8d41a3a6d54e904ae9627665d2b506d95134f88b41a7b779927d4af98e30865f

Sharing

Copy URL Twitter E-mail

General

Target
hotel1.rar
Size 3.0MB
Sample261107-3vdseswtex
SHA256 8d41a3a6d54e904ae9627665d2b506d95134f88b41a7b779927d4af98e30865f
MD5 99718dcdc40d03fc38f7b70ed6f682f2
SHA1 e7ece83a803287a9cd3de09692aa5a8558f0a8e6
SHA512 af16b28f34e900484bd7da468fffdbddf91292e47f35af544aa8767799dcb64c8e8e1f3f2852942882de08e1645cfc99a9f78bd372441b508cad7fe9352138cb
SSDEEP 49152:J6jAqbUtRMrQ1PR8kAhnipF16rydA57V6ad+SBnunqTTTAh+2q/T3l:J6jAqYtRR1PSkYipPmyC57UU+WSqnEhu
TLSH
T16FE5331D1B402260A41B112A2F5FEB41F20976DDFBFD9CDCD5A6345A5873E22F881EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  hotel1/Home.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  hotel1/Parametrer.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  hotel1/Properties/Resources.Designer.cs
- Size 3KB
- SHA256 6152a917cfe39436bdc5fd9b84bfc46981ae86c80b3e740e7ab23d947eca42fc
- MD5 82da0f954d152f776c20a18f7ea9f6cb
- SHA1 e9070813e4c75dfed63586468de6c5ebd940b4d5
- SHA512 935705e3bb0db3c26cde49598c1071b91c5227c79c938f4ab0dad3e174c18ef9e90c3428995000a4270dcec91f3696dab1bd7556fc0ff24e2c88dbcc497f94d4
- TLSH
  T16261CDB71F94C5720C35C6EBE700F841CB211213C62ED529F4EE03615FBA28493AEDA9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  hotel1/Properties/Resources.resx
- Size 6KB
- SHA256 a28c3abdc0cfde9cf1da76d651e539abd719d9a32d537234b79480cb6dcf4ebe
- MD5 f0fb6ce10f3d8ddf2d8cf577f9bfe021
- SHA1 998960c130a28b4e97f8da5bacad453c00fb9aa0
- SHA512 baa4d70c4f9b3e369f68b3a974ab6c726117f3caae79d09f64329dc0923bd768ae34fe6135b1297da24061a99f13ee6ed4afe97e57df5da0bf79ead94b419c86
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuF88EoT:KjrbLPD9sLvIzSvKgIqUyahF8NokwCK
- TLSH
  T1C3D13245B1C5DD260FB3482DE6523984F7A8823B0235AC54B4DC661F9F73885A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  hotel1/Reserve.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  hotel1/addho.resx
- Size 5KB
- SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
- MD5 4eb5913a0e5aa842250f7419538fa230
- SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
- SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
- TLSH
  T149C11245B1C1DD260FB3482DE6523988FBA8923F02356C50B4DCA61F5F72985A6B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  hotel1/ajchamber.resx
- Size 7KB
- SHA256 70c072e6af9754dc1f289c70a2188aacf5e8cde5b892effa542727bdf754f7b3
- MD5 ff9e2e4fc67137190dbde39a1f819f80
- SHA1 4cf1a4a0d8d95b9b4aeec126553afa03a84e7f68
- SHA512 0da2a65b71aa385e9c22568fce31cf46a37d03ba9b68d3afb6009c073279fa44397afab931866684d0455e43dc621ed0c0a4e358cb41994f84e632126a623fc9
- SSDEEP 192:KjrbLPD9sLvIzSvKgIqUyahFUgwookmwT/3BOsh8Al:KjrbLPxsLvASvKgwyahFUgwookR70sBl
- TLSH
  T141F19451B1C5AD260FF3483DD2522984FBA5823F02316C94B8DC620F6F72985A7733A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  hotel1/bin/Debug/Microsoft.AspNet.Scaffolding.12.0.dll
- Size 102KB
- SHA256 8b3674840c188620ebeb457caf5f315b458b9fc4e7c4a1bc0c6775e86cc8ed2a
- MD5 f3db4b7b731d5dc920ef73bff91e2f1d
- SHA1 74bbce3a302419823bfcfca5acd8cc82a5928522
- SHA512 b00104860c914da3bf2fc0c2157c8d3db79321c41aa4cba730cd168e704128316ec8d4d47981bb67d02862d3c5f827914cbd219c27e033bf9f59c425a3a2239a
- SSDEEP 1536:345SYzMA6ziRlbnRADuaobMZbVf3FxQ+fo0Zlw/98fKKaw4hsVy8GzV:3oSYYmXnRADuaNzFjw18fKKKs3G
- TLSH
  T170A36C20A3FC836AE7FB1738B8B411154779F3576011EB6E8E88B55E1563BC08A12B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  hotel1/bin/Debug/Microsoft.AspNet.Scaffolding.EntityFramework.12.0.dll
- Size 56KB
- SHA256 d5350af54452772d19f6b4352f906e74372d0808373655e41b954222d306d3f0
- MD5 e50ec7988eb11f8f04876886d9d4f351
- SHA1 99eeaa704d81f2205c9cdda6cb9537230426d730
- SHA512 3d1d80393679d6de797fddf413627272a036959e0868fbf3ba8718eeddb0b46cb340ebd3c945b3403a4ca52036e957410b3d4fe52efe5f3d8b95bfeb63442704
- SSDEEP 768:WVr2PSS0iKvmk6vG0oGJEstunU8CJ6LDmoJEKx9SiLMYj/9zMh:/2i0mu0oGJsnU3oLDmoxxUijZzMh
- TLSH
  T130433C5173EC4316E7BF2F7179B5A0864E7AF617A800DB5D0D84694F08A3BC09A21F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  hotel1/bin/Debug/Microsoft.Bcl.AsyncInterfaces.dll
- Size 21KB
- SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
- MD5 48efe61d6ca3054309907b532d576d2a
- SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
- SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
- SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
- TLSH
  T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.ComponentModelHost.dll
- Size 20KB
- SHA256 c1f53844af032330af28bf038d8b7d9fe18d6c9e119961783969d5e4d2e85b54
- MD5 b9e4e90406445731a2d8bbb80d09c5bd
- SHA1 5b8b222af660f063720df555e04daf2d003c1cec
- SHA512 f6e58861db903bd4c290b26f8b1defd6263f16e861e3243c60f0270d1cf0abb9f428ddc056e58dbc578d68b2cc752c51d92af77406a3e5a0efd19834c85494e7
- SSDEEP 384:F4R6WucnwVcUtXtOEoJYjLWiJLl7Wi+RQWb1l2TKAR9zdno:+wVTxtOEoJYjLplcd18289z2
- TLSH
  T190924D21CFAD8AA3E8620E7046E5C1433E7CE7836D405E2F46C59E451DA3B54DF11A7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.GraphModel.dll
- Size 473KB
- SHA256 fb74ad636dd9921728ab9a3189de01165adee324417feb5603001c0c10d8603c
- MD5 1d0a1909010bb3a8139ec371ceaa6022
- SHA1 1d18599fa897987c993938ee5f3e77e21c3a76d4
- SHA512 051558fd12d4f8cf49d35987f1676f8858d6c6735ad0c55e1416e7fa9ef891fa5e87e6fb72aa20011042ec4852640356f98e41870e3160f04c2a02162bb35774
- SSDEEP 6144:l+aflvGQ+B6/ne5CPt9R2k3cSSScL2MjTVuGRWUr:4afVS6/e5C3R2k31SScL2Pa
- TLSH
  T1EBA44A03F3FC8E2AE6AF037AE1751B6567B9E6871643E75F18006DA51C27B40CE502A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
- Size 21KB
- SHA256 21e9388960143eab0323b9b56443b6c47439973b1682653c37e0e50217e3bb08
- MD5 b340a021abaa327244b5f02542bd1def
- SHA1 c4471b8c3bf60ed300ebce0bd843f017d205ad5c
- SHA512 1970ebe87910d0b7759cae3139bdb78b73e04b3c5a8a22ede42b772e1dc73bffa05d82a5684aba1b90fa265e30e510806bc5e782117ddd620612625c0a6b2d64
- SSDEEP 384:8rnvcezWjkWY6F0GftpBj3RS/yc4HRN75ulMY:BeMz+iJRS6Ba
- TLSH
  T1C2A22996CB7C9643ED935E3066A9CA433C3DE3C35920961A116AE1A81CD37C4EB1876E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.Interop.dll
- Size 2.5MB
- SHA256 f8651aa0a3646c602062682cadab7d4acd78290a9bd98173caa89971ccd7e8e1
- MD5 6bce4d2c77619fbbdf9a9a2f9ff43887
- SHA1 c7a9054f90d951f9f9a36d61f4968ba741941b7d
- SHA512 cd6e71d4837aa5d626e70d7e51f72b833789049c844810c99954551ff1ad67acc3be0db5067b0f09f564f77d6749067228b78282fbb38ac4f0078f313aed1d6f
- SSDEEP 49152:ERcqUZPVPPPwP10LV5pZ/PPPPFPePFPNPPPJPPdPDP0PkZtPPP7PWbbPPbP7PLbx:wIfVhYa
- TLSH
  T17FC5B65AD62CDD1ADD28D17E7C534F223779C24B3326CB1B4125012CAD9B3918D2AFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.ProjectAggregator.dll
- Size 13KB
- SHA256 a150a29105617f67be0559bd1b039dda6cf088671960e6b28c6ccad5369ff980
- MD5 1460dd3bbf19db3eb22a73bff871f137
- SHA1 6dca5380c79293b35167d72d667d10f5fc3f6209
- SHA512 5270b0a81fb6569e0e605f68d39df64a860532e95699cc147de0777448eb4c422c461d1c84b5e2fae0fae5ed1dc31e5d35e3e46947779275dab86734e2feb8a6
- SSDEEP 384:A9EuIbWXs9WoyHRN7/GlD/LVNSR9zEf4hP8:UETbtu+xLVNe9zi4hP8
- TLSH
  T16D523AE69B784443EDE7A9B05398DA437D39A7C70D20966B0199F6582DE33C1EB2433C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  hotel1/bin/Debug/Microsoft.VisualStudio.RemoteControl.dll
- Size 44KB
- SHA256 bfc4890087c01f629fa09e744e5a861f9f68b504100cbcf805855fa5906d61c7
- MD5 2338953ae2ab47de1703f27e872e84ba
- SHA1 2765b2f2cd04a0e1df7556da551ce9d763bc5c4d
- SHA512 417ce0ef8344409ebd05b8c52b58a3960489fe810b95af31e72430690ffb8258042a73e205fc27396731113ad84302ff898821b4f2db2b9d4fa2b2293ccca872
- SSDEEP 768:KBgzal57T9j/z7HpuTkQcWeoMlpERQ3VSbK:KRx/vJEt9XkpK4VSbK
- TLSH
  T117234B0583BC8723DBAF6ABD69B1D5224A32B7536952E75F08CCA1D91C93780DD007BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32