bc04631769f7a601ddd4e4ad2a9aad1f3f72e2ff900ba923fa886727c1516c8b

Sharing

Copy URL Twitter E-mail

General

Target
verifynationalID1.zip
Size 25KB
Sample260623-pdg7macx3s
SHA256 bc04631769f7a601ddd4e4ad2a9aad1f3f72e2ff900ba923fa886727c1516c8b
MD5 244f08a97f700cfa8b831c0b64e5ae3f
SHA1 1a200c47bf9a0242346ff20357c1f8536a7d26be
SHA512 275dd703a5c03dfa178a6cbc464c46efac8dc9c247c1d5461891f4b77e5f570d2f7e346af3fa659c471656860b808dcda3de85216475d15a86daba6b9ce26ec8
SSDEEP 384:LjWEGU54I3W9rmqia88tTw16QhP2pJIU6ksy3XIRgQ5GGgiwy7QN/RRHC/oKNPK0:5GU5d3cmqtKhepYy3AQy7QNvC/ZNuW
TLSH
T17CC28D7657198C70E51F8C7DC0E96286C26E51C381CA648E2D8A12D4154AEEB3FF7FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  verifynationalID/config/email.config.php
- Size 5KB
- SHA256 078a299096cbc808888ca161750675d84b7dbe71ce9d47a06edc6fe457da398e
- MD5 bee875b5934a3e0bb4de20fcfc8048ef
- SHA1 b06775aa8503cbe41a29e5407d4b57cfceb04157
- SHA512 de8eb157d1c92887147d1613b54e09a4cea57297d8c5c88c0fd8ee645a5a4714d0469fbea9482fa5cbe9e7fddedac9216bed46fb26961c688ad1833e6bdc9b6b
- SSDEEP 96:SsbytD8F4KDE9ZJuwEQ/0KE1QNh0T4PBWTd1KC6V+ohQa+dimVkmlQNj2ksmQNyZ:SsveuwEQsKE1QNKT45ad7eq5ddVkmlCT
- TLSH
  T12BC13454B4A724140BB3F07F9AABE0025594481B616CFE637D5D87EC6FD8148E9F4C8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  verifynationalID/index.html
- Size 514B
- SHA256 45497db68000420ff020b72ab828991c6ee51ea9d81a1184124654a9d7c06f9c
- MD5 9862aff47e17a32fb27cad969ea8a8ab
- SHA1 c80a795de597c89fffc241b40cf6f4e15625ae1b
- SHA512 9cdebf3902901bee9dd6d37438759914438234a358b558f3b16aacabec728694123ef3eebc19ba91205a34871e8d66153b4584ed22e3b650ab66f1b46f9bf2bd
- TLSH
  T14FF059C744D0028692F362111DDAB21D2173A5AA1746D8006D9DE19A0DF9B8FCA6F6DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  verifynationalID/index.php
- Size 26KB
- SHA256 5cb6400e6b942100edde79efb463c4563bb14f6f34896e091ba5c7673932bd6c
- MD5 03516dbba0ad1026492332643e4c4b8a
- SHA1 f2333676906d9f93f3870e73772adbcbf3666b87
- SHA512 9ef7760315765e1891697f0a72fbd609fe04074cebdc1c26517cdd3a403cb18026d0c4841da271cfe744df57d328dcb1ce1ba106819c7a53aa6b1fee48f527d5
- SSDEEP 384:Y5YlxIrsmwRciM9+bLoyNLN5lo5XOTd/CP8hRokpQbzejf8sA5GuOzpz:Yw7oyDLotq/CaokCbzejbA5Gugpz
- TLSH
  T17CC2B6B674A750706C8796E62BEB465A3751D1078C0AC890BEDD43A44F85FF2BD23F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  verifynationalID/payment-failure.php
- Size 1KB
- SHA256 b0d6b09d71006b2f38a22307579d7206eaa1744cd4a41c040add4e31eacfd6a7
- MD5 eae66734e56ca1cf27fac4df57a93790
- SHA1 eba0afb4454d6ceadea3ed7b158d7778baf1b78f
- SHA512 31b5eecaa6428d4d3bbd8b95d3339bba71eb317e349f440de70ab3f562fe5a24c9d2e797cd832c9693a1d13c248d689cff0ae9a5b472b621b0a2fb4309e15d31
- TLSH
  T19E41469B6451444535A607E8066763093583C16F511BD8803E8E83EC6F44FF797A7FDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  verifynationalID/payment-success.php
- Size 3KB
- SHA256 d9bce47c327cfe86d521fe442478408b3e321e9abaeb52234abd8712a898c1c9
- MD5 37fb86eba2aeefa3c5ad38569bca1dbc
- SHA1 9991180c5df2efe54df9571056ef4da4a0c523f8
- SHA512 76c3b2f4b56eeaa21d97f5b1f4b832a51f96e2bb9bd996d1699cfe071c9f2c406d2d296df4d39f135be24878c2d3d8362e0eb4a75b04d2123bddef868b9bd71b
- TLSH
