1a648f99405a1204e0a7a909729b3cfad47d789d0ebe95139a45bce1c5fd9fed

Sharing

Copy URL Twitter E-mail

General

Target
0_windows_x86-64_SMD_4.5.0-beta.0.zip
Size 56.4MB
Sample260910-2lnetsyzdt
SHA256 1a648f99405a1204e0a7a909729b3cfad47d789d0ebe95139a45bce1c5fd9fed
MD5 751e1ff272ee88073c4895da66dc1796
SHA1 742bcb18d7029243a0da5df994aefb09148e35e4
SHA512 4398752638bed86a763348b415d2178ca1b043fff256766c4fadd9193b74a4cc00ea07d0ec568fb60b7a09fdbbd731eec458cf4b47ffe66fe7621d0e7f8601ab
SSDEEP 1572864:p0U5OTE3Qgd+oIiIbceFvo/QzsJssBi/O+TywTTub:prOTEggd8QQsQmFBi/vvTTi
TLSH
T1BDD72333544A0987C646FF7866C06DA5C01E760239EAB54F3EA12778649F889DB8FF0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  SMD.exe
- Size 15.9MB
- SHA256 3c40dc0f5732ea5400301c15fb2d399d46724720e9b2a6d1c98203319802409a
- MD5 3d74655807514baf89ce98793c53798d
- SHA1 fba38d2fb27be731b922540bcf910f3105e7a712
- SHA512 f49602699ae22c2bdd4ebcea9324ee5dcae09f5906493253cd377e417713d981cc5b9953d8438df1d745c6bda700b44e1c6b0cd5b55a8a4bb717368e6bf0eebc
- SSDEEP 393216:wTAqgLVtxrBuLg65mt9PsJ4eFMAwIlyMgP69lB3UUjgf:wTbGTrBuLRgvPsJ4eFM9/69DT
- TLSH
  T1F9F633367303E15ED9ED393B965BC52129B1FC510303F6AFA2647D245ED3AB10932EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  _internal/rpds/rpds.cp312-win_amd64.pyd
- Size 540KB
- SHA256 8b4b68653e93ffc61124c96fa85fcb3c4f9c8e3059a3706dcfc671af1f0caa1c
- MD5 fd3a3dd93a1937345c35715281cc9d94
- SHA1 cddf3cf06d1c740ea7190ecf75c119775a2432b1
- SHA512 762da54c7fbdfb445b6216a0962083c7f46c8b1c142bc186e4136d989048012dc25d9ae9dbe4f856ffcec10cc6a9e2e85ec1618455d2d976053f1a53c53dc13d
- SSDEEP 12288:xsb7N9KpmOGLKqwxaN6s6843NDdravUg2qe:arKpmOGLKqwxaN6sq3NBrZg2N
- TLSH
  T178C40824BA659B69C44BC47483578AA62A7130CB0F35B8FF04C5A27D2E79EF91F3C254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  _internal/select.pyd
- Size 30KB
- SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
- MD5 d0cc9fc9a0650ba00bd206720223493b
- SHA1 295bc204e489572b74cc11801ed8590f808e1618
- SHA512 d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b
- SSDEEP 384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
- TLSH
  T10DD28F476B60688AD923C97268A64E27DD35B752871182CF3358C15D1F227C27BBB3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  _internal/sqlite3.dll
- Size 1.5MB
- SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
- MD5 e52f6b9bd5455d6f4874f12065a7bc39
- SHA1 8a3cb731e9c57fd8066d6dad6b846a5f857d93c8
- SHA512 764bfb9ead13361be7583448b78f239964532fd589e8a2ad83857192bf500f507260b049e1eb7522dedadc81ac3dfc76a90ddeb0440557844abed6206022da96
- SSDEEP 24576:HU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTKJz:AVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoA
- TLSH
  T186658C4BF2B801ADC0A7C179C91B170BEBB2B405177497DF5594CA692F23EE217BA324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  _internal/tcl8/8.4/platform-1.0.19.tm
- Size 11KB
- SHA256 32348d51f3637f375b056fe99e9b4d89d85d45db907847dc370bd72812a2e2fe
- MD5 a0b269d76db613c2d927efa84fee88e2
- SHA1 f9c7ad375f4d4223f0668fa1e2c4e5a83cac2d03
- SHA512 5427762147825dc2ed3feee4011bbf2100932a4d93f3242ccad15499c9dc39f42a82aeb42ed5db5839560cd7aae5d30621ac3694552ffc650a1f572cee32fa54
- SSDEEP 192:rXlm2LnoZ7k2mOEhYoKVtWD2xLsmF+MNlPQ4lJ+B0O0DgryYY/+zy7go:rXlm2Lng7kvF2VtWD2xLeMNT+B0O0Urk
- TLSH
  T1FB322C5273A9D27AB332631BC5B1A194EF7A90B74E9BC0ACB89D412C337171807647F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  _internal/tcl8/8.4/platform/shell-1.1.4.tm
- Size 6KB
- SHA256 0a6b4b109cfdfc4b40fbdefdb2282f9b1af3cc2f9624dd39958eebd78781afb2
- MD5 8abc3029963e433d1d9865aaa7e1057b
- SHA1 a88091dc98b2fd0ae3a258b59f8be43f41f04323
- SHA512 d5068375615a2200ddc13eeb852b2e21b7e4aa416fb7a0e97c98b8b106d7701792c523739e8bf266d2abe411d4298a0b5b3884cfb9df820fd4a2b61b22f9decf
- SSDEEP 192:PV5U+VLnNUPVvH+knNUPVUHD5ngWftN+IgMufIdqi+g0SYiCXVDjqL:Nm6MFXN5uwq51iCFD2
- TLSH
  T180D113266357A5AC0336D23726D19135EF3EE0BB8D97844CB98C815C3F708444BEABE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  _internal/tcl8/8.5/msgcat-1.6.1.tm
- Size 34KB
- SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
- MD5 bd4ff2a1f742d9e6e699eeee5e678ad1
- SHA1 811ad83aff80131ba73abc546c6bd78453bf3eb9
- SHA512 b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43
- SSDEEP 768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
- TLSH
  T1EEF2D624334741AB36B2526799B9A2A4CE3CE23F10AB959FB89A801C7731F5D43F74D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  _internal/tcl8/8.5/tcltest-2.5.5.tm
- Size 105KB
- SHA256 35a88f56df57e6ac6f2ccc4d193210fbb9bd224ac99670603e077ddf8c5610bc
- MD5 655ec828777244f9f048e0d08203482f
- SHA1 790446d04fe7be12fd5dcf6e6fbd4c5a08c45c98
- SHA512 c249caa5da76a0b0876dd1bd201ff2d249d4fcd8467992c9de51ba5a1c5471f98c10d69c46df5b25dba7941f4301b446d90cbf17bccfb8b0ed27b22bf4da20f3
- SSDEEP 3072:74s6YTLsaoi4N8uBPM5PP9AlGXJL/ciBh:7N6Y9oi4N8uBPM5PP9AYXJL/ciBh
- TLSH
  T13AB3D8217346A06AB3B2B21686B9B064DF77D1FF19DA416CB8CEC21C3B7041146F9AF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  _internal/tcl8/8.6/http-2.9.8.tm
- Size 115KB
- SHA256 7a30e7a49c1f6939537eb7a80cf2f5bc7a4969f2b2ad99ba4e26db85bbc2fcc7
- MD5 acb85feb97b27f1362e1d76b686d498f
- SHA1 92c370f838bd67c72e153fbf7ad05e26ff40a393
- SHA512 ea504863386817e1b21549376148fd05c7eaf74f91a3a8da97efcf3784530ed3cf1910df9b2431ec47d1175759cdeb1a0e9e9e02bba94ec2123eafb7cbd2b90a
- SSDEEP 1536:RYY1IO/KuUhIW17zr1DLJuuBuFsj6aIsGc3e6xGxjndp72y4ebBxIQ30Ik:RbyOCuUv9r5LJmsjlxTxGxjndpCBeAQ0
- TLSH
  T1A0C39555FB56229E7D7183158ABEE070FF3880B763A0816DB49DC99C3F3210852AFAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  _internal/tcl86t.dll
- Size 1.7MB
- SHA256 3d2769e69d611314d517fc9aad688a529670af94a7589f728107180ae105218f
- MD5 108d97000657e7b1b95626350784ed23
- SHA1 3814e6e5356b26e6e538f2c1803418eb83941e30
- SHA512 9475cd1c8fe2e769ed0e8469d1f19cdf808f930cccc3baf581888a705f195c9be02652168d9c1c25ba850502f94e7eb87687c2c75f0f699c38309bc92b9004a0
- SSDEEP 24576:/AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDf:/A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDt
- TLSH
  T14F858F1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  _internal/third_party/fzf/fzf.exe
- Size 4.7MB
- SHA256 9dfcd498da2dab1c35cdc95d0179c3d931a083b4aa5fb121bb83a373e3338902
- MD5 c431308046bad40ecd8a4914a935a078
- SHA1 a92cbf67c821fb99c13059b8a1c4f0aa6f3d0147
