Overview

overview

4

Static

static

4

carrierwav...VE.pdf

windows7-x64

1

carrierwav...VE.pdf

windows10-2004-x64

1

carrierwav...ck.pdf

windows7-x64

1

carrierwav...ck.pdf

windows10-2004-x64

1

carrierwav...kefile

ubuntu-18.04-amd64

1

carrierwav...kefile

debian-9-armhf

1

carrierwav...kefile

debian-9-mips

1

carrierwav...kefile

debian-9-mipsel

1

carrierwav...ion.js

windows7-x64

1

carrierwav...ion.js

windows10-2004-x64

1

carrierwav...n.html

windows7-x64

1

carrierwav...n.html

windows10-2004-x64

1

carrierwav...4.html

windows7-x64

1

carrierwav...4.html

windows10-2004-x64

1

carrierwav...2.html

windows7-x64

1

carrierwav...2.html

windows10-2004-x64

1

carrierwav...0.html

windows7-x64

1

carrierwav...0.html

windows10-2004-x64

1

carrierwav...x.html

windows7-x64

1

carrierwav...x.html

windows10-2004-x64

1

carrierwav.../rails

ubuntu-18.04-amd64

1

carrierwav.../rails

debian-9-armhf

1

carrierwav.../rails

debian-9-mips

1

carrierwav.../rails

debian-9-mipsel

1

carrierwav...11c.js

windows7-x64

1

carrierwav...11c.js

windows10-2004-x64

1

carrierwav...c86.js

windows7-x64

1

carrierwav...c86.js

windows10-2004-x64

1

carrierwav...962.js

windows7-x64

1

carrierwav...962.js

windows10-2004-x64

1

carrierwav...9fb.js

windows7-x64

1

carrierwav...9fb.js

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9921f237b65302380224090ad77b5ae875092bed5d6a54dc0d669b513e386be6

  • Size

    2.9MB

  • Sample

    221126-ggmmhsad7z

  • MD5

    94e0354816fb012f020c679a74c50269

  • SHA1

    c2c99a22616323fdbd4ff2b3ca6dd093b8e6e5c9

  • SHA256

    9921f237b65302380224090ad77b5ae875092bed5d6a54dc0d669b513e386be6

  • SHA512

    cc44034cb1113a27fdcf1bc392385e48a84982d527e88888cc52b4e67a206a080c2d31d45e931bea831c57738cda9be8b276f96d21e40ed7b1176777621e68a5

  • SSDEEP

    49152:mOdBQBBrSidvehg3t21785u6JJWPa2xZfjpxRPABlK5ZDLTtBf8zOqsAHHxSvf:miu/Oioyt47QWPaAfVxRPABmLx5gOq7A

Score
4/10
linklinuxpdf

Malware Config

Targets

    • Target

      carrierwave, imagemagick dan rmagick/CARRIERWAVE.pdf

    • Size

      2.0MB

    • MD5

      25ff72cb169d9c05f25379d3905ca008

    • SHA1

      161dde8b9d51f9be3ac89d20787cbf39122ea744

    • SHA256

      bb6ce966f9e54a178ad9672c594b9d736bb89a6d50ba16929958fc77f5734e79

    • SHA512

      8717daca1246f1ad66d3b15b9f7b23d7dc9384bae2ada780f76a541f9002b763933cabf7268147ac968ba8962dfa723f0f3709e1b743ebad4ab4ee74ca9f8df5

    • SSDEEP

      49152:PQZXLYLPPgKv3M04pBqg/JASEBpR9BQz7lkrRAtX:+YPPLE0cIBpR9aPlTtX

    Score
    1/10
    behavioral1behavioral2

    • Target

      carrierwave, imagemagick dan rmagick/Menginstall Imagemagick dan RMagick.pdf

    • Size

      240KB

    • MD5

      a3115f98377aa8446c70c977e697e9d9

    • SHA1

      5d33e30f1625836a97d700ee89decf01ad362242

    • SHA256

      2a6c1cbb3cd32bc9aed656a93d1a682988397a4dac3e493b6371241fd5dd9372

    • SHA512

      e5a45f213ab8ceaafa3855a7091c65f0fa100ebcf738d519130f405189a121a3909c977e58fc2269c030832837c3cffacad0b6192f3c43c2de3abcfc68937024

    • SSDEEP

      3072:6fbig8CTuoiN/AEMvQa6yPk85wbboXdaC/weDGuWwgR5aC7aa9m+4SOl4x12J:o1iog/naa85wQXdahOG/wR4m7RYc

    Score
    1/10
    behavioral3behavioral4

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/Rakefile

    • Size

      274B

    • MD5

      8c5e20d624ac34d7884994ee26624ae4

    • SHA1

      553395c86681395dec8047baa869eb05c96df423

    • SHA256

      38b83b2b2f2127396b6b93487e906674f689809e922de2fe5339cebfa12131ee

    • SHA512

      4a3563775cbe7e24a6345a8750fcfc2f1cf11bb40c97508b69adc3d71f01f37881fe01af7926d8c619b57857f2519670ffa173c924976fa98c61d6c38fed82cb

    Score
    1/10
    behavioral5behavioral6behavioral7behavioral8

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/app/assets/javascripts/application.js

    • Size

      641B

    • MD5

      914299d653efca0c6d0ddab6566d46bc

    • SHA1

      0e430ca0a7e35627fc5f23252a11621845ddbf09

    • SHA256

      117cf53ca969ebaf586305e0b230b6daab02e705a272862e436ebc9c82574af1

    • SHA512

      907ec4944c5da306b1aea4d5c2daf69040437aac88c5acf51cfdc7ce45b4415ad1b7fd9ce3d9b013f8094c5d70555cfdf9d1994d74dcd4d89f8ba2b7a37c5140

    Score
    1/10
    behavioral10behavioral9

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/app/views/layouts/application.html.erb

    • Size

      236B

    • MD5

      61c6e75d56d173afc60644c915f79261

    • SHA1

      272dfaf1417255d3e0dbe00db48c14eb972e3af8

    • SHA256

      af452f0efc6fc0da45e58b6eb73e2fb74658dd9a88a99eb5ddabeba1f3a22867

    • SHA512

      ccb84de3afd9adba17090ca65411419612731125d559ee0e3f0c3fa2670b0ede1a650f6d68184947dbf7e832e4271afdf0800c74e36b8c638b83d84d00782c72

    Score
    1/10
    behavioral11behavioral12

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/public/404.html

    • Size

      185KB

    • MD5

      24de55ce5ca64024365055c68130799a

    • SHA1

      2831aaddc2b0dacd549cbc5bcfb7b9b45ead862c

    • SHA256

      fb672e1109e26edcfff3e4bfe402c54d0d098cd3faa2a487c915fc7fb594f3a3

    • SHA512

      8cbfc009cc7acaa4dcd153f6ed3354aeb264ca06f8a510825043fddd9d78392e8559a83cfc6e40ec7be41e729ef57c5005c3763fd987a4fe6a5ec45b54ddfb83

    • SSDEEP

      1536:WW6p9lAirrn3t4N+ks0BA/qveHq3FBF9CegM/RDVY6ihWENFz4IpfZC8KNXHjaMQ:o/Aiv3t4Ni/9deff65DfnLJ

    Score
    1/10
    behavioral13behavioral14

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/public/422.html

    • Size

      185KB

    • MD5

      3305b8f2a215919eb71871921510a668

    • SHA1

      2591db35a33276e0f3cf97bfb8bec33f311b4326

    • SHA256

      2037b73a3450ef631464435fb7e270ca095a38816d12d892c8c111fb4d98b83f

    • SHA512

      6509b6358af7c637c025cca1a8f499d6f4f55ef150d669b6ba2a3b21c3747c3ffadda74e1f37c5059beb83cbc40f88dda09f56c6b8bd8d82d0e66914ffcadca1

    • SSDEEP

      1536:VW6p9lAirrn3t4N+ks0BA/qveHq3FBF9CegM/RDVY6ihWENFz4IpfZC8KNXHjaM5:Z/Aiv3t4Ni/9deff65DfnLW

    Score
    1/10
    behavioral15behavioral16

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/public/500.html

    • Size

      185KB

    • MD5

      880f59614c323f8495fca5f11a5e8016

    • SHA1

      dd6ed5f4dd783c68db8f42e8be797703b876b5d7

    • SHA256

      9a586efbc58b7d343ead5cadb1a36107eb6f2ba7eae372764c9d3b7bf130dfbb

    • SHA512

      a839006e5d4ad5e0959bea3a9d8f31bfc61f559718e579b8a51a6be84835d5e769020724f0c43161131d52a6ed40c440e4df9395e603d27a9d09f6487b978348

    • SSDEEP

      1536:YW6p9lAirrn3t4N+ks0BA/qveHq3FBF9CegM/RDVY6ihWENFz4IpfZC8KNXHjaM0:m/Aiv3t4Ni/9deff65DfnLyQ

