4978034b35571c05bfa9917f8e2e4f9d6932df4ea11d3c22daa5ec43b9834801

Sharing

Copy URL Twitter E-mail

General

Target
xfinity (1).zip
Size 1.8MB
Sample260603-phm9faex81
SHA256 4978034b35571c05bfa9917f8e2e4f9d6932df4ea11d3c22daa5ec43b9834801
MD5 9308f0577ab3e81aa52c3874698dc471
SHA1 b0fa8ec1518c84e9e7143ed5bc0ec5273923bca8
SHA512 5b405606b92f0822e5dfa763c8c2eb03cb73588e3f8dac77887af36867dec561cb195a64f137ddc1c148bdc89b9586859f12c7cf35875d9003d2509f35cb7eec
SSDEEP 49152:6IxXpOGSYx9sefSQUs1cFGg4Ffftzzcn9y1RfuyEI/v/paJzdKc7:6IzXSYx+eqvgcFL4FntzzYwtuyEcnpaT
TLSH
T12D9533AC5B4D1453DB0FB2B8D05CFA5EC503DA135649E46FBB1462B0FA4EA883FB1960
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  xfinity/Link-gate.php
- Size 17KB
- SHA256 83e93c72044bf0c4e239d1681c872d44ad8032417648c1f3f5ee518bb65804de
- MD5 58ded5b8288941fcff7149708af16e8d
- SHA1 4163f31325e29d4a42dd74b5d975ea25508c7859
- SHA512 170d0aafbacaa2cbd08a02fa4e19726a0ac8acaee18716b0dd304eb3c49ec511e93f9ff87a4cd8dde9394d383db84496db88e501a347a81f935462b8bd7c75e0
- SSDEEP 384:fGVPpCIhgxNDuD95WzkC5sX43QFIsgZcFxDDjKn:0CIhKDu55AskRoxD/Kn
- TLSH
  T1488244582CE791614677F02A9BCF9408F229842346694A51FC8D46D8BF9153CFAFCFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  xfinity/U-so0192/ServerResponse.php
- Size 9KB
- SHA256 aa281cf728b4b72932a1c24cdf76bfdf33f5531aea39f74a51a76a8129fab9b8
- MD5 885c430848c2fff9aef56cb60d946570
- SHA1 2332844ded6669c405e8cc205cb684fbb9b6eb11
- SHA512 6f012be5184d07d8e9706302572f36f14fb628a24a396bc1ea61c0ffeff6e13bf45d0ec7054012550d5087e555d3d90866f982a3359d10bbefb0e0037cba3c86
- SSDEEP 192:ExEZJM/ZK4yVwBuJjr6m/zPyW871XwPuo6jCcRaEFfI2fiTW8ra00N1F:EmZm/E4JuryWyAPulG6aEeqina00Nj
- TLSH
  T1C8124D4FA16F5B4D14093EA610B5991BF84FCAFC7E3B77DAD09EA0E911FE1014601A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  xfinity/U-so0192/addressDetector.php
- Size 9KB
- SHA256 a5bbcadab436b47ca170ee45af2c0348f3315ca36dafc49fe1f1bb99396eb613
- MD5 d5673ea63f5351b73158867693843cbe
- SHA1 51ec5c18f95da5998845462aa7e0eff5794f8e8e
- SHA512 f441283e4d6362206825c80ec8359fb938a794d2dbdffe08829e66ac4ccab5ca2899ff13fef9828d17cea18f385da8c78ead0ca2b5109c8e3d389e0f77e1a638
- SSDEEP 192:ExEehifjHMum8yBi4zHzexbh/gVC6wRTq4x2wN9w1GEsgf:EmQyAhBLHzexN/gVCBx2wfwAgf
- TLSH
  T149222A1B812E974C540E3DA511BD8A3BFEDAD9FCAE377B89D10EA02719BD0510F42297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  xfinity/U-so0192/fileBlocker.php
- Size 1KB
- SHA256 89370a0d2b5fb11d3672fd51b7a78077e7b9105c5cc10285bd3555cc8a92c498
- MD5 9a576b7fb9dceebdd0a76c736969f049
- SHA1 d8c6e69d10fabd6e1d83b6ff823415cb68db4131
- SHA512 3dfefe22edac38d019cab0574157d1d2fbcdd351398605e10d37763246914a9e4ff8fb220d8c744fff54951052a98ac2dcadbdea244a10fb95285d6b4dd73e35
- TLSH
  T14941B48210C8AB1C18178C59B0F54E179E06ADB5BD23DE94D6AD68A112F42980F12EBB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  xfinity/app/assets/css/prism-ui/p-046b0377.entry.js
- Size 12KB
- SHA256 06d9df1866cd504333f268fadd0cd04bec518abaa2e48da8d3a6bd314aa0bf1e
- MD5 614e5c1021be90bf3c2148e9a3db4aee
- SHA1 651cf36cedffaa5a42ef79f5b60fdf145be8700d
- SHA512 77001c38d0fdd60493034473e82c8ee026e8e792322bf65ad10c38596e8b9636b4c011fe2ee5202e300a1f8f49937cb39c4ef790b76b6bb23476c2d23690751d
