a97ad1bc6095303712286cfc4f2fe6b9f4b4fe04757b0b18158d953eaeaae9f8

Sharing

Copy URL Twitter E-mail

General

Target
enchant-1.6.0-x86_64-1sms.txz
Size 134KB
Sample260905-l7e3ksdb96
SHA256 a97ad1bc6095303712286cfc4f2fe6b9f4b4fe04757b0b18158d953eaeaae9f8
MD5 7f440596d10be924f1ba31eab68406d2
SHA1 a99d8d043ebb9fc85fa34d67e0739be2a2b13cbd
SHA512 008d34257d3c0b99ef0443812fb3db35e5609b90794cdd71979e38d9c32d4053c709359e57812f0ad5062711e45c5844a5bb9fdb4f05c750c5b36808aae54f20
SSDEEP 3072:+q22r6+Pgxr9vSxHGgT4kXmjztjwsvCKEWiFt:qK6+YxrFSxHGg8kXmjesKK3iFt
TLSH
T1FCD313C164A5200AD6DDBAA0F3FE055FC82703A1635180CE973BEEBE746B86B56513CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution linux

Malware Config

Targets

- Target
  install/doinst.sh
- Size 204B
- SHA256 cad5e3be9f035d5d2ccb02d4e4b158ea3b63e20813938942ea528d39358e4e2f
- MD5 d50406c886cef0e1433ce9302d0ba0bf
- SHA1 3ad2178f161da5f33eb4c4561ee4cf12ce3d4a88
- SHA512 cf6320a9e4e9804d576490be336d82554b3c4be2d5d2fdf7fabb986838413859f42b4edabfb0b9b0f379306de2d60edcd2dd04ab8433e60fe07293850a52f08a
- TLSH
  T168D01261C30A4EDBF12390C433C220FCFCDD068413DD7E2A94CE68F0000249578A1D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  usr/bin/enchant
- Size 13KB
- SHA256 f0cb33a35256277eb3aeba70ef9efd610f606295f6fdfd9e70644c77aa700f0d
- MD5 eaf892d9d53c72294fd4ebc7ed4b89ac
- SHA1 8e9b732872812a59fcec0be3b842142da4fb6554
- SHA512 3991e4aee785509e36dca1c5ee8549792c7d563b80b72c227f650dd5f46c7db37c56cb3808a370bfb21ff044f4fb7420d0356129fc30bea068e779f6db1ef862
- SSDEEP 192:GL8YCwtKuUFCCrjqbniTi/hKolOswMFzvk1DMI/r+vT93dTQnMJDVC1/DDis:mxdCrjqGTclOPqCIIaL9OnpZ
- TLSH
  T1D9529127E640577FC9DA82300CDB8239B5B3B170DA21571B554AB1703F123E99F1AB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  usr/bin/enchant-lsmod
- Size 7KB
- SHA256 de7694975ae2d101acb26a888cca5f1b641769bff199ee2745778edb6a46f5d3
- MD5 bd34252174f90aa65b5ef6c7a8e6e955
- SHA1 6084a4139c5135b50639ab176a8055e88ab1985c
- SHA512 27cc94ecf1621cfaeb07ebd4baebe9f10ea5f3da47cdf1e9e2617bb8bf1191160e3838f7b787ad299ed22c1ab56507e1160221d2eb581646a4f5e304463c9f3c
- SSDEEP 96:GMTgXuc/VJ/K8MwPeRgKchJhne5CJUdksu7MxNqjn+C:GMH2/i8RkshKwUdks8M
- TLSH
  T1D8E12113F310897FD4D84A388093A334B677F679D7226B0B6558E1392E6339C1E2A696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  usr/include/enchant/enchant++.h
- Size 7KB
- SHA256 f491e57a91cac50cecdb15ca8916246db6e0bbc51d12c1b2cc2bfa523f873bb2
- MD5 784d3a1c7b7a1661f2c5bd9e717f269c
- SHA1 56aeb64a38923a416646e98b23e37f4749f02d85
- SHA512 dff7416f83274c7480b6c7abfa20076c90e28dea68143f0e52f7fce905ae6c4a3b46d18d12f99003bf77b0d130cdc122fc97577cb2ea7d9ddaec03830d5926ff
- SSDEEP 96:WYuwobGRia5MFudqPYhzO90DLSXmIgh5bbBazbbBhKP4LM/DGsoT:XucoYdcYha9MS2rbKbv4/c
- TLSH
  T143F14E85D78DA4274711007564B934D6F13CB33FB334ACF2FD9E6124AA9681E867B8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  usr/include/enchant/enchant-provider.h
- Size 4KB
- SHA256 09d7004df2644368fc5ee66177025ba24342d4303c1f351fb40ccc5dc7008e0c
- MD5 426ce2bd152372b1f344ccf9ff867c95
- SHA1 e58fb5bf36bdb75c600a54fb61be589766bf8699
