0a90a60bfc76acb96fcb59f5c7e19f3e897ee0f245f12fbbbbec5da32e68b20e

Sharing

Copy URL Twitter E-mail

General

Target
spot-stream.zip
Size 486KB
Sample260528-pfdl8aex9j
SHA256 0a90a60bfc76acb96fcb59f5c7e19f3e897ee0f245f12fbbbbec5da32e68b20e
MD5 cf2a1824046035d7402ab5a44ca14b52
SHA1 67a6a85e29513c0f47785492607ffa686c6b751f
SHA512 45652445bb67a6e208c2124337fae4f09c2ef1a4c179fd6679f71b900dfbcafdf79ea07eca1850240696b7a4287f18af182f53389ebd05d2eb482798eb014820
SSDEEP 12288:SeQuvaJ55AEF5/TYSWHwDT0JFqRaLu38nJh9W:SezviTAEFJTJ5TzV38Jh9W
TLSH
T1C3B41279F51100DBD81BD6F8AE482F44C6EDBF435043BA1B5BAAC48EE5271873778889
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  spot-stream/panel/classes/mother.class.php
- Size 3KB
- SHA256 df3c164b68d60176295e7c5ea67d04dd4ba54d3186ff5c89d93db6da71023880
- MD5 3a6ef989f90d9350e363792c7bca3db2
- SHA1 bf3b4b1b602af9127a7bb0bfd8124c114cdca1c9
- SHA512 594ce3483f3b1bd8855a2b58acae37355226b3e0c86c7d53e27d18926a9d92d1284eaec13f55088d4939f94636d201995d2e3091d0ba2ff4f34a02fbda14df07
- TLSH
  T16571424879AB2EE4B13720AD072FD4423875A81B6C0D9501BC9C4BC82F7835F76B5A7E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  spot-stream/panel/process/lang.php
- Size 68KB
- SHA256 a5897b7c23edced547d3e330da6511a4bcd3daf27371a667a33da9b6c11cc7c1
- MD5 99ec0f8b6fc3f4549e241f5ad2ee1fb6
- SHA1 af8edce966e07402cd79d5c0a337fead2f47c8b4
- SHA512 f6dad01a3717b80f96c27d1beb62e7b9c9c640c4a1e7a704503f99951dce2e2b79a6e0cd02b6b73e2be8b99ab8a41ff226a908443fad5b5f8ad155b9d6e66677
- SSDEEP 1536:WDy566bVdPc3Iuwu5avVkOs2f0gmSoJRzRSnTkBlo2KyRQC:gy566bVawu4vVO8bof9SnTkksQC
- TLSH
  T1AA63C56524E358329623B9BC07CF540879A6811B8148DF457D8E63E8AFD0478C9FAFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  spot-stream/panel/res/jq.js
- Size 87KB
- SHA256 ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127
- MD5 3e4bb227fb55271bfe9c9d4a09147bd8
- SHA1 156837f75f6600ccb602b4efcbd393636c33f35e
- SHA512 f7810ef9df875a7fdfa7228f7e2f95dd34e18b57f56a46383198ebcc591e32f633b0d73cc6b271fbc669347f7fdc114cce6a6b43681104b25084fe2a1e7bee49
- SSDEEP 1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vN:eIh8GgP3hujzwbhd3XvSiDQ47GK/
- TLSH
  T1589309DDB2C6702257A720BA007F510BF236199D6C4D8450F169D8EABC78A4E827BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  spot-stream/panel/view.php
- Size 6KB
- SHA256 88ef86e51a77374dfe1d8e3258d44cd0e89eb94db21094fb1276f14b34f0f196
- MD5 fd9099779d588c22b4a0aae710077360
- SHA1 61de0774e582cedaa275d6fdcb7865233e35d05d
- SHA512 b10b9df6b166165d83c71dbdd342ced676eb0f137a7dd56bab79e2520ba3a11a69473e9460bdeac270de7d95844be5540044ed8381102e4252c6b38c05990ab6
- SSDEEP 96:PXd8yyOIjGQh7hyBxmYT7eO3YQ/WyQh8Jo/W8tHoSAVOs+Xti1i6ITvGD2vR:TypjjhcBUmSQqBbJM6uqvR
- TLSH
  T11AE1972AF0095F3B50B740A4711EAB2638D1561BEB4B1905F6FC97E81BC9ECFD41624A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  spot-stream/web/add.php
- Size 12KB
- SHA256 da42c6d0d01f33f13d4623028dc334b8cebd196d6c28d8f00740cb2e73e16b78
- MD5 54bffd4d19699796396a1be4f2cce18e
- SHA1 de0580441533606bb2f2abf435a5ea759316fda8
