37b040c8fdc308537d1d9ae51a4d1f1c6f76efb71f67020011c6e12cdc3850ba

Sharing

Copy URL Twitter E-mail

General

Target
nexusmovelogistics.zip
Size 30.8MB
Sample260625-wy6t2set5v
SHA256 37b040c8fdc308537d1d9ae51a4d1f1c6f76efb71f67020011c6e12cdc3850ba
MD5 1be0eb533b6063c38351a66c0cfa6a8a
SHA1 adf182330aa8ac2f9357b98cc6fd4504ba206879
SHA512 e0e8b1e347608f02fb2b522adef2e809d9b95dd6ca413189d3e2f855505cfc2966b6191371d0880aa2ff0654daed12be4b7d2a3ee0a4faf60eb7a6de6559731e
SSDEEP 786432:P85m9/AHG6miWKyZcu77YkD/hJClAAOGLGOQhOB:P086+ZF75D/c5qY
TLSH
T19A673399E2C117F2E44F783EC4A42E4D7A4E2445E3459F6226F6FFE826C8708488DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nexusmovelogistics/admin/dashboard.php
- Size 7KB
- SHA256 5c0b644f1913366973eeaf95d1c0488b3b4306f4829e16a6df5391393c3d6408
- MD5 543d66a755d12a8f65ec9655a200a3e8
- SHA1 968b3b34fc4db5301bbb27c221b2fc4e3dd9c4fa
- SHA512 b284d75f11bd6daa05063d1700001e902966d2459625acefce25c549eb0798e8f875ddab7f771d72e132871342ca1184083b1449dd979e0ae66880ed8a897438
- SSDEEP 96:7/VFIkGlCH7Cj7uTh4xe+7Tz91sJWKuaB/3F7SvtBLlEw17WFuGMN2Il:DGlqgwh4xfdtKug3FaH7912Il
- TLSH
  T199E1631660E2783715735767DB12640FFFCEC12B9B015606B8AD23CB9FB2C05C96B689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  nexusmovelogistics/admin/login.php
- Size 9KB
- SHA256 8a71ecf80101020198294048dd19cfc7f33abc0300703a295f635f445c13fa4b
- MD5 7f93bc8673fe472af5197b22b2e7191c
- SHA1 0ffd9103c6e8c143f2fd8c284bc518d4211200ce
- SHA512 e39f4582f6dd6f26210c899b284f7957524b27ef19b6d0be99d3e7b92ad94c7cc14d3fe61a8b2760582ab8234ac16134f2cdeb239470d786249d7e076c1dbad6
- SSDEEP 96:LwlXyon2TgAoE9x8oxhJNkuxEGG7OdsFv5T+n0Rc594MQvW9fk+IgF4OjS6orYqI:LwtnRVEjpxhJNL1ep+00qeJT9FJeXBpa
- TLSH
  T1F022E701584A295129B3D5B87B629508FB81C2131A0183357EED13C9AFB6E499F7BFCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  nexusmovelogistics/admin/settings.php
- Size 7KB
- SHA256 44f194daae3b0ceba433e852c2476d3dd7ca778bed57e484b83d4596e1ccda33
- MD5 942afa7cc4fd69470a60ecb6c3c19784
- SHA1 b9b3cca31aeb82e5f0d616332713eb31ca751182
- SHA512 35a9d422b8d5df8e4dcea9be472e3d969a0f1bcd6777f7e9c5fa2e6ffe2e4c51c040da9a9857c747ca3cd07d40a59180fd3d7b1577573ad5203ae6d5df9c0921
- SSDEEP 96:7/uV0C2Vicb0YCMIDgmP/+Uer+my4EUUB5RpXW/anI+gV4+8JT:Qf2Vjb0dMIDgmPL+y4FUZOeBJT
- TLSH
  T1D2F1710914A25D987173C9716F21281EEF418327BB05C55078EC66CBAFB1F86ADAB7CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  nexusmovelogistics/app/delete-shipment.php
- Size 3KB
- SHA256 bb59f98a0d50626b52d612d9804b96b2e2589918bf2e213a6b04aaf5f46a2305
- MD5 3aa2eef5f7d08cdbc010546a8704c8c8
- SHA1 b3db8fc346a54abeecd7b78f0802a788a6fb78e9
- SHA512 4bab801283ab205ad19adcf738afbf7beeb828d24ef1a3bea52728df7d416ab6f50cabe9692f988be70db8e907d2ce032cfaded178e7edd50ec6eb18cfb2e609
- TLSH
  T14261630278F7262356B3BBEB6747301770CC901BD398CA57FC5E13818FA1698AEB0182
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  nexusmovelogistics/app/login.php
- Size 5KB
- SHA256 6280f60c1c96cb0f9ce706d8e295700cfeabb9fd07fe8cd0aeb61183d3454d38
- MD5 fa107843490906587e21844b0fab8208
- SHA1 56924d9674d6bdcf4d3bf81b2c21fee434d429a8
- SHA512 5c0f98b8e4a8e507a3e240c3b0ac026f53c17e69a082a5fb238c7d4d60ea1396cff13fa776a10dc8543133136a614baf02b00fba358ee47dfdb7693be3942319
- SSDEEP 96:LwFHy4PWzYA4EVBMoxRhdsuZEGuDmdc1nZDm3sp8B9YMQvW9Q:LoVPhFE75xRhd71+Rm8U6e+
- TLSH
  T16EC18444140B32611DF395BD6721E004EBA56217291083247ADE43C8AFB9E8DEF7AFDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  nexusmovelogistics/app/process-payment.php
