100257e29d7e415bdd309eff677b899c11814ef8a920df06b6b701c0abe002fd

Sharing

Copy URL Twitter E-mail

General

Target
YOURLS-1.9.1.zip
Size 3.9MB
Sample260620-pedwlaex6q
SHA256 100257e29d7e415bdd309eff677b899c11814ef8a920df06b6b701c0abe002fd
MD5 ed1a458f71e87d93e7725f1aa7523dde
SHA1 fd90a51ecd567fffcfbdc875ff50f84f31621cbd
SHA512 06edc3aa199917682a98336ea84e874bb1c225af3103c6c1f28f1897e257001c140403541d85d3897edc5f11237ee5e4aac6acf567fa42ff9760304b4cd01f9f
SSDEEP 98304:lXlXO0OalVmj0HUKbIwh9CUpL1g+dHdU/48z44YoydD4:lX1ODabmjfqKU4+Fd44sUoSD4
TLSH
T18D1612A1D719E906E8CC237FB943B883E1899400E5C30DD392AC1A57AD3E664DD73D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  YOURLS-1.9.1/admin/index.php
- Size 11KB
- SHA256 6f925f8b3d23b3365a35e1ad7e97ccc9ffe270a55906199b5907971fd0c5e0f9
- MD5 1fc270ab430a84a6e819ab1863de7316
- SHA1 634164cd5acfeec054ff922a179daf2737d7974b
- SHA512 67df721d37f0bf270eee616282b2e94bdc0f36a79978104fb70386baf4aa3d5de59f948ab7e053d90b9aa49644f19a047bbaf6bf8f35c5647ad6fbf74b577d68
- SSDEEP 192:A3IZx+kcVpui36Ul68Mc5UPbLC7fGqhFMOdRmGEUOg1+KTUPkJiXF:AG0ph36UlUPbLQGqkYTEUOlPkJiXF
- TLSH
  T1A032A59CF0EBF57B88AAF064AC58A94476AC4A037286795EBC8CC3D04F6CD61D47CB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  YOURLS-1.9.1/admin/plugins.php
- Size 5KB
- SHA256 09fde0f446b60cfbe1a428579b94469814a622589dede42e9466ce10a678851c
- MD5 38f09b70210b79e57cfe11486dcc0492
- SHA1 45af15afd8f667657ef177cebcddfe8175e4c66d
- SHA512 d47c8a8e8ba078c1ceaa70f6e7074edd73ca8b5b2dceab2e29162cd74ba307b35f30c977038f7439efc9eff87348323c09c0ddd08b9de956bb35c867ade7da3f
- SSDEEP 96:pqyBiEVpRHpgANnAvrtE26Ei9mo3jcDscqGt2V8+n2TwX2rbhANvZ0DKolVDrJg:ntVnHVnktE26Ei9mIcDscqGt7lANvWf2
- TLSH
  T16CC1411AE2DCB63B407BE4B721614ED371DD92D56200E861FEBE05505F30BF8597BA42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  YOURLS-1.9.1/admin/tools.php
- Size 14KB
- SHA256 04ff35372f01f713f6c627b4ce3d9891216314d0c8ccd5889aebda65e52bac98
- MD5 e6861976b1b85ed6f0e52092167013f8
- SHA1 e723212c92069f280d5e2bb937b8f976618c87f8
- SHA512 8da014f4f87c988a5490d37c49aa7f66632a17a18468b62ffdf4465e26e265e306f625803aa8a1dd0a038ed348b0051573de06a35710d1ff06a2812cc875e9a3
- SSDEEP 192:piiPPvsH7zDnlstxDs0vv8pgqPK9+76bJ5IOwVSvcg:piiPPvscXv8h7615IOwVSEg
- TLSH
  T12862C50FC3E9732EA065686B8B9B4D5020D6AC4729147825393E02C81F7CB6F1E7B3B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  YOURLS-1.9.1/images/accept.svg
- Size 1KB
- SHA256 6426e1ef770f7e4ff6e82c54ec5f11f3885adfd9da47e0ba003b0c8993fc8282
- MD5 c5c74dbb463bdfb293e4fec9b8b06d1a
- SHA1 171a3796e0dc6739caa150b95dd016cbecb691a8
- SHA512 3a076d38aa227b6ef81f190d5ea2831626471188f2c527e8dc09ff01c87539f86bd0e0003c7068a751f21d2dc0550e516cc77baa7454abb993484a479984671f
- TLSH
  T17A31BF89F1A758D6922C86502DE6A916C31AB0A3C2980D5ABDAC4470EF444C3F37E7DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  YOURLS-1.9.1/images/asc.svg
- Size 1KB
- SHA256 edb15e837fa421629ee44640ace4235ba2cb6cd71e898bd0091a91b5c0ab2fc9
- MD5 6d7568ebd564e0b07878392fac409d19
- SHA1 7697383e103814d797261c44ef08a829371d382e
- SHA512 2699fcc04139491e675b82df022a5058b9135b337309c0cd11c4ebddcfa7e6d062378c8e8032222d161844c064803d049b78117ac6ed6c86ff4e7dd80ac47b70
- TLSH
  T1FE31CD95F1A748C6922CC6512DE6A916C31E70A386980D5ABDAC4470EF484C3B37E7DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  YOURLS-1.9.1/images/bg.svg
- Size 1KB
- SHA256 6c601394389c1bb7d0d71a6f7c3b2fc21dccca61b47431f3e8f4085a588dc7f0
- MD5 bc251c363ad18bccda787481b8b4d94b
- SHA1 02f4af9294f8a90aef66149e8ffc75a6f27add61
- SHA512 4a19bfda695aa53746f11c139e0cd166ff677c2463d3048f5ae89379b0e67aa9a50aa9772d8fddbf5d89d150800c026eea99e966d092817c62ac52470c97f615
- TLSH
  T1ED31C096F6A758C6922C86502EE5A512C31EB0B387980D5ABDEC4470EF444C3B37B3DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  YOURLS-1.9.1/images/cancel.svg
- Size 1KB
- SHA256 dd7e7c4082e7503d06b2497145e03b8b9e2d20779dc4e90d58158e731113217e
- MD5 56f00c3c244d6d25d9b824a34f768041
- SHA1 a4db2b3827389e2653ecb501f7df226fe2932727
- SHA512 6508c0363f8e16fc022fea32a46130d11a380517521f1b9a492361d5a7bfcb148118a51205d16422df81b2d7da37076d6b7bef17400580cd065e213995fadcd0
- TLSH
  T1C931F29AF56658C9922C83502DE5A516C31FB0B782890C6A7EEC04B0DF494C2F77F7DA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  YOURLS-1.9.1/images/chart_bar.svg
- Size 1KB
- SHA256 4dc264b6c73da2bd14f8deec1d2bfd54b6b9314197d726504c1e75c8604d63e2
- MD5 4c5ed3f50c956a6d205abc2b6651bc5a
- SHA1 9c867180084dea14edb7e20cc4e568101b52908e
- SHA512 52634237c7cb2efe9a1f2528cef3ac388843f9c98acc20147a18e348b5a6718ac4c0a9223288590ca86ca66e7556bde19a080bbae8ab4e34e799e178af36aadd
- TLSH
  T14C31E085F1A358C6922C86513DE5B916C31970E3C3D80D5ABEAC5860EF444C2B37E3DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  YOURLS-1.9.1/images/chart_bar_add.svg
- Size 2KB
- SHA256 62c149df4ac53c832319225e9e909102f443ff8280f8df820578f6b0b9f93bc4
- MD5 f7245bc70cd59deab11e83b5d3204ddd
- SHA1 8742f97bcfb15cc62b039fc4a52dcc16734fb833
- SHA512 b6259579554a429434b681203be9b21b1a1d2887c9db21c73e35c26e06b956d8116ab0da14ab49ebf7af35df3e1bcceafe0d7bc8ecbbc454aadc66a29325ec7e
- TLSH
  T164514585F2A648C6812C85A03ED6BA1642197093439A0D5BBEDC4835DFC50C777BF7DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  YOURLS-1.9.1/images/copy.svg
- Size 6KB
- SHA256 7ba104446c553f02b241964c7582823741a578fad9eb149afa784254eed22377
- MD5 9e49653312297fce6cae7a651a191eea
- SHA1 b13e565e9050fdd645973096a93be7ad3cf2a562
- SHA512 6bd52fa684ac710aac6172c7fa5de31cf9dadb761dcc0d034b62add54cc55892062ed49c369756a8aabbd9c74c92bc99bfa90b2da05f49638d15a6ba84bc09fd
- SSDEEP 96:VkoIanLXDzJYfLuEwmB3OaXnxHTYJ1CkYB8L9I32Q93a:Vk6GRB3OMxH+Mk5yz9K
- TLSH
  T1C9D1E892F36940C4316E0AA0BCB739527208A4D753159847F69E4C34EFD79E173AAB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  YOURLS-1.9.1/images/delete.svg
- Size 1KB
- SHA256 8e4878f9c1bcc3cc4b8932c7d1501ce066fffe91ec3a55883ca2ba90e05d89fe
- MD5 810c702b83d4074c9ecaf9780a099d08
- SHA1 ba27d83fcf808500b4ff38bdcaa51990caeb7816
- SHA512 8c3f89fdff3d54d35b757531d3015ba5986cbaa00a3b43d25a475795af1eea4cdb8653077f128b4d33853aaea507208f06b6a3c888b1add15ad598d7ed00e238
- TLSH
  T15A41AB45F1A244DA922C82657CE6A509C21960538588497A79DC1C60FFC54D2B37B3DF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  YOURLS-1.9.1/images/desc.svg
- Size 1KB
- SHA256 baf55c58a1cdd952ec7aa8b944803918b3cf071c21a168efcc45fd37bdc1ebc3
- MD5 71826a4b58b2a5033dd98830b9a8f4cf
- SHA1 a4ae19111e60d1029fe070969cc901193ee9d2d6
- SHA512 55dfc26c6ba715052085c20aeb5fa43607ad765d7876006fced0ba453d563b88f66b57e1c5b3e39ebe22b90869ef681b37b5782b8fb653b9fd34286ef6b4de3a
- TLSH
  T1DC31AE96F1A748C6922CC2512DE5A516C31970E386980D5ABEAC5470EF444C3B37F7DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  YOURLS-1.9.1/images/error.svg
- Size 1KB
- SHA256 8e60653c1add32984a73a7922df38ff85bf8c390828133683f6a20ed66707301
- MD5 62f74cc4b01f3d61a8b83799304d9cff
- SHA1 c67de05ac192bae806a0cd8d9685fe9f1b2b7a9f
- SHA512 cc18e30c03b25299fc20a70dc9e8121bd962caad539297448c9bc0a8ce066168302e1bf9b21fc068c213e95f0c87cee9a0326b030c181ddef736861b9aacac87
- TLSH
  T16F31CD85F1A658C6822CC6612DE5A916C31A70E382980D6ABDAC1860EF444C2F77F7D9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  YOURLS-1.9.1/images/facebook.svg
- Size 2KB
- SHA256 4df65c61b00ac5673220c1e970a1041a9aae62976548d3b9c9b0aded48678ad8
- MD5 dda396ee80580649feb65195106ea1ee
- SHA1 a71dc44077c16bd6adcc6be63d091f1459293dad
- SHA512 2acbc38fd4af9572c60180b8c0d52385a46e26ef81c03f400f6ee751d9745b1702eb923bb7cb6da00f94cb5dee695a10ec78800d2f940c2b55567231153451d4
- TLSH
  T1E841B9CDF56D08C9512CD9503FE2A606831A78A5838D0DB779F880B4FE502C2FBA97C9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  YOURLS-1.9.1/images/favicon.svg
- Size 6KB
- SHA256 da81854b677df36c965d6d49e6d3a9fcc5016ece5a0f42781b9a2855bb1f8058
- MD5 a4c05ab7236d050bca68906e68f98ac1
- SHA1 df213cf73e426ae0bbcb85d61fdccd7de5f38b01
- SHA512 4fc10cb831f78d187e1c0a0ad25bf388b05ccd49a46539f85eb7b38678d6947d865948014ff41be43c912df8506ce5646d867b21a91806453e73e3ce25b75ff2
- SSDEEP 96:VkoIanLDRX79+yhYfLJoMLHV3XDwLBB0PTbBTr3EDcRv8+H9H1v8Cbma:Vk8IyuVHkLmTbeQTr
- TLSH
  T15ED18141A39D90FC626F4A245CE774021B1E68B33311290A7DCD6870DF591E6E62BECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  YOURLS-1.9.1/images/filter.svg
- Size 1KB
- SHA256 58caba346a3257daa7c87fb0132dce8abb4578843f098a378277e12b88525f43
- MD5 2ec00e70dfbc9ac5e03409b844233c41
- SHA1 4f47f365cb6b933d93c9f6ce5ae332c8684e45a9
- SHA512 c1832b69261e5cc3a52dd312cd4b2797d642e3e14cef77a7c2ef943c89a35855dedcf2e9d93920af10545a2e16f8c97632e65c5a81f60f1b2887984e20ab598f
- TLSH
  T1DE411049F1A648C9921C86606DF6A612C71DB0A382A80D6A7DEC1470EF450C3F37FBD9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32