b6fa2c16a008d7f6881e0f003453216882eb08753aa1e983df55b8dcf5a9a6ef

Sharing

Copy URL Twitter E-mail

General

Target
codychat-store-hunter-store-digital-services-boomcoding-store-cybercafe-kody-shat-1782271841-codychat-101.zip
Size 20.6MB
Sample260625-wxap8aev9n
SHA256 b6fa2c16a008d7f6881e0f003453216882eb08753aa1e983df55b8dcf5a9a6ef
MD5 bf3e15ac04df120d7b143cf1770c35c0
SHA1 2b7e4160e02303be2a368ded5ccd2a5d2b01653e
SHA512 78e7a57ef308efc78106b2f82e21b86fde3579d0cdaf659a2a229ce848c9dd0d05e52363c9dc5027a283cfcfd8d267fb3ffb7cbcc5ca9e32c7dea9318710c946
SSDEEP 393216:saiaUZ3wlt/UVJgTuRyiy9Z2khzyxEEyudpkmB1RmS3zOHjo7h9RNV5tyIL4OclK:saiarU7gCRMz01a+B3CDo7hT/psfMo5S
TLSH
T1C2273327E204159AD9D7E87A304D2110EEFE4192FA13761F7EB9DA94F8F1BCE0325921
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  10.1/addons/giphy/files/giphy.php
- Size 4KB
- SHA256 1aacc7d85c0c1347f95469a7e16e3d13dc8c4a19823c49e6ec23c861a6fa80d3
- MD5 0c67a309576d2db09be690be62ff9eef
- SHA1 2baabfe8f4d6614512220d49b70c5a3ae01d17df
- SHA512 35a67d0cfe63420ad2fe3f4b77fe1b3181893b0b53de872f34ce8097853f1bf59f979dcac06219dd1476946bce136e5b569da741fc1ddb598399a7c79399e7d7
- SSDEEP 96:bcCwQdh0VHVEGSIIVsNatEg8/weeWbeqGkwGhzf:bhcHO16ot8ZCq1p
- TLSH
  T1A3A15088B3EC515D46E536EFC1BF9431EC78F4226B088472E8F080D679B0A34AAB5DD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  10.1/addons/giphy/files/giphy.svg
- Size 2KB
- SHA256 4e489d4cfad062e7e569b7572423745bafa6c919c686463b3dd9cad11bfe4587
- MD5 4750ac6ae2d18b436e8eae7d75268530
- SHA1 c319ddefb6f8d7d65154eb900ad382f902ce766a
- SHA512 1007e1c941fe38b56186c2b0947fe395ef1629210001c76f2618169e14aa333244acfec089c0fa205ee786ad0c1b2fb8e033938c019b19fe5318ecca3637b7c2
- TLSH
  T1B34142A816D4445FC004CF26A2F5ADC5B17FF88263740888FA69343FE8252ED566864E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  10.1/addons/giphy/system/config.php
- Size 2KB
- SHA256 e34fa2d758d545cb71535d42647fab256acb6ead8c8f0816c42dfc8423d40a8b
- MD5 a80fcc4ee64082aa24218d0b94db3229
- SHA1 be1a04cd11d73b2c1620e9a533080cc568fa24bb
- SHA512 1a21a3696ce070ce209b9b76964e70ae5b78387e712e8f75c180926ab0af787421c8ae811255356a9ef330c789e863e9267ddadd8751a647a73aab31fff9e49c
- TLSH
  T1B341B02672DCA46B010F18E791758B6B35BFFD39D6538419B8F272F3A242C889892C57
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  10.1/builder/encoded/permission.php
- Size 3KB
- SHA256 238628b26c2133a50877f6aad3dfad46554dc60526f1e8f66c54fb6adce396bf
- MD5 a2158ce2fba3d1f986d68342290acfc5
- SHA1 a9dc9d84f8e5a1d36cee170ffae85656c565d452
- SHA512 559ec0a0bb1ee01da6d0c910e7573a7c853d5b7645aa2238bf6071e706797031fc0859be3c72eee124e4ca3006e25da63f71b87058b19dfa6460656b0ce91afb
- TLSH
  T12F61A65572F71436217BA191CB6F88017B65840B6B0AD8187DED32D84FC8FBDB0B7658
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  10.1/builder/install.js
- Size 4KB
- SHA256 7be038505f2fc3d31fd0ee717ab491838e77aeeea0da9dc93e49f99f478b6151
