e6cb71fdef1cc0e3d16ddc2401772b23b8eac1d89fc4b60c2b3b435e368535ab

Sharing

Copy URL Twitter E-mail

General

Target
php-8.3.31-nts-Win32-vs16-x64.zip
Size 101.9MB
Sample260508-l8a51sfx2x
SHA256 e6cb71fdef1cc0e3d16ddc2401772b23b8eac1d89fc4b60c2b3b435e368535ab
MD5 6176ac938f72ea0ad6212ce0703ea997
SHA1 9f08d0bbceabf954a02fbd23bac44234874dd029
SHA512 b504598ce25a8484ab8692c638f357249d9c29cd5f475df05ee17924e8a1113d1b3e2a310f1c3ecb28afe5dc8d877519dfb2da51ea1831b15d69f799e83dede0
SSDEEP 3145728:Oyny0yOlCCIvU2Z29hatUuIJuMFCVuVT1XRL:O0y0yOlCddZ2n2T8J1tRL
TLSH
T1483833DCDD717203DC739435AEC6B88A8A9647B7C68688B97410C38798D3FE58B1391E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  leveldb.dll
- Size 566KB
- SHA256 36ab84a6b04632984d3eed2473e3b8b5bc13104b72dd45b5305a80449bf85258
- MD5 be8cf35d7cd4c88ac92b29d9e03783a0
- SHA1 cd271d8101fce64f58b497f25203baa97b8989de
- SHA512 93a435e004ef19f919aa84ca8211875f2e0fd6cb405d26e7c4867a00a487ccb8339a8a3a544d955ac9bf207f9b5b934a9a0038cf5d112013c9ecdf4f546c350b
- SSDEEP 12288:/OzMd795m7J69Sg9uEwRS/Z5fKOPmoi+MvgM5Eco8EJh7hAP:Wk795m7J69Sg9uEwRS/Z5fKOPmV+Mvgo
- TLSH
  T153C47D1AAAA44779E067C138C9678A42F7B2784A07619BDF03E0467A1F677D05F3E730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  lib/enchant/libenchant2_hunspell.dll
- Size 464KB
- SHA256 a36c34aa22ec0d718bf2709d76f79365effbe238292c7800d678cb9ea0ae58af
- MD5 492fc6fadc00402cdc90599aab630763
- SHA1 a4a5fb9c42b6d85518bef69126f6ee534e547a74
- SHA512 4305975a8b84601fba0fcc8255461dc7118eda3d1e49cccd97e26b4ca114b92917fdb964459639d3b7654e2a018119d241c2cd9710d78d8057725e30669365fe
- SSDEEP 12288:NE82kBAHEvlAs6P9jEGdYFAPsByypqSFO2y:j2kBAHE+s6P9jEG+F3ByKqSY2y
- TLSH
  T1E6A47D56D1D642BDE1BBE278C2576E86E776700B436089EFA3D08A311F86ED02E7C351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  libcrypto-3-x64.dll
- Size 4.9MB
- SHA256 a0e46ff48d86c244141f4c11bd90fab7e4af14a106837cfa7698de9865dcfba9
- MD5 2aa9a4708df5df85177c586e84303762
- SHA1 0f45e7ac978f17baa91c0256bd48feaace76159d
- SHA512 b1673ba50c347ccb2a13cf8754154c9a1b8e8b0ea89628e5f63f4331356d1f969c62a36ff7daa68faf7dda978e1849845a027b8683280a072860fb141aa6ecbd
- SSDEEP 98304:ZC+3vvykDl1m+Hf3COP+1CPwDvt3uFlDCk:k4akDlA+Hf3COW1CPwDvt3uFlDC
- TLSH
  T15C366A6AA7A80149E0BAC13CCA534623D6B1F826577097CF19A5967D0F33FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  libdb61.dll
- Size 1.6MB
- SHA256 cb373e0695f86a6a7ffadc5b71c331e71f0036f3a18221243a267ae2d12b149d
- MD5 817235e6472a0982b6c894ee255cc0f1
- SHA1 9a40608648dce924a9449594094284bc901f2e32
- SHA512 f53b549b40463ce583cbb312ae8f3dfcb13968ce2f71fd3739feb92497469b00dbecda33debdcd0570a304421a5ff9a0f91419b5bcc93dc2e69cb69f7c27a66c
- SSDEEP 49152:u81HnnlkPSahkXAYkyuKhkrXOwQ/jSl9VB:dEy/Mz
- TLSH
  T11E755C52A7E904D9D4BBC778860B5717FBB2700627245BDB42A586993F13BF2233E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libenchant2.dll
- Size 41KB
- SHA256 3ab82ce56ddf53f938c0ba7bf8bc9f64c40ac3ba7a99fb60a3e7b435e314991a
- MD5 bd002a5c73d47a875ed491191b231707
- SHA1 1ea6cea8ac04afa4f454ab912b5c743990f01992
- SHA512 1f2e184135fc1e69ea4254300f79553a46f10a972d2c8ef87b8bb040229570ff704b6b58807847f7470e461943abf5b364206b225036627907f31d07d78910dc
- SSDEEP 768:NyBFBd36dyXiPL+rWxCdhnp1yYjm7KS0GkpuJ1yD2HFGx:0BHd36dyXSwWxCdHgmkkpxD2HFm
- TLSH
  T166135B86D30410AED633C179E679B646E2F53062235197CF1670C67A2F73EC62B3AB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libpq.dll
- Size 283KB
- SHA256 e3ad50c1b4bdfe37f62539c8a8386100933c1273981c54fc748669f5b01be419
- MD5 d448812c0806981e7e0587e8169cf6f2
- SHA1 e859313f5f60e2b96a4470c2ae10f134c4b2c535
- SHA512 e8a727d49f5e2785c5d6b1af63e303e85ad65a2ec7f211901da59cfd32097e8fbf8a0a5ce72ef8da448ccacc51bec9576917ea07577a58414aed321a00b7c59a
- SSDEEP 6144:Dq/XnHBwK+f9ZO/immLqUfI43z7U8r7apSOOB8trbs:rf9ZO/imm+uQhO4s
- TLSH
  T1C0544A06E3D128AAED1BC73D8647C517CA7A78550321CBDF13949A393E037EE6A39316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  libsasl.dll
- Size 104KB
- SHA256 84bd4c145873a4df7778e3f2dbd12fe1d8ee6fdc14ea4d03820a54dfab69064e
- MD5 5d294146ab8642cbeef0d0ee19e6321d
- SHA1 bbdd6b2c92faa3024948102666719c1bbf9d81d0
- SHA512 2a5770960c78eaf0786e350337c27326a0d9eea0e223421eb50b22f02e48b079bd36e685e39b10eaa73a502e298f6e8e2c3f5e6583a49d09e55b828f04b64524
- SSDEEP 1536:tCpWoBgkQXBVyUKNSVpC5/CT4Yqeolrxe6ZqVb82HMH:t0bIRHKNAY56Tjqjde6ZqW42
- TLSH
  T19CA35B57B2A510ECE2A7823C86734607CBB6B4157321A7EF16D0C62D1F63AD5AE3B350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  libsodium.dll
- Size 294KB
- SHA256 e65d72ba1266ce79683a055a22ee62e783e1cc8c597ecfa3e2658d5ff489219a
- MD5 1ff19eb429713bc1e686126284d15a3b
- SHA1 bb26843ad87da1d8c7b637ff88a98ba68e418357
- SHA512 d4104af3ab70c30b0a5cd89a58fb3e73526e2045daf482bbc200e4d989d6e4807188be6654fc3ad6588786507f5642da2e07820e6518453370deebebb71997d3
- SSDEEP 6144:an8XoKkFk0E3Tvme9VRM001YsMFXbIOlE2dV50DEraM75Qjj:an8XoKkFkvrVX8OlEZDHjj
- TLSH
  T115546C5EF9A9A5E5CDB3E0BCC1BEC69AFA65380C43E417F7239249442943BE15138F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  libsqlite3.dll
- Size 1.6MB
- SHA256 79224420393e69f8899dc594f5fa60c1e326cef6486ea119a5f4af3cc383d3ea
- MD5 35c720c36f7dc50bc90934761ff6c23c
- SHA1 060841094489fe4dfc0eb528282301b6b0028a07
- SHA512 381fa41bb148e7b59ee1685034286f4f2a5a6af1ec63497972ce875b3dac29b6dac9948de6c937cacf286b480bad9214772eda782e41a7113b5ba5309bf5ded4
- SSDEEP 49152:wgyipm0usGkuMqVQDxfHavaaKc0PUFvYnBwdK7ZxYL/fw:wJe/F/avdKc0PUdkBEE
- TLSH
  T1B5757C47B3B9019CD56782BCC6179707E7F170052B14ABDB56A08AA92F23EF51E7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  libssl-3-x64.dll
- Size 758KB
- SHA256 ab7c802ec807c7fda08f63261d7097a4590066b3565d968cff6062d55b1e140e
- MD5 488f2e7475e25aabf545bffa3248d220
- SHA1 14991e9895a77172a73f59531f88fc89ca24fed3
- SHA512 12437fe8608f1d9bcd08615a360ef52b66ada2c4a2d71d65de1f05b1ebf8ced2dec1ad982f9d0d234702d467939cb9a4b8e4bd19dbe0f7e922fe19d5ae9a1add
- SSDEEP 12288:OY/+Lcmf4mg0yTLApas3u1K3A9eFe9Xb:OY/+Lff4F0yT9sIK31Fe9Xb
- TLSH
  T1ADF44BADB3B8059DE9B6D17D86534623E3B6F4152330EBDB0650867D0F23BD52A3A348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  oci.dll
