Overview

overview

10

Static

static

Stolen Ima...nce.js

windows7_x64

10

Stolen Ima...nce.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Stolen Images Evidence.zip

  • Size

    5KB

  • Sample

    210727-dmk5bzhbnj

  • MD5

    c47d524b7942c9c5c29e226666ffb3c4

  • SHA1

    02c79043a55838d92e2b88e520c70b4dd80bd6e4

  • SHA256

    d28f963518923d308071a4d3387be175312b8e649f1fc744ff76321b01deced9

  • SHA512

    38e5b167adb40e09969424c071c7a4286fdb6744dd5348b112eb7cd9125cadebffec02d83353051e3e6ed49eadd84e57a4e33575b2822a88f55d94c75019f806

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://munardis.space/222g100/index.php

Targets

    • Target

      Stolen Images Evidence.js

    • Size

      23KB

    • MD5

      86c4c4a86388ab87b8166563fc6080b9

    • SHA1

      a22941692d34245363e1ed75a2e55f9e439f3e2d

    • SHA256

      6961814b2c02d34f6eb8da26d59c3e555763f28680ed67bd7c6b30994dba74d3

    • SHA512

      9005d46de018ce0409a2a8f0bd7afe611636c88e5f503b4d0e22ef72dbec7b0240a3f1c12b6711a07dc839d04225df5f3fcee4db8c68edf4eb8a58a7aef71ebc

    Score
    10/10

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks