General

  • Target
    5b5e4d8ceeb36f09e50a4f50d4131ca39143d8b0e40f846c7c26d724ed79cde7
  • Size 2.0MB
  • Sample261002-2g4agsvarh
  • SHA256 5b5e4d8ceeb36f09e50a4f50d4131ca39143d8b0e40f846c7c26d724ed79cde7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      sa-mp server/announce.exe
    • Size 40KB
    • SHA256 2a0270ee3766ff09dfcb2aa70316c4076c6c713154784c9b324509d66c019a26
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      sa-mp server/filterscripts/a51_base.pwn
    • Size 14KB
    • SHA256 fd3d2544184277e39eb34b62197745bff6724789a0db612468bd3ee344bbfe1e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/cargoship.pwn
    • Size 6KB
    • SHA256 154561cde86e3ed4b1ab572ab208e4a808f0cf5abbecfd861ff83d180346e6ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/dillimore_gas.pwn
    • Size 5KB
    • SHA256 50ec84777c8e71c3d61dbedc285d9b2a2beecb4e2d89919820bcc62d39854f4e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ferriswheel.pwn
    • Size 3KB
    • SHA256 47f5284d95fe337c2c3fd1240f51892f936e8035212a8f950ae7ec4a11004bdc
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/fsdebug.pwn
    • Size 57KB
    • SHA256 549456be6806e8d7d6fb6bf77bf3475d579d29d93dc6ef8042b460584f1ec1cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/kylies_barn.pwn
    • Size 4KB
    • SHA256 22ea39e3c524fd29e2614d73031d46f8a5b2856c2a9f8c72c869a5b776311921
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_apartments1.pwn
    • Size 24KB
    • SHA256 576964e8e703de0cc76c0da8fd6243e309812713683b9e3f4e73a247671deb0e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_beachside.pwn
    • Size 23KB
    • SHA256 3d039a36fd49abca7b6d4c58484b0eb7a3878f346e640332ebaea55760650541
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_elevator.pwn
    • Size 14KB
    • SHA256 e1df2fba86b16a4cbe724acfb0c4c6030d3128eafb9edf186c109161b95457f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_mall.pwn
    • Size 15KB
    • SHA256 03905c8f259abd754a01c00149be177e5625e65e2ab06ba02d5109d76be46bd4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_prisonwalls.pwn
    • Size 14KB
    • SHA256 ab4a1412b5165f33bb6b09e04730d434e72b33099774a5bcde4efeb51bfe6f3b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ls_wellsfargo.pwn
    • Size 4KB
    • SHA256 739cb04586b177836b05ca4a717f756677d36f463ee80860aa29f2d1a0b3bc01
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/ospawner.pwn
    • Size 14KB
    • SHA256 4a4940eb1c5fc9f1c73ecc3cb561b7e0fa399846ff8c460be6f79ed5cf96b7db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/pirateship.pwn
    • Size 6KB
    • SHA256 cc06766df6fbb944a20e54ff6c9a6c3b54207135c3af46c0e3a9bc0f2afb2a71
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

    • Target
      sa-mp server/filterscripts/safe_animated.pwn
    • Size 6KB
    • SHA256 82641a059f172899486cf137f6c8c284b65c632b8f5e953b74c64885a3770e1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    • Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

upx
Score
5/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

execution
Score
5/10

behavioral4

execution
Score
5/10

behavioral5

execution
Score
5/10

behavioral6

execution
Score
5/10

behavioral7

execution
Score
5/10

behavioral8

execution
Score
5/10

behavioral9

execution
Score
5/10

behavioral10

execution
Score
5/10

behavioral11

execution
Score
5/10

behavioral12

execution
Score
5/10

behavioral13

execution
Score
5/10

behavioral14

execution
Score
5/10

behavioral15

execution
Score
5/10

behavioral16

execution
Score
5/10

behavioral17

execution
Score
5/10

behavioral18

execution
Score
5/10

behavioral19

execution
Score
5/10

behavioral20

execution
Score
5/10

behavioral21

execution
Score
5/10

behavioral22

execution
Score
5/10

behavioral23

execution
Score
5/10

behavioral24

execution
Score
5/10

behavioral25

execution
Score
5/10

behavioral26

execution
Score
5/10

behavioral27

execution
Score
5/10

behavioral28

execution
Score
5/10

behavioral29

execution
Score
5/10

behavioral30

execution
Score
5/10

behavioral31

execution
Score
5/10

behavioral32

execution
Score
5/10