General

  • Target

    a1aa5a455e482d846a71d76598e6cc7f

  • Size

    2.3MB

  • Sample

    240224-mrxhcsab71

  • MD5

    a1aa5a455e482d846a71d76598e6cc7f

  • SHA1

    2cc646235be6775ccbad67c8a7837d060299803a

  • SHA256

    28a96d7ae07744563ac1170f707a26e82febac7222eb30a1e7ea9009cb8bce8b

  • SHA512

    611731997459353e2138c72c8395821dc8fa7775d4cb2cc9fdf349e2aa239af0077519561ed5f88442c4a6fd5b253c358c53d4b3148c1afc42c72f28f8af15a8

  • SSDEEP

    49152:4FIr4e3OhwJ/I7mAym6aTXWGCqb30uRusT4pJxnsD9v1Lc:4k3OhwJ/I76arWgLp0MGJxsDDc

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.gravatar.com/

exe.dropper

https://secure.gravatar.com/

Targets

    • Target

      mantisbt-1.2.1/admin/install_functions.php

    • Size

      7KB

    • MD5

      c7ce944effcd07743e7c93a38b4c1ce8

    • SHA1

      80c1a98c06346e12f6f7479007ed139d2fd354cd

    • SHA256

      75e057b652a1d6dcc45bb1129dd1348f1373c633a26a990811db6d9ecd8d168c

    • SHA512

      04f4df12a0915c9f56cb351109cf0fdbaed1df7a6a0fbcf70ebb7802f9859d3179b04d4e00d97b205c2fe1db100a7351756fa9ae2ff537f2c712a108febff6c5

    • SSDEEP

      192:0xqRkYVLiS3H6/RsbszqPe91dKNPRaI3S9IOSD:0xqV3H6Js7Pe911wS9TSD

    Score
    1/10
    • Target

      mantisbt-1.2.1/api/soap/mc_api.php

    • Size

      14KB

    • MD5

      1d0d9e5fab710c10ed4ab1ee9ef85b6b

    • SHA1

      0c8f349518b0b859e932e5df651579e1ac2cf03b

    • SHA256

      76fd94d0c7d2abe6ab2f5089a9bf37d699c399153448bc1c7929800e5c318264

    • SHA512

      93bff82a9d84e9d908e041c914ef227109a1852b844704c347171b2ffece90464c24f88b2dc216322c39647f05f7ac44b344ff742c16eb36345ce848477acf63

    • SSDEEP

      384:6kxY/tLY1UvcYRYPQf7YLVYJYrYrtLYjUYgZK+/+rEmoMMNjA8crE+vbG+:6EYJYRYRYPQf7YLVYJYrY1YdeSoMTrE0

    Score
    1/10
    • Target

      mantisbt-1.2.1/billing_inc.php

    • Size

      7KB

    • MD5

      4a093ed6739a6fac36857b2ec4628e22

    • SHA1

      4673d115409f8129cb5850c4c7b0877fe112a4fe

    • SHA256

      93ef3df85fbf3d4b35ccd2cf24cbde7ce2c7834f007b20e79c415ed0ff5fa4fb

    • SHA512

      d8d1971aa5b3199cf3cd819b333f70f896fd8c72dc0b33d802311604fa61d35fc32ad41218f0d3dae627ab5f831cd3e147a8b71175e3bba259bbcf32244bd467

    • SSDEEP

      192:0xm0b/vmoAakUkTdpBoUSx+ADvo4ubwDv:0xm0bvmoAim7/9bev

    Score
    1/10
    • Target

      mantisbt-1.2.1/bug_actiongroup.php

    • Size

      12KB

    • MD5

      071e898a96df63693a8f06d056d206a2

    • SHA1

      f47551a72606859f2dfda0ed254911bc9c82a50f

    • SHA256

      f59cced99ae6f1ee475323483332520244e696c6afb87869023738ac2f299c8b

    • SHA512

      bc38aca1a409eba6aa0eab56195dba8b12cec232cec37b63d60d7a03e2515fd7ee00866baca6c0771b6d788356217d586c9047114bb029d5b0bea049e270f571

    • SSDEEP

      192:0xrNMuJhe5wC+c9w0I9qR9K5ckgX40jLRHsZ8kpwLoqD+9ivUopBl4:0xHhkwl/sbKyEpvqS9iJ4

    Score
    1/10
    • Target

      mantisbt-1.2.1/bug_report.php

    • Size

      9KB

    • MD5

      c59a3f7a7f57a76f97e67ab512ac742c

    • SHA1

      69016d84730953a1a1b3b950aadbb381d4a61bb1

    • SHA256

      2694aff649463eb7ef2e39dbb3b95487ce76e90771689f73cd91b54f78a6645c

    • SHA512

      0ef16a6cc41cfd26614324aa52e21e90afbf468c7be203f05cb56145e3033885e0e52eda9f653f4528a54b163adebd729653d089a277408920f35f1963059d7c

