8242c23f60899dc8dba57c99bbf6495878d14aad63b9f6dc7f07cf9d7930ae5b

Sharing

Copy URL Twitter E-mail

General

Target
neweligibility.zip
Size 16.6MB
Sample260620-akjayacs7j
SHA256 8242c23f60899dc8dba57c99bbf6495878d14aad63b9f6dc7f07cf9d7930ae5b
MD5 b35bb4a4dcacc14655e42ca934057e54
SHA1 5539b938da2bb59a7ac52bbcfe3d30430f5c863c
SHA512 eed83f0ee9ae57fa2e931aef5ef8858075f6b43470e309688394abff06b50e01c17b2076dc843ef57c037c0997f7e3f5efc83c66c5f1a27df8c2172f45fca73b
SSDEEP 393216:MrhfrKx5YHQ8UY7Z7xZaP0HDjF5DMBLoo:Mdra5YjUY7lxkPQMBMo
TLSH
T11907023AD71D149AFD53BFF0D700CB03E91CC0825954B22B19985391CA978C96FDFAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app/Http/Controllers/AccountController.php
- Size 5KB
- SHA256 54ee4aeb6f7b40efd1fa6555ff089aeb6f01709796a39297bbbbf65e0cb6ccdb
- MD5 b3e7c5f14e392b1e1d8ca35c9850e6b7
- SHA1 f60cbdea84ecfbd6e4e38dbb2f3e831cd8ed222c
- SHA512 b4ef71b4c5c5c27bae379c6763f7aa4424924a2f318cf1a56bfe8df9d0bcfc215f6ddb60911e7eb13b9396981dd2c5a520acf4905c57806ae41add1403d2d4eb
- SSDEEP 96:M3vo9i9OnoW1x7StOqTD2qq8YGETFcgRW9v1a8bu2qi8YGNRl2:hYs14TD2qq8HETFc7q8bu2qi8HNRl2
- TLSH
  T122B13481390A94BC6576B326EB31D514DF7ED52324728641B4AC7348CFF0C26A6D1E96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  app/Http/Controllers/AccountsController.php
- Size 146KB
- SHA256 b32e18de74beb1a3d21fb3ff4fae3614280b85b52eca3eba78676a4b3b846ee7
- MD5 5e1bd35ecefdcd4a93e260540f3725d8
- SHA1 a5e7dea3f799444f0d731ab2bf060509d3f66024
- SHA512 f9ec4e763879bbc576cef481580fa77abf95f0846113f23eb926971164fdee43e2ba79775f37427c61880e6987f01f04d0fe1620a7daed66c87be17af3879d36
- SSDEEP 1536:cc/miJTN9eIfP8mhFHtCsZcszWimfsv6vmijg:cc/pcsQsGg
- TLSH
  T18AE373BA3807A4B58F33B2655F865708DAEA2013D9978574BD7D03811FB014AECBCD6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  app/Http/Controllers/AlatController.php
- Size 34KB
- SHA256 7f7224c26075753792bee7f5bb5c7a006492507c82b43e149255120a02457b69
- MD5 9acbf065cf242ec437ccb962df847961
- SHA1 a2e950dcacc96f6d7a211c2bc6143a9a47eb11c3
- SHA512 f1b95396aa5ae203804bdafbf63e59bd0fc12c98705ef2cd603c0f49b380be4abef01581f533005595c7981532a91fa70adf72bacb4e4e9dad166f956d60b212
- SSDEEP 192:za1ArvoHlWwL6IH0tAY2uGq3EO+va9BoJDa1ArvoHBmLzM5dthomLDF/FF/k0VRy:zaurWxbH0mYbiOSamauriFdFJ9iN6M
- TLSH
  T161F2B4E1BEF73A9C44164570F7A97B865FA44103930B4C90BA0C773A0F48FA6AA6775C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  app/Http/Controllers/AnalyticsController.php
- Size 108KB
- SHA256 7456be4f594e9e7ddbc2844accfa5638f035bc43ae0345582f03a0a74d29b8a2
- MD5 e704c7f2c4712531e08c8a785ef15992
- SHA1 36e70a3055ae8a69f368a744b14ce2aaf3e13ace
- SHA512 a314f898c0998b82c7a8590409fae024ce1aab7fcd3806d3f749c8f5830a8f2c9c3140e525d069d944ec934b13d6040b995c47c047db8c7d77078353668e36cc
- SSDEEP 768:lek7wnUAKwYcw5+l5lvkjKdj439iEQqYzhDGXTcNUQOJ4vevW5rwoR8pwauNnBWm:wSJcw5/sEQqYGXTcT2psJvZyyKQ
- TLSH
  T1B4B385B5FB0F907C567351E6B9318104EEDCD232216581E0FC6E6548CFA824A6BE8D7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  app/Http/Controllers/CalllogsController.php
- Size 101KB
- SHA256 e65443865ce20d1c356f602f443f0418c4ce19035b0ccfaa6e1b46191160e3e2
- MD5 9241fd01fe6b3bad67f4b1749dcfe3eb
- SHA1 25938dab8904cd11e7ffa14013691ab48fdb2337
