General

  • Target

    pl_2 (3).zip

  • Size

    6.9MB

  • MD5

    c0719498f0b3afc0d6497c92bbe8cf42

  • SHA1

    baa9de29b8122b11a08352a67103bedb423d6162

  • SHA256

    b16f0904dfb1e0a167ce1155b05c28bcc74ba71d6871daa2e84f192d0378239b

  • SHA512

    d04e6f5eda1560ea70d80d4606335464b985546ea6b3bc828fc967f27e166ce92b221247a18c0a69ab534fa8e7b6d32b444d0423b3dbb77d60da6976acb6f6f1

  • SSDEEP

    196608:PoAne4yJfeHAGMRkEbhEKNE0NnhK0txmBrR2bmIvrgMHD:Pq3ZGMDFNE0No2Yr8bRgMj

Score
1/10

Malware Config

Signatures

Files

  • pl_2 (3).zip
    .zip

    Password: infected

  • pl_2 (3)/pl/a1b2c3/index.php
  • pl_2 (3)/pl/antibot.php
  • pl_2 (3)/pl/bower_components/angular/angular.min.js
    .js
  • pl_2 (3)/pl/bower_components/font-awesome/css/font-awesome.css
  • pl_2 (3)/pl/bower_components/font-awesome/css/font-awesome.css.map
  • pl_2 (3)/pl/bower_components/font-awesome/css/font-awesome.min.css
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/FontAwesome.otf
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/fontawesome-webfont.eot
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/fontawesome-webfont.svg
    .xml
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/fontawesome-webfont.ttf
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/fontawesome-webfont.woff
  • pl_2 (3)/pl/bower_components/font-awesome/fonts/fontawesome-webfont.woff2
  • pl_2 (3)/pl/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js
    .js
  • pl_2 (3)/pl/bower_components/jquery/dist/jquery.min.js
    .js
  • pl_2 (3)/pl/bower_components/ua-parser-js/dist/ua-parser.html
    .html
  • pl_2 (3)/pl/bower_components/ua-parser-js/dist/ua-parser.min.js
    .js
  • pl_2 (3)/pl/bower_components/ua-parser-js/dist/ua-parser.pack.js
    .js
  • pl_2 (3)/pl/cc/favicon.ico
  • pl_2 (3)/pl/cc/form/css.css
  • pl_2 (3)/pl/cc/form/form.js
    .js
  • pl_2 (3)/pl/cc/form/newloader.gif
    .gif
  • pl_2 (3)/pl/cc/index.php
  • pl_2 (3)/pl/cc/ng/ng.js
    .js
  • pl_2 (3)/pl/cc/robots.txt
  • pl_2 (3)/pl/cc/token/token.js
    .js
  • pl_2 (3)/pl/cfg.php
  • pl_2 (3)/pl/cloaker.php
  • pl_2 (3)/pl/config.json
  • pl_2 (3)/pl/core/form/core_form.css
  • pl_2 (3)/pl/core/form/core_form.js
    .js
  • pl_2 (3)/pl/core/token/core_token.css
  • pl_2 (3)/pl/core/token/core_token.js
    .js
  • pl_2 (3)/pl/def-page/form/form.js
    .js
  • pl_2 (3)/pl/def-page/form/newloader.gif
    .gif
  • pl_2 (3)/pl/def-page/ng/ng.js
    .js
  • pl_2 (3)/pl/def-page/token/token.js
    .js
  • pl_2 (3)/pl/def/cc/index.php
  • pl_2 (3)/pl/def/done/index.php
  • pl_2 (3)/pl/def/index.php
  • pl_2 (3)/pl/def/info/index.php
  • pl_2 (3)/pl/def/login/index.php
  • pl_2 (3)/pl/def/sim/index.php
  • pl_2 (3)/pl/def/sms/index.php
  • pl_2 (3)/pl/dotfont/dotsfont.eot
  • pl_2 (3)/pl/dotfont/dotsfont.svg
    .xml
  • pl_2 (3)/pl/dotfont/dotsfont.ttf
  • pl_2 (3)/pl/dotfont/dotsfont.woff
  • pl_2 (3)/pl/dotfont/dotsfont.woff2
  • pl_2 (3)/pl/gulpfile.js
    .js
  • pl_2 (3)/pl/home.php
  • pl_2 (3)/pl/inc/Mobile_Detect.php
    .ps1
  • pl_2 (3)/pl/inc/class.jabber.php
    .js
  • pl_2 (3)/pl/index.php
    .ps1
  • pl_2 (3)/pl/index1.php
  • pl_2 (3)/pl/info/favicon.ico
  • pl_2 (3)/pl/info/form/css.css
  • pl_2 (3)/pl/info/form/form.js
    .js
  • pl_2 (3)/pl/info/form/newloader.gif
    .gif
  • pl_2 (3)/pl/info/index.php
  • pl_2 (3)/pl/info/ng/ng.js
    .js
  • pl_2 (3)/pl/info/robots.txt
  • pl_2 (3)/pl/info/token/token.js
    .js
  • pl_2 (3)/pl/iplogs/.htaccess
  • pl_2 (3)/pl/iplogs/file.php
  • pl_2 (3)/pl/ips.db
  • pl_2 (3)/pl/login/favicon.ico
  • pl_2 (3)/pl/login/form/css.css
  • pl_2 (3)/pl/login/form/form.js
    .js
  • pl_2 (3)/pl/login/form/newloader.gif
    .gif
  • pl_2 (3)/pl/login/index.php
  • pl_2 (3)/pl/login/ng/ng.js
    .js
  • pl_2 (3)/pl/login/robots.txt
  • pl_2 (3)/pl/login/token/token.js
    .js
  • pl_2 (3)/pl/mn.txt
  • pl_2 (3)/pl/modules/apk/img/de.png
    .png

    Password: infected

  • pl_2 (3)/pl/modules/apk/img/en.png
    .png

    Password: infected

  • pl_2 (3)/pl/modules/apk/img/es.png
    .png

    Password: infected

  • pl_2 (3)/pl/modules/apk/img/fr.png
    .png

    Password: infected

  • pl_2 (3)/pl/modules/apk/img/it.png
    .png

    Password: infected

  • pl_2 (3)/pl/modules/index.php
  • pl_2 (3)/pl/newloader.gif
    .gif
  • pl_2 (3)/pl/node_modules/bootstrap/dist/css/bootstrap.min.css
  • pl_2 (3)/pl/node_modules/bootstrap/dist/js/bootstrap.bundle.min.js
    .js
  • pl_2 (3)/pl/package.json
  • pl_2 (3)/pl/php.php
  • pl_2 (3)/pl/sim/favicon.ico
  • pl_2 (3)/pl/sim/form/css.css
  • pl_2 (3)/pl/sim/form/form.js
    .js
  • pl_2 (3)/pl/sim/form/newloader.gif
    .gif
  • pl_2 (3)/pl/sim/index.php
  • pl_2 (3)/pl/sim/ng/ng.js
    .js
  • pl_2 (3)/pl/sim/robots.txt
  • pl_2 (3)/pl/sim/token/token.js
    .js
  • pl_2 (3)/pl/sms/favicon.ico
  • pl_2 (3)/pl/sms/form/css.css
  • pl_2 (3)/pl/sms/form/form.js
    .js
  • pl_2 (3)/pl/sms/form/newloader.gif
    .gif
  • pl_2 (3)/pl/sms/index.php
  • pl_2 (3)/pl/sms/ng/ng.js
    .js
  • pl_2 (3)/pl/sms/robots.txt
  • pl_2 (3)/pl/sms/token/token.js
    .js