    • SSDEEP

      192:0xyo0flF+qtEnj4bJPAwRpnHEivxhzYrc8g7Zs4IJWkNRUnJd2bpUIX3FfuxvJn:0xdWUqtaWpkivSOO4I/8JIyg3FfuxvJn

    Score
    1/10
    • Target

      mantisbt-1.2.1/bug_view_inc.php

    • Size

      22KB

    • MD5

      35b2122a6a1fba618b23fba6578d233c

    • SHA1

      b58df26080198e9ab97fb0c8ee5372567df70f59

    • SHA256

      e7fb965371823a8d7404066aa5e0c62f2270b6c26a69e8b6995d340fffce62d7

    • SHA512

      13735379da57d8f52b3662b338f1df5449632ddb195ee49c3b51c4ea0bb8fa62cf83430deab091a92662b9e09f330ef8a172758a24b383597841246b16aa2f00

    • SSDEEP

      384:0xfVMc0oVU+Jind1AHjh7CPkM9sJXAKuSHefU7+2ym:0xf+c0n1ADKDsL

    Score
    1/10
    • Target

      mantisbt-1.2.1/bugnote_add_inc.php

    • Size

      4KB

    • MD5

      b03cc166c6cee4daa648f4e55234799b

    • SHA1

      fb87415d0e3f84ec636a649dafba30fdb0300892

    • SHA256

      1601182580695103606cb851f562de65763a035b18dc8455b8d6631f42808c0d

    • SHA512

      8226091afcc318740eb1b2cd5f90422dfafffb6004b75d6f88a8ea18af7f64b37bba6e282f984d86a4b3004c797c53d28bb50403935725084787d0df691de087

    • SSDEEP

      96:az+wmWBlRJldBDcd5/PTR+HJ4/BPL8w2xUxlcxXGzfVfsf:0xTtcdNb4H6/BPL83xUxlLVq

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/authentication_api.php

    • Size

      23KB

    • MD5

      f2cbfe95665eeb0950a0fb3a41cb89ea

    • SHA1

      dd5179d743b44302605137b2f650e1538aeec9cd

    • SHA256

      dd2e7731fc7ea3e34796e8cfa2e7cee55537b85f9d55a57a9edb59c2eaeaf357

    • SHA512

      a29d7909025dd04e7dc9994fa58c6f872b203178adecdd1905b7524c49dffc370a8d6ac77cf9f9581505445b2c9a2a7dc760df830a7833a9ab1d66026cfec790

    • SSDEEP

      384:0xlXfnJfvh8gmcG+1qPr1zD+L1QlE4dkY6hqzVQXca79ruG01CyfE1:0xlXxnh7hG+QPrIZ0tKY/ywHM

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/bugnote_api.php

    • Size

      21KB

    • MD5

      e5e9beae1021ec471e5f93f479e34979

    • SHA1

      e1159a0b491cae8067157f06581877230d8aa9b2

    • SHA256

      9900e1553296e61453fcb50312844e5095ce26dfb082a0c7999e3ce647a1cf98

    • SHA512

      92dd275a663fb668306fed98eddb7d2780b6314a96231754423fe1330aa4762aafeb8a90ebb519ba5e7b648c98ca816f7421b0203922b29e4382d4136a9ad439

    • SSDEEP

      384:0xUolGTo6SiMwGqo09noLoAYzDVNP0PXwT/RvfGC6Xo:0x/lGT009novENsGwY

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/category_api.php

    • Size

      16KB

    • MD5

      b220eb6d1517346f32b359af0a73d8aa

    • SHA1

      36c2bd2635244557d60c057c6c16e0140377afe6

    • SHA256

      ba848d9f430e61bc916329c2a4e709ad1ab4812a20564204004db550d5920e0d

    • SHA512

      872856f1994ba76788b2d319c95ba876869280e1a31d3ff4256ec6922055b2edd98a0ff2e05e1b63f5df124476a919a50de8f1d728840be8731032678bb9c8c7

    • SSDEEP

      192:0xMrvrO2cmQ8nQdIVuhDIdbE52BHB4gdyc9HodZih5nVBfpQijDthwXTR6KiXMDq:0xMot8wJm2u9VtfpzwXTRbJvO0HXmd

