5fe2ff480b2126e794cfe8d906d2e29b8b54094ac17a0f63c17cb2c2c7218d5a

Sharing

Copy URL Twitter E-mail

General

Target
Void-Tools-v2.0-main (2).zip
Size 1.1MB
Sample260828-bspcla11fw
SHA256 5fe2ff480b2126e794cfe8d906d2e29b8b54094ac17a0f63c17cb2c2c7218d5a
MD5 c095c5083e277e7ec445afbeafa1bfa2
SHA1 65052fffe824062ad47afcf177ff83914df8360b
SHA512 9d8cc8ac962203034a0f7e132bf86c46b235f8b36460dd30d764926cbf5363beda2ef735572a59164cf95194aaddf2e4ef68ae0b643c91ecd24c65e370dcc3e3
SSDEEP 24576:uZz/Ybc3+BPxis8abFBAY5X5Cqf+eztr7SVecta9XjxcgqP+kA:ud/YN8qAY5pCk+43ctSzxcJtA
TLSH
T18635127DCB18D852ED27B27CE99DD3AEC5CB5F121E021C5F2E214A4832AD0C02B6665E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Void-Tools-v2.0-main/Void/tools/simple-dox/en.py
- Size 4KB
- SHA256 cf4b5edfae5098f428855138a5d960c2dabc59b0eeb32bee33db9d27337f31cf
- MD5 be416f1d187c438b7143178fbc12b22e
- SHA1 d92d7c82ab34d081310d5ab5ef1fd772e7ae405b
- SHA512 3a0212728717419fe74fb28be92f7edd63c8eefaef35c19690d6c2056514545266e1fa2973504eea23245b840a73405723c8e98fd9f3f565544d73cfbd025687
- SSDEEP 96:k6bNtTHJePmTENuVVJ4MVBbV3Jkca3Z/tnzxyTIFHaIu5OXgdT:k6bNtTHJkQ3mtF98IZZuOQdT
- TLSH
  T1ED8169326C403721936DCD6454F2FC6CA7A178E2CA725424F4ED82D06FB5C319D5C6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery execution spyware
behavioral1 behavioral2
- Target
  Void-Tools-v2.0-main/Void/tools/simple-dox/fr.py
- Size 4KB
- SHA256 8a9c9b0b0b96877063139d945bd69c1efb681cc689163beb627b77b1757cfdc1
- MD5 861a94200668af1d4c64c2d96c59496b
- SHA1 ca3acc6caf6a764730acc66eaf90bd0f04ac5308
- SHA512 c00b63d3c6ab6b32a4f6d38d76ce8725c71f5de47aea23a448c2f90ccc7407717bd6ad70b5126ce24ae167d7c2dc365093275f0a744b6cb75f28302de478b3dd
- SSDEEP 96:k6bNtTHJePmTENuVVJ4MVBbV3Jkca3Z/tnzxyTI+Y3aI+OnqgpT:k6bNtTHJkQ3mtF98ILZ+OZpT
- TLSH
  T1AF8166326C40772293AECD1498B2FC6CA7A168E6CA319024F9ED82C46FB5C319D5D5E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Void-Tools-v2.0-main/Void/tools/social/__pycache__/core.cpython-314.pyc
- Size 14KB
- SHA256 fbeb58f36e9e860f4561dac1543446c47f52b6c11faade96e3ed5a6b4ea9adc3
- MD5 34bda08acb54b77debecbde37dd20e00
- SHA1 f66143c13cd94f59595ccf42deaac01e82851f4d
- SHA512 d16a52ded11e1dcb57e65a2c697cb720de436ca580213dfb95f037192da2a90024644af9d9b899a0cd33ebd7c383a3468b6a4d74588c122baaf23b036231a3a4
- SSDEEP 384:z3pKmaPGg2dWIcOgHSlTkx+LrwfthxGJaYzs:z5xyGcILQakxy4KaYzs
- TLSH
  T1B862C6DBC8846A63FEF9F4B435E755D98722C187AA81D713D1184C3FADCA261983131E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Void-Tools-v2.0-main/Void/tools/username-hunter/en.py
- Size 7KB
