341224c95541dbec95f3469eb8138bea49933648eb052352ce389727b3a436e1

Sharing

Copy URL Twitter E-mail

General

Target
341224c95541dbec95f3469eb8138bea49933648eb052352ce389727b3a436e1
Size 8.3MB
Sample260905-eed69aek7z
SHA256 341224c95541dbec95f3469eb8138bea49933648eb052352ce389727b3a436e1
MD5 015d7e9dc5ace50c81bbe5763a5ed185
SHA1 158a54c04bacbf978378bbb3104be6ade9557600
SHA512 dac9b0fd445bf4d14bb279f113bca69eee4775c1a71f64ca41ba0973771ade8f2b3ad9dc4794e79f4fe36beae09ff0723d0c36d7217ad2a2defe12b7d173ea8e
SSDEEP 196608:34QzgkyE6lpMJpW4SzyRdBQnmg4BsZ1FL2Pqsa0XH/HHYBYSqBs:344b6rQW4SGRdBQnL4BsZKPPXcN
TLSH
T1639623E8A65EB8C3F12D957008457F01B668F8F60CCBDB4F08714D85A8971C1FE4BAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution pyinstaller

Malware Config

Targets

- Target
  TKEWorkloadTool_x64/TKEWorkloadTool_x64.exe
- Size 1.3MB
- SHA256 0e75fb481bc578a5b98d8c0c9f2da15a13925db3f02cff6a8be47baffc6daa61
- MD5 3d45293ea854ee99cddf0d756cd8b851
- SHA1 6fac2dcee469e84b595375f257765f551f7fa2f6
- SHA512 7beb0941096d78d0867d0ad52dc0e7f52f47ab1e3723226b33879e7975a2a70a0094a1c30b0bf53a4c744470b7a8e7c3179a4b541634ed937856d3fb51f6d215
- SSDEEP 24576:W0RYHGIZWmeZcJVjhlm2rQmaSAz+vvJlTwQy56RMmhcqos:7RPjmsWjG2rQmaSLvRlkQ05mhc
- TLSH
  T160551215B3E414F5F8B3523DC892810AEAB1BC250760C6DF43A497752F336E1AE7AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  TKEWorkloadTool_x64/_internal/VCRUNTIME140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
- MD5 f34eb034aa4a9735218686590cba2e8b
- SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
- SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
- SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
- TLSH
  T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  TKEWorkloadTool_x64/_internal/_bz2.pyd
- Size 81KB
- SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
- MD5 86d1b2a9070cd7d52124126a357ff067
- SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
- SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
- SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
- TLSH
  T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  TKEWorkloadTool_x64/_internal/_ctypes.pyd
- Size 120KB
- SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
- MD5 1635a0c5a72df5ae64072cbb0065aebe
- SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
- SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
- SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
- TLSH
  T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  TKEWorkloadTool_x64/_internal/_decimal.pyd
- Size 248KB
- SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
- MD5 20c77203ddf9ff2ff96d6d11dea2edcf
- SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
- SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
- SSDEEP 6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
- TLSH
  T10B446C66A2490CA4DE77807498974B57F7B278944320D3CF43A4CAA73F576A323BD748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  TKEWorkloadTool_x64/_internal/_hashlib.pyd
- Size 63KB
- SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
- MD5 d4674750c732f0db4c4dd6a83a9124fe
- SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
- SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
- SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
- TLSH
  T1A8537C06A78440A5C467837DD9D30EABE272F4405751A7EF4368C28E2F237C3A7B67A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  TKEWorkloadTool_x64/_internal/_lzma.pyd
- Size 154KB
- SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
- MD5 7447efd8d71e8a1929be0fac722b42dc
- SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
- SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
- SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
- TLSH
  T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/auto.tcl
- Size 21KB
- SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
- MD5 08edf746b4a088cb4185c165177bd604
- SHA1 395cda114f23e513eef4618da39bb86d034124bf
- SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
- SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
- TLSH
