Overview

overview

1

Static

static

irs/bank.php.js

windows7_x64

1

irs/bank.php.js

windows10_x64

1

irs/card.php.js

windows7_x64

1

irs/card.php.js

windows10_x64

1

irs/confirm.php.js

windows7_x64

1

irs/confirm.php.js

windows10_x64

1

irs/images...vg.xml

windows7_x64

1

irs/images...vg.xml

windows10_x64

1

irs/images...vg.xml

windows7_x64

1

irs/images...vg.xml

windows10_x64

1

irs/images...vg.xml

windows7_x64

1

irs/images...vg.xml

windows10_x64

1

irs/index.php.js

windows7_x64

1

irs/index.php.js

windows10_x64

1

irs/js/boo...min.js

windows7_x64

1

irs/js/boo...min.js

windows10_x64

1

irs/js/jqu...min.js

windows7_x64

1

irs/js/jqu...min.js

windows10_x64

1

irs/js/jquery.min.js

windows7_x64

1

irs/js/jquery.min.js

windows10_x64

1

irs/test.html

windows7_x64

1

irs/test.html

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21bf1d3c_oEqEHE8kDD

  • Size

    482KB

  • Sample

    210830-7x433m7dvj

  • MD5

    21bf1d3cb5530abccfc15de6cb0bbb41

  • SHA1

    8be4082456929e6a3c1da3e86381d8f577be847e

  • SHA256

    64591f750303fe4aba5c2f787597cd5cd56dc9f87a829cde27b3239cf7628957

  • SHA512

    2e4e86e82f39bda85ad7d94befa55c026269f442d5abb88fea1968ce1c931274b2ee80fb9c33bfc15b4d6b73d97dbb588d8dbd13af87dffc412664c18633926d

Score
1/10

Malware Config

Targets

    • Target

      irs/bank.php

    • Size

      59KB

    • MD5

      83262800a488fdf6a589a4038e2b9742

    • SHA1

      cfc1452d23008d762e1080249c3bf15c7133e136

    • SHA256

      2706d24d88f36bd515ab736fa2a3597e2b92965f029620cef4a525bde5a4fbe0

    • SHA512

      6f8a20f359310fcebed0775cd8ae91422e73438c009d585229eaec37631697236228e6fcdaf648f0503cae9586148069d9615d7ffcad1cdc7553b4407b0658a4

    Score
    1/10
    behavioral1behavioral2

    • Target

      irs/card.php

    • Size

      23KB

    • MD5

      096f1266144b15a9af0aeb21aba6da51

    • SHA1

      a73575b4cb76a4c57f076545cbff545ec6ee61e6

    • SHA256

      1324e1c4daf34b84ff39d693772971c2a06054cd93f44e7a09fed889752697d3

    • SHA512

      b4679d3e9813fa706e2ae515ff11c822e53bc049f50d5248b38e3593aaf103f29560d6ca0f0090617ffc0156d17c536c634e3e65b096773da5be2755c97ee10a

    Score
    1/10
    behavioral3behavioral4

    • Target

      irs/confirm.php

    • Size

      24KB

    • MD5

      20393718d841d052b2159f32b30440a7

    • SHA1

      a56de494e8e404852bfdf36bf304da2b0575d727

    • SHA256

      c8a8819547cba87d9cec7558ffba8e310b5bf078c2c932700ae3b67978777869

    • SHA512

      e29fe69e4bbc9241257e675c64b5d95b45f8f08a6605058acbb87a25ac5e451954f0359a942e8f3ee9ca390d2bd0058dec646f654b122d3b44cdc2af71099f9b

    Score
    1/10
    behavioral5behavioral6

    • Target

      irs/images/noti.svg

    • Size

      656B

    • MD5

      627361e7f33ba48cd231cd59e2b9a309

    • SHA1

      039512bfcef1d44e22b5d4433f34bb713a9949f8

    • SHA256

      3780ebbc08342857b88aab9941cbe8158c0ba2e3eb76755daf3c7377af71be65

    • SHA512

      2a8b967d038c48e8d54c96edd1002fd4b08a642af87c39677123ff6fbe34b02c1a46a1e8e3811b3b28bd3389506a283c25ff9e5456ad5a79669a525262092980