- SHA512 0e7e177fb8a80cc69f2c36d8cb1c8e60b8e0c4d0766aafedec97a85658f9f3caf3d34a6a8b2332ee795f4490b7e1144bc267f4a13f2f4d95e6d0101408f65c37
- SSDEEP 49152:3qjHPb+b0eoFjx09SgmVIPkPq0j3c1OuljCUwKrh/kcMD4qd:+fKy6D9t
- TLSH
  T18F363847BCA145A9C49AC635C96A82527B317C881B3123D37B94F7783F76BD06EBA700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  _internal/third_party/gbe_fork/steam_api.dll
- Size 18.6MB
- SHA256 1f511bb64a75fada483485ef6d8ad1fed519e5e324b94716ded786a68f130469
- MD5 4fafc4f81e1a47e0be052e569663efed
- SHA1 4d591dabcd8559725b6f64e821024843a5ea7279
- SHA512 5b4705bf40021e7f068f411a42acc6acd6b4cf22575e1ee10d838a29a202170d060358bc1ab55e0490c31b0a8ebc857ff066560f37bcee3babe58f4e13710f20
- SSDEEP 393216:eB52nVgYyubjkKlqHKOxdwcIgA72uwAuWf:eXD3dwcIgA72k
- TLSH
  T12917AE11E391C135FBB701F68AFE066E5B389F612B1102DBB2C469494E76AD1FE32613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  _internal/third_party/gbe_fork/steam_api64.dll
- Size 21.3MB
- SHA256 f2fae8a389f8d031ee8355b2fe57c30e86d4fcb00e4e4898bf34bfdfda396126
- MD5 41c4991072d9ff0124bbf33b34699211
- SHA1 992818ba7f8d5e11d48819de0c26c9995b2b1297
- SHA512 be74bc741b3ec41fc42d4c0813a513b86efca49270335fe351dbc789c5fa86f75b7737d1f8e8ba6eeaa591fdd8803c603980fe17654dececdb9d6bc3147aad3a
- SSDEEP 196608:Wjt3JE5L6BY7wciZgA72D8UsioByfVExn9bq5:k3JimBWwcIgA72IioU5
- TLSH
  T1E1275B07E7BB11E5D6B6D03895B3623BFE717495833097DBA680560A0F62BE4E93E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  _internal/third_party/steamless/Plugins/ExamplePlugin.dll
- Size 5KB
- SHA256 c6dce0ce7d432fbb8cea249e4dcd1394adc8c2adc819012c745b709c68e585a9
- MD5 dbfe069390646f3402b21f28005f3156
- SHA1 062664b8e81e0b06f72970acf8cac2ecc2001d51
- SHA512 904525f99e9c458e4e04db95e4d10bb34f78cfc569b61b5b9a57e557bc50bf768e6d29f43ecc70b381e7a50d74dc7ab93ed5202e14b77a3ec036d031e9db19ca
- SSDEEP 48:6c6A+IvVrnXjGluJoN1DDemM+V4edYGlQlsNlRmlb/lbGyClbVSVgz3HVNUwtwcr:j+WVjgd1V4Wh5yWSVgzVxa5oM
- TLSH
  T185C1631563DC523AF9F74F71FCB353021639FA118DB3DBAD1489064A2D135248A71B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  _internal/third_party/steamless/Plugins/SharpDisasm.dll
- Size 215KB
- SHA256 6d3ce990cdf58da228697d25416d16d15994135c5f66571fe1e00e9c975bc2cf
- MD5 0f900d9190603d646009ec3523fa43cc
- SHA1 a04598dcef92337ec57c0a357c2e55a1fb9c0f40
- SHA512 24397a81c9ad30f3d5377632d74706345c4a9811076357df3fc8d307a8941167b2b40b85923a4782f22a531e9f3ac4fe234ab892bdc1139a1a60f4ed7798a467
- SSDEEP 3072:y0AUOuR0cuVT+INgDgU0CaG8yVHZ2pFnjuWG/tDTQPd0FvAvxl3vBsyr8fnLN64R:hsuRUVT7U0CaGpVHs/jEEsz6
- TLSH
  T13224A772654223B3D0766BFC47B3E68F01A0DCB729279F59388B39D6D9583305AA2D31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  _internal/third_party/steamless/Plugins/Steamless.API.dll
- Size 33KB
- SHA256 d6acc4b0cc768213a46ffad0a6bf6070a6b13f79a22e0588f0ab50c950f9248c
- MD5 c347632a60da1519c48ff043831ca7df
- SHA1 5fa976d84468d69a7cda801651415f666e6e9b69
- SHA512 9ffab32ef1a53f9a08cab77d68b9d5b9676e4e1c2a63acc258f80769d544629a31b03c6f9b3fa17a19f7897e2fb0613379802e67758629a46b6d4978c5137906
- SSDEEP 768:DQS4Cd5dulN1LdZOAQoAksbgaDTO3NnS6KmskO4Nuy8S0N:+Cd5dulN1L7TcTy7NuAG
- TLSH
  T112F23A4117A4C32BCE9E0BB4B87391064375C147BA42FB9749F8B4DA6D533C90A26BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32