6113d6c7a650475924008655cf3a486d4241dedd775ff1e0d0699bf9ece5bee0

Sharing

Copy URL Twitter E-mail

General

Target
fknew_no-off.zip
Size 13.4MB
Sample260621-pc26eac17l
SHA256 6113d6c7a650475924008655cf3a486d4241dedd775ff1e0d0699bf9ece5bee0
MD5 11557b5dbdf90fd847a3ed8258707e92
SHA1 c920c1adb324df2e881d1496725c565b8f1c2b08
SHA512 3c8e18ae2f38d479ae547b17cf6a05fcaa43a568abb1ba35931f296be021dda2081b677313f6be57f0b2b1df22a3db76232f83d4687f87a71ff4b171b1695d50
SSDEEP 393216:QeIQc0yr7x7Lrt8hHJWOzrgIgmOFIwmyuS9LIhK:QeIQcLX8hpwIjOyyuS9LIA
TLSH
T103E633612DDAF0ECF41953B3DEBCB1A1D7035199E04CBD090309E2866A2BED6AD77871
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fknew/1sysadmin/media/items/Dsc-29-03-2026-1774776936সাইকেল.webp.webp
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  fknew/address.html
- Size 9KB
- SHA256 7792f2523d5603622af0ef5fc9ec3524812829fb6a504cb25716379bca6bd6a5
- MD5 6653f4990dc0da930506cf0046f6e271
- SHA1 5c694430677bcb18342359f10e15939a9bff7a2a
- SHA512 b0e9ded012eddab75aff4f3c4fa5460458882b859db509b4e949747d0517a2be8415940f6557e20c429cee1b713bf567f20684653fa7a44ce10f3c04145ea774
- SSDEEP 192:jL/WG04MtMiIUmTpoXJj6g48FAypgbCyi4:jsF48pK
- TLSH
  T1F622642178F0887920EB44C829766A1E6DF5C703D2458588BAAD4FF94FE3CEACE33554
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  fknew/assets/js/address.js
- Size 586B
- SHA256 7c5b1963478f8a2b4a7efa7070e7d7b394075ae979228e0d0e4b498aac080840
- MD5 189ddc08bcf9faec95f17c3380b7acb1
- SHA1 0b22e0d35a067858964757d0b732f5bd6a75b305
- SHA512 3bd72ea7a28c03eb205c1a2208e2efd0d112f8e036cb89715335263ea51be26bb96c3cb64cb96fb5088741c4fc363f820dd5e77aa301e1b759575248e6816273
- TLSH
  T1ADF0F61B54B2478C05B731689D2FC320E32151573D09AE8534ADA9823F2EB3D7139608
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  fknew/assets/js/bootstrap.min.js
- Size 99KB
- SHA256 ef8e9066e062c2e1bfee6e7c4c7762af31de7b51c54386897b49cf7d665cfb96
- MD5 e8a4df46e011469b4a198fbbb103f27a
- SHA1 ba8cfd9ecc5816478e45daa05e7c254ba48446bd
- SHA512 3f6a77cef202774a3f1294ba5917bf4d23b9ea347f551e3373e64f3397cac65077b21fc00b2051bb28ab4f921b09f80c6e54e787ddf63931abc83e24d558eda7
- SSDEEP 768:CmHu8dsjJkh+XDDiWOxFyL6lV4CAomHzk0ISVuOUABpJAhQUmSCZzi2gV/hVH52h:CR4hbBlMXIluzn3t2KgJG
- TLSH
  T161A30E0B36EA643195AB707A8E6F9146B935944F5E4AE9183D4C52DC0F1CC3C22B6FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  fknew/assets/js/core.min.js
- Size 164KB
- SHA256 2bb31ef0df1cf75b99497c6ebf638c432fb7ea6dcaddffea17d0d3dc8948b05b
- MD5 70a0ed646e29b76a849557865fafc2fd
- SHA1 7529413fe24d3983722304113371dac661b5a264
- SHA512 37ca29d9fa38806f7916c655c228f09099d3de3b1149fa2698efcdfc88822c0e86019057b851fd1b2b353588d33ffdd3ffaf69ef818dab3de8b930ec417755b7
- SSDEEP 1536:lc+UvVG9yK1yJNQYEhBhc3QWqoYXcU4pUWokjMU4buOs9GJRSF7e0bBuxKhoG7Em:lc4oYxWo1U4buwSgau5v3NWra2Nh
- TLSH
  T1F0F30B8A6AE721319223B17D4E6FD809B535545F1E98FE003D4C82A59F0C83C97BAF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  fknew/assets/js/custom-index.js
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  fknew/assets/js/date.min.js
- Size 12KB
- SHA256 04a5535f38c0f1d385ae198626c4ebdb7531b3c10c841561fc863e0f51f3a10c
- MD5 d9166ddd02bf96d3035c59f536348cef
- SHA1 ff80567e441291c93909ebb494a1d0cc7ab9a447
- SHA512 dbf4da6a21f5ed668125e18396ab66894b177fbbb7b9727133778d25764ed11a108d38ab2e1dad3ad32ec425743af8469f864041b56c534abce9b9a1d04e4c20
- SSDEEP 384:CqVzlSful8OKT0WNSRCDF0dKIkFLV+aCY:hVzlW50WsRCDFaeFLV+0
- TLSH
  T12542784B6AE3B424A323B1784E8F9804B915594B2D9FFD497C2D81D05F1D42C93B9FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  fknew/assets/js/fb-detect.js
- Size 2KB
- SHA256 4fb7c08ba8a0936e8c286b137a4bea08e578a989861c8b18b0f0d5410971a178
- MD5 949685547e553e2c2767a5e26bcb55b4
- SHA1 bcd6ec8525fa1560e8677e156ea663b274317788
- SHA512 39f063c38e8de058d46d6b9291ca09637229f2f795b3539f7752346f9f29acb62f4e3a5f5a432ef5dd59267c227f47a748ee8ae9feeb5baa0e77b4c7b48d6d18
- TLSH
  T12451A5588A93183F297BC0D3F65BB1157921C033424BAE01BB9D6695AFC452B0676BFC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  fknew/assets/js/my.js
- Size 1KB
- SHA256 a1aea23b2966e0269145df54d1fcd36e4edb1a00ec80a6bd402f7e6ff10bcc84
- MD5 81d9c8eaff8e678bd071ca0d7d2734e8
- SHA1 dad07bef786ebf9c8384ece3a527907d3c4c9fba
- SHA512 dd507f6ac9b0a69343a1eb71c338ee10072b305a20b5508d1bb93bf042590b9beb5d74b1b7ebaa8677f08172ee5a0a391a8beadc611ebff81ca5edb9b741867b
- TLSH
  T15F31D266B8A2197014A572F31EBFE102787720829048B64171864D8CBF9783C47AFE5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  fknew/assets/js/product-old.js
- Size 6KB
- SHA256 a47f6b15d4c6352fae8ba66ee7c8fef425e368ab7ca9ae43ff39466350f7b321
- MD5 312d10b018af749e07c5851b16b72f17
- SHA1 32b0d65fec76d3496b8c376aff3075e34f43fa4d
- SHA512 768fcb459c49dcb724cb5c274a865499dc948010b1c78e75eee3416264df7ad6e6089992c8fb310992222fedfdff9525312156ef3e84a2921ed0f20c3fd8ced3
- SSDEEP 192:kWGtCHs1cT1+Otje5UF5TX7XDO+38HPPnVop:mKs1cB+4t7aNQ
- TLSH
  T1CBD12008F5F64937682320DFBD4BF8E0B67155837259CB4078EE51C83F5C9A28396ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  fknew/assets/js/summary.js
- Size 1KB
- SHA256 8cc3d51bc17cb5bac84d62ff2dc6293d27bbc7cf90c704ab7e746e03060a0dbd
- MD5 7ec1d4c33ff599b6b227c7acef9040a5
- SHA1 4ac946023623d8e3fdfe5513981d7a90cbbeb6ca
- SHA512 e7fd8bc48a92da0fe77239cc4fbfb55d9ff020c03ac113e7e4835a588bbbb1a2cab2ab5fd665186234a21e95c922d2488a744c94ece2f489574c7473fd52917a
- TLSH
  T16A419C06DD6C2602207630A5DCCA9144FEE594A75259CB0230A8D1883FECD9EA7F1A9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  fknew/assets/media/favicon.png
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  fknew/checkout.html
- Size 446B
- SHA256 87f1f678c820faad0d39dbd843a860e0071d476ca1378e0e2d5f3a8e4b940d6b
- MD5 bc730ce72bd82daaba648ca0a38b5dba
- SHA1 c1d838d00282a5e03a44a3c74fd1670e9cf3848d
- SHA512 8dbfd98682d41b0773a676334f47b5d7eb3469d01d02948390c7ad8aec8c0fa4700954c7c110add390fc81530702941d5adb1de245840ab879b15e8ccc412fbe
- TLSH
  T15EF0ABCEBE05C83251A93681AFBEF10C54075605E892E56040F934581A60FABCD43E90
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  fknew/index.html
- Size 212KB
- SHA256 d52ff334d67689c0f764fd9d6e7bcfc8252b9243251ba88659b709b2e02abac3
- MD5 839a23001e81adf395c97cc74faa197d
- SHA1 9513aef6e16cdab4e15f02171fa7f97b5208964d
- SHA512 16cc4066ea30f1165338bb282c72e68f35d8c2f3d7563a9372cefb0ee3aa603dedbc345303f98e6d052463948277b486d3db104679dbc7249664a65e71edeaef
- SSDEEP 1536:hhtXealCgp00oEfGcVvHiVMtKtF6t6970E7VvEh7UB6O1SQzzBDc6WJ7uJ6qKB3z:h7XYgp00oEfGcVvCVMtctP6x
- TLSH
  T16F242E6195F241A7106380D5EB302B9F3F71A663C5178B04B6FC2BA69F87CC69D6368C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  fknew/order-summary.html
- Size 446B
- SHA256 9ee113d6eba26c79f2ef9c01e362117b65b9b0010a07ec968725cd092fd765bf
- MD5 6591caa5db873700a5c2a493b9d0564c
- SHA1 1c8d891ca948aca36fe701f8f3062087ba28aa7c
- SHA512 d5e8930fe70fd082b418de75ee3f6cafd107abdd4e7eec5b855d98383ad0393eed67c57da727b1a7b7e3f2f6d907f858c84879fe518897ec14ad97535bdbf185
- TLSH
  T116F0ABCEBE05C83345A936819FBEF10C540B5605E8A2E56140E934680A50F9BCD03E90
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  fknew/payment-assets/css/AdMTtDSBh0Tk.css
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32