    Score
    1/10
    behavioral7behavioral8

    • Target

      irs/images/settings.svg

    • Size

      994B

    • MD5

      0504c83119eeed267d040d3d2810f3fa

    • SHA1

      7989956f35cde6cfbe47643b1d7fd24e75647548

    • SHA256

      ee1827eed4063223ff9e97ec96f199075b39188a47cf46c07e171ae836c87f5a

    • SHA512

      ceeb62b538b9ca2dd1a6755a3b6dfc5141e81a962a0b105bf35bcfa1ac10a8dcb666b4a25f3ec0cfa9f65ede276b979ff40cfc1f63fc1e82d3ddf1745d604703

    Score
    1/10
    behavioral9behavioral10

    • Target

      irs/images/success.svg

    • Size

      513B

    • MD5

      7ba2c7ed2d27cc893b31d1689324ed2f

    • SHA1

      258e44e65d4ad780c6b86b8d3df1d1420264627b

    • SHA256

      aa73ecf6d7a0055ee569c7d11e1223342bfd53d83e137830a60cfc99eb5347c4

    • SHA512

      5b4a3715e650b024003c5767e0a87dde375267f407eb8b0c0c3a1da7f3d6cc13a6747f2052d30550221832be74e16ce4926cc5a64cec2c3e3669689194dbef86

    Score
    1/10
    behavioral11behavioral12

    • Target

      irs/index.php

    • Size

      36KB

    • MD5

      7b15cd71b277693a742c60dac7c158dc

    • SHA1

      435b27402963c53a56d4369f7c0320dd0a72cc9b

    • SHA256

      db80a30914cbad833a1145ea88cf446349a5ed402656468b231680e63c1a57be

    • SHA512

      3fd47c005f1da4d8f6a9377ab136e8fa871b038240f056aec8898af2411f8a6aee397fdca1face942d051e46f157cae4838b58ca7dbf07bd1eb24d17884e9274

    Score
    1/10
    behavioral13behavioral14

    • Target

      irs/js/bootstrap.min.js

    • Size

      49KB

    • MD5

      eb5fac582a82f296aeb74900b01a2fa3

    • SHA1

      fffea98e12e63b66693d567315a2f32392b780b0

    • SHA256

      c5a17d46976d471cf060c5a0e25749a323d6ab20cf0910f40afed81047ba21ef

    • SHA512

      60ad4ccfd52266685b1735e031b9776cee3dc19efc5e3de1f13b5304b147100123501c6c11975777c225e5159b84f3b207ae776c64033551869f2da639166ae0

    Score
    1/10
    behavioral15behavioral16

    • Target

      irs/js/jquery-ui.min.js

    • Size

      247KB

    • MD5

      bcad1d60cf9cb3bb180a1a8339ed5529

    • SHA1

      e045cf3abc14f3d1489828d51a47dd8fb10db197

    • SHA256

      21cacca8e9eb98f1f32702b4176685f2f941af51ab5bc7cf88ccb5435a1bb080

    • SHA512

      98c64d9b57885b57f687b1bf1c48dc87682dc9b7ffa16caf8e1d2d59a838cfa040cbdd03c4a04902996efbb6dbd87b3a7a5bd63c52cff1fc9b4c799dce5ff6bf

    Score
    1/10
    behavioral17behavioral18

    • Target

      irs/js/jquery.min.js

    • Size

      83KB

    • MD5

      25a4757b2ef1bec5f437944a7e33ff77

    • SHA1

      41edbe4dd3ccafada620da9821f2686c922d8fa7

    • SHA256

      b393399496c96983723466f13b624f70da2d432c1493826e87e6cec3a949dc5d

    • SHA512

      b30169c9a955a558911621538e6e617cca62b6a5c6eafc5b4d0c6de5b5381851620a4b9356ffe08655d80a1eaab6858ccb19654a0e7ed073059512669835df59

    Score
    1/10
    behavioral19behavioral20

    • Target

      irs/test.html

    • Size

      23KB

    • MD5

      f8968b5cec271891dfec168f814a0ed7

    • SHA1

      b31cd27358e4fe531ee61836b41a943e9c9e2ccf

    • SHA256

      2833d9fb8fa07e55dd18b5b22af852f793dcfafc9c645d40b0ca0f42cef5f556

    • SHA512

      52e72de8202587fea152098d68cbbb10faeefc05bbd943ab898d5dac361d6560e0f95642af19a024e6e589a7c77f2e3cf594b9e37a2c4148ada62b90e583202f

    Score
    1/10
    behavioral21behavioral22

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks