evilgnome | d562d18e374deb2c527b66af008d8b4e3d17f63ed9f3a702196af2d09a37ef0f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Files.zip
Size 15.6MB
Sample251119-pfgc4sbm51
SHA256 d562d18e374deb2c527b66af008d8b4e3d17f63ed9f3a702196af2d09a37ef0f
MD5 df41c68b6801a23c666620f080e98c6d
SHA1 cc4f3852919ed0bb16c8f75199960cae3029baf1
SHA512 54e993f064f0f67030a342e29b0b80cbaa34e82d978d741d56a64ba177472e0b067dd7f566d0453b3d43f0a3f7f3a5f2922d658fcce995d5206affae15bb3348
SSDEEP 393216:Mj7PRSzTUjQ/DkKnCEAq+1q8QB6HhjpEAXvN6atQsWQ+/I8YpXm4o:MQUErP+1F+6HhjOWNhQHUpW4o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evilgnome discovery execution

Malware Config

Targets

- Target
  rules/snort3-browser-other.rules
- Size 44KB
- SHA256 b399f231d21ad7694cf8d33e549f878b6b547aaf686f638ac6f886e388997f0f
- MD5 97491f151982fca1928aa41f6c02dd8c
- SHA1 666854b8d32430b4948138ce953c3438668e25bc
- SHA512 c24b43369368f066325ddff1c5825d404bcdba7bfb0873d09d1b85fe429a2a47a36dbc5a39a4f0e9ebc52523a86bc0d72425ddcdd4ed69d4723e688bcebc82be
- SSDEEP 768:8023wYSh0eEpWRUubCbIuYOdYXOSJyz/2KGxOz2hK1CPpAIpsTxcFZ5CXW1/b+9I:uXMhOfXxqL88
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral1 behavioral2
- Target
  rules/snort3-browser-webkit.rules
- Size 77KB
- SHA256 67a4466f5f322ce05a59d3694fee38fe2b78666eb1c41aa4eba8df95b5e9662c
- MD5 4a45b5948caa54ce90d75ea74260649c
- SHA1 bccc43fc6b6ed483c87eb4dde7db2b1614fe2968
- SHA512 3d739c7e687573c9e7786974e43a9af83524e4c10748f074559e6fd157de79872c2a6c2a429c24c5db9ea9d1fef52fe7de2265ad78da0d4eb7a63511152dde11
- SSDEEP 768:8023sjapAhBafmToMYK/2S7mtfDvYAWiSDt1sOhaq9pU27rj0hIifuh2d4pGUDFx:uB+KtJ9jrG7si
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  rules/snort3-exploit-kit.rules
- Size 397KB
- SHA256 44711404abb4380b37ca1402c632a57801affeaa18bca8e0d1dfa4bb992ddb79
- MD5 bfdf183a7ee67dde0f2b48ae8ae12ab9
- SHA1 fc5509d20b984c541961d9783783edc3c622491e
- SHA512 90ff33859b97f28751db4e70b256b962997766e30d7561394328716e003d3d0142f6d7b037f7c559eb3e801335cff8d1f28d23c7551d5f3b7707017b552c8f1d
- SSDEEP 3072:u4geRICl2EFIioUMduHrC8L0qIss1EkCiPvG0jpd:ujcICoLioUGuHrC8Aago0f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral5 behavioral6
- Target
  rules/snort3-file-java.rules
- Size 122KB
- SHA256 c98e6214a725ce0c43ff0ad328166546f8d88b643f79b337486537c85a3ba2b0
- MD5 b4b74fb54b3416b9ed64d736c7cd820d
- SHA1 c2252d5faabe0cae15a073cd3a48312fb1ab2cb2
- SHA512 8f0713c09ffdb1ff1914f0c6f60dd4eb996a80b7d68f6ccf3b2a7972b1ed08ba63b9424ad2d74e628d8c075a43fa373dd5e84a8dfef7cf7efefa5bc84967dedc
- SSDEEP 768:J/531BD8B8reyLacYD1Dudw9nvuTZWIXUCCPVfbKtpemYH4mNZcNC0Jem7HBYqzs:frwBcVzIkwWmwW3AmoBRoBa52J+9I
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
behavioral7 behavioral8
- Target
  rules/snort3-browser-other.rules
- Size 44KB
- SHA256 b399f231d21ad7694cf8d33e549f878b6b547aaf686f638ac6f886e388997f0f
- MD5 97491f151982fca1928aa41f6c02dd8c
- SHA1 666854b8d32430b4948138ce953c3438668e25bc
