4372f1d22e7b66eef360ef96f4807777346c6340abe6be091335813b4ac19a60

Sharing

Copy URL Twitter E-mail

General

Target
zehn_acf50b1a4b_VSTHEMES-ORG.rar
Size 6.3MB
Sample260910-ryc5hsdm5s
SHA256 4372f1d22e7b66eef360ef96f4807777346c6340abe6be091335813b4ac19a60
MD5 59e49b5be80ae87d8518d1c7d4225b59
SHA1 1f92b553f60d4c6c4357a2d8f10a0e9a1ea2a04b
SHA512 6f288f4a26553392de3668a21fcf0ef7673e77f068ce40b15c3e608fe91b91f7a6e7754d239e11085a3fc41c58f1647a11dfced628bbc3616ebc4a741e81270c
SSDEEP 196608:t8247BmQlEYMUZcWdaGWOPWaLZrFqS5owiVduT:r4FJMjZOPWaj1lcuT
TLSH
T1DC663357C43069A3C36833326F4A0A013D562B385A9C6C0DFC99BFB152D2E61AFB7756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  EN.pdf
- Size 243KB
- SHA256 53f5a96cae94f3acf493c8c0aa288a3745113a8a578c8a866f5fd432b51b5f06
- MD5 b38ce309fb3a65ab971d79b3c3c19a7a
- SHA1 f84c9af18ebe997efa50f8614377e490482114d1
- SHA512 e25f51719c9b4812ff1540ae9e08b98d2efe61f5fe08eefdec2deffed5b95cdae65cc41e03839674e4bc5fd375cd6645bcd04bdec84ebe9223bdc3290730257f
- SSDEEP 6144:mr78Jw+DSMwL0yTlrNG9HENU5XWA5ZZblfILV:mrAJwawL02lrUl5XWYfpfILV
- TLSH
  T17F34CFB7F08D569CEA83CFD1E4B7B46D452F736EADCDB48189A44B3DA0A09188B51343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  RU.pdf
- Size 235KB
- SHA256 444fe19a66bebe25e70cb287780cce59f5544deb81ba69f7159da0b0d05459dc
- MD5 cbe8e82b99edeb0da9b5b4eb95a5eb5b
- SHA1 cec3a17a3842e0cae59a2113014f521c17b7d440
- SHA512 d87d242d18844eb99a3cf2088f17e3048d56c08735e2f9e03ff073113a9405a772e81f36c80a22b9843c277e08ceb618677486045a1acbfafc03c65a81bd0744
- SSDEEP 6144:row3283JlywWSt9X664aFBiSkPK9208XVIo:cg2UlyJStCayPPR0YVIo
- TLSH
  T11034BFB6F48D9ACCEA92CFD1E4F7B45D452F735EDEDDB4819AA40A3CA0A04148B51383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  configuration/foo_ui_columns.dll.cfg
- Size 522KB
- SHA256 4097d0f2ed5da23ec50668357194825a11e4dc43a694caa4e73cebe9aa5ecc43
- MD5 341a160c16468897190e6d7db551d511
- SHA1 60206931133e34d1093ce039f44bf4cb2c737e2f
- SHA512 e544e0881ab001535ba022563dec0bdc8de5284c86218e7853e115823f5a8b53ebda71561371004df5dbe3505baa2703f3f1d3a196196bf392946e73865c0aee
- SSDEEP 6144:dZ5wCXb+yNctM+BtEYPyMayLtrJFOYfxOqOYfiOFOsf5OoOsfbOGOmfxOKOmfqOq:dZH+yNctMoNPyMFG
- TLSH
  T1D3B42A05A74A0037D1F1B3386F9F960CFA36990B5951860DBE5D91C03FB492A42FEEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  skins/Zehn/Zehn 1.1.fcl
- Size 519KB
- SHA256 f02911408b0b79ae8689f2b98c38ef8af4686c782dd94e2d927a81b779f7c00e
- MD5 1d265e2ea7de58a356e7808ca65dd693
- SHA1 4a3aa4b20b4430426185a6a5054c6a96687631c0
- SHA512 a19e42d7d503cdda93ed9a6e345181df598a2410cbaf5962c1333adccf8796d1355e6b21e48d0abcc3bab6fb140a7813c0c4f2373a8bfd9f8b770c9beef79612
- SSDEEP 6144:M5wCXb+yNctM+BtEYPyMayLtrJFOYfxOqOYfiOFOsf5OoOsfbOGOmfxOKOmfqOJ:MH+yNctMoNPyMF1
- TLSH
  T177B42A05A74A0037D1F1B3386F9F960CFA36990B5951861CBE5D91C03FB492A42FEEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  skins/Zehn/scripts/button.js
- Size 1KB
- SHA256 5b931eeb29454df25db66383c5b3337b193d39ac124550bbce734a0507d050d5
- MD5 b9e44063b70c0432d02a814d35bfc341
- SHA1 1413a5dcb15445113c32eb4a74e100e93fc0046c
