293c28d93f3691969cedc5a96e1cb73afc04af06151403d0fb3a30fe206d88d01bad54895a5c88daada53a47f7133a409cbac37193491f
- SSDEEP 192:oU1padPAlVAHLhbohkzzNldBIm91Q2WIPn00:+PAjAHLhbo6CvIfl
- TLSH
  T1400296972ED663E252B8E32742DBD651FB2942D113D28009702E99651FA0C3243EEEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/search.tcl
- Size 4KB
- SHA256 bea80b1b64879f571576e21deb3d909b95418eac230376f3df68f757a7eddf02
- MD5 4095a88653db88e386b3b19f2030294c
- SHA1 00a1e209de5b155add67e8de16c690c97353b9b4
- SHA512 25feb3d6ffdae12261f21fadbbee8addcd10849b8e403c62a00ddc94f7c978e24493c587550a3ba1eae3866b959e7480a4c7aed085afe10d850237fa32a10621
- SSDEEP 96:JlOkLvHqMWBC5ad+r6f6J3FqYCqOV/3Ql+H2hiGsYvNFdW0208WxlYB:rO2qBXCMiEY3g/Wg
- TLSH
  T1FA919416128D0326DAB202A1A3DF7091EE15C2EDD766D285F4EED7383538D6AC5F82D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral14
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/square
- Size 1KB
- SHA256 5fb92b6033f2d05915b984076971db0ef87bad1e463591f5ba9507bdaeb95966
- MD5 9da95778f94f274b3baadf67cc3614ec
- SHA1 4f82d25f79907379eebda588e83e6e938fca1a21
- SHA512 a59cee718828418e1fe01e30b905c1673b2bcdc4019df982779fd60b126c57c385d3af8c3a7c5c7dcc1f830c8153df6597c2d5f024f5079d1259da98472c7df6
- TLSH
  T17F2183937087119106B71B7F3695C180FF2D509662ABF2053879A06457B64B443B2AFA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/style.tcl
- Size 6KB
- SHA256 798f10af8f6dfdcb4f95d075224e6de051565d401aa28604a45005a592efb263
- MD5 63d063bc7de08a34dd0f3a84cadf7e0e
- SHA1 be8a1efbb8141209b61eac215601a691433a21f6
- SHA512 61bc87b09289d9d89709dbc1866b839d9055563ea97d698c456ddfba5bb0b1e6b005c262d066875248ceb9d2a3b4d115e212b0084b97945f839e60c02329c472
- SSDEEP 192:qOhEOPQYm0QhAwLsEmrK3TjPBmT8wC4fsQTL7hXsS4XkSgPMTuF4ruV3vqF6gXZB:qZjq5k
- TLSH
  T177E1ACAF228C0E7FD6E1057362567B149D17C2EAE6D1FFEA68E6D068025503DC46FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/textpeer.tcl
- Size 2KB
- SHA256 440f52dbedf0c2e4754c93971d478425c9e78f71db19df3274720903647c9e15
- MD5 db84ac00b54e9685430d91087dc43bf8
- SHA1 b0dd9e005fb0b8c18e110132744e9c8513ca83a1
- SHA512 898d8e30ad084ba977da714bafdd0326b20377d3ae54074b307b10777ceae9f83acfd621db8dd9168309283b3c41a9b58c2bae714ec7e3ec685aec7a668e703d
- TLSH
  T118412023124A9F11EBA5C9337A846290FB11D25B96C6EA0D78DDE02817D0B2884BDB91
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/ttkbut.tcl
- Size 3KB
- SHA256 e1e26aa0622d79b6532b54e4ece6d9136d36c96dd6dacea1eddebf2bb07cb9cc
- MD5 916f3f8e35ab802c643d82df4cdc1ec1
- SHA1 5bd51dd5f7c76124f7ea1d3563da2862ae3314a3
- SHA512 940d68d71d5e196d67d515fbf0b5e2230daef50355cffd3eee695293900fdeb3898bcba63a83628a7bb88e96a921e4158ae8b661205e15377880d07cf1552f04
- TLSH
