9d8603456c0183463185cf2c5b40b461c801de27bc64297a8e06f3105ea11386

Sharing

Copy URL Twitter E-mail

General

Target
IDA 7.7.zip
Size 377.3MB
Sample260827-2s8dks1sby
SHA256 9d8603456c0183463185cf2c5b40b461c801de27bc64297a8e06f3105ea11386
MD5 83bc0f0c5b4c41055bc634cf1a63490d
SHA1 280a237f09026d8501719af78854de95a3cab2b8
SHA512 97ac7eee7c0cdac06fc8880a42d1f58642e477a62bae95c29878f633782a8083aa2cfe9f7a0329c9c906e5a973d4b6a964fe7bca246ee62c53b646ba20d2424d
SSDEEP 6291456:KJPk8GBipjObiEUgu24ZkNGIEx8zyE4GOLI/WQQZLsrkorAekhOzldhnkKFcU:KKHoZkNGTx4yE4C/W1ZwrV0PYNkKN
TLSH
T1221933B38FAB9DE6CB17B03AC01A274DA75ECE82D187F52B7B9291500F131C05F5991A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  IDA 7.7/cfg/gdb_arch.cfg
- Size 6KB
- SHA256 37dd482c92714f7c18b52d32ec63e5eff28e9576212eddce19012f41e85ce3ef
- MD5 61d39cccf6d394c6878c59a0b7a0bfb6
- SHA1 f2006e11d7c26c8fe9ab6f87e3ff467dd53362fa
- SHA512 1b7f57ba7c7451a54723970eb1be43b7b4b0ab3d72b29efc783718dc354d442104a1f20f400e7d16341319e8d8a4192b0f136a80cc6248e0ce5f179858706117
- SSDEEP 48:6HByvXXfEJmorBXFr8Fr25LI+nltKrBFrvGFrIGFrL+Fr7FFrErf5cRwrFrwFrXQ:Q4gvI+PKH25cG1nVSBG
- TLSH
  T135D1EB02C5A2081AD0A2D4A132D43A0665AD7081F4CA4C7777CFAF8CD7A3B79C80CEBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  IDA 7.7/clp64.dll
- Size 1.0MB
- SHA256 5870149d7b091376e6a89d691a9ef4b7b889e3c3bf2516f8c7b73f6cf762fbc0
- MD5 9551263c9dd81e8a42487718dbe1a17a
- SHA1 9b048160efc67e8b2ef713933212edaedcb158a5
- SHA512 bae732d98371157f764316e66f333d4362b0161b4a38650cc9eb23e3d01655b892b5fc86d99b45afc649257694a2cae6be563ac40193f4b546c7f36a0d31be36
- SSDEEP 24576:w7Vt9qfawrN27U1izzZaRbfp81L/Wm/nd6Wrr+U/FQT:sBqfSU14Zadq1L/cWrrTFQ
- TLSH
  T115356B46E6A505ECC067907543B9B157F6B1301A0364ADF70B929B292F2BE90BD37B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  IDA 7.7/dbgsrv/win32_remote.exe
- Size 713KB
- SHA256 4d0782fac17baa4b91c8ec36b2d28398656f9fbd858135be2d418323c1c6648f
- MD5 ed16388d2796c93b705d6f4c98f16259
- SHA1 b546c201eb04d4ffdd9dd02d0925d7667b286541
- SHA512 ec9060adcfe0a3a9db19692f5f88402838cc6f5a286b34124c38cc9cf6ee45bc57dacedb9f432f5a705040d3af442fe27b02ac23da73452bec8c39cb93022274
- SSDEEP 12288:riygK09BFg1M7J8JjBGYaRCCm0qPZwtY6CpJg4Kg+3PuK3JhJ6LaT/D270gFU:rafOCmzwtY1EfuK3f8LaTb8P
- TLSH
  T1C2F47B303741C632C1A21171487D97BE6638EA690F655CCBA3C82E3C6E356D27F35A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  IDA 7.7/dbgsrv/win64_remote64.exe
