a1b2af283fb3b9fd680e04f0086056ae72c9fe1eb53c52bf89c0f85331b7b3cf

Sharing

Copy URL Twitter E-mail

General

Target
deployment.zip
Size 29.4MB
Sample260623-wwpsrae191
SHA256 a1b2af283fb3b9fd680e04f0086056ae72c9fe1eb53c52bf89c0f85331b7b3cf
MD5 58e36dc84b8a39b6a3d0d0ad006c81a6
SHA1 810615236db4644c4d12bc413c454ee79a4ea766
SHA512 a2accf53b47f43d4c24f6504037ef8cf91f3a6024917296821fc9710c95041d1bbdd7c72e9521a4c1799d81167de01d203ca207694c8f0e7ea6bda9d90919fed
SSDEEP 786432:rOLlEFZmZcAG2VAHHDof00/wCsA9cMJ68pFB64:AsZm+x2VAHHDMj9cMJ68F64
TLSH
T1CE6712339A5C5202EC43BFB0DF55D852D81C06C33161A0A729C80796E96B5CD5FEFAAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app\Http\Controllers\Admin\QuestionnaireController.php
- Size 9KB
- SHA256 3036a3c55bf51cf3a35dd80f585d8e8f3bc88bddd9c922dbdbcab667f885edf0
- MD5 e16878662930c5f50bdac1ef20670bf8
- SHA1 f8979c2c1b2e40a3a1b7bf59b2419080503b279b
- SHA512 a740713b815e31a959931f0f76d8b3c33939cf1744137d1325aacd73c3e4d25b3554d3ee468ae6afe77d7b4832523f6e65d73c4149d22ccd4f56e494a190b471
- SSDEEP 96:MhsxXCiSxmPA2IC9SCmP1bUskCLIgU+VhjsqWu+7DE4sU5Qwg+HSckXMv/bbSlAr:mkCLaS4DEqOLMPSlACcGHk3
- TLSH
  T1571240A624DE4271DA3352729F56D65DFF72432372C307B1B5AC22A41FF01E4C2BA968
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  app\Http\Controllers\Api\VoiceController.php
- Size 1KB
- SHA256 44fd5b48e170a63a4cc7731f12ecd146e0081226f3901e72cf4a0e21547d9cb5
- MD5 fde7564c7a086f8bec476c27d6647597
- SHA1 743e58a39234fa4d968838315bf89bac9ffbab5c
- SHA512 51a7d9d5d9fb4b5e9a5f9c2425e3a35c72a45ef828b8de15f0bdbc4b929a1ae114ae8a0f5213b131ba89b9821a6387e2e41f30766ad1fa3964a34a2c594cc773
- TLSH
  T15421CCB218D202A1863A72AEFF43D41CFE31E10BA258491372DC888B5FF0988CD60D59
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  app\Http\Controllers\Tenant\QuestionnaireController.php
- Size 2KB
- SHA256 9c164e3bf0701ede80bb7ae4b3aeba20e13bc9cba73b1c9ec852c90ac5e6bab9
- MD5 34b6984f4aec47dd1d05de9092e01bac
- SHA1 89b7354dc32fe400e0941f3ffbcf6be0c52df9f7
- SHA512 df329d82fe5b85ab429978a2fbcf7bb537b66998f3f932b8a15f0f664481d784a97bbad36532765e7a506a46e727f44c8c5ca9b9f04c616dc1d1bb161e613cfe
- TLSH
  T15851158A38CB9170867291B4EF13D178DD21E64331A716537AFC61B80FF0B9CC620829
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  app\Infrastructure\MultiTenant\TenantResolver.php
- Size 850B
- SHA256 a4a041ed4a1879c61fc268e70d2816769085b3cebbbd015a11c61dba09704568
- MD5 1a6e2eb4e04e78525e85136dd0ada8c5
- SHA1 01cb9fbf7db5ec8591bf112408886a568e2262ef
- SHA512 0b22c1ced246da7ec46fd8f82b53ba53bda2d308da68a02036923a64c3ced812b0185e97af3271e04949194289f4050f5cf2d6c3d55a6a3994d59d243d091e49
- TLSH
  T1ED01D0521486F1299532F717D619F211E617A327A2070028FCAC47A83F73FC4B5258CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  app\Providers\AppServiceProvider.php