- MD5 aa6c52ec4f4c72ca384542ca72694ca7
- SHA1 44ef29d92393a674c4f4d747d1dedc8c8a57a302
- SHA512 28d8632c638813d91c4d08ab17a53e6aa1b24e3155669ddf20145f29cd8e0469f8912a39c9070429a08de20028409c383896df05e0f62c0ebcaecc1da9edaaef
- SSDEEP 96:udD3U8RyVB66ifY3ZS8vNMd5y5AmH6mQyvFQye/Po50oWoT:udDaC+ZVvqd5yemHjNtNSPo50oWoT
- TLSH
  T104A1036AB8F11BB12C3BF275467BC8053B6B800B9906CF50B5EE26C42FC2765552355B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  10.1/call.php
- Size 1KB
- SHA256 d57b375faf644277308308474ded57a7f61f5ee47427f0d0e7f7eb0d5777b0fa
- MD5 688453c19840422b6f3075e79980ce6b
- SHA1 eaaf59d9bfa3137253b25db72aa17685f68c0966
- SHA512 d15e28a264b3062b5e79612f84a594e796f6429d9bbf9f21507b76f97ed39a8aff84f91efbc7f86f986dca9b747e1b3d135025d446106137d2f903ab13bb360a
- TLSH
  T1B73132171C09DA1D46397ECE8371C804ECA6D81E1702465378D1A4B746F1798A96FEC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  10.1/control/audio_call.php
- Size 1KB
- SHA256 dfd3f4d6de53f0d625994094f7c2b0a5cf14aa7c4320ab47b1e6a9d5ff7e189c
- MD5 0c3096d730612f469faad4264444dfc5
- SHA1 c82cc081e775af8d80ac21739c27bfdbbe973cd0
- SHA512 15ad6cf6490b6931cf7f5d3cf867ee58360f957b738d9f851b375727081ace3804cae97d1a1a9c936562d059a1f2bb8465e248ca1177a167a6a0dd6478d22bf6
- TLSH
  T13C21E3513A6EE97A0126FF971236668CB48BCE097F16CE22D6F5B5B70241F84EC034D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  10.1/control/body_end.php
- Size 309B
- SHA256 1b03acc27f77f4aef52f19bc2f91a683c0b76ad2a8ea936ccf20fc91b4dd426a
- MD5 38da120207785f98aff72759f912de11
- SHA1 ca197c63e5af3cfd4278cff64a28cebc2410211d
- SHA512 2855584fd51102271af677971a34e77dfccf4d932f1ec74816527bceb03608b7251f84cf364178f2e85b79fbd93a2bb76a4d2d6af65d163cae9b0124c5449549
- TLSH
  T151E07D893E1A8835415D4F762237E3042C99BC0F1B1281020ECD4CD7B6606DC9DB3A88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  10.1/control/captcha.php
- Size 723B
- SHA256 221683b49db8b29500a8721671092d41a9ff1ef393a86c3ba8416476bda16316
- MD5 bf83827b56831ca1010222b2fa8bc001
- SHA1 72546855f24bc61cb9f246f763e92d0696594dbc
- SHA512 a845aaf6fa8c6d7d5f5ec900370b1ca35d5d5c768b4d47d4a86a8c500399a192b61aeae21ea13fd2bde407382dd05ffa4b6585b96666ad68d1016b3635031d8d
- TLSH
  T1AC019CC33C3AC858CD218CF3A520D9DCB04AE5066CA6C69229A055CF97389FADC05CC8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  10.1/control/chat.php
- Size 39KB
- SHA256 c246edcec19cab6726893b2109a321f5847bfb031da9ae86603c21cf45d219aa
- MD5 d40ab516f2081d82973b7c743cc15c4c
- SHA1 a354a277b12006763aebf2afaa6cb1bfd023b1c2
- SHA512 15d45a50551b9b8be9c08add7b683b56ed0b848ec0c1074fbf76096bcd816fb2ccb9a63b865211e9eccbce70e2564db159a9df38a8668f61e4809535e31567dd
- SSDEEP 384:ZJzgiyMh+Usf+1W4JZRjqjxw1n4Rq4zKsRqTLMOzWRqOGqL1LHX40WfVw7lXLXtj:ZJzgiyMh+UsCCBWM+J806UY0TjHe
- TLSH
  T1B4036854719DE07B010B86C7A1726B6AB2DFDE25CB679812B7F063BB0282C11BCD7527
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  10.1/control/group_audio_call.php