- SSDEEP 192:x1cUntIoRzUyCh+hUk0f7rTJMDQHAgAsMV+xQwYI:HHaXZk0f7rTJ5AgAsMVUQwN
- TLSH
  T13E42B60DB402523E3C57A1DED72A819D923336C1ED1407CEB94B91A897C7BDB29B3278
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  xfinity/app/assets/css/prism-ui/p-25b9fe06.js
- Size 1KB
- SHA256 dd418c012d57c46a4870b09ffb3146390a6e838ed24784ae8942bb1be3529101
- MD5 ea4e9ef7942d1871743297cd9fe0738c
- SHA1 e7578b447ffb80bdcd5cd9aa4825ccf118477685
- SHA512 b7ef972c99d40c71a47ba248f9e87a796acd8d3d9bad1af962ecf2372500fb18b719a232b3e669f325da37d128287d7086f3a6b185cc8a33fe06f0e5943929e8
- TLSH
  T1C31161A02600B4F0D78E028BF5B8D78AB40263EC345B7144E08C469B18D959396AFF5A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  xfinity/app/assets/css/prism-ui/p-4819f891.entry.js
- Size 16KB
- SHA256 7d567003acd22c29d07e9978756459a12f54cbc5cc3933cf4c1c48970c420d0c
- MD5 989109bc8d24c4ece410f2513a039f4f
- SHA1 eb1a5b2486fa404fd8faa82d31653cec7eaca2c0
- SHA512 66c4b178bdb41027b962549d703c9af97c432a63293b74b466e50d40a00a757c4f89d6efb192bffd8c42c9bb2707adec29b9f34a13f5306f911b6ec29a016a81
- SSDEEP 192:x1zUZq6FDoP/LxJpcYTp4jvrWhvD1BMDvywIlyVt0OpDaUSpDIpDQZiSSUdo/8i:HIZFULxUjvrfDvywIlyfUUWu
- TLSH
  T1EF7295566006803B4D839AF8D3CCD1D2AB5612C0BE2284DFB95514E19FDEFE526B3B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  xfinity/app/assets/css/prism-ui/p-93c35470.js
- Size 27KB
- SHA256 96e583b2657703a7d06075d408bc4810ae2eaa0f465128a4d2d3443e5b4a8b64
- MD5 d3d8bd5b4d06581c774b4270cbd0e0b5
- SHA1 b6abf05abab537dacdf2bef3da974c2275a819e5
- SHA512 b863548da07b967b4dd920e6d0eac0816a3171beed88b0903cf14d2deb4d0eecd2a428a0de33f0fc392a9a2860b00a8b5cd93c7e2ba24196fda761bb5773c7b4
- SSDEEP 384:w4N27r4CqzeuRSAszw8j9tVwSghXigMwS0CyZiYXJQOXBOwq:wVOxVNktUvC4nBOP
- TLSH
  T1FFD243A872C7B0E547A251A5083F3C0A633B5D4C154EF548FBA9C880BEB959F8533F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  xfinity/app/assets/css/prism-ui/p-a9350269.entry.js
- Size 23KB
- SHA256 cb2d5278ac6dce7bcb6bd358c099ca894a3890e568732d06c878677c0eaa8992
- MD5 9967f9efb16df59a11fb5784467d0a42
- SHA1 a9350269d8a26e9ae27ff9855a5a0d913de0e6c7
- SHA512 f4217c4d4cebee6040a3f5ddc5130f3b01ec666e760f38783b9ff239c65ccb5a07a195244ffcc8e71155b5fa404438c22bc661e550dda0d5feb5752e52210842
- SSDEEP 384:HrAIjSYspbM7V7XoNNqi4PQneJrIXy3BFTWon/hMW3/E8BPsZIsBs0aYzBzYufOq:HrAIjabKhci50
- TLSH
  T186B2629DA620D03EBC2660FBA78D529E911175C1EF17CEECBE4204A4C5DBFE22162774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  xfinity/app/assets/css/prism-ui/p-da53b8b0.js
- Size 15KB
- SHA256 ef9b86f3b3e91d7e983ccbaa676f00e49f8d45e8c63b1c42b0bd251c8e12109b
- MD5 4fc98c7c1e1c836d599e6bf41101864a
- SHA1 2a27075e587d623e8c79c165bb02427041555cea
- SHA512 3c021ac2a33b4549bebb960bb4343df75663b1bf475810b2da164468ee2cfd791639a6e749dd957f2dff90c52483f9102d49e3ff67ec1b79f18f975cd76fc8a9
- SSDEEP 384:2cHcw+YmKO3V2/8O2XdNdedan/kxURn090tBTJRHonRTJ/ciEgYXZeX1:2c8w+YBO3w2lewolOHonz/nERu
- TLSH
  T14E722A76160CB7667AE605DE84F10091F2606B2E340D8AF1F66C9E7B28764C310F7E6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  xfinity/app/assets/css/prism-ui/p-e5022679.entry.js
- Size 57KB
- SHA256 4778691dafd3ff2c205b351a4d2984aa1657b99d2c410cc2ef008244a11fa136
- MD5 8106f0a4c606d53b585b10e4c3ca9aec