- SHA256 dcbfb5ff29917b47521914b1d1983a492cc3593929916d6f92c86af46a1fc9a8
- MD5 ae0e70b5383d5b92f63f3f3ba8e7d1d0
- SHA1 a2d5f5440001c8e0ccdb80d14628216ef780893e
- SHA512 2148a400f75c05b598684aae121505e5fea694bb3a0d2e43fbb1ff6dce4d2f45fda83c9246564e4365bb36a513def7d98878a20e209f79adfe1cca56c72bdb28
- SSDEEP 192:kZiYR5xH/fctP3efYOyxx2PFRxI2A9v3O8LEMgGw:kaOWxoFRVCC
- TLSH
  T142F1CA33A4117731979E9C14A4B6FC6CAB6229D7CE365024F1FD82D02F69871DD28EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution discovery persistence
behavioral7 behavioral8
- Target
  Void-Tools-v2.0-main/Void/tools/username-hunter/fr.py
- Size 7KB
- SHA256 2c2965912e58a24fd26b667c46a7ac4dfc429e4134201c2d8a53a6fcb23ae8e4
- MD5 164cd1b9cbc2c10a3e2b4fd1aed6fe4d
- SHA1 1b3294dd266b3a14aff6c2793f01d0b5f104c608
- SHA512 9a2e02105335d43698a7263d336c59b45c2b8ad18290a5436be61a18d3234fa57c0ee4babafdeaafd8f8ccee118343d8b1690b99ecf0a3c1ea3d83ce24cadba3
- SSDEEP 192:kZiYR5xH/fctP3efYOyxx2PFRxI2A3hh3/82Ev3yw:kaOWxoFRVa2R
- TLSH
  T117F1DD33A4117731979E9C14A4B6FC6C6B6229D7CE355024F1FE81D02F69871DD28EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Void-Tools-v2.0-main/Void/tools/void-nuke/main.py
- Size 53KB
- SHA256 6dcffd95c759089c245426210114eb48553dddec4f74af8454604fd2606e3a1d
- MD5 fb00636df79ec235d7ab840c5d927a58
- SHA1 0494f429cbe2fe157698a7e4731c9bb489ffd422
- SHA512 4994a827b6d196e46ccaac90341a01260788739ce81f2cf23f7894669b43ed67631605de99d4003877157771a9a0fc635efd5fe5175f20544b38aace00333d3b
- SSDEEP 1536:/48EYshx0/q9MdVGhUAML9+sIzgdDgrvXoMHJ+f6kh661ND0:/fEYshx0S9MdVeUAML9+sIzgdDgr/DH/
- TLSH
  T1BD438135984A6222E707DC1D48B5AD02236C3483E9089434B9DCB5C5AFEC635DEB9FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Void-Tools-v2.0-main/Void/tools/website-admin-hunter/en.py
- Size 4KB
- SHA256 0c36b65fbf5c543e07bf4eacc22b35893eeaeeb4395b4b74eb48b8831858e49e
- MD5 a4ea28542118a82b72264ed5b7adee07
- SHA1 817097bd6f57d2d08bbd10b1335a2be485449eac
- SHA512 4dc071e5eb239af3d73f84037be8de1918569828008a269200653f5a018779f68fdf750bc6c2082b1462d6829aae113aa9da0c778b26bf74fb9ba2dfa4b2fb36
- SSDEEP 96:kZb7U5v9x2PflVzDf+VmH9Z6Nmca3z/tpzgyaFHEEyFOAOZGK/u:kZb7U5vKrEkPFupFHVIOAWu
- TLSH
  T14DA11F3328513371A3AE4C9494B2FC2C677525D7CA765034F9ED82D06FA8C309D66AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Void-Tools-v2.0-main/Void/tools/website-admin-hunter/fr.py
- Size 4KB
- SHA256 c14446f68ca162bd13758d5a63884c820e4b32d0f03a90f4a387dae9d284d792
- MD5 9d32ad5361aee4747a58efe6ebc6acd7
- SHA1 ab6a8c7147bc344a8cfa3148e7bf51971a63efe2