- Size 804KB
- SHA256 bf229ad6affcd486910c5654e777dc586f7e806d14b1d6613e03dde26359f2cf
- MD5 9613938952c5e2991063309982f2ae58
- SHA1 aae4c44ec35960f3729142e0b64edac445d29227
- SHA512 9bc1a6b96d577bf7d5b9157ebf64f281326440a2d9dd678205e446b6af81db9bcfb96f6c86e30c37bef683544743953d8ee46f89a3fbaf9f18cc94579c2ad8a5
- SSDEEP 24576:RDe8PcYcOoDekAMNHFZ5AXxu8PcXroThr0:JvXvMHFZmXoa+oT
- TLSH
  T13C058E5EA76801F8D07BD139C9925717FBB2B81607259FDF07A0522A2F13AE46E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  IDA 7.7/ida.dll
- Size 4.1MB
- SHA256 013235cbb26e7d5131b5c589c895beaed595052254f094ece42bc4a77fbc446b
- MD5 d5e960ffde42e89894753b68608442b4
- SHA1 8b901a0ba3d0a36891244ab3bada7ed24e046778
- SHA512 b87f5c55ab59baa224bcd19c4258475bff909c148ab206eea564c8c265d58c57f2d17624fe33a40480048d559c0aa0722f80a4e0ef6ad039c9b9ab11cd470b9c
- SSDEEP 49152:X4ie0OLY7SMEAuDKQ3wNhdaG/GECAXjJVGnEWukv+N3yVYCazzrOPYubrmarAMFU:X4OGejwuXN3y+CqYYuHvq
- TLSH
  T112167D56A26A12E8E07BD17EC65B5727F7F274060330DBEB06B447662F23AE4167E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  IDA 7.7/ida.exe
- Size 4.0MB
- SHA256 016b7a713b52b20123ac3100ab0347daa2e6def4249dc6c5490f1ec2954ed4cc
- MD5 9d6d3e344709427ab731813f88a739e1
- SHA1 407f520ea5dbf4480fa331b72183b40c3ae76766
- SHA512 fb3d10e6745023d3a858e9dafb7701bf9c5cedacbfc5243a5ae885e7b5a2d3855a18c2565c7c35237e30f6479ca842ff3e9b68e964e03b7ea643100312548e43
- SSDEEP 49152:p9EJ6ZQOajI9/7MlHrbh/MG7y72fl1cDQK0czmoPgqXfUnpzjfwRwaw5ArwuJyNa:RZt8HyG7g2fly9ljwCqDolZEKu1mD
- TLSH
  T10F168C5B737501E5D326D07CCA8B8507E7B2702747225BEB29688A6A1F336E12E3F750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  IDA 7.7/ida.hlp
- Size 896KB
- SHA256 93f7546bb17cc376948d7d0eac669dd4fdf29ab1b240c7235ef54f97f35edf73
- MD5 a7c50f70b17f7814adbef8cc944fba41
- SHA1 58f16aa120602d4ab9dfcce14d3d27c4384f3ebb
- SHA512 2122eecaf14a80128b960a5c9a861ce78c0f7f92fc6c3033e466268328ee822ab30c8d09d6b680b38437525ad69900006cf7c7d72684cb63fbc1e130c5ff9218
- SSDEEP 12288:H5VaMY9pWaM+GZSpVHKHzMnT4BjiJs53+glLf/V223:H5VKpVr4BeJs53h223
- TLSH
  T1981508063AF06372C5E241B1BA4E22D2D734C36B7324919134DDB158AF0EB69D6FB9D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  IDA 7.7/ida64.dll
- Size 4.2MB
- SHA256 d35e714949504f1da5e894cdedfffeff93f3b02ab8063a815d9f96b9ca064c1f
- MD5 36e4a1a33c5b557ebfe9750990f866dd
- SHA1 b68596cf0978c7cd349eb10251d2763c6f60e558