- Size 3KB
- SHA256 6b0bf3a9bb6d1144f71c4a47c9232961318bebc2107da30a2e7556ea479e91bd
- MD5 9a8b50a8455c644e4e651bf7b078b1f9
- SHA1 6f9891b2d7a06626e334481494bfd9ab39010d0a
- SHA512 63219f6492f0c4032cc4fc9d98d2a24601050aee77959bf53c3d554a42987a6acbb5b41f98a9af7f9ccc440bb164f271132a7db6bf2eb5c49487f5868234ed45
- TLSH
  T1E0613394B4F7A6A75D536D1D7787A034A0CD911FA354CA0A786F03C84F92368DAF07C2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  nexusmovelogistics/images/qr.svg
- Size 1KB
- SHA256 59b5b6b2af127bdcffead5554c6d4a4e868b017bbb753342f79ad3dfa0fa723c
- MD5 8519b1a20185d0e70826484375f81006
- SHA1 f0a52cc9c625d997be9e7042577648baa9387d43
- SHA512 10b0d2e1b05c8cbe93487dd9d21cbd77629a829f566dab0780ca572282283e4300b141b8be7b16031456c53ac396760b74e9a6372c54ca8eb78585bb18b90871
- TLSH
  T17D21009066D5602AD844570987287A95F7CBA0DBC62D9044FACC271DBF098CFFDE229F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  nexusmovelogistics/include/admin_protect.php
- Size 1KB
- SHA256 5f8c6c9539920a67d6d8b6a54ac0b54952aa8938c6efb68ea0cd1c55d6988a48
- MD5 84ba12aceb406d555904fd4b22c93c53
- SHA1 0faede581c4f76f93c507fd45f49240cedc9129a
- SHA512 a69cddd09d4147fa9105762fcfec2a2f088826ea7e4f2646262f48dea60c10a15b21347affd987df6611885e5fc0922d33caf10230feae2b939276dca8c92fa4
- TLSH
  T18D2169AC2915233161B3E6DD0F311042FBB2B12B7160D344B7FA86949F24ED89BF80D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  nexusmovelogistics/include/auth.php
- Size 6KB
- SHA256 a4a0ef33713a18a753e2841733bf7d86be640e5fcd5dde1aa47d7b4810708d6d
- MD5 159ab939ab469fe655a55e743ab5f61d
- SHA1 5f82b5d4f3359dc2377657c5c51a8106ff9fae0c
- SHA512 cccb0c6662210659aba450a0d8de118175472330434ddd9e4ba6ea4c9ef93eeadbd8f56eb1fe0bc564b0997c60f879c7daee2280d5c7936416aad5d4d3ccc09b
- SSDEEP 96:g+PERVwkBAMSbGCPMSSdAlRMNggR4uZ3UpQjyMMlMZlD+cj+:g+zfT7Syq53ULuVa
- TLSH
  T170E15088106B337126F7866D2B318101FB6A121719109619B9FF83895F78B58C7FDEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  nexusmovelogistics/include/connect.php
- Size 656B
- SHA256 b81bf11bfa5ffab361ec66f01afb7773c28c5369db615892f86a1fbc39059ef9
- MD5 0a7f55652775a94e13bf4fa7ff1e318b
- SHA1 922dac708d40463df266ffd81b16a2d6702de171
- SHA512 cd1e074a9f1f60cc0d7ef50ab05936766ab2f3a037a84363b651689f76aa1db4088ada4c35bfb55ce4fd10aba1931a03f1aad08ec33a3dde36d79175fbb562f4
- TLSH
  T18EF049773103C95709B010E05F40B004F624B5571515B122BAAFD3CE9F325A9EDB368F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  nexusmovelogistics/js/admin.js
- Size 1KB
- SHA256 7c1cb20b182fdfdc1226a313c9233f3005b2b0dcdc0b693039f1219f298f4b8c
- MD5 434143a143cd2215b04a853bd18334d9
- SHA1 b7d0ac51da89ccf57cad4870d6427fe46c39534f
- SHA512 0aea9110d9632548e7793174aff5c4a63777439f39c1ef1d106779c8ae64f2b0daf02aca1d2989ddf3735779e083eac61cb46631d260f2c5551bc79fd84a1862
- TLSH
  T1E921BED542085B7784FE4F7232A6D289BA60C0D3526246457D8FC5DC3A6BCE9B0F0EE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  nexusmovelogistics/js/script.js
- Size 3KB
- SHA256 7352bac1fc1fd47e451176245147e2cde637daeb49ba79f8c1d7d894d628f3c5
- MD5 30baf2bd05174384ec591a79834fa50a
- SHA1 96ce205e4b894be198b522d76a6a430fdc77e43b
- SHA512 9bd4d3663d49a1c60e67f4691e3b4d5664a21c43017d2854f3fcc3adebc5cf0fc659f16b132bb7c589242d9bde728bc107c827311280cc6d9cf2bc7d54c1fca4
- TLSH
  T1277141E051111736447E8FAA2299D208FB70419326534516395DC9DC7F3BCB8A0F1EEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24