78d7a925e8bc4406e84833fc869db8ef5c8eb2b33bb748d6f8bc076807add572

Sharing

Copy URL Twitter E-mail

General

Target
kamlunggroup.com_jakarbuah3_cartagcom_nggimynsoo_backup.zip
Size 7.9MB
Sample260622-g1r2cah16w
SHA256 78d7a925e8bc4406e84833fc869db8ef5c8eb2b33bb748d6f8bc076807add572
MD5 b06440bd01a4dfba214b7776e435d32d
SHA1 1497ea61dcd032402a2d1394a8143c7574b213c6
SHA512 f514a19687f205407d8218778d4780908bc4858a67c10720e2b734d752eac2600548779fb1ed542c387d77eabd013f1c5dec6dc38c65e77ec04c6db3483cc450
SSDEEP 196608:Aq5lmS/biBj64Z2gWZQYUQ44Esn6lqpoDZB4YnNB:hlmCbiBj64ZoZbU3sQq6DDxnz
TLSH
T10D8633C13384AD0DC19B6D7154E03ADFCDA8593B54D6604CBB0ED05ABAFFE8892937A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  contact-us.html
- Size 161KB
- SHA256 486ec6f11a807bcc8fa5aec7da192353ce1b3831bedc7bc93359e53216d2cbf9
- MD5 e1a13296048f8f1419be504671ce3361
- SHA1 71d872ccd629a03dce2570ad1ac57062b4c03178
- SHA512 5271a64193dac4d2fb97389a1f46cc5bcfac8db66505131b4578a8e41eb1ccb5fd65b7bb7a3d597573f6e6c25569ea8c4ded090f2bb88e399cb5357b72dd9cc3
- SSDEEP 3072:uW2Xe4kEwXWfguIgTXWFtXCFHX/FfXPFZXaFTdXgFQXRFth5CSMsnc93E3vJFl2v:uWie4k6guIgTXWFtXCFHX/FfXPFZXaFC
- TLSH
  T19DF3E65E67B631B170134F06FADA6B24876CC2139A610DF6B9696508CFC3A9702E371F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  gallery.html
- Size 180KB
- SHA256 64c2853065672d7f4a6eaf32a4a412d9f49259303e63891932f2c0afd6edf901
- MD5 6a9d7a8b760042d5e36aee344bf7c0e7
- SHA1 4494921cea2592dac3382c3d7c5918a5e7abd029
- SHA512 e4af8db5eff5f57f575b3db67416edd6f67ea4ec863b154c97676d313681cdbb8cc0a68df95ef1a2ac9ccdd58f83512ac54601bfec7b78ca38a4be7d1c6faaed
- SSDEEP 3072:uGzze4kEwXvfguI/TXWFtXCFHX/FfXPFZXaFTmXgFQXRFtQ5CpMsn6Aw2yFzM8tw:uGne4kPguI/TXWFtXCFHX/FfXPFZXaFQ
- TLSH
  T1EF04065E67B6317570134F49F6DA7B24876CC2139A610CE6BAAD6048CBC3A9702F371E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  index.html
- Size 177KB
- SHA256 0562af47d5c16a920b0e6a03e39dfe6b57a9379716b84d4720175f79259c7c04
- MD5 8566c29e86e181ad52323e55f05c5190
- SHA1 57e2985c4c1418fb98d5ca30625b1593bde83c9d
- SHA512 fa4a7aee75e533d6d10eea86f61554fd0e30065756bce213321093ed78aac3ea4df737ee9e96687d0f02c7a6222a7d20d0885269c97015406996b4d4e6ed128f
- SSDEEP 3072:M0Xde4k8wivfguIzTXWFtXCFHX/FfXPFZXaFTAXgFQXRFty8CP1jkb7jFdyMU9st:M0Ne4kgguIzTXWFtXCFHX/FfXPFZXaFa
- TLSH
  T11704E55E53A6317570134B8AF6D93B2487ACC2139A610CE6B9AD505CCFC2A6702F376F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  online-order.html
- Size 124KB
- SHA256 788a4d671471db63c3d7e12ccbc73e0c08a86fc685287d3363436b871d0f2e76
- MD5 79abafc21eb63680e853fc010fbc717b
- SHA1 5054078b6b9bddd2ceae70522c2a45aafe76679d
- SHA512 9576414767dc85152b042a3862d2f418a46082578bfd19b620e4d329939e3f331c0db4d0181a12338603202ca20852133a81b370e3ef5b0a34463ccb039ea3f9
- SSDEEP 768:+uNeFTZdap/treclGRNjcXscJGcz74kBbsEO1wA8TzguIsxHo5C0BOhMsV:+zaplrFl4kbowHTzguIGHo5CnhMsV
- TLSH
  T1A4C3F74A77B63174B1138B09F9D6B32446ACC113DA110DF6BD79A6288FC369702B3B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/ImageCarousel/frontend.min_ver-4.9.0.js
- Size 7KB
- SHA256 19b2de77dd341e5766ca379e9e11bd0bcf6662f30758cd88da7af048116ead23
- MD5 e482b2c317843abacec320d988aa63f4
- SHA1 42f01058cd264c7ea44d28ee456623f74a4bbf25
- SHA512 9a607583200e1e126a74de969b0a856ef12220102a58ab68723975e6e2f422936a14118a1162cd5c5754a9e629246d7d6cd4f45e30052b793bd7760c8dea5a2e
- SSDEEP 96:3WvY7YpSniyCTFymm3C9KiL8hwyMLZtf3f2ZMZkZnQIXGEuLt6GSJgGPERg:oGoSniyCT8mOitpHf+WylfIt6GSt2g
- TLSH
  T1BAF10248B4F430225AE3737B0D9F9401B076E4474C4A6E30B8DE59419FDDA7CA6B6AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/MasonryGallery/frontend.min_ver-4.9.0.js
- Size 1KB
- SHA256 9f7a8131aa9ecf782e3ea4dfd1f0604d33167737b5688c241b4deed85521f02d
- MD5 daedb18ec13beed472a58c1ae5386929
- SHA1 e70f85959ad72e46f0bdfb871542f2f39f67c68f
- SHA512 5599a406777a90d5fad70ab4dcf1ce4213b5f90b35cb4984fec80e6765a30c21eecba6d7f0fcba45ccd73ca6f3352ab0055603607e65e9225726e0eeed026dea
- TLSH
  T14621C04BB16A233719DFF9E09A6FAC046073B9B50BC15890555EC4B8CD74C2C12ABA5C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-content/plugins/supreme-modules-pro-for-divi/public/js/imagesloaded.pkgd.min_ver-4.9.0.js
- Size 5KB
- SHA256 96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44
- MD5 e2c1a80b99251b7b94726b41312fb160
- SHA1 6d3e11174e22668e69df236e5c4542168f7cbfec
- SHA512 4b93d9f46c4964ed7ab53f6bdd6269fd269f9f7d5ebbcb96af382531a8434f876c9a0a96a27458f60ae4de3fb7b5fb8fafd58936c7e8a0e47b1a2ec72f95b68f
- SSDEEP 96:bwRxr6JAXgWWwrrSTrmM4KvlGC89QPjRxq2uVBXeHRGKrc4oPUGPgNhd+qLoBV7J:bwjrycrr3rKvE9IjRxjGjgNhdTLo3re+
- TLSH
  T119B122CD77A27535229AF0B3A21F020F72B6406E6918815D7959ECF65CFCD192633BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wp-content/plugins/supreme-modules-pro-for-divi/public/js/masonry.pkgd.min_ver-4.9.0.js
- Size 23KB
- SHA256 367d6afdfc741fb48d2d9310e47c3924b693459a74c882c0fc545ec5ed7d55d2
- MD5 520e46df77727aaf3d5e799ef241be02
- SHA1 d20252cf76c3be8af37a8415d13ad368c762b4d8
- SHA512 25195cbd26405d3f3ee5241002f9255c626ec574e8bb2abca0831a60445941ab01f120431d96946de012b095a9934514adff3d0cfdff69e7cf3eb94c475875c9
- SSDEEP 384:cr7mIr/Dh5rA3rzB4rMhr/XWGHW/6rMz1xftF2OUVP4eAnbhfreD6dCBEOav7blM:iSxxGG2/71xftFqVP4eAnI0ROavPSCzo
- TLSH
  T146B2858F73007425428BF16696AF020F7137655C7A4790ACBA6AD8DB1CB984D2037FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wp-content/plugins/supreme-modules-pro-for-divi/public/js/swiper-bundle.min_ver-4.9.0.js
- Size 142KB
- SHA256 3d1e0960fed8dd23f59da33dea0401435b44bf6d18d25978e3eeb62ec7e2d236
- MD5 86d5c270156901644b40767297cc1a2a
- SHA1 f9699c071b3ba160fc46de78ba9e8b28e26affe7
- SHA512 9bdcba91d958472a10afa5f05cda557551b81c9d2b68135f23b118bb8a31e1ec5c46b2d49368cc978bf793a4bf03310a0e5236348cabb66ae42ba05305261556
- SSDEEP 3072:Fo6dezM8ABXhOoMcrOpADH79cVOd3dqIvv9:G6diMNOoMcrOpADH79cVOd3dqIvF
- TLSH
  T13CE31789B364B2A151E73256539ED10263B65805B80AD1A470768CD7ACBDE8C03BFFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-content/themes/Divi/core/admin/fonts/modules/all/modules.svg
- Size 294KB
- SHA256 4e96c47e5a897a089177f34082015b96cb29eeaa5a8ea1c287423b623ca7316e
- MD5 6e3a57866a2804e45c4e2eac3b565c9a
- SHA1 ec61e990e5f34ed24203361f3a9b084b2309ed24
- SHA512 6c4a050925a8710115a6c98eaf5e08713779396eec7eba2f4712ad1eb1df18e51919db9cd02096223d9b9f404b737e49d2e01f1ee82d5223869ee109cdd31cf0
- SSDEEP 1536:9VLW1NKPdggCCWeFserDBK5VU5UxnHmVWVH8eNNeU+tet04/3Mo+N/4KjXUcy3XU:9GCBCH3BlBTnyoCK0rZV2BOc41G6+0
- TLSH
  T16B54B6D5E734F1BC4BDADB8BEA2400383C2AD5EA3F614A34A678EE350ED361585449CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wp-content/themes/Divi/core/admin/js/common_ver-4.19.2.js
- Size 1KB
- SHA256 a104564722900ae2490de0f71d2a4c633e5d4105a3472c2f5cffac55f2a685a3
- MD5 bc46e69ef4f073948358a37a79a2ac1d
- SHA1 6eda4f3dda17b97237141c09a001515e3a6fb8e2
- SHA512 56ba3cfb56f35517e8946acc792f91b63b5295b2753fde558eae0da34ccf0801dd7f6b45cdebdb343b0b807a0c39e8267e6479439095385ca30f3ec81eabb6ce
- TLSH
  T108216B4947AC9055CD1230F6141A70F8B9BE90A7DBE00D7BFEB3E618D6C04A6127DE9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids_ver-4.19.2.js
- Size 3KB
- SHA256 462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
- MD5 fa07f10043b891dacdb82f26fd2b42bc
- SHA1 9c1dc49e9747758e033c0e9a7d016401bd78602c
- SHA512 828f723649ae5a7b996de43fefc9b904d1a1d54f83671cc6998fdc7e0bb75c7761c8e0bb4a4497f2e4658606c193953c7019d7859e6ebab3db34c794ec575618
- TLSH
  T11361316932A6282D4D5330EF1EAF4014B619C0B707EBE86C78BE85C98F849480625BFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup_ver-4.9.0.js
- Size 22KB
- SHA256 218245936977d52e558f054ccfaecba631664d718302b1ef83a869da6261c8ce
- MD5 5c1f973adcc2acce831956ae9f1ebfe9
- SHA1 2ee3fc5c7e43a02fac82ae714c9488ce65075e1b
- SHA512 7c6bfced2be7deb3298fe67cefdb86e80d4a6fb7f55c36a430e71eb5c5bb48802313e969ee2a86e978701f5298e53e1e40b3ec50442a6f821433a18074b4d8bb
- SSDEEP 384:+4j4PhVOFQ2G2XAQpFVxRQZjilC1LtAYTn5h5/F6l8aZwENztLnpz3sc:+hPG2F9hn5h5t1qBDLnZsc
- TLSH
  T194A21868F2A2B26383A735B4646F700D35729953EE06C845A55E98D86EFCD889037F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wp-content/themes/Divi/js/scripts.min_ver-4.19.2.js
- Size 267KB
- SHA256 425c17cc0de74e7e5ce91bbb6ceb6405518d61a38d298938099ad3289ab5c1d3
- MD5 8115ebe3b0544b7c5f218658b1a5ebd3
- SHA1 50b3f04903e15b688c9a8cb691812175a8db6b61
- SHA512 7b09c2dc2395fdcdd74ae6a02e4bdff7d98374a7925c840634b451356401f40f5089954ef57f86dda6db07466c7e5ea2ea19b149e770901c78aa0a94f326dcbb
- SSDEEP 3072:NyJFhgNMH+/DJ6eJOIZGrwtux3E0pyPN2c0EhH6rUa8n7OS:ghgNHl2ctux3xmNVharUao
- TLSH
  T1A244D74CB360B8F162FB65B5116F670AB1726D17A40588C0E172E0F85DB8D8E6263F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wp-content/themes/Divi/js/smoothscroll_ver-4.19.2.js
- Size 5KB
- SHA256 75079f39fe739015589a0f995f41b4c1c29d4ebac85c93a792926af09f61cc83
- MD5 b6a40b8c22e5dd0e51404ac7aa45710a
- SHA1 823e4b015387a2714f826a7f386a0f6698c4b6e2
- SHA512 0efaf2570d7284e021ee0e37d3f25ec594d6dba246cc7912bfd30c796e667bfa84f10c7f2ceb2fecb45499b0ad3b29e90e3aff8cbddcc72e31da83449bc3fac5
- SSDEEP 96:tnXf6Q+yx+BgZi1ZUWkEf5wZGWypDdMCBUw4XfRPLJvOIciIC0M:Fv6XyxhUkWkER8GWyjcfRPLMI0M
- TLSH
  T1D5C1E9F83692B4A183A7A66B913FA300B17545206407E870D73CD8847C78CEAA25BF69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  wp-includes/js/jquery/jquery-migrate.min_ver-3.3.2.js
- Size 10KB
- SHA256 d42490c6288f50ed2c60dad5c0e8c916f4f59ada49752918eb985ff6b361ed7a
- MD5 7510cd2a721bbc1395363e90a834e7b3
- SHA1 fab5e7783b4736101db71a15f706100bdc04e347
- SHA512 7a2c4c6c7c5b5f28e6b60a9b0900b535c21e544fcdc03cc49fc3764d074b7b9e1c7fa90c7c902e4891fe9b230d01a279df06c1d9f49959a403a3b7bc13062c19
- SSDEEP 192:JrprDNvD66fPP/+I6OP1fQP0OIr96DB6MHXcwr1RV:JrprxG6fPP3P1fQMOIsDsMMI
- TLSH
  T1A032C59D71A6B4624EB735B8B03F939F71B605D9250D8940D26CC9F6782C84EC22BF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32