- SHA512 88b4a3d34db82a81c7f2fffa88167dcd70bb8933e553dd87670bb75e46f20731e89639b698f492d9213dc5c550b5115baf4e478da7f529ca9499d78addaee800
- SSDEEP 49152:L26gm5RpmkLsUbjeK0Ah0cqJgIeXkfWLZWR2070bdVcPvc+yyxiDNZjaTbylizSq:M/U+MJYgos+P+NZjlK7
- TLSH
  T145167C5AA3AA11E8E07BD17D869B5717EBB274061330DBEB06B447672F13AF4563E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  IDA 7.7/ida64.exe
- Size 4.0MB
- SHA256 70840575ebddb25412f6de60329d5d395b325b709df9202411b723d0744c9624
- MD5 24ba0b4e0a3445a6c2fb866d94669f05
- SHA1 3b6bf89f5ec4b19266260fd488ae720a90f1865d
- SHA512 dcbd7babaa0de562a0a6682c3c0b053c419ddc2e78d6a0213c081a5ca50a256a720d0c6cbf3b2de669a5410918dfeb2d7d4fc29b23ae3285103c8e3c2be8b2b0
- SSDEEP 49152:GQptxtn8v9flRURQXyczsoBR9RAzkdk9ltnv2UtxOpYjObpJWYcmD75zoELxnXAm:GitxMR4QuoBPRAzz9lRvMVtdwdZro6m
- TLSH
  T1F7168C4BA33641D5D377C07CC58B8507E7B2702747625BEB29A88A6A1F336E02E7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  IDA 7.7/idahelp.chm
- Size 613KB
- SHA256 e6f23f3995d3943097f110c89a62db30c8cd10fcb355ba253e7376ff55a78f31
- MD5 ce5b6973b2ef73eaddd5b3ddafd750c3
- SHA1 00d30b7180cfb5282a8785aff25f2d599d3b35cc
- SHA512 f8c0274c53b25020f657087103659dba2ae5c602f3c7f7b35d8800d092e174506b257630e2e2e5857cc0c1dc4058aa9dac47ef77d69fc8c2b0b98a078a060138
- SSDEEP 12288:WqZBNO4b58puB/V1WorO1TWo1VZ02cm1X6Bs5C5htAAd0YCUKJ:Wkt8pu/vWB/1j0BuX6Qmvd9CUw
- TLSH
  T124D42343EF29064BF8152E38FFCCD110BA45FA06ABA6C783790391469B3478655E5F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  IDA 7.7/idapyswitch.exe
- Size 71KB
- SHA256 fda1967948657e7184f47a39bc3dc18c16ca3a0f7c087807723a4e9f55adbd98
- MD5 896e63c20ca85737e90d32dda6004206
- SHA1 e3f117772b4d24ffc6413be08ff7ddb74ad8cc89
- SHA512 7eb90072f209bf5c27458d79f09c6f111ef564db5fb9ba4f4e3399a70b1978ea5b86009b2ddeae7295507b906fc7f1f5128c493d86f5dd826b1f51802273fd6f
- SSDEEP 1536:amZJ7bsXCWaosxaOsqzQjjljGwsZ+J4OAWkrgOxAlb:eCL2FGD+Jherg4Alb
- TLSH
  T1D663396A77D911E9D07AD07CC6AA224BE3B270660721A7DF03B542951F23EF82E3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  IDA 7.7/idat.exe
- Size 1.5MB
- SHA256 d4345a0e6a6d04a4493d1235e89a63bba0106c1570c2a4bf4c33b5f7f3f7d243
- MD5 26f9edef3c39c5d826a953711800cd74
- SHA1 48331606a4637552d30d37ba31465e3f3c7f71a3
- SHA512 85986ecce6e8a06b0b9631bae4d358fc809c900c4e90af4dd97d963a4ff1e8a6f0604af60aec7fe134fea37069930f926cabf6e3d1667d4d7fb02e697f2f8426