- SHA512 7e913aa723ebb814e9c313a0546e9d8f38628f6a42b9de86aed64e77a90ac2712e486b75ea0a03093b158cda5fc6b462801a488fa6410b962d59cb91dfed46d7
- SSDEEP 96:kZb7U5v9x2PflVzDf+VmH9Z6Nmca3z/tpzgyaFHEEyFOVyOZGKIO:kZb7U5vKrEkPFupFHVIOVyRO
- TLSH
  T155A1FE3768513331A3AE4C9494B2FC2C677525D7CA765034F9ED82D06FA8C309D66AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Void-Tools-v2.0-main/Void/tools/website-basic-auth-bf/en.py
- Size 5KB
- SHA256 4effea8a0f0d4b7f366ee13379789840c4067f37eae42493e93f7e55ebdb1ab8
- MD5 b515abb887fb15ad6e897e98bc2afc2e
- SHA1 96e7fdd25fef12aae11be41a5ff91a7006bd5e7e
- SHA512 f83101431fae11bddf0dc189d1815a89f7f90a47012961e3ef0850dcc36215136c96f846b0fdbacbddf7db1eaf3a896505c754eceeb36c92f8b2a9ef39d885cc
- SSDEEP 96:kmbwU5v9x2PflVzDf+VmH9Z6bRca3z/tpzgyAeXZAAOcOi7T4g3BPGKXWb7oFV:kmbwU5vKrEFPFuxeXZdOcVgg3hWb7oFV
- TLSH
  T113C11F3258503331939E4D9894B3F82C6765B5C7C9B5A128F9FCC2D46FA9C318E256EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Void-Tools-v2.0-main/Void/tools/website-basic-auth-bf/fr.py
- Size 5KB
- SHA256 6f6ca581b2f89f8dc0bf6fc2a644759abb9ecada167dc9b49d8bcd1ea13bab5d
- MD5 7ee0bba7ac73a406a3d5011796a72fd5
- SHA1 83dd048bf723b823c555703fbb82c3546987d577
- SHA512 5383462ffe3744f028559ab1be5c52add529c291485b1fc2edb4047954b25d8772c63a9745b0349bea4f3bb6f2670e1b11d07b3735b7eb29c497f8c65b47a99a
- SSDEEP 96:kmbwU5v9x2PflVzDf+VmH9Z6bRca3z/tpzgyAeXZAAO8uO1h4g3kJGKWWvLCWPGG:kmbwU5vKrEFPFuxeXZdO8uCig39WvLCY
- TLSH
  T146C1103658503322939E4D9894B3FC2D6770A5C7C975A124F9ECC2D42FA8C3189256FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Void-Tools-v2.0-main/Void/tools/website-cloner/en.py
- Size 4KB
- SHA256 e8cc2b54fa7643179b383eb62a04a9c57ddd248d4b9183c0f49e0c16d7416561
- MD5 aeb741a48c6d8c5ff66aa8115a13e2e5
- SHA1 de9d93e41711dbb4b9226be6888326217e5c135e
- SHA512 7966aee4636e6737f3de1403ab2efcf6712531e052e7a1d81dbe4c0d5da115727ce432917c61333acda57b90b223dbd052764d0356783d1cbb1e9e7d6b07b23e
- SSDEEP 96:k5bx5v9x2PflVzDf+VmH9ZySAca3z/tnzgynjFOOovmzz/0XWPx7oDRT:k5bx5vKr01PFMuF1JzSWJ7oDRT
- TLSH
  T104A1BA325850337093AE4C54A8F3FC6C6BA129D3CA726024F9ED82D46FA5C319D65AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Void-Tools-v2.0-main/Void/tools/website-cloner/fr.py
- Size 4KB
- SHA256 c8e4297569e69a0f895ac81051cc994b347d763ef260906b9f82c4740c11a7bb
- MD5 a38cb62995e649cd4527217f39b3d8fb
- SHA1 5386dd1cc7b14e98a1d75c8e7ab5f17dbe45811e
- SHA512 c9a1a80b64016d8ef170939aab26d84da36d089c5731c8fad881ff1a168e706805062a56df76073111a68379a15c93e278f57d686f58fedc3d45c5bbb8876101
