6b10ce87ec0d3c3b8509912316509966971c29fa156d05a95b8efcab184d2585

Sharing

Copy URL Twitter E-mail

General

Target
clink.1.9.32.43da05.zip
Size 3.8MB
Sample260913-am19jacf38
SHA256 6b10ce87ec0d3c3b8509912316509966971c29fa156d05a95b8efcab184d2585
MD5 95721aa50d3dcc99eefdbde6b6aeae82
SHA1 05c983df7c5266fd281aef8cf655065fbf2dbcf7
SHA512 419e7994e71a24a6026f498e14cfdaa11b91a5006a1ed8dac3bbb06827ac24c1ba6d03131b9b469b2f73102a3864b4bee9f1636b0188e3575b3f5be836d5cb5f
SSDEEP 98304:Yh2fBbPu8EZKiAHsyu7VMSECOE+pgGBowjcBEvc1OtlxKXMxjv:YUBbPfeKiAju7VcCOlGGBoFBIc1OtlMO
TLSH
T15D0633704923F90BFFFAA37F6882957D52D0FC5C81380B8F0935AA582D98255AE47CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  clink.bat
- Size 1KB
- SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
- MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
- SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
- SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
- TLSH
  T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  clink.html
- Size 1.3MB
- SHA256 0b180f01d4c1e0163a826baa8414ca90aea17eb708186d6b8a6e65240a98110a
- MD5 f62bc65d8759caa75c41626b9150b04b
- SHA1 4d149e998912f621f869edce3858c87b1cb5a164
- SHA512 32e7b4e57c44941b01df10657ca1e9fdb40ebc0419f3eb2f6994ea011415beb088a76db264c7fad3c07de5b3e5ab34edf03b15c67b4b728b1ede304e890e6edc
- SSDEEP 12288:TulykA9gzd1HMcPQ/K7gRAoocYLrDwQ4KOmDx52s+KJB9oVJVtebW8sawvMIw8Xn:TuckAi7HMc4/69ToFDGrv5WkR4kJHC
- TLSH
  T1EB55E87241D4563B416342FDD2092B7AF2EB406DE3120BE4FDFE870B479AD906A272D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  clink_arm64.exe
- Size 16KB
- SHA256 989de80a8e14bfa445f0eaa59c9ad31df7f79d83c6ef6b27908abd95d5318570
- MD5 a48bacf13fdaac94573a7c57ad5eef69
- SHA1 95707845ea43fd4e66b99338e4bcd589b561336a
- SHA512 aac7acd818bbef8b32d8a06bdbe6e7c05978328ac2fcb4dd9fc05b5c64a1d66675d38edea5d98f4f352202ca7dc87776043c58e8be3082ace89b7046742a448f
- SSDEEP 384:a+tNw7sVd5ge2mND0kdWXSofousWu4q6aS4C:1Ky5bhakySoQuSB6aU
- TLSH
  T1E6725CA58F2844E5FA6BCF7068DD817B9D71A7A11C818D0BA00805DA6F837B56F3437E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  clink_dll_arm64.dll
- Size 2.7MB
- SHA256 c055ab4c5988fba7c7956064191a986c65ade5e3f9f5268d78f79507509566b5
- MD5 18efb4e922a28100dd97de7cf39a98c9
- SHA1 fb39ebbe3aa50f3f921064b6b284d0e1d88abb76
- SHA512 44ace8bc864bd75297e14a01e0ca1ab437c0490204bceef8ecd2d1a1ee68988f07341e1d32c1640ce8fbfa35289f4c830e87d8590849ce413e286eb2e6362814
- SSDEEP 24576:i3Lw4kcdkq7DuHXp4AiXxnnhcJOgdJeQOtDZsahrPFu5uOfgG+DBy1KA4YoIAjM+:ibdkEkq7iEhu8FRMSG+FykIL+
- TLSH
  T153D58E92FE5C9A02D3C7D1FCCD934F903126E6698525D98B8216410CEC97FD0AABA7F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clink_dll_x64.dll
- Size 2.8MB
- SHA256 a7ee021b3ff12d730fe05a3024168cbd5c599605db02a8ca71c0f70062c304f8
- MD5 b4f3e16ac380a4b5346f55ed0334ad97
- SHA1 6edbf4ed349ad8d1d690bcd59d6a277c32f5e8fe
- SHA512 7ac861dd43d22915a3f3227476c050b89093986e9780646e8ff29fc09961c9a48e8f72341521575177fc7977e2f94c0600e1807a30583785c880975468a5a4ce