- Size 1KB
- SHA256 ed22e5bbe3a3271e383679e311eb8c6fa220806dd63ca15e841f9bdf672c67db
- MD5 bb8ef9d570366e17b8886178c73a770b
- SHA1 e0e3f324e2ae4c60ac2a907a09e0e0d45efead81
- SHA512 1cea32d7f499313a514159a0e8efc9cd95781514a6a76cf477af055969bfc116fed0a0da7f33eeb7b56c51b9eed551c47a447e860e822ef995fabd1322fbe1c0
- TLSH
  T1FB4168ABE9DD5EA381979C3EDA8712A05D2047D311B982113BED328CEFC0C684B2215A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  app\Providers\TenancyServiceProvider.php
- Size 5KB
- SHA256 aaedfceebbdbe9f548ea23a0529aa09b6d55adf84d532eca86e4a29c52993e4d
- MD5 d029e1a8767cc6001f3782b0b25315c9
- SHA1 789417d5f2c3d6b4679372df54f33915eb738e0a
- SHA512 dd1cd8433d01219eb340caf0ddecf5a4a6da8c090f3a089df39c16e9dac5ca8d536c043dbc6eda5a6e2cf6186d75927181915ecc550cf0f6a94088413e59c93c
- SSDEEP 96:N2wjzUa49gZWZXsXWrtrZh/5ly2h+EFXCL:0wjzr4uiXRTh5lyMKL
- TLSH
  T1ADB1F418A19486F5419B6F5A1F4DA042F110E8C79746684079FEFF8C0FD896863E78CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  app\Services\AI\AIService.php
- Size 5KB
- SHA256 099c65587cb4e2d18fc78e248b5d740fcf4aff6dc3bf517be8935ce90c854d81
- MD5 0e3731b2b2700ec4345b197d375113f4
- SHA1 1557b0b4f1d0cc709a37704638b0e73e6209b9eb
- SHA512 654721a653577ef6e766c810fe073b5626f6e9a8563b7d78f9f619278923643eec59485d60feb5a262e1381bd6c623b41de93641bac04668c6ac150a0c0293bd
- SSDEEP 96:MnKW/zHod7+O6ZJqoW96D91kCIwB4iUtv5wZfKhmorfNMpy:QKI7odCL9gAX0AChm+Oy
- TLSH
  T1D7C1A57A785355204A73013A6F41E819FB20D317E8406212FAED93882FF8538D3B8FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  app\Services\Voice\ElevenLabsService.php
- Size 1KB
- SHA256 2129b376d33b2c9d3687c10c67f736eca0969d342a19c9dfa4ddaef78f6244f0
- MD5 3608585c15a4900cd86be9c02b8213a4
- SHA1 df4e6b95b36c6dac7f812a8ecafd25a93269bfd4
- SHA512 cf9313cc48eaa06a681b67951bd021dee6015f0d6000150c41d480cc2020dd1e07185c2bafaffc0afa836b944e90121ce40db0ca638dfd25066795a1dfee401f
- TLSH
  T10D31428B18574D915572A7BEBF57C248F609832317948203FAFE51065FF00E88D70EB9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  artisan
- Size 350B
- SHA256 e313db8b935d646e728aef4402df1dd5345760268139449f13e98d9a294a9d97
- MD5 6db4e64ab2d4fa6230e6dad951a79530
- SHA1 925a54d077c40e11fb87f42891ead8b516995b33
- SHA512 14b6b21deff4dc6e9736449651f6f447a407110a0cf2f2c826df4f06f1ec9aba97c31c628cba6f53887a6dc66dae61adc834f4546c3b839b42e46da28431a0ba
- TLSH
  T1D0E0C0BB1B8C0121DB8534CC174CD5030C8CC5132CC030F9F912381847C68D97A663E5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  import_db.php
- Size 5KB
- SHA256 576cc86c81bd1b223b4da1991c40de198cfb84f97eece04a89574dc332219279
- MD5 62992747176e86e6baa40ea35eb71fcb
- SHA1 d1d37e5f565e45633d374c206ada44e262d6c7cc