- SSDEEP 24576:kc032Z0CodVHkQ6WVIW8otvg2eYn1oTf96JEQjsdl+vw20DsE959N43dk03Bhlz2:k3tdVH6Wi7otReY1oT9yEQjQlM/0GRhJ
- TLSH
  T1EC657B5B637801E9D57BC0BCC55B560BE7F674120720ABDF1AA446AA2F63BF8123E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  IDA 7.7/idat64.exe
- Size 1.5MB
- SHA256 be98f11869996aedd0a3e0ff86dca967dc0f8338215e301cb65c8fa02da41b57
- MD5 a281903a73582e5e404604936056fee9
- SHA1 8481210f0455e93410592c9a962e1256f7e57b23
- SHA512 92d33d73d530a62fd0a3fed0b737a2b3f10b3d8159fc309d5175abfab856141e9e08847b06dd9311507c367388e737c4a3c126e789f95393bf5cb76a0a5af09c
- SSDEEP 24576:j3d+13WxS/FfNEnAah1DE7JsyaXNqMUJozDpbQI5uRYOIVYZDzVyAU4tgVE56Kmg:j3s3tNEnbPw7JU9qMZZcouRYOol4tgWB
- TLSH
  T13A657B5B637900A8D17BC0BCC65B964BF3F674520761A7DF1AA046AA2F63FE4123E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  IDA 7.7/idc/ida.idc
- Size 2KB
- SHA256 1dc1dbbd3c03c81498f93d979b6c129caf2f02f5199d27db696a9bc984d61aa1
- MD5 dbff77091ca7ead006b0e240a4c2b33a
- SHA1 f00ca4ab9ab105bc065db0c849ecc6a9fbb87e8d
- SHA512 c7ee235e07c8481fd0d5a3436af4a8b8f068a0f61fc02598f1910ab462492ddb10bb3acb36e1b05c1167a6e0f3bf07c6e1e145b393e6c80da178919b69e044b5
- TLSH
  T15C511142AD97E2332AB6C3B8BB0F3412D3075857C7E4459070DEC954AB22156CBBC9DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  IDA 7.7/libSwiftDemangle.dll
- Size 172KB
- SHA256 4e74f93024f151b0afc39783e4959a6bf604923ab4bda110b3432935f45c0c94
- MD5 81bcec92309ce4888bd9386c67e6c080
- SHA1 e0da099985a2c8453d1f14ee496a1614326fb318
- SHA512 788ea308ba28c3b680f98f0dbd1dbf51bf5d0a916d7284f560a0fabce03cc22670c09278d5a131e24805988641a7ed00b0e05f1cd60a38eca0c50fcbd7d5a2f6
- SSDEEP 1536:Mr1GHHX5FNjP7YMasZBjDE6/veP2FcI1rWqX03i6cx7GrCjfut6AQ2ZcKuu6KAkz:YGHHdkMH+uGupsV3nc51jiNShl6KjY
- TLSH
  T17A04490BB61900B4E027E2388AD15503D7F2B05923708FEF16D58B76CF579EA2E7AB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  IDA 7.7/libclang.dll
- Size 20.1MB
- SHA256 a75780ed8ebc4e16d3e785590ba2f1ff10e837597a8e6e876f7f8e42658261fc
- MD5 7c6ba9c768dc446dec1ecb3b91d70ae0
- SHA1 e0841cd931ec39bc7148626e6bba5cb0903040a9
- SHA512 889e11a55176a929138fe35efec0467b3785b269d0d3738fca8709fbfc6ea60fd84b1bd0ec4acd198fe95db38d64501d26a90cd1ea362d65f8de21df7b38a206
- SSDEEP 393216:B+YZsFnX5hmFxNHIGBnEVlMcd2DG2NvWMQybDnKXPAms:pK42ycd2DG2NvWMQybDnKXPA
- TLSH
  T1D5277C53616C4691C07EF0B6C5BB1F4AC3B6BD263121A34B2DA7E9501F533A0F74B29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32