- SSDEEP 96:k5bx5v9x2PflVzDf+VmH9ZySAca3z/tnzgynjRyOOovmzz/0XWP77oCBT:k5bx5vKr01PFMuRy1JzSWz7oCBT
- TLSH
  T12EA1DC325450333093AE4C55A8F3FC2C6BA169D3CA32A024F9ED82D46FA5D718D65AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Void-Tools-v2.0-main/Void/tools/website-dir-buster/en.py
- Size 4KB
- SHA256 fd0e6fa332550fddbd025416527b83483b4f5642a8c96fe5edc5b65e41fa4527
- MD5 f4f94a0688911789e1c8f89821d69f9e
- SHA1 cc1400ee0ae3cd361382e274b04069ddae8665c7
- SHA512 3c56233372eab66b8aea0d920a41749afdfb6e2a10f4f59cd1f51c76e3cf7de6cc8c05c8a646595b6fce17a9551d6031eea475e57ad0515ebb122826a5803351
- SSDEEP 96:kZb7U5v9x2PflVzDf+VmH9Z62fca3z/tpzgyw/42FO5OZGK+mi:kZb7U5vKrE2PFutwEO5ci
- TLSH
  T13FA1ED3364513321936D4C5894B2FC2C677529D7CA36A068F9ED92D46FA8C308D6ABFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Void-Tools-v2.0-main/Void/tools/website-dir-buster/fr.py
- Size 4KB
- SHA256 d625f607640d53cbf32b7b789b93e04c2a08330eb57b525181abedcaeb9e0a90
- MD5 29083f8c435bfa44b662a4de16e5550a
- SHA1 1bd40025c306a615a4f06ea6ef35ea610b31ba46
- SHA512 4c8fb609ebd9515a5c18c1786affb8f28b642d9ad519ce336a4b44340c5b2dc9e3a89040f143417be476b61acf6b6a7700708903bcf965806e1520593721d658
- SSDEEP 96:kZb7U5v9x2PflVzDf+VmH9Z62fca3z/tpzgyw/42FO2yOZGKVm8:kZb7U5vKrE2PFutwEO2yB8
- TLSH
  T165A1EE3264513321936D4C5894B2FC2C677529DBCA76A028F9ED92D06FA8C308D66BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Void-Tools-v2.0-main/Void/tools/website-info-scanner/en.py
- Size 12KB
- SHA256 6004d52f27e5c59df245a70a26d7d988db415856441ea159392dce576176b7ad
- MD5 f0548c1bcdd9a7ad83fe639d8dda3bf7
- SHA1 4b9e2de067de6e62eb9ca84f359090d962eca36b
- SHA512 9a9e13f901269bbcf12ca0291ff7e4c7e29c0a9b9cf396738b4c43115972f49bc04bc3dbc8f9c84cf61b3539da765cb7855dc23a573e8ed2228e67b1ff0595fd
- SSDEEP 192:kLG55vKrE6OtF+Rl0e744Zxw+1MFDLbZYM2RSCTQ08YZ1I2PXPHpVJ+6bSJF:kIvF+ROEtIDXKM2RF79SJF
- TLSH
  T18542E63BA8252770938B18186873E818776564934A66682CF9EC83E52FFCC73C5B57DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Void-Tools-v2.0-main/Void/tools/website-info-scanner/fr.py
- Size 12KB
- SHA256 640424de2e5d55e0dbdaf9d5594972f6f7711a4e2dafe4f4830b00d1b14e9af9
- MD5 dab36b51e9ed770f83b3b73444307102
- SHA1 e35e6eeab73397b3ab6bff0def055fed487de815
- SHA512 998a8629f1fc5d90e16f6da084bb6a5407cd4f5c93b1613866f925dcd5bf272f17f8b2f8f421ba76be8503fd72dd369fdca514d4bcf6244f969bc324e62d41cf
- SSDEEP 192:kLG55vKrEITEtF+Rl0e744Zxw+1MFDLvYTaRSCTQ0uZ1OtiNCzCMhDN/MPFwSJL:kIIeF+ROEtIDsTaRGGvPSJL
- TLSH
  T17A42E737A82427709387181868B3E819776595534A66682CF9EC83E42FFCC77C5B93EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32