- SSDEEP 49152:XETkWHk03Prrt0X5ZJebIuBAbOl1gjydG+6Wut:0Tke7PaPJVEqO0wG+4
- TLSH
  T100D59D47F2B906AAC06B8034C9571657E7B1B59A4725E7DB13D0827A1F23BF12A7F380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  clink_dll_x86.dll
- Size 2.2MB
- SHA256 27a3afa9fabd5494d397d3df2c4ff807ec82c4fa522e8d95b8f9355869c04578
- MD5 80fe67378e80c859bf0cdb932765ea1d
- SHA1 ccbc24d117a6ddf27bfd6a26d55763b2d6d88fa1
- SHA512 60f8961312bfeb7a0d411a37ab3d011f818718c111aa6229c427c57fd69d78c558b982d4d3f978f197618b05c16c49a8b779f4bd70c8b961e2ec270a4fda8d29
- SSDEEP 49152:2sPtTIpIC/1I3/kuza9iBW+TOtLLt3b+Mv:/qpIC9au9cW+T4t3bR
- TLSH
  T199B59E43F9D246F3C14F017490BB6B621A38C6A54725DAD3E3842DB998613E17BBF28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  clink_x64.exe
- Size 16KB
- SHA256 4720828bd9314f4c4dffcad49d1f8dfe2971f3163b5c56cc09663eb6853b0796
- MD5 930dcdec357c051430569251775575d3
- SHA1 6b8be204ce6408d871377a5aa2ee12fb59edff61
- SHA512 f0d8a17ee6deb50c621cbd8a1da95cd386fe784a504d0f9cb5a5e6fc24f32cf07d493f2fc50b9f920f892a1e42bba17a2469f1f23a64f9931b4197916ea880d1
- SSDEEP 384:V6tqw7s1d5ge2mNDd148dWXSofousWu4qgSuov00:1Ka5bhnm8ySoQuSBgE
- TLSH
  T1FD726CA98F2454E6FA1BDE7054ED813AAE71B7A21C54890BB008459A3F837E53F3533D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  clink_x86.exe
- Size 16KB
- SHA256 d2e5a513629a4e5d898e91aa5c928292c56ffe9daf00287bda1948263335f431
- MD5 2adb493767b048cc9dc2fd11935e29a7
- SHA1 f75e4a58bb928f111955a7b8362e0e56a34ffccc
- SHA512 c9b7e70891a964be063b2f029ca6a5a5a8b5432a8716d4c1f25ce56e62d84060cc4e6f0a37a914e160cc428c21d0adcdd087302d74ec6eb4e66be80fda711c5e
- SSDEEP 384:5XBKZSGw7seVd5ge2mNDseadWXSofousWu4qVSuTzj:tWKN5bhSzySoQuSBVh3j
- TLSH
  T1A1726D959E2818E6FA53DF3158DCC46A9FB4B7A21C90890BA05805E92F433B57F3437E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  themes/4-bit Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 20b0f61ffe34e3ba8b6422e2a6be8bbe5a58913cb5df12e62b2f0af029216e51
- MD5 ab5d1adddfdee014978f7f2b33f47e9a
- SHA1 bf721dffd4f8bb27ad060e1f39b39d88564bd9c2
- SHA512 54bf42d1422218eef8b7ce909f619e0a5ced18110a3676f0fa4989de7526d52b39bed1ef5ab87956daab803a31ea4a9cc0f49a4b46d87ce26e15449f30310240
- TLSH
  T1FA31DE2CF4C4A8F32AFF0F1FAC28D849506A2D052B32B76971CD81F09355B1650B6B76
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  themes/Antares.clinkprompt
- Size 23KB
- SHA256 aa857b55deab2a7e704d168c6d0c3f97047c2b17cdf216227b69dd783b4113d3
- MD5 54b6f92db08dbf8c2d1e205e534d0a02
- SHA1 1fb6cba9c935fe7cc80c56e8e46f6cfd88342926
- SHA512 44341e6302a07e7ee6968ebd1c6a03e1456ac7a3c85c2d535b71f1dd875565b0e823f1525decfa5c2cfb7bd73a5856a9fc79838b31f78ac63248d900ba86c3ac
- SSDEEP 384:KLZCPFlDD5q1ViEBnSfeKFK9bobC5czBDoTU38mmtY9Qx/2AZRjQYgcK:KEFlD01AE1XkEmmtY9QpZRjQYgR
- TLSH
  T1C4B2CB0E6E024E6894BEC51344AA65F2DA4A3557632D0194B6BC40793FB0C189BFDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  themes/Dracula.clinktheme
- Size 1KB
- SHA256 8400084650e409302f84629815b7cb0c13e15b81a55fc856a72346fd32a3527b