- SHA512 b3c40ca7aa5c79381ae31d03e55339e721707283ed1f87edf4b9e90b0d0a8d0117f35f21b68bfe0abbef04f4f87d70e319b2c9551b2c16ba5394c5ba13d4bd89
- SSDEEP 3072:90tAKyuZRUmRUDRU4RUuRUC6pu6pVRUqlOaHO0BkURUaHOCNUtHObNUjQdHOvHOs:90tAKyuZRUmRUDRU4RUuRUC6pu6pVRUF
- TLSH
  T1E5A3A5A8B8025652177333BDF7569120EA25E413E8D18614BD9E93CC1FB2018B9F5FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  app/Http/Controllers/CardController.php
- Size 5KB
- SHA256 edec7c93d85dc972bc82d94cc500e9d832200363bcae78cc90d0ae380d1dd584
- MD5 457c05f80b6f27c71735c4ed87e46fca
- SHA1 b9e29bddcf37167ede05e38238fd4241af58e533
- SHA512 1ebbfff4135cb6a05add71b23dda3d63c7a36e29ebc42f6f1f446713e308331d4394f7a08d67e45f4c733b4fc4953ba0ae3f786eeaeb562224bf41e9d7d31347
- SSDEEP 96:MyI6xikBW1x7StOqcBoGoIGEWb+96aa80ZjU7S2:Dxil4cBoGoIGEm+S80ZjU7S2
- TLSH
  T15DB1CE807A0AC5B86572A267EA32C910DF7FE6233571865174FCA344CFF842972D4E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  app/Http/Controllers/CreditBureauController.php
- Size 3KB
- SHA256 6e77f8c83c4e46b89df92fe6d9203b7b6a172f2199f14101d0a042ee2c05c411
- MD5 e252063316db9150ce8ff431d589e1f2
- SHA1 b9a6a6e806047896cb72a6c3600d53baef69bf40
- SHA512 9419417bb637c4fd5d6695024722c79b8100638d41d879f8d8ef16ade7d20ebafdc1110cb61394352e4141ee73d354540a0ee20845cf47c99be2b1deb3128da3
- TLSH
  T1DB61628696A7CA631A6888D4775B758C730C85632440CC90FADE361E4FF467B36B202F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  app/Http/Controllers/LenderAuthController.php
- Size 115KB
- SHA256 3c78b8f2e14c3c98a2fc643aa5340c23737bb1568a732d66505949c5ab085255
- MD5 6aae134f6bdb953baa5d7d78e5f89f0e
- SHA1 41560f4e60e77ab6cedcb78354709af41f866ed0
- SHA512 0ea418bd545df4890323f8713ddb3a3a8732c5b8a4845e885189dc9fff949e6c26f848fd6c487672f20eee00e0b800f0ca1495c5599c5cd84437e0f808f852a3
- SSDEEP 1536:GcafaVAyaFY3hnuOVnsVbIxNadSWnaN3+nobjX:Gc2aVoY3NuOdsVbsKSWnaNd
- TLSH
  T1D7C38595FF0D90AD119394AAFC32C608DFBCD631312581F0FC6A6A48CA9C35A67DC967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  app/Http/Controllers/MessagesController.php
- Size 17KB
- SHA256 5755a93d114ffc147a9a8112c5d7b64ba95ceb8809020daaf259e6510ed47167
- MD5 a033e0d0080451aa2a7c07e40c338d73
- SHA1 3e7a496a172fefb1196e2cd7abefb77a9505c7bb
- SHA512 0b656ed23f966804c48d6f3596c7f23943193af2af0d389555dc91c4a7972e38ff8d8a651dd0947c7f472fe87edd1279d9896fa05753a6c2e3f383aae94c74be
- SSDEEP 384:hs2P2gUFM3fhKJaqakbN0IRjahk3fhKUa3fhKI:hPeBFMJLtsakJJaJ5
- TLSH
  T1B382DE9F7C13F8B94973D63FBB437440EAA2405384625A253FAF42982FB06159E16F6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  app/Http/Controllers/NewAnalyticsController.php
- Size 122KB
- SHA256 f1a8dad3ddbcd2babb95c2081186a5f22c8a877d625a91c5d6361bc7438c69b5
- MD5 cc8eb0390ecfc59057a3f7ab7b39a517
- SHA1 6ff034a2e464f743585e239b9a8899ee16d197ca
- SHA512 339ebc970de2272fdd8f3a1e7cbface06a1facbeb6702edb6228fef802188458383958ee71041a321a9111091e0aeb82c60821c43fdadbefe5c51f45c2e7ee04
- SSDEEP 768:R5ek7wnUAKwYcw5+l5lvkjKdj439tEQqYzhDGXTcwUQOJlvevW5rwoR8pwauNnBE:6SJcw5/7EQqYGXTcXntR6G+v6pyd
- TLSH
  T14AC39774FF0E906C557392A6B9318104EEACD233216581A0FD6E664CCFB834A6BD8D77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  app/Http/Controllers/NotificationsController.php
- Size 50KB