  T1BE713317141423A5E3E0C174066F92A5FB2055EDD3E3B990B8CAD2BD439493398BFAB3
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral18
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/ttkpane.tcl
- Size 4KB
- SHA256 e1c472dcc79ab4826796848e320fc8769bc9daf6fe0378995054686a006d2c14
- MD5 28c707a2cdbf91ce33938c7a301c9178
- SHA1 b8dc280ffa2c449242d777fd1decb765ce189f6e
- SHA512 05afead5a7d9029453bf208fb9437c1db26242d334732067ce7c42a4e9aa33969dcfd1cbf06ca14b2f8e4c572cb3b8351eb62d64152084ac1ee2a8fb6285601f
- SSDEEP 96:vOKwhUQKb0vA0vJWZSuKcZS3M/DFZSq0C0LfvOdpbxpjtu:vOKPSFF4xY+Ta
- TLSH
  T11B91A7760794523ED1F14A62C75F2230FB29C1E79BD3A978F4ACC05C5B3225B296CB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/twind.tcl
- Size 11KB
- SHA256 36b00de2b67c0974873787b4ff033f169f7201ab88e926fb4058f5cbb0298284
- MD5 dca4731b8c909eb10453b4125b049b14
- SHA1 3da186293b4bf4b5ac8405e37a8b831e4e90d95d
- SHA512 8031b7ef4445e57f40286aa1401a5bd76daa93dc60916a25b70be1c0f1a4fe588682ccea49aabada27b5770f7f95468562f8866290fab0a3a94f5b3112a2088b
- SSDEEP 192:mOPHlHxfNieTvTFQCamBHN1sYXdgKbfNTXEs4S8xqd+1cP7ZvhqcYDmA3f2bwSFT:m0FRUerTFQCFtPdRNTXEs4S8KP7VwcTr
- TLSH
  T1AE4264176244091BA3F04633166BA200FA16D3F792D5ED4A38CAC168AB7113FC67FF89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral20
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/unicodeout.tcl
- Size 4KB
- SHA256 a5cc2cd45093b91cefaca4842055b89aa193cdc8a8c21ac5b049d15a7a1d044d
- MD5 3a6f391b44546c9372f2008028e12fd9
- SHA1 13d060581e3c5c5fbeca864506da446f4502cfc9
- SHA512 18d857fe0483870986f5b4fee8889567032cc40aa1f39efd72a8194a480205b1a715df3faa1a33f6a72e32f5c4bd94ff9fee5bfb38114f478a191601adcf199f
- SSDEEP 96:Zs/OhVL8i/JTDEMxqRrrPqZ9Du/2ClJoHvVDIHtjX36YUYukoOn:WOP4i9rxyrb+Ju5JoPVDIH5n6Yqa
- TLSH
  T1DBA1E96A32C5152ED335677271726609FD2840FB0BDB60163C4ED324FB760015BA5F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/demos/widget
- Size 24KB
- SHA256 e2b9bc4741bad1d3c8489e62ceb14c7e6b1e91296d016e4887099a23e4658453
- MD5 906ca95f6f978257767679bfb507cc35
- SHA1 0bfe6c3408a670c65cdfa8ff152dd5c039668907
- SHA512 928994a804908abf2867b1eb2e8c4b5ac9348efdad38bee9a37b71c272d7b1be35f4f923d6e57477f33c1109329747272bd26a4eb6f7ded03f508fd09fa0b635
- SSDEEP 768:mSGo9ErjOhUUfy24h73DRxjwPxHCSe8mI:mSr4h7TfjixHNe8mI
- TLSH
  T1AFB20923364952A697B2C537A6FB6000EE25D1B75E57A04C74AF817C6FB061382FC7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/entry.tcl
- Size 18KB
- SHA256 6ac78f764434f932d37e8183aa6db5d04eb1848b774c92f7abc243ecb7d4a59b
- MD5 ce819200e8cd36e4458b4cf47cfe9107
- SHA1 d04357d9e236f83bb0d2f5db97e9ee228c34ec80
- SHA512 6576612c380ab04fa75724c72108a2f386d7f75c9db7a082445778f675e268d0594280a7644aa9ff3ac3d29026327b84a0990ee0c7a9f94bbac3ae63cf91e1de