  T12061864B64C504CD62E3161509973B083193C9AB810DCE44BE6E43E89FB4FE7B5A7ED9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  verifynationalID/payments/callback.php
- Size 3KB
- SHA256 f37c1c84ab28e2f2a2afc1c8b11609295b80cafddb41c810e1a0c1c47f298ad1
- MD5 742b5458075597de2cdee8eed62590eb
- SHA1 d7edfcfcea9adf015736a98079cb5e54a33679a7
- SHA512 f3be08ed049f6c08adaa44ef90b6834d74d32d9fed1b565e011ff751a110e0f58a1d75c6733051859c5a38568df6a60521f9dd927909194aaf8afb1b9557d7e6
- TLSH
  T1BD5155803AD761D669A3E94ED9836206A32FC24B14595121FD9E12084FD26FC37D3EB7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  verifynationalID/payments/init.php
- Size 8KB
- SHA256 7e5dfd251a21e2efda66a4cff9f4eb93306d1a50ec6b75c34612043cd74b6712
- MD5 cdbf5b6b65e735e73681a0f6f01329a5
- SHA1 081e80a1edd7114b18cac4b01177c7f0fb77f410
- SHA512 e202610ec4a56f057a3ed50b8a264f9b4054d605473e1a0dc194702447ed441b79af8f9cf4262e8702f05c57454aa8203ffc0bc4df9c475bff9affe07cbedd58
- SSDEEP 192:lib5wx5IRVwL6i6Utr5UNQIoUd3AV9sq3A4n3dFAEMK5RXC/jTrGJAEMQoY:lgwxeRA6UtryNQIoUd3ADtA4n3dFA1/+
- TLSH
  T1ED024286385B51D216A3A02F361F96455A9E411F4DC89812FECD33A80F85BBCF633E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  verifynationalID/payments/verify.php
- Size 4KB
- SHA256 ff33ec209a1aa0db922e245a4990ed4ff65f208335393a643a41c0bba96814c9
- MD5 3872c19d30ff614f9d72f367cf9e1007
- SHA1 d12f0b2f720864d25caeb659e0e981a3262af27a
- SHA512 de525ccfab063421b2fbe2d34b7fc99a1a0aaa7af33596c35f207008a09383794e13c62920524c5bb34ebb0861ee5ecf1a4676fa607b3b2bc2efa39ceb637b88
- SSDEEP 96:tnJPOkgkZZhu9ug116vUw4zPi/gkmTR9nUSgr1tzPcSgrl9r/kpxU:tnJPOhkzhPgL6sw4za/gJd9ngptDfgZp
- TLSH
  T1A2919484B88711920A73A02D231F074DDB2FC91718198552BE6E52E11FB6FFDF35396A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  verifynationalID/payments/webhook_flutterwave.php
- Size 1KB
- SHA256 0632b9657c5ecb287cc4a94bcebe3f8f11e594c27d700ff7c72c7c8c8c0078cf
- MD5 2af7969224b2d851daf4a30eb5a9de7b
- SHA1 5562c9aaac962f963f7825ff2f2102179e771f85
- SHA512 6db8bf92babd5c510b8e854740f92edcaf678ca1d815556b278144f87b8b60418b1dc7e208b705e331192fcb3f485e09a776fbdb524aa11e75cf51e6367a73cb
- TLSH
  T1332128C53DB174639991F45B5307E4CDB68B907F3687D021BD6C13041F44589B7652E3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  verifynationalID/payments/webhook_monnify.php
- Size 908B
- SHA256 5e9a71af7963686d8faacef6af1fc5517f64f3fe3de38c9683436fdf22fbdf02
- MD5 1be92f7cf139c73a3f9b54ce5ed1889f
- SHA1 2db6000ee4ef71ff9364e927b35884236ceac853
- SHA512 8caf484e74ec3e85f648f2cab79f264539ca4e6ab859294f367536aa4724df53c01367f42c94cbaa9b8977439a5891df26e3059908dfda1fe10f23f62824dd80
- TLSH
  T1B8119CC229A12192A6D3B02B4317D0C9662BD02F3D959020FF5C53185F40BEE6B637A2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  verifynationalID/payments/webhook_paystack.php
- Size 1KB
- SHA256 0df56cf6020917879bc7cd6e53637f90f6c9cde82cea0c5de071124d516b97f2
- MD5 72f90274458f17f75a9773bc83ecdd41
- SHA1 cbac6cc33b12d9831917a133f8e2b6a8a432b72d
- SHA512 9fe70e32b5f212573cfd272badbe5a68801e49358cf162447f7012c0a7fb6ffc9f81803380373431d34ebb631f288a0117fdc13632d580133cb10120c2ef1eef
- TLSH
  T1672114CA29A119825762F4260717E5CDFA1FD07F28D9D011BD7C53081F88AA577B32B3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22