d2999aba9abdf46c9b1b3dbf9548780a282f3b761fe8d547876394ba1c5200a7

Sharing

Copy URL Twitter E-mail

General

Target
d2999aba9abdf46c9b1b3dbf9548780a282f3b761fe8d547876394ba1c5200a7
Size 309KB
Sample260930-npg6bs1ycx
SHA256 d2999aba9abdf46c9b1b3dbf9548780a282f3b761fe8d547876394ba1c5200a7
MD5 28a21093ddad405c3d5ae1f38d45a897
SHA1 682bb25ed6eefb155d956df35dd04427914e71d7
SHA512 7d5ef281e3932d31846c34d9b04179b8f2ceaa4da8f6cd513bce965cfa8bacaa660f238384b41c91b8415c89a1176fc91655a7fa7787840c4ee86966da60f019
SSDEEP 6144:Fiupm5PvJCat7TUb9SvAT/fPXJQ5zX9FKlVZ1q9OatbXy:zpexzxgbUz5LWTZs9Oak
TLSH
T1196412B0DA5345FECC8196F80A4CCC1DA67B6BEB00A8BC1239B842F46D715A9DD7136D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution macos

Malware Config

Targets

- Target
  win2020-2024(一键激活)/CLion激活.vbs
- Size 2KB
- SHA256 0b794ba1241f122456fa9c91882d3c1b30c52a895c4525a0095634386256dedf
- MD5 c6ced3f8f41290b8530ee9c0da5a4496
- SHA1 ac2a077227809eef296b3879b9c96d2646a50b6f
- SHA512 413a6ec59f6938506fa9474083ca8a7d80849571879d723387964982d292b4f7deabea19284aee173002c42afeca2393456cabe5b39bd24edc6ff10041c8afac
- TLSH
  T1375123D6BE225B9101B1934954905C9DFBED62F34212826D3AAC44A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  win2020-2024(一键激活)/DataGrip激活.vbs
- Size 2KB
- SHA256 406f9bb94a5a75803ba8be4117ebe6070714924e1e2de2b7dd9dcac08e511a8b
- MD5 f0664f3e5bff8a6713acda92104fcef4
- SHA1 e230ad86c888f13ca0926c704ee8b65c78204ba0
- SHA512 32ca1c10f2fc4a96bda4d8622f66cccd1262d0a58db4fbfaae220e41fdc0209ae1d0d8e22e782f671404cc58f38c1ffe582e718f19e8374109a927e18105122e
- TLSH
  T10C5157D6BD225B5101B5D34854905C5DFBDEA3F34612816D3AAC04A48F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  win2020-2024(一键激活)/DataSpell激活.vbs
- Size 2KB
- SHA256 9a0297091c112d7e2b5c2fb3f45219ed482149c889a13fcf80a15672a4b721dc
- MD5 fc2bfec707e76f2161ddb87c0c7a22e2
- SHA1 d58783ab53e0701292f8c549e9dbd2eb03c734d0
- SHA512 4b366a00a177e12538cf09a0aedcfdbe20da96ae9fcb1fd07e590b2f54d32f711124e854a00a2be6ba3258e234eca1b58946b3bce9bf7a8699b0fc784eae8de6
- TLSH
  T1AB5124E6BE225B5101B5D34954905C9DFBDDA2F34212826D3EAC04A88F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  win2020-2024(一键激活)/GoLand激活.vbs
- Size 2KB
- SHA256 aefa257c29b187b589d3bd9612838b0de1cb36b1de5a9e380ec8c5824cbe024a
- MD5 eec6145a16c93bf76419ee27ee481508
- SHA1 384a2ede54c2549c20326f1e7061923349dd448b
- SHA512 4dc047f03ac2b5c8c317e720c7c20896b2a6414ab68c54d0d39f75f91b4dc49e840ddf29ac9c891a0f0b14461279532db2c394de68e11ce722aa22ecec27dff5
- TLSH
  T1F95134D6BD225BA101B1D34954905C9DFBDDA3F34212826D3AAC04A88F36BFD86F09DC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  win2020-2024(一键激活)/IDEA激活.vbs