- Size 790KB
- SHA256 59a93947d843dd0e1074b8618a1f5d560b9e873cee2dd65e2e8d96f57dff5789
- MD5 d192344fe4a988e1ec6588a6fb10dc6d
- SHA1 7e6ce7f3164403bfbf18a4e137dba5403d0fccda
- SHA512 7ffdd9a647382dccdb7447cf4d719c0d4ab0bbc0f25ab747d2870e6d98845cd1b73e8354052f4c34855f382261997d2df1b9e4e981991fa54c91b0ab66464f30
- SSDEEP 12288:x++8KXG5QHHtCs6qaCyiPNiaVlDbFP6NKGC6gAIJTVPA9:x++3XGOHNiMyiPNBlNP6NKGC6g3
- TLSH
  T18205C636EF947265FC0431F8C522B92AC738D0513A99AA4580E19F966FE5F423F0C7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  phar.phar.bat
- Size 43B
- SHA256 ef0f0bd1e919ee96c7d20547f7a823218cd73452f36c47d1a22f2726d5d64308
- MD5 9c8d6858fe19259b1be399080be8608f
- SHA1 caa83d1d0aa6865e6a357aad820c45ee19ebdf8c
- SHA512 9585e997a18f306dba6ee8f35dbfba17d4f782f613a65038db1bf1ca3d3ff4c2b58f4b41ce96153d12c4e2927f379f7fe590635f5812c9553e303a90aa25e220
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  pharcommand.phar
- Size 64KB
- SHA256 ef8a93ca2a69b8dc53733fc9f4020868712702755bb9f6f6d6dfb6d51a717455
- MD5 888768a2afd2ccfebd1e59ec444604c1
- SHA1 367a03f23f38ba766484e8bd5e7ae1c70161258b
- SHA512 c910730dfae5d292522ac3185cf89e980d81e48082f219e684b2a2648a4bdc89449adac4e75502a3ed90d2ec47cbde8f1bb10b3203f4abd2d8114f40048f8fb8
- SSDEEP 768:HBx4vdbSm8dxT5JAxUDd3mqsEZ+ODgx9KlT/65K2KqKHyaqp:HKss4gr065/JOyJp
- TLSH
  T1AA53731A38FB692311173039479BA049F139521B125DDC023D6D27F8AF662BDCBF1AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  php-cgi.exe
- Size 66KB
- SHA256 3097106665914793f97e99e9862e122627f22e20c383ba45f7b3d0bbc43d8587
- MD5 8876da60f8bf1c2a8e850140d3532acd
- SHA1 0a21cb1924745066feba151648a61c49afb7542a
- SHA512 7f4c123ff88f7b5bb141055209cd983bc9ae879984c52ab9ca14d5d0ad8ab63965b0ba06e97907f17262af6b85549ada1da86bf662e9e507a9698ba405c3e122
- SSDEEP 1536:Wcb94iSzo414RRd71zRl/gavO7DoY2ugDppf7Wkw:W894iJRRFRl/gavOHo7ugDppDnw
- TLSH
  T181638E1B638500DAE5278734C1735253E271F862272057EF57E8C96E0F236E9EE39BA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  php-win.exe
- Size 38KB
- SHA256 6cb53e2c8d6f396e60efedbd668140b0d6b33f623d421bdd10801dc89123d23f
- MD5 8000594ebb4e1065bf45ec65d42860c8
- SHA1 060131a84528b529905d262560484cfded2bf5ac
- SHA512 c1ef8fab150b7b2698802fb46c7a77447ba103bf1ff9cdd8994cd3a3eb579a9ec5e8107c93b1a41a60c5cce3b1b286244aba72d34601d29f83f4dfa55d6dfa72
- SSDEEP 768:/g+jcqsnEWv356922FGMlJA4Zyh36Z5+k:/g+jcLEu2FGMDJo3M+k
- TLSH
  T1F403280257A100E9E15AC379D2B32AA7D9B4F4575324A6FF3EC885541F22BD8DE3392C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  php.exe
- Size 141KB
- SHA256 0e19eec5c31dec194a9acf2dd2f08acbbb868ce74ac606edef991d3aaec8eb3b
- MD5 3351d30470033630fc2758d064fdce82
- SHA1 af5f142d1e3bdba10f15d292b595dc5f281d9108
- SHA512 b385d350cc298c00af854991fb581aae6983002563d9fa7b26e5dd761742ea43323f3f18dd3f8ffa123c95dd57c8012ec0f0ea55b749c2fa5b678cbbcb5921ac
- SSDEEP 3072:z+KISw16lW9cG2XYY7qyvjL61jM+QYLPrjJgzBh3Bpi01i:z+dclW6rujxQ0Pf6zb3ji0
- TLSH
  T1B5E308D7719230D5DB97A13E88628192B772F53D0B9093DFBA94C0290F062E85F7762E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32