- SSDEEP 384:mDfyPIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnsKAN3Pp64ZnCD:mDfyPIlBk3yJ8mtpaplcpwo
- TLSH
  T15F8241D62D05577562B7C373E3ABF600FE36907722974026759693A02FB6022036EFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/focus.tcl
- Size 4KB
- SHA256 8872f236d7e824aec0acd4bacc00fdd7ec9bc5534814ecf2160610c10647b7c5
- MD5 63b219be9aff1de7de2baf0e941cae38
- SHA1 a2febb31380e12ff01e6f641fe8b4f815941462f
- SHA512 057700f8fde4b7c3d7ab7cefd6c531060bf2b1b3b727cad6a37ecd42ebc557765d94b83add438bd5afa1f6f919d80ae755a8d98918981167b871f31ad42fdf5e
- SSDEEP 96:J3MRZZ7HWb/6OgRKjtS6Mn9GRZZ7HWb2Y6aO6R5nh76SMoB2kd82KtTpsi2D0DSn:CRZdPul1RZdFaRf0XoB2gZKZpsi2pn
- TLSH
  T118A15121B60563B366725293A2BFE249FE3B40B5129D54D87C91C128732141BC3FEAE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral24
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/fontchooser.tcl
- Size 17KB
- SHA256 901f70bb14a197495575d3bd2bf11e8654f9490e7e16d8dca8057c5393ff2093
- MD5 48b77259261d1b0be6ba1253d55f93e3
- SHA1 345bb0f09df3da9d87edbf68e860a10c8819146d
- SHA512 faff122acf9510f51ae8c7731c9bde817e58ecd914a6c17c944195e507071bcb0ce0be70d86fb65c35b308b9615de3ae352de352fe175eab46f3932ffdb8bbe0
- SSDEEP 384:NoRqdguMCeor/4VxgU80QNxWHKVozN5EaKdhsbyM:NoRqdguMCeor/4VxgUnQN0KSDEk
- TLSH
  T1968297122545E46131B2C73F99EA6124FE1DC1AB9385A1A8BCFE811C2F705E552E8FF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/iconlist.tcl
- Size 17KB
- SHA256 541647a1d4d91ffb8ee93d53b0017e5c3d3fa943373bb8490761d25b7a2ca330
- MD5 f538719bb6b5b6cbe451a13df9009b7d
- SHA1 cba1cffca6e78eb4b1701abb4c73020d82163685
- SHA512 aa5ebcb5364b2fe131317c471ae51f3f709cd1ed49ac843127739c211b9afa690f011e89e397028a3bcc97ee04bab91fb936d9a40c9246f125f9e8ac69795d1c
- SSDEEP 384:FNP8nO9Wo8k5NfQH8EsOy8WMdtafNCvHshPOw7jW:FNf8uNfQH89Z8WMdA1vDW
- TLSH
  T1707263023F4691AD31B6F32755F2A010DE7AC1B780DAC1AD7C6581647B3412B87EE6EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral26
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/palette.tcl
- Size 8KB
- SHA256 849b4c57e4644e51beaeaeb3ae59b7ff067e582ecd10f1b2caf6b6e72f11f506
- MD5 4ce08a10cd9ae941654b8c679df669f3
- SHA1 f1288babca698fd18c3bd221e6ae6c02f2975aae
- SHA512 0f37539da3540e9b1da7b0377e3bbb359b71db4271d63bc9501e95931b4e609e8cb91dc2f7b08a6452598d4a0d58c6a2034049a215000eef0f93a9963d003632
- SSDEEP 192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
- TLSH
  T1E1026112A34952AB72B3A2BA0077F084DA3C52BB515A835D3D6ED1F8373043687FB6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/safetk.tcl
- Size 7KB
- SHA256 579701605669aadffbcdb7e3545c68442495428ee6e93c2d3a3133583bcd3d33
- MD5 21a3ac11146ec26784c0e729d8d644d0
