200f7d1118525983b6c2e2fc892f2b35a31ad56a4f818cb5e94c0d10344155c8

Sharing

Copy URL Twitter E-mail

General

Target
wizwizxui-timebot-main.zip
Size 622KB
Sample260623-g1r2caa15t
SHA256 200f7d1118525983b6c2e2fc892f2b35a31ad56a4f818cb5e94c0d10344155c8
MD5 d95caef6cbb2a66aa112601617d4936a
SHA1 dba712742da33791d98ca3d3a406e853af45afd0
SHA512 5d6d9622955cde3be09bf84cfc27a28cdaee574953818fe6b25a793470e02477f90f8017c162e11b6c624cc3bbdfc938ba3ae96ea5d0036857c66d297304cffe
SSDEEP 12288:woQbiI6s0B5KdA0XQuqGMNE0AdFCInokQtLA/KxnwyQPnhEy:stErwADGMK0onokQtrkEy
TLSH
T194D4AF38E270E100D30E58FDDC5A145962AAC31DF38A1D957F444E1FEE1EACE6EA1672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  vpn/bot.php
- Size 441KB
- SHA256 1ce31c116f5549f5250b3a3ab6b9002fdbc014495dd614bd8487c0a5dcefbeba
- MD5 aed88bbde25014c4b579439f725e3cdd
- SHA1 e493f2f0c8aca13f59a1e02253f0396f1e31ba54
- SHA512 350f2cf343344cafcc6170863699e08c05493d98f0b8e6587704db395aec00f6258bf5febe64c2e52111b143e1e852321dabd56d8e6bfa197b9fc20fa3736ec8
- SSDEEP 6144:VQBKYZzXboQYEzuBTfoOD9eEN6Y+7VE4j/PKCmSdXLpCR:VQBfzXbok+TVDYY+7VE4j/PKCmSdXLYR
- TLSH
  T171A493653077CF2455F7A01B27876928BA6695037104DC41F41E8AC54FA8AEAFEEC3BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  vpn/dbbackupwizwiz.sh
- Size 1KB
- SHA256 6ebc73a7132cfaca0f71435196493b75d1f5b863f2a1e3c7b4efaec8720df794
- MD5 3db3cb57d3647a2b25411b7855ea6b37
- SHA1 3931787ae5e0449043c8bd460c60fc11910f6f97
- SHA512 a6d992b04b4959aa4213d70a300e054cc91e8f255b80912ab8ff3e76695c7edd8ef74045f6d2cf1dea34143076025ba20a1ce02e367277e6c25fc1b5ee18be8a
- TLSH
  T10211328E032A9D35EDC2066149B1B35C8A6EB4566075F901C4E0F5EF68C5FAAB8C2F0C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  vpn/install/update.php
- Size 11KB
- SHA256 7f3a5392ebd60d6a8870925b16b4a3e8e365ff600e0d819028faf30287ec8c41
- MD5 1e4abd5bd0db0e43824339a42f39c556
- SHA1 930b02d0c2218ef7a2d6585c130027e2e794f594
- SHA512 d028322b44d3312dfdbcd05822337f806171fbd4c3a2649a20a582751e8128bc94268d456c5808fb7e54eec74aa5a563423d41c12c484b0eef41cb046d5f13c8
- SSDEEP 192:3ejzZ6qX1D/uwc+20vLiE2cxxKLCP7byiCEq4SHiv3yn8zSt:QZxDxKc6cPKYzot
- TLSH
  T1C632744E3A072B4418F7A52081D669E3A57C615F6F24B040776E40D88FBCFAE46F629E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  vpn/pay/back.php
- Size 37KB
- SHA256 60dc3ef78b03a8ff932ea2eafb63e9bb8399d54a4d9098b7e9192219090016bb
- MD5 498026b14c496df1e543d349a609c5db
- SHA1 40ceb5c7eec6480390f12d4dfd7b1a326b0d4b26
- SHA512 b0ae5efc1036718ca0cdbcb82fbc4644019fe1dd4b2bcb8c907deef0d54a645a8f8a245065f3bf58d682af2d8b4e27087b1eebb34e2ea3d5a88b2133a5eed585
- SSDEEP 768:V6KblyI06TEc65+lNTl/03yyOISAufSRi:V8J6YcW+lxC3yyOISAufSRi
- TLSH
  T19C0362103873CA2416B7E1172B83787C6A69DA037245C80178BF56C54F947DAFABDAB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  vpn/pay/index.php
- Size 8KB
- SHA256 84fb745134c148e46bb18783fe81932570695fe4a051735755494a97c491f255
- MD5 5e3e576a672339b70ab265085e30f058
- SHA1 3b4ee048a4c35891d4f7d7a513eee8532a12da25
- SHA512 927b9030d7a6101ac407d44e134b46c2a2ae331297728c850fa3e9c628ccd5ab440da5c19dc8902ed2cec3d7285a318f17eefb14eb030ae7762952a4d9cd5de6
- SSDEEP 96:1ogNYzRHBUAMiOybBEOTsfQVUiiCkX59D8PcIdZHXFWgQMf918z9gIQEnqEVJWcG:Cg4UAMihBlVDkHON1VWq96z9PPnq4+
- TLSH
  T13012B44034B3852520FB84BA67573829364FE507655CC840F99E21D60F98BBAEDB63BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  vpn/phpqrcode/bindings/tcpdf/qrcode.php
- Size 81KB
- SHA256 74a281421414fccbfe77a1228afae7324c0f057140000cbf95ccefe18b9e9c82
- MD5 c0a11c1419131032614c0c5d2c9eb145
- SHA1 90a5ff87c6230eb872f4cdeec6ccaf55c35ebabd
- SHA512 dae2c14ac6d1a3d6f90c8f6415d5b50fdefe30564c18cb64aebf56f2bcc1aa23e7c175b2c76deca72513f119994a3bdc30260efdaa753d914e158f515db5cd27
- SSDEEP 1536:uU/KfucbiwDtZ/DVie5fkAxIOxIxQkxycf4hz0T0T0Tn0he0lMlFw:uCCiwDtZ/DVie5fkvW6fH0hec
- TLSH
  T1178365D1DF4E68BB3242F0D5274A8688D2BCA03BA5551CCBFC8AED58730463C56BC979
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  vpn/phpqrcode/index.html
- Size 1KB
- SHA256 11a650b4f7c5709d7972353329a516b3eebaa8e8071f5229303626222d1714dd
- MD5 48ab3e833b9991653ec5f91d95ba5c25
- SHA1 ccb29be589251246478e4ec60998bb4b900628d8
- SHA512 d87533c4979f713888aa95a6f52980c5789480235acbaac58ac4689e63da0b79aa6e6b320568687c16a8ab95a4c6d4703be1b938119af00386203b112be5dff8
- TLSH
  T1C031536521CEE0BF491382A74232739ED0CBED05E753A913A4F132BB03CAE01AD2311B
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  vpn/phpqrcode/phpqrcode.php
- Size 118KB
- SHA256 291332fcc8d67e1bddb4253a7c26042d98250f0966af07b77cdc7f4d56b7bc36
- MD5 5d6fa18048ed122bc94aec4f88b173d0
- SHA1 1a6c460c0421f2deb5a787efac907f748912e27d
- SHA512 27c458834c569c2e9a4d6209eec50354b15fd3a5df4e7d7286226c6188f080a4c92e600aad331e940ef887b40d69e1211652fb93c0382e8727514f8d92a52fb4
- SSDEEP 1536:Zwckp9Dxf0/0/0/3CwE/FoQ0vpm2vKUvP4k/vej3Sewbg9RgvDpD:vkIv3/63SewbbZ
- TLSH
  T13AC362483D0659B823B3E3789B478049E77B156B6A4B0A81BC9E5BC41F30518D6EDFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vpn/phpqrcode/qrencode.php
- Size 17KB
- SHA256 1f912b413eba03b5280dd98af39300d3ea851a9fdf9a9ebbfa549292fe4777d9
- MD5 dda263c8a9742aaa71cc302820308541
- SHA1 3ccb9031591c2aaedf5840b41aab3fe7ce51653f
- SHA512 a6e998847a492398c8f318c001c286ba137faaa47492d12141936cd07846a381478e6e994d9a784511c23c1493befc783ec7133ce505f18bb5c8c3f7009195e9
- SSDEEP 192:YmjM6+7H+HkPauRd7aCkm540rIGUvB0VM:YmY6+7eWFaCkm54zLpD
- TLSH
  T19672CD442D495CF56772E3B89B87C005EA2B247B6D8B0A86BC9D43C05F3511CDAACEBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  vpn/phpqrcode/qrinput.php
- Size 24KB
- SHA256 7756f1ec86a9ad302818112b6ccff837187059d9b163e0b8d765bbd6c8fd21f6
- MD5 07ee5315fb6c319dc208de59a9de95c0
- SHA1 23feb45ccbf6aa8182c1933fdafe2fa41129f854
- SHA512 800c58a3b1f158764296db868fbc447f180826a144b8e11f7ebe7eda58b9a51991d7260cdafe4815e41d5933c8ff38cab7585d57d2970a8c0a5e67d7b08b0027
- SSDEEP 384:MIvymLaMmDMAfqwPMh/4FFuQpGv5LsNjJN+4:MIHiqKMh/4FFuQpGvpsJJA4
- TLSH
  T1D7B2ECD87D45ADA17573F37A5B9BC488E7A7202B015B0501B9CEE2886F3411CD2BCEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vpn/phpqrcode/tools/merge.bat
- Size 22B
- SHA256 a6202784156eb74aff4f5f6eabb35a2fe018de3c1d381114ba2ec4e1c6bc5f01
- MD5 86e934a4304536ad09b2f7b9e814241d
- SHA1 7332a0b8e467e48e283bdbc551f4075b896f6e3a
- SHA512 299aa9b4638f4fba9a471d018865a6202612dc2ac920e4089a045557baed4f56275ffc000ecb61171da453f08f31a725876cbfd254c810d911366da33baf333c
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  vpn/phpqrcode/tools/merge.sh
- Size 26B
- SHA256 5dbf7f46c5ef7da6663a1881df8ef8b1610058eb0fd4052545a79f243b94b6b5
- MD5 d2b77c3493b2ffe3d76d4fb9330e72a1
- SHA1 ea0ba5435ec10122e0c5f4076722b03b24ad8cd1
- SHA512 277a0e49b39520f5c96f05a10074b9f39348dd8bf918f1e2f8bb51469d1223e407474f1018c4fbbdaca147d013cc4ec0749c5992681731c95213c7e90ef1eb90
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  vpn/settings/rewardReport.php
- Size 30KB
- SHA256 2e39763e3c7fc85ff593a2f5d96cdaef9c16d45243f93e9d47d8302c21a3c43e
- MD5 7ccdae251b7ab755177929ef1c804406
- SHA1 7e9fb8b84cb2145d02fe36a6cec9c5567bf9f06b
- SHA512 420f54887590e976bf2fec2841e3cae6b8825cab7f74aca0fc170d989fb0447e881bccfbf4018b2a69803fb226d4ed2c821097375c1430e5bf88f816299d8e5e
- SSDEEP 192:TGXDDlvQ3iT7ahvChy5hcCXEPS58/943y9snMjqhkBBk8pKnk5W4BTU7GwzVBKGZ:TMDDlvQ3qGNMDht6l/U2LRJIOVx
- TLSH
  T136D243153873DB2456B7E05B27837C7C7699AA03B241C841786F85C14FA46CAFAEC3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral29 behavioral30
- Target
  vpn/settings/tronChecker.php
- Size 39KB
- SHA256 e2d987eb14aa1aa168147fa518e0aca558a1794ac5ad7e55fe501d6ef6582e7e
- MD5 46453d703b4d20759640c0a78c2a79c6
- SHA1 e67554b3350f077ddac8612e85e1ce5a6ae33428
- SHA512 6e234063216814fb4482001dda5a4aa7b4161beb70d971aadead7bfd317b88a094d10d265d4e9d779a84db875354551dbe03def0c48e68fae1ded0437d579ddc
- SSDEEP 192:vktbqGBBwcB9CvS5c/3SdYn/C5oj3GpJ3qYEJdWKGj7azzvTHkjGKTGpi/S0nyz1:MtbRBwcZ3bfNTl/PU5oQsSiWm17O
- TLSH
  T1B50362153833CF2416A7A05737436C7C7AA9A6037245CC41B47F9AC14FA46CAFEE86B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32