- Size 1KB
- SHA256 a3a8f8af5d00cb44dff044b36cf907a80156b73b54dd3f487e28b11a7e9725b9
- MD5 5f68305d88789032bf818d1625fd17b6
- SHA1 535d7e52ba51906dcc9162fe315a007cc1c8bff3
- SHA512 1ece808d73dcd525e85ebed814c78bef983ff3e8e67378b6b8f4ba2000e0c9667f876a92e05ef9b54b96bf14dfcae0216092e440b0e335e2767b01dc4fdd987d
- TLSH
  T19B2127513A6DE87A1126FED7123A668CB48ACE096F168E22D6F4B5B70345F84EC134C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  10.1/control/group_video_call.php
- Size 1KB
- SHA256 160a9c839420b7bda3234f012530c7bd13c6b62d23074436531a26a1e32fae24
- MD5 5897acd981e938ae2905d4c3468dbbdd
- SHA1 7a7269a2910aae3f1d630044b8de60b2f5493bdd
- SHA512 4f1d0b5085540fe729898f77bbd7381d0b9eada7dcd845b54d8b32fcbea9d29c65658df9297bc3e67179678a6b4e54ce664ea8820e82620c8430f4d84449c418
- TLSH
  T139311711395EE47A1126FFD7123B6688B48ACE29AF168D12E6F5B5B70245F84FC130D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  10.1/control/head_load.php
- Size 7KB
- SHA256 c8db57581893d1eb5b778ec0fd5258ffecdf03154f93e189b28015c77d97b76f
- MD5 d0590121e41687b071d4ad8a6105ec39
- SHA1 dd8d7bd7c7425702817f57eb9e64bda6acdd0e9d
- SHA512 f0b759c49868b415acd170f10e733f2439d600f0854287eb1361df6a5ef8637bdcfb8a4fd100aea558a7bccc8fb42f919b673d3784da1b4db150dc117736aea0
- SSDEEP 192:pD6DEQXWuXC45TNOoxpQVN1wCfiLvZefjBCefXfqyfWfdRy:kokd1g
- TLSH
  T10BE1CD4F3D29CC2D412DADFBA121851CB5ABD81E6611CCA26EA960EF10D07D4BC7FAC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  10.1/control/kicked.php
- Size 2KB
- SHA256 99ccfe7c51153c9cc92b0b7fbb0d96c1b1af8fb7f9a787e2b0f85479e83120a2
- MD5 4f8c92eba187288423ba4059c48009b9
- SHA1 bb2be035c5e0d298c331f3333e36ff9a81711e3d
- SHA512 b5f63aab26f4002be97594570cab5a456fcbfd931e919287be7741e24ccfec2bcfa5fb3ff2db6b736fd75e36e84fabd2dc0a0a44a9e6c125860df764ca855c46
- TLSH
  T11F414124B14CD69B02DB0D8B963927C4BCCFEC0B5703A8589AE512F3CE90D19A947CB9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  10.1/control/maintenance.php
- Size 858B
- SHA256 b1c944d2266509cb9f342039e2ba410f666b828b6ec9f8b5d5d14a188edde462
- MD5 beec92f18032e2aed9c5428455782b0c
- SHA1 2a15bbd73401f626298f4a1cb70c561109feebf8
- SHA512 0d84c784802461ee81c1fea7f4ddf7e89b33db86a208082ab55453d27d5eab8cc046b150fe8fc501e45e6f8bf23166fc75dec123f98764a2fd37009efa438628
- TLSH
  T130118C25B998D16F42A7458AA9327B49788ADC54AA43E8216AE463B3CB91D44D80340D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  10.1/control/video_call.php
- Size 1KB
- SHA256 29c6128704888cce3accdd63e1b37c929b169ca326aae0dccfac4445c93ff7f3
- MD5 9f320c0de1c198b97795efcd394afe1b
- SHA1 0868d41ff57438588c2f5eed12b92f3e83f5643b
- SHA512 ad850a0754a46fdcf326dde9e24fe0d4335020ad16c59a263bac1a64701398b423240dd047a217bdc7edd832dca9b73edb930cd6e0c70b9f766f3eec7620bd01
- TLSH
  T10731E3113A6EE97F0126FF9712366688B48ACE056F16CE12D6F5B5B70241F84ED034D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32