- SHA512 624fb87a504d683578b150ece86bfe309f186468ae0b971627c6370a18475cf0516a1451ecbd09a2af0516110c7f36112480198d00edd8275b0b69b3b2bec087
- TLSH
  T14521545633321DAFC1A0A2879A3F11EC9E20C8055384987E78E8B0D020AD01F8F3DE76
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  skins/Zehn/scripts/common.js
- Size 395B
- SHA256 8a3ceffe8168d8a9ece2cc14718d3aa46aa78bd0154241a79a8bc59689b98ba2
- MD5 7051e2e930b9e07145910128cd6bb37f
- SHA1 27562e8718f53c60273dde473269bf812e05fade
- SHA512 b1e46dd943e6d3d615ea3abf344d80069aecb7d6bb2f2cefb0504994a9ac532b5de66acf4f0c6506e5ebf002166abc28d6e500460a350bcdf52f1a63759606b1
- TLSH
  T1B0E061467043F03D93061F59133FA847DD9C2C56D115E5BBF54444F03A2153A6227C1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  skins/Zehn/scripts/guiext.js
- Size 6KB
- SHA256 ae723a50cdb5ec3318999aa0153d14331cdabad8edb01a2afacde4ff935a936f
- MD5 b25164af1c1bb66a8ec6f1f33823d05b
- SHA1 175e6e116fee761fe27a339c0d8946a078554808
- SHA512 4e3cb46889894cb75515a60c1f7f948f3168abd6db500f1a876f4a6619d97602d1750cdebb23ae6a31f82aaaae846e9507690997a93213ff425de55d6ca15109
- SSDEEP 96:Sm/fOqXbMYW5V0RQamnSCLdunrwvJlba7m2mnFmpFv9QC0oLuvU2mn0Pl8aLrbYS:Sm/fzI2QamnvsnrwBCm2mnFmzv970WUn
- TLSH
  T17EE1A8994B792068C136F3A6DE6F42CCCB73089B2852869EBD8C70D15F342754629F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  skins/Zehn/scripts/helpers.js
- Size 17KB
- SHA256 53eaba189c14b930427856d6f1bc2c66357ecad3cc2176c2d8f1808d98c67584
- MD5 906e01ef51b99cdb1f068f016d65acef
- SHA1 7fc0a56034039f49bab273432563a65fc6852150
- SHA512 18ecf4c3a408bc689ae5283cb19a2f6c893a060a1a2aa9d12b6850ab7a4b97c221a0a4a0fa810d72178e757cec95700de67583ebec75ccd9e35340abb7fe0117
- SSDEEP 384:BC9VT73BUtEj/R68yjr4JMaOuUETU7fn+Gxw:BYB7xUtEN68MroBOuBU7fnRq
- TLSH
  T16F827598329D564AC6827398A47F5418E9FCDC62C1C6C97EBC58C1C4F5A04BA83B5BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  skins/Zehn/scripts/lodash.min.js
- Size 51KB
- SHA256 1ee223758dca8bde36055d1d4dc60fabdb9bc05764cc871f21749b0b9a1252bc
- MD5 5a4dc5ac6f4245c77dbf579cce96f531
- SHA1 0a186de1d0fd5057664027cb18e30fd2b7f2a1e1
- SHA512 9eb252b01e80de40c01b8e7a9f3121f0e3f35c858c9756f2d119cb3b317ce57e66674c790445ebd6a59da178736c298224bb5f50247877518743a8a43a0bd592
- SSDEEP 768:i/zqvuBj/Gy5s9O0UY+stxOCaYv1AQ4W38yB1kxBCzKYmmvCmTO+xnd18eLES:7vqVY+OOPE+Q448yv6aom8/ex
- TLSH
  T17C3373C979D3F02A83A764B1406F058FF23D9EA0ACCC6604E1A5F0E83CB955ED167E19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  skins/Zehn/scripts/panel.js
- Size 8KB
- SHA256 4578ef119e7ee297b2a0bf89e6db38903b05521e0a00d3ccd23c7b6b1f60b381
- MD5 bf00f3a5dfecfaa7e44cb31040965d36
- SHA1 908d7bc63f50387bb0578636f81495d4a6b4d815
- SHA512 a749675736a88a0af4aec259fa92a534969bf37587322bfd3b0dd5682181e2aced435d16a11b1d57fcf925432ebc09ae657448dbb2ed9c719aae612e466b31bc
- SSDEEP 192:WuHO7O8O1WukyJRWEB2jJkGHXqcdplpjwLeYxRIPLLUJuOHObO2OwOqgPVzXa9AW:Wuu6x1Q/qtuaLNqjuMTQ9DUDBx
- TLSH
  T16C02128C726C1719A1D4315C2A7F2364ED3DC166E0178D9F7DD9C9E4B4A009B83BEA78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  skins/Zehn/scripts/rating.js
- Size 2KB
- SHA256 f9eb4ddd7ca8d0d6d2771d3b7bd302b8883584e2b8b550f7023ccbba9af8358e