- Size 2KB
- SHA256 1c01417c76f091c454d8dba83c4ff3d13128688f64e6e3fa6fac1dc0a9848604
- MD5 6d3b8124f4a10961aeda20b63566f662
- SHA1 4ac1285a70b39358493a9347809abb5c1022e661
- SHA512 4052605178a503da360b0f5990beb05024c6fe283eaa8c7f5fc6d3c04439c4b9fb54f4dbcd01d26b9daca10df7149851842b3e06b39c73d90238f2299128d8e4
- TLSH
  T13A5126D6BD225B5101B5934954905C5DFBDD63F34212816D3EEC04A48F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  win2020-2024(一键激活)/PhpStorm激活.vbs
- Size 2KB
- SHA256 79299ef3fb6d38a3389a7fcd985ad0fecd0f3f3805d6a93ea480ed49ea2acab9
- MD5 4351724322a217398bd6938852de59a6
- SHA1 7c8aee36411cb51d9b46cba566831ccfcc58a4fb
- SHA512 a137537269f134329a7349f71c348591ce5e54b5cd0da599f574b4f3afaa252d74d48001b7be5c20d39173b3d718b7ae20ae1034df4d714accaf40828d6284ec
- TLSH
  T1AC5113D6BD225B9101B1934954905C9DFBDD62F34212926D3AAC04A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  win2020-2024(一键激活)/PyCharm激活.vbs
- Size 2KB
- SHA256 766b6d727d92ec5a337de110259ef7b80119f29063db6f65a1fd58fc85e97482
- MD5 7559c25867db4a0e3f56528ab272e0c6
- SHA1 a884de5b35354a380a5807eb9bfc80eb10d06c2d
- SHA512 84e448501d51023484b5d6c60e51e3320a98d84900b4ed22c0e54be80b55baad16e00501a35ec2cd6bf8600be782f550dc508aa14d218dbe552e55022d5effbc
- TLSH
  T1B65113D6BD225B9101B1D34954905C9DFBED62F34222926D3AAC04A88F36BFD86F0DD8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  win2020-2024(一键激活)/Rider激活.vbs
- Size 2KB
- SHA256 1067f62bfddca05e8cd4f83afa56b70da54213c8c5485239c8ac6e8b502606c4
- MD5 7287cf925b998402ed705f56446401af
- SHA1 798308f47395342e6f3e381a2a5bd668cd2e7adf
- SHA512 5818941a260183a587bc19762fad017f7327f9c270e465b3052efad7cc538876c81a3e0c68ce33ffba09e92863335db5a85aeae40f051ab2f4b63857e056b25b
- TLSH
  T1965135D6BD225B5101B1D34954905C9DFBED63F34222926D3AAC04A48F36BFD86F09DC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  win2020-2024(一键激活)/WebStorm激活.vbs
- Size 2KB
- SHA256 7f7a567ad39328bafc746b2ad63ff8675fd125e2dde93461ef65f7b2e3fa51a8
- MD5 e892e22fc71a7435cd4cff753f6117cf
- SHA1 4856c1c1586b417bb350c9e7c1ed3e2f2edda7db
- SHA512 404611019f80db4ae4b24e72a4bf1f34d54d9f6d146ccdd1f57752c89e6350fc45e9eb7a4b8bba9dd177a26573424b83edea8bde8e7b45629453967fc697240c
- TLSH
  T17F5102D6BD225B9101B1934954905C9DFB9D62F34212926D3AAC04A88F36BFD86F09D8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  win2020-2024(一键激活)/active-agt.jar
- Size 47KB
- SHA256 3acc4e9d91793f6909458a4761b75b6da45c8868e75dca33c9fec63659202995
- MD5 2fa1b1364515dce93eb67c423b570deb
- SHA1 2a723c2ef30be4a5c167c6639bf9ec0b9c7e7ca2
- SHA512 0b6cf7caf6d48419251d0aa1ccf280536eb20b1f108f874a9ce86943601c2317833031578fc869366e3bc40dedfabfd64527598ea63b879bc77f82a9a218766b