- SHA256 a92290591fc2c57daf9897280fad87b8f921513da66af4d82cf722b794937cee
- MD5 6901a4c847b2c5e742c6b10ee204e4fb
- SHA1 4a7868bfc883bb59f47591eae2eaf1a9b4ecdc6b
- SHA512 14670f0ba61373a9c819c72925eb57251a30d1710025b180b0bc648b12ef58958b24f384e0b7befa60063b1a82ebec13d839e3c08ab24035d10fa1c3d4000eb9
- SSDEEP 768:xWrZbCAby69QHA/0llmZoaK4+rcvfU/b2hlXMFZt:olbCAby69QHA/0llmZoaK4PCb2nXM9
- TLSH
  T1CD33876056ABE2962A675079F70F3700A96480079A4ACC317E5D13ED4FC492CBEED39F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  app/Http/Controllers/RepaymentsController.php
- Size 55KB
- SHA256 b10d2b1a3986e235cc1ac0a71f704c311a22a8b49a8b161eab336f26c9191201
- MD5 9b7b92d7a45f2ce27af846aa125caa03
- SHA1 ca986f918dcf72fe0bed5b147b4200d916ca80e3
- SHA512 fbbcccf36bf94f84dc05d5de7c8042a2e7554d2cee5ff92fcd28be31db87b7330653cfd7c2b9b86b61b18bdd90a2c7ec13a454969405174892987e392ed17923
- SSDEEP 384:cHgBtLMmbHnZFrk4gBtLi1SybkCIYfWfW9NiZ0gEopXFSvbNfbRllK:cHgBtLMmbHnPgBtLiuUYW/o0V+FSvbRw
- TLSH
  T1D0434361361B89A85133B133EA355401DF9CC5DBA1D2C990FAAC435C0FB642E97ECE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  app/Http/Controllers/SocialController.php
- Size 73KB
- SHA256 b22b88006a3c727688fd08bd338519b3919e46bb83b58f412e66571fd371df58
- MD5 36f5579788c95a66ba9db0857bbd882c
- SHA1 76a77ec7212763e9e5723b9e2f2cdfdaefddc773
- SHA512 6fd5fb42939e51e4fb271feea2f357554089270d09bf1eee288ce7a11b556eb5a99891f1228bae891b77f111fa2fa24504b0b6ec328c4cc31b21e4a2c431ae04
- SSDEEP 768:GDCZb7VXLLqPOdujFOLeA6vHl7glDr5aQOLeY3+u+DrsEl0WYfsjOmnsLDATypd4:QCAexlifVmnlypU3fQ0zXh
- TLSH
  T10673CBAD7D278474625760F2FB178400E7658913A680CE12FD9D92CC8F8136FA9F9B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  app/Http/Controllers/newacc.php
- Size 118KB
- SHA256 588b1b638ff4a1fc7222db252e5d296b2c6099df6457b11c8800ea4a11431993
- MD5 6ae48123affb1fadac06f61e46d1935b
- SHA1 b3fe71c525ad8864fe008dc418e70ec3804f9d3c
- SHA512 6c5bee713d87d06f75cd1a75d0caf9b9315715df54e83e6fcf1c824e38543b5d923eca03544ab72a453aa2eb9ca75a86758ada0ef0e9ae4d321665c09f8c5cf5
- SSDEEP 1536:Pf9tR6vTKnHS6nArJtzx+PKn8dM6ZKPDYOoQqymY:PFtMunHSZx1nwM6ZKPDYOoThY
- TLSH
  T1B2C374A4FF0E906C551754EABA1585C4AEACD13320508CE1FD6C6A4C9F8835F6EECD2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  app/Http/Middleware/JwtMiddleware.php
- Size 1KB
- SHA256 bc1d590301675f14189991e3adf371500f759466621120acc96cac57fdfa9107
- MD5 d76fa0c6d5b210fa1444a02649cf54d5
- SHA1 9907a78ce41fff3f9075f67c4b253dcf787d648c
- SHA512 facad6153f2804cb8e888ccfbc6423cab2042c91e59c51807655145b30b5664e2264bb1c6f7775099aa9a899e6d85a4f102309012d7fc113a50aba377dd07968
- TLSH
  T1D121AAB81887A2014B7266FDE348CD26F45AA66747CC43A3BC6CC6D52FB14009F5BF86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  app/Http/routes.php
- Size 7KB
- SHA256 5a69a541bd2967501f61cd24a79418d9575a4ee463da36b8cbab55e2246fdbdd
- MD5 474422d58cbfb8933436b1ff197e113b
- SHA1 5e1d4f41956e22f6ea33c978f0d5c7e8462a6456
- SHA512 bb78df020936777a2ba1d9fec2fcc37da9f7846357728f561b1e34ed95e1594903d2e1869929c9453c46672fbd41f8035af6bcc5b68c89d4b02453f7d11b0738
- SSDEEP 192:rwATYHYa59fNies8kiRo2R1aT819EElaFqLmvg1:4Ze6f
- TLSH
  T156F106BEEDF00FF44EBBD68CFA3169A8D8117CD9863251329995BD6407C80F6929F109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32