- MD5 ef4c4c008633499e9dbd1f2f668f92be
- SHA1 deb91c7f898485140db293b8789a7eb693ef7f49
- SHA512 424786d5fc6d69fb8119fd22faec1c3746b0c3386eccc797cd5db83d659110ab250fb55cc0cfe926dedf0cab8fbda2d73f338455df5e313294867cf3d7d3163c
- TLSH
  T151417A69339C898E879023294D3F5D19D67DC8B6D68188AFFC8C50E0D9A140B97BBC38
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  skins/Zehn/scripts/textfont.js
- Size 1013B
- SHA256 fbf274afd0710b5836b8f3124a55adb5bba60c83e54f2ac8ad13f8eabec83aef
- MD5 3b05c467e94c802a2aba0bac06f358bd
- SHA1 09752c9a9c17e5085c0336198bee95e3dc2cc9e1
- SHA512 2659000cecae91de3dcb9e3be01f7c5593201964b742a965546fe60ec14bcedbadcae8cacfda23b198f54ee772f0d29488078ea9b64a953128d5a199c3b63dd8
- TLSH
  T1E11106B90D091850F4A16218375B7290A89E704B4AE8D312B9DDE305FFF590AD9BCBDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  source.url
- Size 115B
- SHA256 64bbc55cbf85d92016024beb5a594cbae42a1cf3a24d84eb2ddd260af5722b0c
- MD5 2b45bd80d269fd181816573d97a00460
- SHA1 dca505fc36abdd7bd6ca07ff4f9132491b09c198
- SHA512 9db858aebb8bf202ce277ad271d5326cab5e53cd4003774774a2eac820ba8107c2c9e8e5b2e422f805dcde90dfc9698e715b0a4f65a6fe0027817cb29c00c530
- TLSH
  T101B012E7BA0981D1E392A4C6E030FD00CC0F70B8CDF2D05CB164FE9E68C9061C040B06
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  user-components/foo_dsp_xgeq/foo_dsp_xgeq.dll
- Size 216KB
- SHA256 72beeda85c2c88506fd4ec3bdf76854777174c44480e7e3d97a6f1c9febfba36
- MD5 c69fb75a8c6493c2c5520919f2c01248
- SHA1 4f325c29aff4cd5c745d8bb237567ffd743c785c
- SHA512 0942f7d601cc196285d765d92aa0c2ac5f95a99ec46486aeb06f8f43453ea3676b36831b598c6bac484f8ffa150a45737a64e998c8e8d3bbfc49cda167de9ee1
- SSDEEP 3072:Y0Kj0thtLE1oYiF3dlxqy6XKWktLGJPjTyhIddOdhVAg0Fum8XwYFBVgLB5:Gjdju7wX6ttLGJXyhIdd+VAOm4X+L
- TLSH
  T11A249D1172D2C4B2C1AE10745857A7A61A3771720B78C8EF3FE49E2E4EB86D08E77356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  user-components/foo_jscript_panel/foo_jscript_panel.dll
- Size 1.1MB
- SHA256 b8be362dc39547281d76375e58ee02375d1c9a18455e2de40bcd3045ea354e40
- MD5 9e1663af25233cdd85045c43c3e1b349
- SHA1 327981d8b34fcdf4ebfd59d4e7a3c030e0afbe16
- SHA512 95a541476b86fef2730b0baf099ea721953c1f466001beb8ccddb32fd3334944a638b316e10c4478821667461085e3a9709e6ee113725e9de1acd65f290a8526
- SSDEEP 24576:L0dhy0rSu9DK/SSv0anGjly4+D7eWNh1F/7gDHe4AXVb1BC76g:ahy0rt9OqSv0anGQ/NhP/7gDHer11Bs1
- TLSH
  T101359D107251C272DAAE12B05D7D7F9F152CEEA90F6249C373C82D6C6D313C3AA3665A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  user-components/foo_jscript_panel/interface.api
- Size 7KB
- SHA256 d7f28ab60d1771da22df80ca2d2fd3127316cfa238e34f055777d2bd674eb4dd
- MD5 808443f317e016a1a4af3bf16d7ff78a
- SHA1 87a61d5cb41eb8a544f28926a95276eff8dd63a5
- SHA512 4fe915000cf9f4875a7becede0f8ea9032b7da4515191a678349977bad8ad308ca4cb1785f873afa45fa35a5420370608de068275819c90f77f5a226a0ff5e99
- SSDEEP 192:Ppa+BYO26s4N7ikokBZwmfTvZztzPsqdrre87/EaQcNMWa:PpaPlrUPttNM
- TLSH
  T11DF142033468099730EAF65B73CBEF05BF699144AF71E77126BD49C9229244BBBB9201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32