- SHA512 ab288aafff399505f13e73856eb5f6a52eef048dda18e519b1da7b7ccacd673c080f76cf98c7180811de30459041ed7836d110300659fbca0f96ea43f153f6c4
- SSDEEP 192:RQf9R9P+RbTN5QuXklFYczUYBwTkJTNak7:dy7
- TLSH
  T1B742740A955448498033D3B99BF31358F9768053A7478E687F9C63C39F76E48AA27FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  spot-stream/web/cd.php
- Size 20KB
- SHA256 14c0ec3ff884adb72a89fd97d6440d26764ad6ffd37f8eaa021973e04dea162a
- MD5 6f56928c616089d9cd595ea2ee1388b9
- SHA1 cb6de4621552d21ba1b7172d8818ef2ebee4ba85
- SHA512 9830fd987ddac5be135c50d18612171d83579bfc02d6733bec2c42fc74a148382c3769223eb0ce7ca38db19e14ffb5010aec201b24752b7f7c192ebe1456d2c9
- SSDEEP 192:1TOsTE4tJSUvRypQyDxJC1n/rxJzFPoYN3gos1YuJ9eBOBQ/G05OsPvtk1hqcdX8:RZVx/tHBnorJ9OOCCsPvtBcdVTdr1jp4
- TLSH
  T15D92401AA95400566473A3B99FB2574AFE7680539303C998BFDC63820F72D488E67FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  spot-stream/web/connect.php
- Size 10KB
- SHA256 3a7e1d7f83d293fe96f6072c77d619f00aae2df1b1a3b5b3976d72d9d20aed19
- MD5 f461751223dc181e9e25556427d89807
- SHA1 54186c21e58015ad26a0d6bdaca339be573ad368
- SHA512 bbab27c3f8124159cd479857ddc462ab96b3322e32f795fb92afe838055166e0430c42d1f443998c2a6cedd8ba8ecdb93cf2abd4c891eac00403e569199b9130
- SSDEEP 192:gyTOsTq4t0AndpnVC0eFnc9RdDD4YNl9Jj9jJxavEw:gGXnAVnEjOvEw
- TLSH
  T16E22011AE1804446A433E3B8AFB29B45FF569053C20289647EDD13D74FBAD09D927FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  spot-stream/web/exit.php
- Size 9KB
- SHA256 205da40ecf89b6c68781ea1fdbe5079725fbca6784e5f74344dd23ae28511f92
- MD5 404f46171f34fbb9997205d7e87a4de8
- SHA1 af20485cc9ab68bdcbec6ce27140f54e4a7bf120
- SHA512 8e6163f5c974fd36f02141ec40a543629f58aa2aaa69ba74685cd16de80c2a409544e1e165dd6481ae7222b9984226284b10a676b1abe7dd149016f833d44136
- SSDEEP 96:PyzBETOs+UFxq4tvozc/crKux93xcm5xmeuUYxEYNl7Urm2UjkwH:zTOsTq4twYkrKWDdYN+rGj5H
- TLSH
  T1AE121E1AE59000456833A3B9EFB25B45FE929053D30689647EDC238A8F7A948D853FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  spot-stream/web/img/apl.svg
- Size 913B
- SHA256 fa173bbfc674f749b4c6275d1e270993407180b619e8c85da1b25dc4280819cb
- MD5 e356139ea90852da2e60f1ff738f3cbb
- SHA1 6b6335b37cd02812c18c2931376c5e27ac357438
- SHA512 d4b18271cef98513c8151526973c2d0bd56cc9671036b20162fd8acbe720e6fb33417144adea6dd3426802dd411a64eb9ddfb7f703cf16d903fbae41fc6dcfc7
- TLSH
  T10E110CFB9B66A0D1DAC6C764EB72520F72B6787A1FD4CA05C5B86F08825048C868F870
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  spot-stream/web/img/fb.svg
- Size 536B
- SHA256 a315bf64477d20afda420228d40f906275b0c2d5d8539833fa19dbc5489fac9d
- MD5 eae8e1b6256f7ccf01cf81913254e70b
- SHA1 1213bcb252b1a73906b0dee0c85a9d81809c0deb
- SHA512 d30b1880d11fc56a9ec8f510b74e9c789a86284e12084706e2592dcc3ebe520c13ae3b1a6ba75c0b290b451c04037da90dc1add6fd935066de37fb75f590f395
- TLSH
  T14CF020F49F9CB3988640CB39751CB01839AA3070294F4F08DBE81A28C71956A094EA40
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  spot-stream/web/img/go.svg
- Size 1KB
- SHA256 2998e21de5d77c5c325adb584f547923566040bb1425e20391a6a5002ec82ad3
- MD5 72fd940a229bc94cf9484a3320b3dccb