- MD5 c7617b1643a9189337d407f773e196e9
- SHA1 5819f29fee357b3d71ccb94395e4ac947f146cf5
- SHA512 d5a9532c7ae7fb7a2e0e1d578e3824dca448a065f16a5a42a6828241db71882ab7be19ab87aca0413e482ccd6e57ec04add76be4a0f27dca97101c0ddfc389ca
- TLSH
  T15B31452CC4DD62EB367F0C9F6669D089C961A13421227B3872FD1A78B740B5282471BD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  themes/Enhanced Defaults.clinktheme
- Size 1KB
- SHA256 2c3105e81a4e887a8f00008628a11102f17d3a684189a71aab381614c938ef4b
- MD5 1f7a47e668aa719dec19e32ec0dd4a09
- SHA1 b7e0c56cb99570d095b6fac585592bd91a6cc540
- SHA512 b57cb82d2bb0a3bf9a11ba7d5f0c2fd2b5f72ce6f564c6e72a8fa477cba9f2f5e3d6304aed02b6d1671a70ff4ee3b04ddc1d3f06e135a104e978d397d70cfcba
- TLSH
  T13E31661CD0CAB4F7A1FF0E3E2D19C8489A6B2A292722372875DD71B4534130941BFB75
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  themes/Headline.clinkprompt
- Size 23KB
- SHA256 bae95d20531de56e83f45e051fc938339c688a2ec2f90f7d72c074267e5baa09
- MD5 37fccb761b8ffc5db94a81ba6a3a157e
- SHA1 fd6cefb421ed77c0f707bdbebf4b04e157342e49
- SHA512 0e813cbf6bc4d97891fa85e6c19c97a5ac3541ff977c5e13755a78ad2fdfa8a8bb3ec5ccb8ab55132fee96250a4c77c6fc0742e07b4906cd3a3d58ede0c35c2e
- SSDEEP 384:yI/VxfyFCENWiUiMS2UId+3i7kg9wkJ+H+J73aGApwspO51jvG1E:yaFEN5Ui7Id+H+J73Qw3G1E
- TLSH
  T189B24F025D0A927024B8C6BDB89B1D61FE3550972219C037B4EC41897FB0AEFA6FD7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  themes/Plain.clinktheme
- Size 1KB
- SHA256 6e63901094a309b2e3079d98950d0c488aba00b9694da76bfa3b0768b574425d
- MD5 f91651de99673500b7f49f6f516b244b
- SHA1 8d5349fd5215730e693e25537d4fbdd758685d56
- SHA512 4248b41deb294f1b20d9c8e9540bfab4ece1d880b23294aa485759caff651248b5d727d2040dc91447d41820d4c2a5f8ef64e085adb363108e9b9c0853b3cf96
- TLSH
  T16411E42DD4C491D76ABF4E5FB829C588A02AED25BBB2EB1472D40930A044FA34086736
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  themes/Solarized Dark.clinktheme
- Size 2KB
- SHA256 3ca3ad89fbf8507fc60c025d81239e51c9c244bfdd9bde272ebee904b0ad1d81
- MD5 4271dc349cd8046bafc94082b179d0d4
- SHA1 2e27125e8da3a1d6fbb574e6f58e13a6ee08f25c
- SHA512 1ce30cc32a3fcbee80020e519e59a195064f04d580f63d577fc1b92943d4400be296c6b53879c75d8a5094f4175cde55da30398b47c4d1fc4c9cbb85a70911e2
- TLSH
  T15351DE2CDCC995D726BADAAF2964C9A7D13DE20B34626F5C3AED8C743341B40A24F431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  themes/Solarized Light.clinktheme
- Size 2KB
- SHA256 374bcdcf8de002f843ed7e7f84058fae29a0476cd3e0315c306b229040dc281c
- MD5 0f54e3f5021015fc5d833ad00ee8ecf1
- SHA1 385bc4598a57fa42b4b3c7561f1e209bf462e6eb
- SHA512 f344593f64230fbfea5382a297a3230bb19e4f8a26943e1a36d217e00d3bfa7962a280fb2d73a4dd6623b473e81b0f4da9063a96f62f517efcaec4982028d0bc
- TLSH
  T12651C12CDCC954D726BADAAF2964D8D7C16DE30B39226B5C3ADD88743341741D24E431
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Loads dropped DLL

Checks installed software on the system

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32