- SHA512 c24b43369368f066325ddff1c5825d404bcdba7bfb0873d09d1b85fe429a2a47a36dbc5a39a4f0e9ebc52523a86bc0d72425ddcdd4ed69d4723e688bcebc82be
- SSDEEP 768:8023wYSh0eEpWRUubCbIuYOdYXOSJyz/2KGxOz2hK1CPpAIpsTxcFZ5CXW1/b+9I:uXMhOfXxqL88
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral10 behavioral9
- Target
  rules/snort3-browser-webkit.rules
- Size 77KB
- SHA256 67a4466f5f322ce05a59d3694fee38fe2b78666eb1c41aa4eba8df95b5e9662c
- MD5 4a45b5948caa54ce90d75ea74260649c
- SHA1 bccc43fc6b6ed483c87eb4dde7db2b1614fe2968
- SHA512 3d739c7e687573c9e7786974e43a9af83524e4c10748f074559e6fd157de79872c2a6c2a429c24c5db9ea9d1fef52fe7de2265ad78da0d4eb7a63511152dde11
- SSDEEP 768:8023sjapAhBafmToMYK/2S7mtfDvYAWiSDt1sOhaq9pU27rj0hIifuh2d4pGUDFx:uB+KtJ9jrG7si
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral11 behavioral12
- Target
  rules/snort3-exploit-kit.rules
- Size 397KB
- SHA256 44711404abb4380b37ca1402c632a57801affeaa18bca8e0d1dfa4bb992ddb79
- MD5 bfdf183a7ee67dde0f2b48ae8ae12ab9
- SHA1 fc5509d20b984c541961d9783783edc3c622491e
- SHA512 90ff33859b97f28751db4e70b256b962997766e30d7561394328716e003d3d0142f6d7b037f7c559eb3e801335cff8d1f28d23c7551d5f3b7707017b552c8f1d
- SSDEEP 3072:u4geRICl2EFIioUMduHrC8L0qIss1EkCiPvG0jpd:ujcICoLioUGuHrC8Aago0f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  rules/snort3-file-java.rules
- Size 122KB
- SHA256 c98e6214a725ce0c43ff0ad328166546f8d88b643f79b337486537c85a3ba2b0
- MD5 b4b74fb54b3416b9ed64d736c7cd820d
- SHA1 c2252d5faabe0cae15a073cd3a48312fb1ab2cb2
- SHA512 8f0713c09ffdb1ff1914f0c6f60dd4eb996a80b7d68f6ccf3b2a7972b1ed08ba63b9424ad2d74e628d8c075a43fa373dd5e84a8dfef7cf7efefa5bc84967dedc
- SSDEEP 768:J/531BD8B8reyLacYD1Dudw9nvuTZWIXUCCPVfbKtpemYH4mNZcNC0Jem7HBYqzs:frwBcVzIkwWmwW3AmoBRoBa52J+9I
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  rules/snort3-browser-other.rules
- Size 44KB
- SHA256 b399f231d21ad7694cf8d33e549f878b6b547aaf686f638ac6f886e388997f0f
- MD5 97491f151982fca1928aa41f6c02dd8c
- SHA1 666854b8d32430b4948138ce953c3438668e25bc
- SHA512 c24b43369368f066325ddff1c5825d404bcdba7bfb0873d09d1b85fe429a2a47a36dbc5a39a4f0e9ebc52523a86bc0d72425ddcdd4ed69d4723e688bcebc82be
- SSDEEP 768:8023wYSh0eEpWRUubCbIuYOdYXOSJyz/2KGxOz2hK1CPpAIpsTxcFZ5CXW1/b+9I:uXMhOfXxqL88
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral17 behavioral18
- Target
  rules/snort3-browser-webkit.rules
- Size 77KB
- SHA256 67a4466f5f322ce05a59d3694fee38fe2b78666eb1c41aa4eba8df95b5e9662c
- MD5 4a45b5948caa54ce90d75ea74260649c
- SHA1 bccc43fc6b6ed483c87eb4dde7db2b1614fe2968
- SHA512 3d739c7e687573c9e7786974e43a9af83524e4c10748f074559e6fd157de79872c2a6c2a429c24c5db9ea9d1fef52fe7de2265ad78da0d4eb7a63511152dde11
- SSDEEP 768:8023sjapAhBafmToMYK/2S7mtfDvYAWiSDt1sOhaq9pU27rj0hIifuh2d4pGUDFx:uB+KtJ9jrG7si
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19 behavioral20
- Target
  rules/snort3-exploit-kit.rules
- Size 397KB
- SHA256 44711404abb4380b37ca1402c632a57801affeaa18bca8e0d1dfa4bb992ddb79