- SHA1 2bfbf17a23fd0e2f6c1d73d03b37b66116caabde
- SHA512 a18bc288e0005e9a1670e0da8804c5aaa25ba78d25e2709799423d03dc1a7594d898c2d4f66060e0df2ac0cdac3c7b447c97007b97cd52e79bf6cf719779aa92
- TLSH
  T109217BF655D496F18292EB38C63CFAE1342D39AF396A0A4895E36D143F5027E9C0DB84
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  spot-stream/web/index.php
- Size 139B
- SHA256 c0c4a994f2157960e9e326d23e79e6a847b0d839336fbebfdcd352ce42e3b05c
- MD5 951b4c3c543f800a48b30069e00b0207
- SHA1 0376d9187fab3f46758004c3ffc7646500529cc4
- SHA512 ba1e3409bcefed14a904fb2feb43cdb43a74a4bf1eac36958dcdd90af6a82e299d7553f1a93971d00de2cdd15ef7020a0b0f14500a4f841e92b0d5b3726602b8
- TLSH
  T1DDC02B9FC187230FD41020F03DC112D15A8C032374B246303D80541D600803DC9C26C9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  spot-stream/web/js/aff.js
- Size 14KB
- SHA256 c929243edf594a4964f8be677d3639bf65508bbecd2a237bc454219a4263af9d
- MD5 8147e9dc61b61fd8721bde15c1eb27b2
- SHA1 929a512f9778b8807d5b9b38f06fc0e9f7db1282
- SHA512 19b0f0b613ed9dac2986154cf0be8179c083b2593530fceec929379a0e1e91f58a85a0732155cc20543edbcc99c075abfc832611e6c1d5d240e4e9581fd66dbe
- SSDEEP 384:55ij7KGO3jr5S3m7uV2drmcKyv1lcpLIuc:/oKGOH5Wm7bScBvD0LIuc
- TLSH
  T10C625229E4A00E9B96D1928632C23A9671249A175F84340C7354839C1FDFDFFF1BA69F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  spot-stream/web/js/done.js
- Size 6KB
- SHA256 ac20e0a49cb9004ac625fda25eab964eefec84dbd25a14b20145d9d9bc00e54f
- MD5 41bbed5bd2bd2def1ded0217ace190b9
- SHA1 4742ee67419c49a9f36cd4d0255facdcf6b80f21
- SHA512 311e08b719a485b0b15ffbfd363e6c25b85d99d12ce4d78c20774fa78f5e93118ce201e96803e55745cac8efb755c809fe9a80e7955727922c001e6b4a8b2c6d
- SSDEEP 192:PBIJHjGVAEkLS0rMSSqrisv8xXlNSTpjLI9U3l/yIdN:5Oj5jr5SqrNvElcpLIuV
- TLSH
  T1BEE1B82BF4B009559696604A31C61D81712196437D48B829B78A83280F9FDDFF1FBBEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  spot-stream/web/js/jq.js
- Size 286KB
- SHA256 9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
- MD5 1150e561f02aaa2a237a4f200face65d
- SHA1 6afaec62e997d0a42356c71521ef0d157b506757
- SHA512 9ceef080752858f60608dae2c86cdc1703d217e6cf0ce47e36fb4e632db031c5a4ae708d3ca05c144914f345c8375e145636b419d9df7fd126c9dc8b94e2fb99
- SSDEEP 6144:VpkhNVlJ+TC1lFhTzeKpTcYmD2zK8U1Js3Px+WK+N7TFyygRWL/IaLgeNTIPfgy1:kjTcYmD4I4Px+WK+N7TFyjeTiPflAqqi
- TLSH
  T10554B4D9F78D112E423231AAAD2E12CDB77CD171560458AEFD4D497C24A083D83BAF7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  spot-stream/web/js/khikhi.js
- Size 22KB
- SHA256 3994f523e0618bbe3ea14fdd53e98eea6e266bf1051654ede63084d2e7ea83b1
- MD5 602b4a30a258d22765ea37ddc7843de6
- SHA1 8614fe25e13b49f8f98441e97ed5e916a27deabe
- SHA512 96bb8378ea9b244dccd7d2a9fcdbf7e9f78dd2c3eb13698c96056badf5c37ea08096363873eb60ad3b8f5905de270c5b3ea0d7b7cc2d876216b96c2d368ad5bd
- SSDEEP 384:5yFV/xyqjQzRlI0gGWRRd/y3jr5SY4k8CBkB8s4mV2drzc4qsC6LA11Syv1lcpLA:AhyHzHI0gGQRd/yH5n41CBkqs0fpFCKC
- TLSH
  T1CCB2B768E4904E6B95C2928231C27A877134A7136F80740DB749C39C1FCFEEFA5B919E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32