- SSDEEP 768:Oh7IDIGjwZyHIwcctMtI+xIfo1UC6cB+P9146lp3fbYHfkWvQdptYc4klY:KSIG0ZuIQMtI+xIrTcB034673fbgvYI
- TLSH
  T17A23BF2220EC995EDE056331FA43F4637424DC38D118B4971EDC2D82DB16B76F7A2A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  win2020-2024(一键激活)/clion.key
- Size 5KB
- SHA256 231d37a25c0634946849b5db717fdd41b37e41f284c58580981e330828c4ff4c
- MD5 3935af9ee05419ff2d0d724a1e6bc6c4
- SHA1 8b35b8b90c88d6444ee195ea230bf538361dcb12
- SHA512 40cf00c3266fe4f82372879bf1097e10e10f3a0d11e151474b3c7674d09eae2da152d94fd278542ae92cb38a289977ac9f2b2a71deb58f29401643d8304e6379
- SSDEEP 96:4JSJdjjdeRaiFdJn7i/khkcbJ5mkpuFCM92Rpa5cG4kSBxaaH3E0Ikr:21FiMhvykol9L0xXQkr
- TLSH
  T15FB1BC3839FE601DF5F3FF515FE8769A99AFB2322A0B249B109103474612941DE9263B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  win2020-2024(一键激活)/datagrip.key
- Size 5KB
- SHA256 c513b5d364423ecadd9d3f8869aaa098c34a4500001c0acbda6980989233457a
- MD5 6f5469c153ff60b609fa426f677c1f36
- SHA1 b8983d1065a1a46e52c70959f91d841fda408747
- SHA512 2ed3cad73dc8bd4ad12f79a419728021ea92a83025a2366c3ac3588ea22955c77ef4b0ed5e00e45368086cbf7d57f36c47a25f78f83cbe2c3f2e3705a9857094
- SSDEEP 96:bsxJS60dhC2dsfdN5u+Vjhvl+zpuFCM92Rpa5cG4kSBxaaH3E0Ikr:gbvPvwol9L0xXQkr
- TLSH
  T15BB18A3839FE601EF5F3FF455FD875AAD99FF2732A0B24AA109103474612941DE9223A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  win2020-2024(一键激活)/dataspell.key
- Size 5KB
- SHA256 f19d20fd0059a6e600922c44f4cd2f9db705bb52d5045f49080600f424443df4
- MD5 eb7bc5b6e549c81b382f3ff26a83e4ba
- SHA1 3c10e4559bb88641d0e2fd269c89b2dc7f5edb6f
- SHA512 6dd6b4aa2e783882bc6cd1a23bb29468ee7d672945f1bbfda1f609b37a67a836b29ac98da70bbd12f5a0671714a016307d1b7ce4dd636685a45829e895a3cbf2
- SSDEEP 96:fl13QiiwNDjK4kfVlYFppuFCM92Rpa5cG4kSBxaaH3E0Ikr:fy5JfVlYpol9L0xXQkr
- TLSH
  T1D8B1BF3439FE501DB1B3FF956FE875AAD99BF2722A0B70AB109103478612D41DE9213E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  win2020-2024(一键激活)/goland.key
- Size 5KB
- SHA256 0867f6987f9686d53047c6e282ea1b7beab30d526be724710e3ad84b5a04cd49
- MD5 d103da072d4d297da16fc64bc3eb9da5
- SHA1 fd8462aa891ee21ba2454ec2a2534e5f3351e6e0
- SHA512 56dd72d54ed3332d94aa9cd25c1db526729ad1d9ff432bb982edd93695d848647f2cb229c8f8878765fb6141a39f6b9b34fe8ac966128749e721a6bffbbe43e7
- SSDEEP 96:WxJSJdfTQZRappyealPvhUvGEtpuFCM92Rpa5cG4kSBxaaH3E0Ikr:W/ATegGEtol9L0xXQkr
- TLSH
  T186B1BE3839FE501DF1F3FF556FD87AABD99FB2722A0A24AB108107474612D41DE9123A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  win2020-2024(一键激活)/idea.key
- Size 6KB
- SHA256 688021363a39fd5bf77bc210d4e209359cb57ae8263b9f724adc036464603b54
- MD5 7c514522b1b9aa2318f4f2e343c3c06b