- SHA512 f8ff7ad5fcb219bd8b358a2222ff76c2f2e9c083d7d154a8c82d8d9ee88ad6f1d8c6ae46bc4c79f8eafd6cea6ab4141e658d2cdf81af4f3d8c43beedf5507fe0
- SSDEEP 96:WYuwobGRiazHRDHedXDshZ73TSJM2mE4D2ijuOOTtpSCwZNY0gOq:Xuc9HFUTKB3zdEY2iyOOTjSCw45Oq
- TLSH
  T160915018D06852B395B80EB1799B7972B06CB2657336C9D0285FB13C9C13AE548F3DED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  usr/include/enchant/enchant.h
- Size 6KB
- SHA256 0547ee1e6d99d0438695ac5c248f4816dedd0b0b0a5286c588869eba460f53c5
- MD5 32b70813a1bf8c8215c406cb55187875
- SHA1 792e89b707da618c9c3beedf5a09889e7dff1a89
- SHA512 57e99eec4d8914ead71f95989eee824eb3b0742d743310904a0c36e35b2f10d9649b4e8dfedd426e2d90e1d21c937f87db7bb37969599067732f888e76a749cb
- SSDEEP 96:WYuwobGRiadStFDvi3YN8MAg4nMmncA/3XoiWiPebFQxsndniPOy:Xuc+F7i3YN8MAsfA/3YiWi6FQVT
- TLSH
  T193E1020ACA084A3759A94AB23657B620B06EB36B7734E6F0343E74355F635945CF3CD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  usr/lib64/enchant/libenchant_aspell.so
- Size 8KB
- SHA256 50f7d64f4e7311e9c727cfa9a2de774a4083286bd62e71f50c91769e7a891083
- MD5 ef8baefc445c8d565b20076f9d18e849
- SHA1 9045ac111404e16b268e0bda15b74d0df89cea03
- SHA512 1e97780c32818444fe7cefd4f2f2f9287e42336e44993d278354e85ebaa9d91d7febc263f2db9e488cf3ba38143073005e3af73fdb836be8cd5ef3bb62442951
- SSDEEP 96:Rrfqs6BWf0V5h6yEFoxvY7RfXLy3WYGwPcVpyPmaaNxDAFU5adYuYjD7HccZDcp:Rrr6tzgDm+fb4WY/PczumF7DJjD+
- TLSH
  T1FD024287F2E48E2FCACC177C80EB86717B749154DE13DA172A04F27A5812BC85B1B976
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  usr/lib64/enchant/libenchant_ispell.so
- Size 52KB
- SHA256 96d09de527caffde726cf102e5c714365b9866e4ccf24b3982f01813d8c8855b
- MD5 be138613169f0702258624222dce8265
- SHA1 f98297c3228cc0b60859d1ec97a352c03abe8a26
- SHA512 c3ad50dae47a212d1981fd600df6106c269331c4545d53607974c1c84aeeedfb5bf3277a6f3ee97d584e5c04f35b29348bf702ba8267124adfcb45c5117e4f22
- SSDEEP 768:pqUIjSsDugZfUmLufHuDf0TumOm0fMWzNS7uV:kZgglUmL1D0WPzu
- TLSH
  T15B33191FF55680BEC5F98F3406A7063176A478019B112A772284E6396D27F2C4B5FFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  usr/lib64/enchant/libenchant_myspell.so
- Size 253KB
- SHA256 a359a7d9d9eab86c98b2aad039647a5c487c269eb36ebc40e8e95e4bc9045871
- MD5 a660de840a251352031cb2bf619c25be
- SHA1 1afeb2c2577b382ac1d5af16b1635ee3bd692c5c
- SHA512 28733790aa9aa465bec909a135111bb441263373ad27696e7fa826c608311b9e3144112054ea75b8f86b01e9f50bbd563de0799d6a2fe31f35e6f35b7eaf7255
- SSDEEP 6144:jEEwNu/ZVBWkB9w45IeXlMh1ldX4pYQCf2FAPsBeS4:j/wPkB93g3f4WQrFAPsBw
- TLSH
  T1A0446C5FF96794B9CAEFC930867B5331E771B851C3216B2B30C499702F02B540B5AB69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  usr/lib64/libenchant.so.1.6.0
- Size 43KB
- SHA256 5d8526647c8f5665068503d05f2150d31931f12b2c47fd0da72d077e647f064b
- MD5 14a92c2928c6f3ddfd1061f87e0d82f5
- SHA1 75c4b34d13ee26fc43ed02be3c2fdc76a7fd9d2b
- SHA512 284229c5a4e4fa2f807b930b8743731a89b2997dd8decff6ca9a55f5850a91ff21df17c421965e818d640182c400574b9bb824905515f04d285af60cde2d5800
- SSDEEP 768:1F+bmKxLTADulpg2LsRsLgKL29gERfkf1G/nvLHH:7+yKRslsLe9x
- TLSH
  T1C813194BF896543FC1E9CA30A4D7E025B6747490AA216B2F3118A7756D63F380F1BF26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14