- SHA1 52a2c15fa5a7a221e51f7fba3ff57adbb1e89d82
- SHA512 c9bbebdfce289e72fe34ddf3f19fbd54767b6833e523d5dd539d51159520f2cb622a9c99c1511c6e587bd809f4d59f3e6db180ec3610f3fe611721d9ca77fceb
- SSDEEP 384:HDAqrO3okuVpNegbfhfFfnfs71Mf13tB8B9SMoZUU4TOiPx3Kk6csK1owQksXC6G:HDAQRRZUU9csPlx1IHVoy
- TLSH
  T14D431A49B551823F3C03A5FC935CE0AAB35721D0FD798AF7AC8620119BDBBF6A893151
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  xfinity/app/assets/css/prism-ui/prism-ui.esm-ce41cd1.js
- Size 11KB
- SHA256 95193072f84c3c79bf0012566186c2782533baed7f62c8407b185469932e4baa
- MD5 e14b4a548a90c7e8c57f21cbe2455120
- SHA1 d497e38e678cdd228b7a2bbb2b354ae3fa61b5e2
- SHA512 9e60a99f510be23345b3cd070975f3cb11ee9d303046aba4d51256f1262067599d33a6b5848fd378893932bf1c9ca33044733dc9889e7599fedb640107eb8754
- SSDEEP 192:OZmRVH5jD+VfZ8LiUVWXyRqdOYNrxwkHkg0UQovt3H9FXwqfyeHK4Uqc+xI0UF4C:s6ZjD+VfZ8OUVWXyUAYNrxwkHLSo1X9G
- TLSH
  T15132BC77AFFF0A334A43E189A4C4D1C66CDE125593680A5881C8C5B473DCFEF2A76692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  xfinity/app/assets/design/main/bundle-7a530a5.js
- Size 3KB
- SHA256 0414d815fd65fd6660d439d962f3c0615d91e97501530037f345dc62a7ea9ee3
- MD5 31592a21bc0be2224c1a7f75edc36290
- SHA1 366a4ff6e07682310cf2c7742c50c5f4d25153f5
- SHA512 0fc9589dcc1ffe8993ed8e8e56b036354bea47cec9723d8bdf9c2c3306ff6c281c642d802ed28aad482fa4a0fa23e033cf20d5f43060c70046d32fc4efda2abb
- TLSH
  T12F7151A472202EB11A7BA4B7F2FB238566F433C93802A450453CDCE12D3CCC54276E6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  xfinity/app/assets/design/main/comcast-common.js
- Size 237KB
- SHA256 912f85c774a2f1710262ceefedaf30e266e02ba631228df3b5577af51a6ca449
- MD5 936dd790cf56e58a83efc3707cd9a258
- SHA1 efce7f642fe6ffc5f604673daa7f8fef0e8bbf48
- SHA512 7f17f7bf083c259593522920ada6cfff2210f4093d65c0e73a3e70eb8bef591cb3446a731cc8a1c5475febb8dc45e2a840bfca5e83e025721a65a746f8a6a734
- SSDEEP 6144:aT5QYjeOQCGZKQp2ZGzByXi0jc5pebz/aEfLJRyX4tW:aNJjCzKQcZGzByLoS/TrJtW
- TLSH
  T1D4349D4AC7C487FEC184B8E24DAA0A5AC47ADD231C58E66A1576E4E74E38F3C746DD0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  xfinity/app/assets/design/main/prism-ui.esm-7a530a5.js
- Size 10KB
- SHA256 6d94268536b036506354b4d411994a9474c9f1a8042c14fc34b18a021d0e7cf9
- MD5 e26c38159110310e46d2342f4e0f5489
- SHA1 533826954ac04e768a31bcb01f73c29f7b243c4f
- SHA512 387fd05b0b740e4656571b29c85befe9464d4cb3d898065e8329dedd5f5b42f656f8fa337e7e4cb361e0b9083c006b80b23353b5558d76d18f073aa9998221b1
- SSDEEP 192:OZmhjD+VfZ8LiUVWXyRqdOYNrxwkHkg0UQovt3H9FXwqfyeHK4Uqc+xI0UF41Pqv:sYjD+VfZ8OUVWXyUAYNrxwkHLSo1X9dg
- TLSH
  T10832BC77AFFF0A734A43E189A4C4D1C26CDE125593680A5881C8C5A473DCFEF2A76692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  xfinity/app/assets/images/global/xfinity-logo-black.svg
- Size 939B
- SHA256 f831f28eea507b3e762cc59806bb6c8b6f2101cbf56f4689981055d77a7bffb5
- MD5 ad0169683d32ded98ee715cf453e4033
- SHA1 94e5de676c41f5819be4510c8dc852a0e5b629f1
- SHA512 7eff6aac74551a729f091e6d615c61edad582c91e5d2a925155d32ae8f59878c6dfe4e00d5e960ea0e10f2e58d629117ab291297df0c54f916da19c548edfaa2
- TLSH
  T16811DC3A032F17CDBBC89B106060E0A66476603A73B490A89FC3E814AC009F30076975
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32