- SHA1 6f7383fc25d4dac7de2a14267a7c979008b6d017
- SHA512 e726ec261bd1d015191036442455dd1ca5ea1c0952531e7a57e1885dbc2350ab7a9c5c4ad562facfc852126eb8dd04dae96a098802cc8cd783640064f8f5a8e1
- SSDEEP 96:XsJS60d53rnLdGRrdZGpXOKRg2X6BgNw+2g22puFCM92Rpa5cG4kSBxaaH3E0Ikr:Xi8+ypX6Bgi+DBol9L0xXQkr
- TLSH
  T148D1B0343AFE6019E5F3FF416FD876ABDD9BB2726A0B249B108107478612D41DE9123A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  win2020-2024(一键激活)/phpstorm.key
- Size 5KB
- SHA256 ec724bae22d104665f83f055e5971ab5ea4cd309a39f534803dc97c1fd744975
- MD5 0f0b2ea5a28c07230e785202895a9fd8
- SHA1 6f8115ca19bd9b2b41cd36dea8cf297748e3d321
- SHA512 e46290e0e805ec50c2eb5fbaf39f67e5d63f7e8567a5d6f98b6e89ec2410b46327bc2efbbdce8ad007806ccf4a325ab09b4350f922a979f1d068b7d09bdcc008
- SSDEEP 96:lwdNAqd39R3KmHwMCGf1apuFCM92Rpa5cG4kSBxaaH3E0Ikr:+6mQ3Gf1aol9L0xXQkr
- TLSH
  T10BB19C3439FEA01DF5F3FF456FD475AAD99BF6322A1B20AA109103474612941DE9213E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  win2020-2024(一键激活)/plugins/dns.jar
- Size 4KB
- SHA256 d1150b1831b112b93d74a34a10ce6c11606e0d2255d532c29f91f1d92b40a552
- MD5 4f3c516c1704a5569725246d57dd1ae7
- SHA1 4e8693b5a7a3837cf7f6db0c4f1316f376d34721
- SHA512 f885fc751e9035944489578bb037f05521c6258c377c0c7bf8b8d10b799063e6e529c715ecebf9729724f0497f588803d7d463fbb70f5efbd73952624f60d08e
- SSDEEP 96:LSyBi1RBhx1yI/OEEKXejuu9lSx/xowSpTz7g8nJfTfTX:LSx1RBhx1y0OPhox/6fpTvgeRTfTX
- TLSH
  T17BA10673669C58CDE8081672B30AC243640F4E7940A9944F31DD65C72E37B2EE9735DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  win2020-2024(一键激活)/plugins/hideme.jar
- Size 7KB
- SHA256 fa14c735ab9fed3f3a5df0dc78a5d38ae0a146099ddc858197e9f528bd996c40
- MD5 cdab6a30b0949a741f13935f5483c303
- SHA1 729d00e4fa04ca49c00b5b6aa60706dfadd5644e
- SHA512 bf155c0b062fe9c7c237f9b0329a155387b7294fae7c7ed73e41e9528f119ccc513855329f6e91e62106b589c8b215d981ed11f2f89c7e13c06fbdcf7d6d1ee8
- SSDEEP 96:ohFTqRYuFhXQ5GeiCGkeFUgbH44yY8NVFubQLwNUmvHh18OiPKwChme:gFuRDiiCSbH4u8ZuvOMBGOiEme
- TLSH
  T133E15D2220EC24EFD076E5B3F368F413ABCA15FC9508B183757AA2054D7572AB2234DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  win2020-2024(一键激活)/plugins/power.jar
- Size 11KB
- SHA256 26db4a54482189dc989e59734318d5c12d656183d5394fe3c0fe5b33313cb785
- MD5 cdc01ec1abee702c535da143fb3947d9
- SHA1 0f73e2cf797ee4b25a73bc6f78cfd7d41952d294
- SHA512 72c26a50a1f1ab9712808a218cf8026c6540fbe6ebc28eb3fee3eddf011f8566e82446630731a559c2ad0ca684be486bd991fc46149f6412ac692218e4e1d354
- SSDEEP 192:W5aTR3/R61EZoMxX7GQyJ7UlcOgUN/5/9a1bN/:6c61PWX7a70V7N/R92R
- TLSH
  T17D327C33187C2D1DCA52A375F3D9D083BFDD0EF86993622B356A68052802768F673A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32