- MD5 bfdf183a7ee67dde0f2b48ae8ae12ab9
- SHA1 fc5509d20b984c541961d9783783edc3c622491e
- SHA512 90ff33859b97f28751db4e70b256b962997766e30d7561394328716e003d3d0142f6d7b037f7c559eb3e801335cff8d1f28d23c7551d5f3b7707017b552c8f1d
- SSDEEP 3072:u4geRICl2EFIioUMduHrC8L0qIss1EkCiPvG0jpd:ujcICoLioUGuHrC8Aago0f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  rules/snort3-file-java.rules
- Size 122KB
- SHA256 c98e6214a725ce0c43ff0ad328166546f8d88b643f79b337486537c85a3ba2b0
- MD5 b4b74fb54b3416b9ed64d736c7cd820d
- SHA1 c2252d5faabe0cae15a073cd3a48312fb1ab2cb2
- SHA512 8f0713c09ffdb1ff1914f0c6f60dd4eb996a80b7d68f6ccf3b2a7972b1ed08ba63b9424ad2d74e628d8c075a43fa373dd5e84a8dfef7cf7efefa5bc84967dedc
- SSDEEP 768:J/531BD8B8reyLacYD1Dudw9nvuTZWIXUCCPVfbKtpemYH4mNZcNC0Jem7HBYqzs:frwBcVzIkwWmwW3AmoBRoBa52J+9I
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  rules/snort3-browser-other.rules
- Size 44KB
- SHA256 b399f231d21ad7694cf8d33e549f878b6b547aaf686f638ac6f886e388997f0f
- MD5 97491f151982fca1928aa41f6c02dd8c
- SHA1 666854b8d32430b4948138ce953c3438668e25bc
- SHA512 c24b43369368f066325ddff1c5825d404bcdba7bfb0873d09d1b85fe429a2a47a36dbc5a39a4f0e9ebc52523a86bc0d72425ddcdd4ed69d4723e688bcebc82be
- SSDEEP 768:8023wYSh0eEpWRUubCbIuYOdYXOSJyz/2KGxOz2hK1CPpAIpsTxcFZ5CXW1/b+9I:uXMhOfXxqL88
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral25 behavioral26
- Target
  rules/snort3-browser-webkit.rules
- Size 77KB
- SHA256 67a4466f5f322ce05a59d3694fee38fe2b78666eb1c41aa4eba8df95b5e9662c
- MD5 4a45b5948caa54ce90d75ea74260649c
- SHA1 bccc43fc6b6ed483c87eb4dde7db2b1614fe2968
- SHA512 3d739c7e687573c9e7786974e43a9af83524e4c10748f074559e6fd157de79872c2a6c2a429c24c5db9ea9d1fef52fe7de2265ad78da0d4eb7a63511152dde11
- SSDEEP 768:8023sjapAhBafmToMYK/2S7mtfDvYAWiSDt1sOhaq9pU27rj0hIifuh2d4pGUDFx:uB+KtJ9jrG7si
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral27 behavioral28
- Target
  rules/snort3-exploit-kit.rules
- Size 397KB
- SHA256 44711404abb4380b37ca1402c632a57801affeaa18bca8e0d1dfa4bb992ddb79
- MD5 bfdf183a7ee67dde0f2b48ae8ae12ab9
- SHA1 fc5509d20b984c541961d9783783edc3c622491e
- SHA512 90ff33859b97f28751db4e70b256b962997766e30d7561394328716e003d3d0142f6d7b037f7c559eb3e801335cff8d1f28d23c7551d5f3b7707017b552c8f1d
- SSDEEP 3072:u4geRICl2EFIioUMduHrC8L0qIss1EkCiPvG0jpd:ujcICoLioUGuHrC8Aago0f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral29 behavioral30
- Target
  rules/snort3-file-java.rules
- Size 122KB
- SHA256 c98e6214a725ce0c43ff0ad328166546f8d88b643f79b337486537c85a3ba2b0
- MD5 b4b74fb54b3416b9ed64d736c7cd820d
- SHA1 c2252d5faabe0cae15a073cd3a48312fb1ab2cb2
- SHA512 8f0713c09ffdb1ff1914f0c6f60dd4eb996a80b7d68f6ccf3b2a7972b1ed08ba63b9424ad2d74e628d8c075a43fa373dd5e84a8dfef7cf7efefa5bc84967dedc
- SSDEEP 768:J/531BD8B8reyLacYD1Dudw9nvuTZWIXUCCPVfbKtpemYH4mNZcNC0Jem7HBYqzs:frwBcVzIkwWmwW3AmoBRoBa52J+9I
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32