- SHA512 a3d8ca652485a147e3dc8622ac3959a4f87e2fbb0ab41d07ffd86a3872eafedead826facba2850ed167cefdd0a3d1d90ee9730de78d0ff7418b0dd6db764e865
- SSDEEP 96:JYif6IN8xkYo1+rs6bPF4X1ocMnsBLtgs6QMtcEpkKBratM:OHIXYE+bn85gcTtM
- TLSH
  T105B1B61275C5E95889F4F22467A26962D57710039990EDE33E3E83DC8FB0468C1B9EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  postcss.config.js
- Size 93B
- SHA256 c713dcb623f3a959b28f6e7f724440660f890288c7b796d8c9ce42372ee7f36b
- MD5 40617f13f9f0033c23f7830f6344cfd8
- SHA1 c3eb3a797e3ef76dd498edd08b37c98b2ba4980d
- SHA512 d4d3a17503e3fcc432277caf738b2c5b9400d9ab46ab77628546c951c2ec39c10731e9dc11f0d45e600689806d616194224f6b89f7d87d6744329ea6a5407cec
- TLSH
  T1BFB01202007C6253509000021794401250D94AB72C093881760C05145F0D11E5035340
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  prepare_deployment.ps1
- Size 1KB
- SHA256 7e2b6032650275e876273d6461692731a49cea928058cbeb61ef65214bc126c8
- MD5 f258ec1855df8540afea885842f2fc0e
- SHA1 b1f4f3f8a5754cf939d1b5171d611c3ae8640b17
- SHA512 a1dad8270137ca30cc70779c9de3a14412c2c6270cf6fe2880e3a71c39aa544323909cce219a960e7f459a98ea74b03a6f56ae9de3d340bbe1c8213cb87ee68f
- TLSH
  T1BD313452E10A133026F552EAEF01C8C1F6A941AFDD4548F835BDC1CE6F7A8160BE2DA5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  public\build\assets\app-DWHVGQUK.js
- Size 510KB
- SHA256 73267c4b8fff412f9598a4554aa892ef188c94535a676860a66f01f56d8ed287
- MD5 68ab92bb7a4362f615c4d33531679985
- SHA1 39ca505f479aed2ce75150772187eee4c14395c1
- SHA512 78d376c52ce89a350b5203d98605e548a672ad17c1aa434225fc27b17923ca2cbded36084f108ee53b32e5499a37d20496e3a6311004389b4838806518610c70
- SSDEEP 12288:wisEy/lPmMUOS4zrPf/O4miUTFqOCyUVWdpQ/Va02THn8Y+glupOVrlBHdaxFtCH:wJEy/lPmMUOS4nP3O4md43yUVWdpQ/V+
- TLSH
  T160B45CD872A4756697A345E040AF0207B23D2952B40DC8A4F12CEDDB3B7548A61BBFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources\js\app.jsx
- Size 3KB
- SHA256 c86b99ea1469d83ae43eb9e27c3e91f5395010d1627000d8c1e98215a18736e4
- MD5 3f5b6ebe00e6b3190bb3f1a14b501599
- SHA1 f307d188f4a10ae7c22203de31daf76c1127a6cc
- SHA512 840b4daf67b0782a828aade6197c3ef4049a68d5b267580e89ee3776b6535ca0c9b6c01a223e28ed8b3b173b685043d79538aab2c27346f5cd32dbc614709197
- TLSH
  T16C61EE737DF54131D067809F67275266AEB0A713378399A8764EE3224FBA844D22718E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources\js\bootstrap.js
- Size 127B
- SHA256 6fd9fc82e68fa915a882f4e227b9faacbe7bfd66cb953c628840e83bda6b72f4
- MD5 78f909acc19aea4717eddca5a87c1ba3
- SHA1 737674b888fd746d93f53ca3b748936d85f14c20
- SHA512 cc8c649f9d05d0b5c4f51a344cc03f85b1df1284036edd9acb6794fa0f493899c1785537c20b2ceecc0589f193094dd92a6d68bff91a98d0fd4ded3a5364bc12
- TLSH
  T1C7B09B3F54D5741E4A7241D1DE117B14615453A41102D5711156D17171D686BF181694
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32