  T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/clock.tcl
- Size 130KB
- SHA256 1947f8b188ab4ab6aa72ea68a58d2d9add0894fdf320f6b074eae0f198368fb7
- MD5 88bb44a1364147fdd80f9fd78fbcef61
- SHA1 2c3454d2669f0ca83fecf17976d599c85b86e615
- SHA512 010b13e8a2d50521b5d7adcc5f32f7cde3f12e1053961c575d967dc6cfd368640bf45d23832e5e9c3868cdca9fe0505698f949c5557d4169353634c94aa196b5
- SSDEEP 3072:Cbn4IAhYvuCg9epsArAzqpSMpWzP7ejMiIAxBPqGYkPAPaZpHYM8EN4LhVLlarXL:Cbn4IM9epsArSqpSMpWzP7ejM/eBPqG3
- TLSH
  T1E8D3A6027F19412E71B2D33A4ABAE198DF2ED1B776AB805CBC9E405C3B1091446BFBD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/http1.0/http.tcl
- Size 9KB
- SHA256 8c474095a3aba7df5b488f3d35240d6de729e57153980c2a898728b8c407a727
- MD5 c2092f8ca2d761dfa8c461076d956374
- SHA1 90b4648b3bc81c30465b0be83a5db4127a1392fb
- SHA512 09ce408886e2ceaddf70786a15d63af9a930e70cac4286ac9ddd2094c8edcf97a2adc2d3d2659b123f88719340d3b00d9f96e9bc7c8b55192735c290e7d24683
- SSDEEP 192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
- TLSH
  T1CC225385620691AD6DB2433ACEB990B0EE3A51B321B9416CBC5DC1643F7250E9FFCBD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/init.tcl
- Size 25KB
- SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
- MD5 982eae7a49263817d83f744ffcd00c0e
- SHA1 81723dfea5576a0916abeff639debe04ce1d2c83
- SHA512 31370d8390c4608e7a727eed9ee7f4c568ecb913ae50184b6f105da9c030f3b9f4b5f17968d8975b2f60df1b0c5e278512e74267c935fe4ec28f689ac6a97129
- SSDEEP 768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
- TLSH
  T1C3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/opt0.4/optparse.tcl
- Size 32KB
- SHA256 67a157f1873d606b53dc4d894bd8e71f6b1a0dd66177b9513bd039b348b40349
- MD5 4ecd97188bfed58a15fe22ec566fa6a3
- SHA1 6e4e91096298f1a0ae6cd4241f167c8b4f661ee5
- SHA512 1d5067bbb13dab001168eeb41ebfa2d13bacb0f43a8067cc93923e8f4d062aa387da23d7d98d6a2ae77d7c849a6026f2343102cbe03690c2cea0890222339475
- SSDEEP 768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
- TLSH
  T164E28126BA45629D26B252368E798451FF3EC2735296407CFC9C817C3FB0942C6BEBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/package.tcl
- Size 23KB
- SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
- MD5 ddb0ab9842b64114138a8c83c4322027
- SHA1 eccacdc2ccd86a452b21f3cf0933fd41125de790
- SHA512 c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463
- SSDEEP 384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
- TLSH
  T174B2C9217389925A34B153639B352C8CCF3EC0FB51A951BC78D882BC77709190ADEBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/parray.tcl
- Size 844B
- SHA256 e269029c8263e3cbc1920c3604ecdcf15edccb208a0d68f9eb42b73954d620c0
- MD5 577787c2f4f5956ba70f83012b980ae5
- SHA1 040b2469f796f3fdfcd1e1dd2eb1c5b799edef62
- SHA512 c2940f6f3d77412efc537b8ab67352f519dffa95739fcc17bf1817335afd9e5bfe91abe98cba99e278cb4923d4e6d431ed9d72282745203c0f7d73193f550238
- TLSH
  T16A011201430160ED22B1C33642E5EA48CD2219361DD66A99F4CB4138BFF1D2486B07A6
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/safe.tcl
- Size 41KB
- SHA256 c21dce3ab31893118bbed01e559070f1d3541877fee331bd45f5bf4300ed9654
- MD5 b8c1561d471cfbf4111c706411d59883
- SHA1 71483eaeef377ee9af90bec44f70c7b12c5bc720
- SHA512 465065a938c71af4588b3331b51a62dd57f57492eb1cb6c0f52b9fd0a2fe7a54b1e995aa56e4a41d7a99eaff665c1e23e3b240fb3f9840ab242c21b1dbffff45
- SSDEEP 768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
- TLSH
  T1241397126B43579D387283329D7AD6A4EF3D80FB42EA40ACB44CE16C3F71419466EBD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  TKEWorkloadTool_x64/_internal/_tcl_data/word.tcl
- Size 4KB
- SHA256 678f891615e2209a8ecba17857922a9723e78709adb983032e89ca706000c44d
- MD5 70450a0cf04ef273eff2b070053fcfa6
- SHA1 47974d6c0fc986ee1273c4e13ddb9e1288cef0ff
- SHA512 afd3e47324d1497cc46ac6141191fceb843977d0b0285c807ff8985dcc56fde10977f57d503d986cd2c1edc6c62f01e405a0eb483340b247b129fc8d6d9fe689
- SSDEEP 96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
- TLSH
  T1A0A154D29646132E5FB2C119E9DDB379FA0A053A03FF412170ADF1582B6655F083ECE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32