    Score
    1/10
    behavioral17behavioral18

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/public/index.html

    • Size

      190KB

    • MD5

      041da2a5c92178fdff7e12b9e0ba7834

    • SHA1

      20383e6f67a134d7ef34dd3f384a55107fa2e4f9

    • SHA256

      fbe2695bdd15f9af165d041a043f13c66f4008d2e5cea5ec7f2515841a3338e8

    • SHA512

      b3f93d3121f3786ccc869e0d721eb926851e55b26fb5a38fd78b3b11dfbf74a7e532b0b4dcf7c1a55da78f4783b4a8d029b388a0db82d8db851d55645af790d7

    • SSDEEP

      1536:llwQUW6p9lAirrn3t4N+ks0BA/qveHq3FBF9CegM/RDVY6ihWENFz4IpfZC8KNXl:llwQa/Aiv3t4Ni/9deff65DfnL2

    Score
    1/10
    behavioral19behavioral20

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/script/rails

    • Size

      299B

    • MD5

      3313b01c08ec324ae671a1ccdb003343

    • SHA1

      089b8b064e6d09e9315b068e277e39c50578210a

    • SHA256

      e841d6886248b3640771d9d60ad4c6e069321980e9afcfb9c055f436bd9af9da

    • SHA512

      e54f14f83dceeec13fd5f722b83806e5bf5f8b16af28c3ff294dc333def8e9ce920762db5039aa0c59f9c3c36a8b7c63c8b3fd69277a2a1b97ff5468fdbe1d30

    Score
    1/10
    behavioral21behavioral22behavioral23behavioral24

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/tmp/cache/assets/C75/9C0/sprockets%2F93502c3a1b0b3ff965767f520152911c

    • Size

      559B

    • MD5

      c1fd2009a09b77ac008644256a3d9f47

    • SHA1

      6a1f494a88153650a1c27902d04768b34bf9286e

    • SHA256

      73fc97181d08627226ebd5eb01bba7b1c67f169b13f56dffded17d1a02ca26be

    • SHA512

      44719b43ef0a242371bd6b9162fa2e7f4a7619762de8b8bbda8f7d1f05c3ee3cb4369a8a3a47d459d2b7efddfd77209130fe075e95e354f4cc3be22f3936c0fe

    Score
    1/10
    behavioral25behavioral26

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/tmp/cache/assets/CE4/2C0/sprockets%2F127e66033c19dbe2e3c55d362956dc86

    • Size

      260KB

    • MD5

      bbd2c81d5af96ecfd389224111b57907

    • SHA1

      8f4a7fb0f48806b7992a19783a25996bb5d6ef96

    • SHA256

      96a365f246e23fe0a3d30d40db4fa062ad1f0f6efa07b753f4285ef1caece7df

    • SHA512

      5f24ebdc4b00649a2866425280d0225a5b98b90fb40216757a2318bf9e60164d569a535459d49c866a078b01fc6c764476d1acb42f05edb90b5d328fad82fa88

    • SSDEEP

      6144:RZ8Z4TmM/cW4OfYNW/69bQPMU2Zmhx0Td03/wo/GEclct/080k07LqSP73IFS:8W4OfQZbgU75EFS

    Score
    1/10
    behavioral27behavioral28

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/tmp/cache/assets/D43/E30/sprockets%2Fab896ee3695fd0cb7d021a362c7b6962

    • Size

      559B

    • MD5

      1fff51d5cba4331f410f540cf6edd98b

    • SHA1

      06f6b1f46ca7db0ca3bb9ee5e1b6b51e620b0833

    • SHA256

      d642480443d4b03dc7de336dc474666b6c71ea655f631a0e0f663c3945a9650f

    • SHA512

      18760d61f3b00e8d7b5f46c419be14fdcec31cdf1d722db6dbb02b0402adbf7e06acef4639ab79a6a277d656e641a996002963d544f015d079620c0d7a10da91

    Score
    1/10
    behavioral29behavioral30

    • Target

      carrierwave, imagemagick dan rmagick/myFriends/tmp/cache/assets/D4C/4F0/sprockets%2Ff8635d29aa69fa91bc020e8f217599fb

    • Size

      260KB

    • MD5

      9e2ce17a3ad2a629c206d6bfbae22e5f

    • SHA1

      c27c00841ddc8cf0b77bb92e03024b6e90530f06

    • SHA256

      b24eda7444f9bf38f5bc67fa45f9b238288290c92dbde18973f2e4c89cf4753d

    • SHA512

      f97c8a89166ad12a8d4096848f319e7102add7c04617accf971db2f7e6203ae520b0767e71de4a5dc69d16185ce9126d564bab22a9c02b8c57e872d33d4e09b3

    • SSDEEP

      6144:WZ8Z4TmM/cW4OfYNW/69bQPMU2Zmhx0Td03/wo/GEclct/080k07LqSP73IFS:JW4OfQZbgU75EFS

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

7
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks