eab2b2fadfe2a3ddca17a9e131068d1356e582dd5d02457d7894e81b41a694f5

Sharing

Copy URL Twitter E-mail

General

Target
defi-real-estate.zip
Size 11.1MB
Sample260623-k55d1sbw4k
SHA256 eab2b2fadfe2a3ddca17a9e131068d1356e582dd5d02457d7894e81b41a694f5
MD5 f14d2d00989e11335a156fd521b4aa09
SHA1 ccc371f8dc668585c7f381db7f60bfc37e173fbf
SHA512 4d4b7c92cb3328867a0670bd6f9ecb7a95f1543079af6a298793f43472912c88b77ef52be95b5a61fcd189120966fa398ce1fec059e0cdea2273380cddb3c28a
SSDEEP 196608:spT7P3pcI4dd0MVxGJqrrHBdnc5w3d4dI2+Qpda6p0Cevx1Or0zHHBqnGpc0bpni:83fpV44MVcJetdncqt43rpda0XixArEM
TLSH
T1E6C633D36BAFC618EA61B1FCD89F5727BAD7261B01A0F0D3576850120C97AE8D45F10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  defi-real-estate/.git/hooks/sendemail-validate.sample
- Size 2KB
- SHA256 44ebfc923dc5466bc009602f0ecf067b9c65459abfe8868ddc49b78e6ced7a92
- MD5 4d67df3a8d5c98cb8565c07e42be0b04
- SHA1 74cf1d5415a5c03c110240f749491297d65c4c98
- SHA512 a19dbbc2ef6c367aadbfb900ae58c377d88ac9b6c0ac6de49c962d44d993418875f64143defda56bae8d0697dcd15be2928d32aa77508d3958769f18a4a53154
- TLSH
  T11A4132DA9CC6EB734C94C869BF8FD267F980AA580F6E791069C5442D3164EC9C0BF4C5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  defi-real-estate/.git/hooks/update.sample
- Size 3KB
- SHA256 8d5f2fa83e103cf08b57eaa67521df9194f45cbdbcb37da52ad586097a14d106
- MD5 647ae13c682f7827c22f5fc08a03674e
- SHA1 730e6bd5225478bab6147b7a62a6e2ae21d40507
- SHA512 be3780974589d06eddba6fa0aa15a3e3dfe390e2827a1a6ae5cb83d6ac47e79ef9b1bbb53f067372f8dc70db0350d3770e78537fd3cfe734200ff824eca4cada
- TLSH
  T1D7718546B305E5B0147BA621BC4FE0961D89571B27B42E533CC5F47CC8BF39111DAEA9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  defi-real-estate/config-overrides.js
- Size 812B
- SHA256 54acaa58edd58c2cd942271012d9cac59bdd2a90da69d928469a01dbdfae1119
- MD5 7dbdcb42124f24dc429265f90808c55e
- SHA1 278e0e069a49c0a14fd7f0ffd9a6d9d1a12983b4
- SHA512 5769a9b5014b3850b05acd019415ab83503948a98d1307a366b7da7c079070935a687002082b92f3e415fcef94a5dcbe2b24ab66de3f93f85b9296da121b357a
- TLSH
  T1810144D30ADC34171CB3BFC6E493256674ABA3420989608076C5A5882F9F58C633B12C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  defi-real-estate/postcss.config.js
- Size 83B
- SHA256 fa650b380adfabb151a0b352f7135e107e6352345f899060f1c5c231228f94bf
- MD5 8640f9b2e6475cc3f5b1ff4548925765
- SHA1 81781ed39dc8e6d6521ae1d63a67e46894acc2eb
- SHA512 f6f26e33366e073988477e7d08b79669e697ee1073091c2e681ee071705fe13371453dd74dcb0db3c7be79c47861ea8d528f41f6261fb9445fd311d0d8ae7d7d
- TLSH
  T134A02403407C33534150000177D04011F0DDC5F31C047CC073404D144F0D51F10341C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  defi-real-estate/public/home.svg
- Size 1KB
- SHA256 46be89ad45aa42e829337bd26a3306e86fbb307937ae965cade21cf38cfec40a
- MD5 3289a53867c5884b3ebba55322d79883
- SHA1 f41474c7c2158a01159feb178923dd89bf4a9a7e
- SHA512 01ee1c51995ddb8a60e1055e8222fed7f595e092847e1eef043eab41ae5e7f7377d4cd15f8ac88cccfc5642086d655c4a3f06f5ae802b862763a7f6f67fe0d69
- TLSH
  T1E121AD0563464BBC5C9544A0C3F3B78766684453BA2039FBA58B1D32A71F1DE42B73DD
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral13 behavioral14
- Target
  defi-real-estate/public/index.html
- Size 522B
- SHA256 11f7081c8c579e967057f908852d74eead8ee2ad1d1b76fa828f2c26cc63a7a1
- MD5 fcaee84b1a70d06b09c8e6e2c9a5d7ae
- SHA1 2c49da31955e1346ff498a0e7fac1e1ea7b045a4
- SHA512 d5cbd3d9e58f172bda15dabbcee80dcdbdd6a993150763b747aa7f8ef0be5fbdbaff8bd31b45711aac5f4808c6fdca02912fda17ea8fb355aed6b860d95b2b81
- TLSH
  T16FF09E4288F5C809122042666CD0F02DCD86D5CB67596D44B9DB20965FC4790C8D759A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  defi-real-estate/public/logo.svg
- Size 2KB
- SHA256 4954799945d7c613dc2ffa50d6b47fa78de6a95bba09ed50c0476c777c79a878
- MD5 c983c3214c686a4ed3464e6b70f91499
- SHA1 0ea00ec669a515de12816b0126b1259d5dc139ea
- SHA512 41a00ababbac82a19cef6cfcc39657266b421aef83bc77f153be0b3c2c62554fa9c16d443fe60e9880a8483a5b46128379a685e7cfd7f60e5d7c28d9683c3af8
- TLSH
  T18851877D4704D3AA8E0C5B5EAD6679BAE01DF2AFB4C2C399A654D430D6242CD631E218
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  defi-real-estate/public/service-worker.js
- Size 4KB
- SHA256 b84dc1ff5ed815dd8c71dd5a60bc706a0418da5cf68d7d91d4cf52103fc633a2
- MD5 ff5da0b292612186186be55009060875
- SHA1 229678b59d4a67d89c6215d02f3314fb29a56c78
- SHA512 c1df7ba505405c7182667e7af9a72e08c3f3cb4b0c39add75fe8f6490c85b01d413b600c1b83a2e29429ac3c45947d32b3622bf967a255ebb6128b3d18f43b9d
- SSDEEP 96:fgyg21bmi6EygKVqYl8AQywd81i2k3Kn+WQPkzTfkONO2HWd5:fgGZyqYSAQywWQ36IPITkZ2Ha5
- TLSH
  T1CA81A6F793A012261F4342B56B1B3052B23B90AF6295E5D0799E4B280F857B842FB5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  defi-real-estate/server/app.js
- Size 1KB
- SHA256 37230026ad493cc3ba7932ba083aa6f5de5df6a30ea7dea3ff96fcdded6eccbd
- MD5 01cb14a796b1c5835e0a9fec6fc51380
- SHA1 e1c799442dbaa6c081f243b185ce751e2045bc7d
- SHA512 bb84214aed0c631e697d1b81b236ff9cd8b54ecde0d385bcb2db121d4ac850b4851be9e1e7e3a2aaedc575562ee9605bc609190b7d726fc80b2acd3ab222e40b
- TLSH
  T15941715166D5762A21B24ECCE4990823B81BF7107262E851F33C90EF0EC1CADBE634F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  defi-real-estate/server/config/config.js
- Size 298B
- SHA256 1b3b59c95dca9a18be4a88b432a6997369c0e1009c571179f84a6b0ae7708d5b
- MD5 65086e0a4d3932a29768d3fe6eb4dbf7
- SHA1 01e469415fcd97c2410fea997bf06672ce7db923
- SHA512 09632f280badfd12cd8a6f9a6eb95845021c6aff87da9db4a1e552acabc6a493ee5b2256d167b4704c08e1fbab5a8515e96c6b110620e2c966c53f8327955f00
- TLSH
  T17AE0E7F02CF7525D4E0450495F491101D1D744B74CDF178C764F4D05A80331E05CC5ED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  defi-real-estate/server/controllers/auth.controller.js
- Size 3KB
- SHA256 d4a28c11f4443a07e06c65a27b8a8a011371ac0ca7fb13362c1e109b97f67544
- MD5 d1a33f3a907cb4b2b2d02db110b877ea
- SHA1 259a7823ad2a9d0f7dac13eaaf149fe535c945c3
- SHA512 bf4ec1630999be4decc1899a9d27d06a7babae0b89ca86139e683ccb851498ca866d0ca43a1821b240df002fd4d6a9f641f6a0023cd76b6b8d6819853e48e3e9
- TLSH
  T1F1711E0766E208100AA7A99A7E0A541A3E12EC03804EEC11FEFE11A51FCBD3D52F77F4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  defi-real-estate/server/controllers/common.controller.js
- Size 2KB
- SHA256 315b5cd8dc966d79ef557885c177865264c7e788248d377baae857b00ad7cb2d
- MD5 fbce8dca80196b0a2ff2fae4a0c50b57
- SHA1 0454c642591d6a31f29e3f83c2e342a33404ad75
- SHA512 8c6095d61336630106e974bac0936d42db475b9462610fe2203e1c0fbf547613f0d11185a8e1203c5abbf59bfcaa8051ef2ee8b3592d107697c4cd8806feeec1
- TLSH
  T15151B38A1BF398681FEFB44A5B1B51122E525C6B9099D810FE6C51B00FC4DBEA4DC2F4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  defi-real-estate/server/controllers/property.controller.js
- Size 6KB
- SHA256 fffac7d0a8b3cd66e4887be9f25af54735918f65858960f77b4e8e1e374b01fd
- MD5 6f67815a93da35bffdf201945cbb1533
- SHA1 a187f174747ad1e04f8445b7c7b400326bfe8be9
- SHA512 50db6471043f7d4c12ae8334e3707507f19b5070c42d778ea27f4addb76e7302994b2360e1ffec6291246b2e672acf88677b146ef52204d08715cda37255fc15
- SSDEEP 192:pXyjdF0JVUjY+dNc48MkQegkFJA+x6w66n+Gv:SdwWY+dU/MA
- TLSH
  T1B0D163855EB3942007FF745D5B86518A7A22DC17A07DE810FF8C13B11FC8AA888E97F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  defi-real-estate/server/controllers/users.controller.js
- Size 577B
- SHA256 623609667dfb1432ca87bd0d8ecbf7c4e53c77c42e34a2e73ae45cf467ad45d9
- MD5 0f827cc84dd36a6c7b9f012d7f2d009e
- SHA1 2ff2693296d954908478c67ac285067a35dbf512
- SHA512 9ae813da18dffee6061bc969318cd20e8b8f672ee6575c2c19364675a04bb7d387eb1aaf67fbd88e6f261900a3e1f36a9abc1d09b6bc08c851c01fbf445c67f0
- TLSH
  T186F027921BE2A40C0A5B7469CA5C80222A939463904DA800FDAC41B14F81EAD6C9C5FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32