- SHA1 c7e0918e8692c42c1d1dd1bbcbfff22a85979b69
- SHA512 724ed83b989ad9033bec4211ee50e4c9e85b51054c518cdf7e02d0ed0416f636b9f38c0b0d29f8f4f7f465b77c7d2e01d0918d2c2c3fec4c7739ea982302fa2e
- SSDEEP 192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
- TLSH
  T104F17490D30317D6327142A25B7AF3A5FB3500A756F762AC7C8D826C7BA7417C22ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral28
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/spinbox.tcl
- Size 16KB
- SHA256 747889c3086c917a34554a9dc495bc0c08a03fd3a5828353ed2a64b97f376835
- MD5 eaa36f0aa69ae19ddbdd0448fbad9d4d
- SHA1 eb0adb4f4d937bac2f17480adaf6f948262e754d
- SHA512 c8368f19ec6842ed67073b9fc9c9274107e643324cb23b28c54df63fb720f63b043281b30dbea053d08481b0442a87465f715a8aa0711b01ce83ff7b9f8a4f4c
- SSDEEP 384:IMpfyeKu9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfyeKu9Tx8WODTp2zPP
- TLSH
  T1EA7233DA2D14632D6173C33792BBE305FA2690B7569F40203469C1943F7AA210ABFBC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/text.tcl
- Size 34KB
- SHA256 f7ecc5ae6eb297c79aad5cfc200b29c4e72409641fa369c5cdbba30ae41e982a
- MD5 016613531555c4f30f670dab58f10b3d
- SHA1 3afc8aa3e10950d79d1003b0810f2e0dc2135eb9
- SHA512 c5d071fc8cb68c5985e74ab7e90367e9261b291474689c37abd7f921716053e9d5e9446a45c5e91f3bb927589270e818e22e2d675acbe04e0627ecd5d532bc05
- SSDEEP 768:Rp4LaQDlOrqquMwIMyv4Et8rvJLgmTGXs1bYMeNnnZl8n6KRD:RYK8rymTGs1b0xncn6KR
- TLSH
  T1E3F2769928095B7AE533C372A37AF101FE72517B06C28119749CD0903FBE46A877EBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral30
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/tk.tcl
- Size 23KB
- SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
- MD5 7e46d32c3e70dbf17663f57e17d18dfe
- SHA1 394dd3cde6a7e41855917060f4388478a0a84668
- SHA512 6125e9b6c213e48e4a7a47acc0be3b930ddd9aca2132817f1906a2453e0d0b8292e7b2090bab8712856d12d2cf4d119238f16fae0fb57dd66da4db8fb3d92b0d
- SSDEEP 384:Nbyxt+WaB9USY15gSgC3DbTbXLXKr3aIIXyDAbK2LMGgtewT+3oFQRyH5bAy59HU:NbItNe9USZbeXysm7GgteoFQRYMESL
- TLSH
  T11DB2D5195DC062B3513BC12F53BB2A00D87558FB2B76A84978DC48B93F6483B06FE9E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31
- Target
  bluemagicv6.9/bluemagic/input/tk8.6/tkfbox.tcl
- Size 38KB
- SHA256 baf1ed7b617fb64ca097e81059454783c4d922999e19000cf2953cc09c8f4505
- MD5 57d60d17cd3ef211d18bf4f82586ddcb
- SHA1 0a7415ea599725f81118f4b833c4fa1d601d7ba6
- SHA512 d3279d24885cb0c4e72fa0c3783fab215a32dc591e367c5640a3fdb1aed33933504dddaabce98455b485b68bca3c75a97249eac40abeee945b9abaab7974ee0d
- SSDEEP 768:+oj+Aq49cn9tJNgDt0/vsKulXgo65Eh6pQb:+6+ZT/ggEdio65Ehdb
- TLSH
  T16A038412734C6236A2B793339EF95024DF2AA0FF5298525C746C40AC7F31136ABE97E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32