f9527a8301838abdbba9898f444bde05e64e63076839924e8b07753e8a4401f4

Sharing

Copy URL Twitter E-mail

General

Target
salecod59-allupi.zip
Size 7.8MB
Sample260620-wtgpcshx2x
SHA256 f9527a8301838abdbba9898f444bde05e64e63076839924e8b07753e8a4401f4
MD5 eec1ad630351d232525919aa773c0489
SHA1 5633c503aefc77588d4bdbe940fe39f2385411d6
SHA512 a10add0243b184673265d345d808cf93c1c58290610fc3102d61346d224acdb6845f618afcab3fd7bb8b5418585d04be9391af0fe450f16877634739fc177cad
SSDEEP 196608:1grkH0JLR8LLPeMR+F4hM0cXPwQC9Fqrgpw7:1gg0YPXSoMhXY7cgp+
TLSH
T1648633C9CCBD6707C11678BA3805AFBA70D6DF2BD1DB4E57560E7084BC92C2AAC9046D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wintersale/PaymentGateway/assets/checkout_assets/upi.svg
- Size 5KB
- SHA256 aca4839a8a9b0081c3b4763eacaba135a3c2f6b1e5bcc49efd09eb2ad1e9f2a5
- MD5 8ceca2ff24cd7b7a323c0edec9b3de0b
- SHA1 c164b0783090b13b72012d9bff4c3d39e48dd38c
- SHA512 541d792c5306ecc65b247f80d9b5717950dade6cf2c6d6a63b341222b7ae11980546396bcbe1d7231b0cfacac15ceb68bed34d6d6269e891f8925cd3c513cb2e
- SSDEEP 96:z5hf4exYe5qRZfr2aYN6onFx22M+YKJ9ILiVuioqIo/G:D4gAZfr2aq6onFxZM+YKwiboFr
- TLSH
  T110B1004B535C53AC668A13D0C86715E33AD1E4C6A295E39CF7E6FD06E0478B14238FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  wintersale/PaymentGateway/index.php
- Size 46KB
- SHA256 07033379a107d36acc9a0ca56261a010d6f2fd658280a48bd7343b8c97314fa6
- MD5 f7da950060ee1018c1bb1b10c1a358e6
- SHA1 175a58f27d27193efd4102ce0eb7a262f22f3873
- SHA512 aeebf19b828d3621e38459c91d4e6e5800c23acb9c3b0af51d5b7197ea66cc8c2e2bf6b4943a6ba0c777614ecb72a0f88e0caeb27c4038f4c3abf28bf1c3bcb5
- SSDEEP 384:s91g6Zh18/NEzAQQTJVNv+Lva3MeVqzeQw20WatZAQ5HUN/PSnanTBV7MEz5eId:kZoXNv3Vs220dHAAC/P7bd
- TLSH
  T1892308E56B6011A4B476E2FE9F320248FF9280938242D551F7EC2A464F724849D67FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  wintersale/PaymentGateway/phonepe/assets/images/cartlogo.svg
- Size 1KB
- SHA256 28dd6572bb225c8ed5e1493cabfa28327cac5bc425cec68502baed2c0e88c003
- MD5 eed150d217fc11321865db4f40186f9f
- SHA1 0c4ef2f0d25a9d17bbcba3c4201d1c0efb3e07e8
- SHA512 55e5dd35b270ff64ab1f1eb1211f8edb452461358ba8a8c9de14a6168d96d846a5b696a3ece368136b6cfcbc0bd4cc9d62ecef649acdb0a8873c77fd2a0e59a0
- TLSH
  T19D118CE663E4187CB4270794D7D1323E20B702A2072EE998C8313534D95255DAE3FDC4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  wintersale/PaymentGateway/phonepe/assets/images/download.svg
- Size 886B
- SHA256 75e62a308ae5ea1f697b674ad97e7058a972faf755b9bf1f1c702062ce78296d
- MD5 bbdf6abda41aa89834e4996882111740
- SHA1 afb70fd9d7a00f5a2e05051f007e7e5002a8546e
- SHA512 58f33b270d707356dc00d578629c1a40bbc6dfb17e16aeda70d8970ced54d1f3146acf8b97e439dee17488076ae8a157144cf0e29eb3b890ef5873c94fb164de
- TLSH
  T1A3112594A3EC593CB9EE8250D37FB130EA365293030CA148F97515388E1954DB97F9C9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  wintersale/PaymentGateway/phonepe/assets/images/menubar.svg
- Size 603B
- SHA256 cbac1377b4a96ffa6aacffe44bfe047924dea40d1de55722a290875b34b6b58a
- MD5 852e62bfefdd491befec40828b8ba109
- SHA1 fbb59f06d7881e6a47a9416ca35c2ef98c86615a
- SHA512 eb88a5a986d307b3ebc5490314552d73e9a0cc4a076241ee632921c1afcda919ba36734fcdc7ce553f33558cc93c2a73da935c0203dca898713bc314bff9ec3d
- TLSH
  T19BF0F659234C4C3CBAA20A01D36A7274D0A95242076EE158E67166355D1C11EFA3FACE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  wintersale/PaymentGateway/phonepe/assets/images/user.svg
- Size 1KB
- SHA256 a18222589af4aafcab7faab2d705a5ee749a00faced49dddcb6e6ed14ad2434b
- MD5 52e0dc1d8f29ccfd828816572395104d
- SHA1 ded1ebe0a163816198695d0a0aaf175e44a80109
- SHA512 9c3787aea6ddb4569f05546cc0871599ad6cc2b0efb7d4789d36add3267c3614b41f8a3daa7d01c8bf47d9939826aaa50d8d5304f3685b2b477af1354c810cfa
- TLSH
  T1B711A89A93885A3CB6A30B40C37A7120A53924330B2DA714A03422B49F2D52DE67FBDC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  wintersale/PaymentGateway/phonepe/assets/js/bootstrap.min.js
- Size 99KB
- SHA256 ef8e9066e062c2e1bfee6e7c4c7762af31de7b51c54386897b49cf7d665cfb96
- MD5 e8a4df46e011469b4a198fbbb103f27a
- SHA1 ba8cfd9ecc5816478e45daa05e7c254ba48446bd
- SHA512 3f6a77cef202774a3f1294ba5917bf4d23b9ea347f551e3373e64f3397cac65077b21fc00b2051bb28ab4f921b09f80c6e54e787ddf63931abc83e24d558eda7
- SSDEEP 768:CmHu8dsjJkh+XDDiWOxFyL6lV4CAomHzk0ISVuOUABpJAhQUmSCZzi2gV/hVH52h:CR4hbBlMXIluzn3t2KgJG
- TLSH
  T161A30E0B36EA643195AB707A8E6F9146B935944F5E4AE9183D4C52DC0F1CC3C22B6FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wintersale/PaymentGateway/phonepe/assets/js/days.min.js
- Size 12KB
- SHA256 04a5535f38c0f1d385ae198626c4ebdb7531b3c10c841561fc863e0f51f3a10c
- MD5 d9166ddd02bf96d3035c59f536348cef
- SHA1 ff80567e441291c93909ebb494a1d0cc7ab9a447
- SHA512 dbf4da6a21f5ed668125e18396ab66894b177fbbb7b9727133778d25764ed11a108d38ab2e1dad3ad32ec425743af8469f864041b56c534abce9b9a1d04e4c20
- SSDEEP 384:CqVzlSful8OKT0WNSRCDF0dKIkFLV+aCY:hVzlW50WsRCDFaeFLV+0
- TLSH
  T12542784B6AE3B424A323B1784E8F9804B915594B2D9FFD497C2D81D05F1D42C93B9FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  wintersale/PaymentGateway/phonepe/assets/js/jquery.min.js
- Size 164KB
- SHA256 2bb31ef0df1cf75b99497c6ebf638c432fb7ea6dcaddffea17d0d3dc8948b05b
- MD5 70a0ed646e29b76a849557865fafc2fd
- SHA1 7529413fe24d3983722304113371dac661b5a264
- SHA512 37ca29d9fa38806f7916c655c228f09099d3de3b1149fa2698efcdfc88822c0e86019057b851fd1b2b353588d33ffdd3ffaf69ef818dab3de8b930ec417755b7
- SSDEEP 1536:lc+UvVG9yK1yJNQYEhBhc3QWqoYXcU4pUWokjMU4buOs9GJRSF7e0bBuxKhoG7Em:lc4oYxWo1U4buwSgau5v3NWra2Nh
- TLSH
  T1F0F30B8A6AE721319223B17D4E6FD809B535545F1E98FE003D4C82A59F0C83C97BAF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wintersale/PaymentGateway/phonepe/assets/js/manage_index.js
- Size 8KB
- SHA256 9d5a0bd4174926acc0336e99759f3e9663c5d03b40ec5c189fe04019fd37e951
- MD5 39b49b15c0364d7ea4594fbd942492bb
- SHA1 6fab29b245b713433441e45cf11541616a40006c
- SHA512 6fa7fa88636fe7e27813e2a07634f72853bffcd3867284d4f30518c27b40982adb3c1ab43d7eb57fcd2f60892c1dc27279cd7182a0905704adf1c39a1fa784f2
- SSDEEP 96:yJXUk5mxNLRGvvSF39GhbnY75ENm9C6GdN2sHhtjwB2PGj4oh8c0HEXMcmWEcWpX:9LA039GhbnYKNsC8LUoh8SXMtWEb5LX
- TLSH
  T16402A804F5F1A136B0535074DF765A167B51B103614ECE147A4C7A80EF8BE369BA2EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wintersale/PaymentGateway/phonepe/assets/js/relativeTime.js
- Size 2KB
- SHA256 ea9f6f3fff7ea6f076e451e806f1377384a3f8eab7f1982b30089d365f720d05
- MD5 d4769e500149a732d8630d530b5337a8
- SHA1 e18da773f2f7b636db96691182faf3764083e6fa
- SHA512 fd13a1f93b8b1e9a903d48ee63ef4a49b1440857b7fc20b11d24cf4bd38193ccd8e3e9ddc9f8131462588f122e65cab2d10dc00188893f7bc49aca81ed309145
- TLSH
  T18551F10A56E366116663B178471F4C096434882B0DDDFD027F8C98A82F2D43D6F39E8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wintersale/PaymentGateway/phonepe/images/85TgEz3vOpII.svg
- Size 692B
- SHA256 aec0bd0ece07644cefa87bd6a55fd554569cb69f3b1aa456ad7ad0ae437fe86d
- MD5 b0563e69db4eda046947e9bf1311cb35
- SHA1 3817846af3ce8ea5ede562f248743944e29a36c3
- SHA512 0ec439da38228fde48aea7f2ce001ff00544af51a4c9aa0213bbfc6f3803f7803b6b849a0fca456ec93dfaae824c01d0a91e77736001c51e824e82e244ab1928
- TLSH
  T124017B1EF7B0167D874047B057256091B6DF3CECBF29012D91ADA27162431EE39046BA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wintersale/PaymentGateway/phonepe/images/bars.svg
- Size 158B
- SHA256 88b1b7f63d634c2aedb155aaaa9724de33b2e2beb9e5a05a5663a9ed8ca9bc76
- MD5 48e389f73ba176852f6eb881dba6eb43
- SHA1 c71cc9c89f619cd47879ac018fe5728dc7cdc5c7
- SHA512 d68c7d7cd9f62482e9e62b992670ade3c342cd15e6c56870a7e4ab8b028191fca5c69b37956b3b525b0f078cd31686d7c287133682ebf889e9c7dbc141ba3533
- TLSH
  T1CBC08CA6F00C7607D00881301578B22F201F6232689A499CEEC012082309AE27C207EC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wintersale/PaymentGateway/phonepe/images/bhim_upi.svg
- Size 5KB
- SHA256 aca4839a8a9b0081c3b4763eacaba135a3c2f6b1e5bcc49efd09eb2ad1e9f2a5
- MD5 8ceca2ff24cd7b7a323c0edec9b3de0b
- SHA1 c164b0783090b13b72012d9bff4c3d39e48dd38c
- SHA512 541d792c5306ecc65b247f80d9b5717950dade6cf2c6d6a63b341222b7ae11980546396bcbe1d7231b0cfacac15ceb68bed34d6d6269e891f8925cd3c513cb2e
- SSDEEP 96:z5hf4exYe5qRZfr2aYN6onFx22M+YKJ9ILiVuioqIo/G:D4gAZfr2aq6onFxZM+YKwiboFr
- TLSH
  T110B1004B535C53AC668A13D0C86715E33AD1E4C6A295E39CF7E6FD06E0478B14238FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wintersale/PaymentGateway/phonepe/images/clock.svg
- Size 833B
- SHA256 20d668042c16c5271a0549b16d2d108c1fdfbb0f646a1f946b180cf1443311f7
- MD5 ddf1486a1d7246f78644e5d634fe9480
- SHA1 996b4ea3d4229e4b01f889e6d2bc5eea3f91f7c4
- SHA512 4ed684db8c9216b114ea355659b7f4aa453a32ebced7496a10ca0304258356a939580ff0f1aeff29d63af8187c0f60b5d1cada2d28b3c19b1e3329fdf7e8a3db
- TLSH
  T10001D6E0B01D012A818DCA79C7B1F1F2823730CA8187094CB8A83B35106FACF3C292EC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wintersale/PaymentGateway/phonepe/images/gpay_icon.svg
- Size 1KB
- SHA256 42ddfd9a47b5460994897f7bca732049d6186a0e0c4f4a686da904f3cccd51e9
- MD5 b4f45c10f5408aae5ef20bdc6cf0cac8
- SHA1 9eb1088ffcd55da318c8dc2cd59e5d5ebbedc744
- SHA512 1a1e0a3c6d5ea2fe13b2556aa89158e26228005802264abef35d68157dbff6aa1734acb6f3ed9ceb78bf62d0057c476bc885dbadd81c6336ad0e1ef210215930
- TLSH
  T1B841C6E833E9C2A6C46087C159F9655833DB28DB39C0020DF9DCB4063F224D94DA39D2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32