1647d3f6a9c692b31221b010c5a9bba7b1316741168cddcd4662f167cc72cbea

Sharing

Copy URL Twitter E-mail

General

Target
off.zip
Size 4.7MB
Sample260417-w2k2rafv2k
SHA256 1647d3f6a9c692b31221b010c5a9bba7b1316741168cddcd4662f167cc72cbea
MD5 8c1d5c21102668591a5990c2bb3dd6e5
SHA1 b215090bcc0412e0894f86058f9fa51d1bc0da60
SHA512 dd278bd56ffce485bd823ab67de780360418d4d0ef55a6640c97970c8058d453949f896ba58e3621ca3409fca78221ec20d6f3503feaabc70e412cdf1bd145ff
SSDEEP 98304:ZTANooVr381eb42vEjwWpcoQVPnZSaqzB1E:9ANXMMXvEjwSiRC3E
TLSH
T16136336EC4024583C29E173260C684C6279FCEDF774E9FAA6B6FD2443809591E7BD1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  off/fonts/arrow.svg
- Size 506B
- SHA256 bb09c2b3c592d4c96f46ca91c2647144f30ced097b10c478375aee08b94a17bd
- MD5 38155616e0fcf71640b672d13fca2730
- SHA1 7a32fd71b6fe9ea29e15adf8eca979b06be07496
- SHA512 f63d1896df2004ee83ca5e9cc5b2cd749678978d54ac2e33cc71a6cb4996a2502683529f06a1e4e2b7b1b162240e6c086c7c19023a7ac684030b1c64882d7959
- TLSH
  T194F09E8A8645D87DA4258775E7F867C3A37031AEC2810E8C91B53D77E2A54540786BD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  off/fonts/fb.svg
- Size 591B
- SHA256 eeda0347dc65f89ce6126cc80de6313ef7991b515efaaa5b264b47d0c19eb5da
- MD5 5b704c3ec0b6dd27c31c513c564226ba
- SHA1 79c10a5a518ea183bc1bf7ddb0f5b5302ff309df
- SHA512 afeb58b7e19d9fc295b930ac70f37b330ca4f08a511679dcae68db89b00a5a794bd3546657146e74be8f0ad9722e02aaf9cde7678f2c378e228d1b2b1856f0b7
- TLSH
  T1D2F0E1658746C8BE70354234F3B86BC36330748AD2C50ED983E22DBFA5694B5164D7DC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  off/fonts/in.svg
- Size 1KB
- SHA256 688f8717f2c9a442fca0b0d9b5838aa1c9d69b56b911f3c678df2027f22c1fd2
- MD5 bf51e4b282ee8139b833a695b6741f9a
- SHA1 31bf6e7f1d5a7d3fa55a1f3dec7297e65f4ed27f
- SHA512 67e6326bb07124d51e8f47cc220910112ea352b522ecebbeec281b32c1b45353592241c3db1a59bc42721a6e3e99bdc0d8d73110b6a08e9e77318dffadee3fb3
- TLSH
  T19E315917030983DEAE6D1418DA54618A73A8E58BD9B4E4D0BFA75D25D28C4E4BA0D3FC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  off/fonts/logo.svg
- Size 542B
- SHA256 ac67852f1625b338f9d1fb96be089d03557d50bfc5790d5f48dc56799f59dec6
- MD5 29e1a8e117fc5d252ec91c4a5eb7d61a
- SHA1 f53cadec533383271ae701f02a6af073f4ee3e36
- SHA512 bf2a034fd8c49c10aed6da73a9fac664f72712183b0c1ec32f65227c573eb7a28450238bd542f0770e6b1024d2c7cd62005b7f0afdc1b151b7fe3812b40608ad
- TLSH
  T1CBF0C65D8159DCFD6410C70193F456C3A77031DAE3D50DA9B19B2DB5F25544446427D8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  off/fonts/ok.svg
- Size 992B
- SHA256 88c90a73a6d3e166735a5e20c2248636e872c02ff6b2d721d2d1cc1af8b98d57
- MD5 3d587b4987e52c7c81ebf45896f72d3f
- SHA1 79815b2865c6d8670cce5ee91aa560d24fa00e3b
- SHA512 a5e4cddd9b495026921cf165d7dd0b4983edbff879b0a5a697137c286be03998b08c55b48fd5ccc1b501c7bc8167f433bfd8583f28153ede3c778246e3b5b146
- TLSH
  T18711B1574701DAFF7A954124F6942181B3B0F9D7E4B0A8C0DBAB2C76D48D4D1164C6FC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  off/fonts/search.svg
- Size 776B
- SHA256 635e469c445b5332771e9b392f53ab090ab8236de40a64f903725009bd28c914
- MD5 dc19d3692fcc99ff8469e4b06848c7b8
- SHA1 0b49c1f94573e3ec61622034b65cc1afdd69939d
- SHA512 30d458d7af94d6a998d9dca2ceabf03952bf0730e8b817db6c1f7ec474a37822e7b085add26559f5bf35612b5e769e5b5291c0371efcd0c74602d20edf77e002
- TLSH
  T19D01BD164309D8EC6A1DC724D6B8618653B0F846F1B8A4D4A1AB2875EBCD4C4814D3E8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  off/fonts/tw.svg
- Size 898B
- SHA256 38674d48d3aa0e2791f77ecad5a7895dc813f3ccd5d84d7ed5b0454ea1fdd76c
- MD5 13cc73de38a80e48f9a14f826410a0e7
- SHA1 7c710d2054ce18c8878432b01b071d07da77282b
- SHA512 c8c394abaff47bc715e9aca46b8636c70c49792c93208cb4b5e45c2fbc968f2c09086660fabd72b2f1994a9ba889405f5348cb76b6f0b1287e13d1ed1ac3177b
- TLSH
  T13911041A0705DEFD77644354B2AC3A4673B0FC87F0B068C463A71C24E6880F5628CADC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  off/fonts/vk.svg
- Size 997B
- SHA256 3625575f914d0ea3464222b1e382674e4b6186635c28f598a83002491196b66b
- MD5 cb0032d744bf7635e9d760d9d0e613dc
- SHA1 e6506ecae8f0dd1c731e242fcb39f763182de557
- SHA512 60176476ff28cab6787cc4e68cf0ed602e8a17b544c8e64c5ed2981ee7f67d968f382003be59193dd5f7371f2284688510af869b11385be283ef01dbeb9d2005
- TLSH
  T1B411E1560307CBDF78EC5634AAAC11C522B0F8CBD0A059C8BB935476E0DC0E5574C7D8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  off/images/bg.png
- Size 139B
- SHA256 5d1d75b702f13e1bb14ff8d52cac1690acacec3a15821af7fe482a79afda5b99
- MD5 5a5e8efb2b060a20e1e745e3f0115664
- SHA1 72f17dfd86e34d991d94ebfd967635b849b56bd0
- SHA512 cf6d17f2b9bea25b76e6a9cf3e86d96d234f223f15ca09c276a64c2816c64978ebad8e817574e39651a61e8434f656b50680f08d4632834900de207e95bdcccb
- TLSH
  T1A2C09B5D755366449913155167C33641D196837F68DA84510942C593F0CF69AC4C73AD
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral17 behavioral18
- Target
  off/images/button1.jpg
- Size 139B
- SHA256 5d1d75b702f13e1bb14ff8d52cac1690acacec3a15821af7fe482a79afda5b99
- MD5 5a5e8efb2b060a20e1e745e3f0115664
- SHA1 72f17dfd86e34d991d94ebfd967635b849b56bd0
- SHA512 cf6d17f2b9bea25b76e6a9cf3e86d96d234f223f15ca09c276a64c2816c64978ebad8e817574e39651a61e8434f656b50680f08d4632834900de207e95bdcccb
- TLSH
  T1A2C09B5D755366449913155167C33641D196837F68DA84510942C593F0CF69AC4C73AD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  off/scripts/globaljs/sagihhsoghoaghouagiopafioagiiag.js
- Size 707B
- SHA256 7fcd4897949c0b73d1f4f2b75c5b4bb443b87b25cfe89d933c1647c982d203f0
- MD5 8e411f65af825c6c3894d97ae66adbd2
- SHA1 8f0d53c674f95b06357896c0f2f654a9edc09d58
- SHA512 e24514ebc046d14367ba52047b1b2f4f2c0820af1d580daa7dcd13f5e1e20560144228183ed3ad03fdbbd11e94f2d5128a9b1f3e5294bbdb9a8e9033028ea9c5
- TLSH
  T12701158D5494631CA1F7F09448FF670527762957B70BC768C43806BE7EE013B7A0152C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  off/scripts/globaljs/sagihhsoghoaghouagiopafioagiiag0000.js
- Size 866B
- SHA256 80512235a3d91eae3ebdbc10752567d3e770991dc13147b1cc0278622207a4c1
- MD5 5cc8721361c8efc7b6fc508f91bd581a
- SHA1 ca9a6cbcba7e0a6126a75b8b437f06672870b1bb
- SHA512 69615cdbf9a5ab0223920e306c986c42d808ad9c23c64819ed2ece69b11325fe9b47ab82943b6f228924d324c0dd340dc8e1b880142f1f1df1590115e31a6991
- TLSH
  T15D11D64CD16C2D68D4AF42A2E50A900638308D3FF09529A0B46D357F8F87790932EB69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  off/scripts/widget/ruletka/script.js
- Size 3KB
- SHA256 cff4f77effae626fd3fbca304a830aad65a22254a198e5125ddc7fb7b646b5df
- MD5 2d70f87f9e868e133a22c2a5522587d4
- SHA1 dd7a25c9d61e37f9e449ca9a05de155e7feb5212
- SHA512 49287c3e51f2566d7668e64ff6ac990e28f97ff6d40a18d66f5c5b4fa9e7b48b8f3282b3eb13e674002f1fa76fc7d247b619058efe0728a603a4f4c81f1cdac1
- TLSH
  T11E71214CA9F65558453FD0BB876F810838B4003FA08BC95078AC6DBA9FD19B4933EADD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26