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/cfdefs/cfdef_standard.php

    • Size

      12KB

    • MD5

      ac20b001f388b9517a1ba102900d1d77

    • SHA1

      ce6ef1bcfcd01e2aa2d4d82d37beb7e678c80fd8

    • SHA256

      b0765193cc96490996fc7d1184075b87dbe91bcc82d8d5b0ba07508a9d2f8df0

    • SHA512

      d81af2f954022e0112989eca5ad7e407b5f9039b8bf464f2f549a73da6b58dd6fc9975e11b2dd183585d592ec7c972854a207aeaaeef31d68c3ac8e014976c1d

    • SSDEEP

      384:oxk3KtKqK7AksVZx6ku4AkZxYkY/ODgYVSVWVkb/:ox4yNCivxt9jx6/ODgYVSVWVkb/

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/columns_api.php

    • Size

      39KB

    • MD5

      956c7cc4b7e609f695ec85155a51a91a

    • SHA1

      0e4f482ad18f59c546defed3c46b994f96a45104

    • SHA256

      1a7ad7a56b51d4df5a09cec5517615e6e8342fd04698463f0516b6e4a916471b

    • SHA512

      6bc198f21373b5d5082fb8df6ce9dd2e1e0eb130f5719f0002f2773c63f34842ba4844a4f9203eaf94e032892d159986bee0d3566c7d2762a9fc5f575242dcb0

    • SSDEEP

      384:0xgZATAYydUH2qPyyWuyB4V+SZhaJN/1hKgsOJLnOwhFddh23M9RDgXuCWEZ3Jza:0xAgU9KmBmNqPow9dh2sRDg1Va

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/custom_field_api.php

    • Size

      46KB

    • MD5

      305b2b8f2f47443541dbbde69658b3fe

    • SHA1

      65506b006615cf3de054ff9302cf4671a58847eb

    • SHA256

      fdd39ca620aa0ad3b03e78b39ba828c3be4625890dcef1aaa4c1eb83a2a49002

    • SHA512

      6ae86a7751b00ac009319ea8ba801ff7513752d0c5fc02c67b3510a61b27106b96f7e78b93c3b00abe3367cb85dc9432b3e4c93d1ce7d2913ef6918be7a8e5aa

    • SSDEEP

      768:0xx1KntTVeK+pDlI5QWUkXNqkLvGncKBoCJPqQq8xaNtizrAj503kAG3ebhdJH:4OtTw9pJ4ync07JmCOta8Q

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/date_api.php

    • Size

      8KB

    • MD5

      46c0356e979db4741c20307c72651beb

    • SHA1

      ba9e909ca1f4f96e785c8f0c2a97c2fb39461a41

    • SHA256

      a44dacdf74c9080babe6da387a0731d0b250669e81ebf891df21c1039bf6acd6

    • SHA512

      ac505ad1a88e5ff9b94c13abaeddc9970678f19e78c43d9fb24df5a4941f096593dee7d5c522fabf2e9cff7bbbac619de44299e872908ed957df3f5906fdcd8e

    • SSDEEP

      192:0xNWAqkJ5lM52MBhMv65nwcji+Vy3pfzdQ:0xNfqAo95nwUi+Vy5rdQ

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/email_api.php

    • Size

      49KB

    • MD5

      57bbb88102d6936b42071fb4101de618

    • SHA1

      e94275f51cc7006cd4c3e32c5cf979b5ead994fc

    • SHA256

      d52eb0a4f67306955d8e29675f688864ca752cf7fa5dc14adf17c3afe4ed64bf

    • SHA512

      a3d71589de8555f7d772e92d34881506a249209ce0a7fbd4f279d2e62bc5994dcf7940139f92ae83fcfd120490ed29a6179b372d2268a625deb7b98fea8a6f2f

    • SSDEEP

      768:0xX17EFr56L/ePjKBVr4oBQh0pnwFFbzhNLgtB:s1Er56L/ePjKBVrCGpw//gtB

    Score
    1/10
    • Target

      mantisbt-1.2.1/core/email_queue_api.php

    • Size

      4KB

    • MD5

      435ed72a90fcf463274102b2184da5fc

    • SHA1

      f615ec9cc639d25061b75e37e78f82b12101a53f

    • SHA256

      1d21f384791bf28b8ede0329fc7df52c1e482241620f5765bce0ddcd12014a2b

    • SHA512

      4825ff01edbb48603ae590ab3ee0e57049e831d3c97278fb70442db55c9837aaf8500d236ca33b5580b48d920d9cfe9044e7b97e7c5c470cff5e6e28167733c8

    • SSDEEP

      96:az+wXWjvXTerjUkznWh8FEhl/hn7+XekJPdkqlL:0xaXTQQkDWX//hUekpdkqlL

    Score
    1/10

MITRE ATT&CK Matrix

Tasks