7380f33ead13597aedaa6dbc0aa829cb03bf6299ebebb1dd501464abb334a23e

Sharing

Copy URL Twitter E-mail

General

Target
vutmdb.zip
Size 37.1MB
Sample260625-wyafvaew5p
SHA256 7380f33ead13597aedaa6dbc0aa829cb03bf6299ebebb1dd501464abb334a23e
MD5 2f1356641704714825770281c56ce180
SHA1 de7b631e4f9f724764753bf593db6a82c5eadc18
SHA512 2132c7c3e0f50a19b459e9d69e3581e63862e9dee706601513b4f447972e0570e67e6d1e19c967649d18ecdbf9ec1ca9d71570a7098a3034db936f86c54c8f6b
SSDEEP 786432:5Dn0b2EmptUoo3XUb3TmAIQQc+mhuyvr7vGKucX2O:Fn0UptUoxDoQR+mhuyHGKXb
TLSH
T19C873365F3410A97C95777B83C4D2B81D94C201AF2FA2B73285A17C62E3A5C83EBB715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  a/bg2.php
- Size 1KB
- SHA256 64a86b9ecf9e31c9e5c1ba2a44412e341d5aa6461c658a6fe33b105439615507
- MD5 c2c2e00df959718877edd0b123470b39
- SHA1 148277774430c00aa2b41c51d6ab89e3c6bbd7a4
- SHA512 114abf33c938f707832ca25e4927f898ad29917f2e112f5401eb189b1ce93535d42bb7b53b39b8e2e758d42c522fdad9d5bb3bcace943d5ea2d5c0d59e987d71
- TLSH
  T1DC2132BA3EE710861562A7B147E7F1192A427517A241C85039DEA3984FCE74AC0E33CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  a/tv.php
- Size 1KB
- SHA256 768b9710e4c4cbae807babfe462b396bcf5e2c65fa90a8ec56c92731b5fb7435
- MD5 1882b33cca0eeaf188476f761700bea3
- SHA1 199ec56eb6c6e6dd833a04e5b082481640701af7
- SHA512 e9f47c14c08b9fb2c4965c112ee79393fb1998e68f2b5e41d47e6d408773f4aac692736a476074bbb4dbbc8d27989617ba0112488ac94612d56f937a887884ea
- TLSH
  T1442132BA3EE710861562A7B153E7F2052A42A557A241CC403DDEA3984FCA74AC0E73CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  a/widgets/data/js/jquery.fadeImg.js
- Size 4KB
- SHA256 65a614b3aab92824c4d33bfa8bc5d0151d577a3a6a71811f635e3d53906018e7
- MD5 23e68110a58109177ccee82fccc693a0
- SHA1 6fbb6c49ac00b7f95782d61a11082911443dbda3
- SHA512 8b4255c5780b569e49aa421cfeb7c1b646b48d85f9480f2c569307a8f64ce84e00d4bc3e3ffd914ba6098ae29d83431f8ece7c258181c9f5476f7e16e13c935e
- SSDEEP 96:SaBfJIg9zBLxzA9j97EVzR3oSw/S6/YqCbj767tCyGhPL:SaBfJIItFoGnOS6YqCbXutCyW
- TLSH
  T15BA11C0A60F751F29277B07E1BAB692C353288775144DE007E1E0FE52FA143897B8F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  a/widgets/data/js/jquery.js
- Size 93KB
- SHA256 ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
- MD5 895323ed2f7258af4fae2c738c8aea49
- SHA1 276c87ff3e1e3155679c318938e74e5c1b76d809
- SHA512 c40111c3cc0754e90cf71f72f7f16f43b835b7e808423dfd99f90dd5177538b702e64ff1d9ee8d3bc86aeaa11b6f7a0ef826184e354b162158839ffb75d174cc
- SSDEEP 1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmc:R+41ZqLTW8xRrqSb8qGH77da98Hrf
- TLSH
  T13B93D8D9B7D67162977730B850BF510BB13A98EAB80C4CA0F0A4D8E47D74A89507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  a/widgets/data/js/jquery.rotatingSlideshow.js
- Size 8KB
- SHA256 78f4c3f0cec218a13462c431405d5328b0bc219d7d8b2c5bc1144b6fb5761740
- MD5 691874f2a145d2e24cec9dcb019f5b8b
- SHA1 2497eefb52237216e5d51b6963c8db4e948c67e9
- SHA512 b1eebc447c867e4270ff34eb566b584825e68b4971d9fb266a8a0eff18b016dd5512d1594290b234f2f303177a8c77302fb0308793f3c29eb4c76379f86f67b5
- SSDEEP 96:A8y23Z4dSh6YI9DGOqdCLEmpqCHMi4ss/Cw0csQOTeU+UMw4mJZp5GeLJ0KnX:Ay3Z+qOXpFHeFsQMNhXnp5GqJ0KX
- TLSH
  T16C020E08B5630520C863B2BB2B6FF415A2BE9B13750AC95874CFC39C4F915585266FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  a/widgets/data/js/js.js
- Size 7KB
- SHA256 89f77e3669c502f53b75c0557c01fe4c0ed42cb5beb2cfda99a0010286cc67f8
- MD5 10f96dcc1f0c002558ac9804ef31b36f
- SHA1 6274253ec34ee884a1be442908d594de440e723d
- SHA512 d727d0a5eb66ed28c48bde4f3883be2e356fe0210c8d622b76be89b95ec7075c0fa263aa4fdb74b7bbffeae97ce365f3b4dceee778ce4374ab4c1b5c37f81c93
- SSDEEP 192:9PLkNlKBN7q9msADmc4rrytQankCq3cSds9s1sy:9zkSN2EF4rrHap4ds9s1sy
- TLSH
  T10AF14099D35D185D802B11665E9E20C9302D543BAA4FE83B3E7ED6688FD42DE0336E70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  a/widgets/widget1.php
- Size 3KB
- SHA256 e92d8572e8787eb90309b96d9ea16da61dab5b35f0b3d5549192f4a968ceb27d
- MD5 1455eac63b54627a1cd7fd893bf677f3
- SHA1 cfbca3a63ed3ce992800e8f3729022e7c91d4935
- SHA512 065cfc7b93bd2e7e4069fd99f23359a5655d0976f1f54c910b11e50a45ae79b8a9b052c58cc14bfb3292ee559f9b9b324d892c57fa0e57784a113782763e0c5a
- TLSH
  T11D71EF259EE76049BB1BC0BA6F7666042769D053DF0BCE2837EE32B06F4258848673D4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  a/widgets/widget2.php
- Size 2KB
- SHA256 3b7cdeebd67d6a265a9b1b61c3256313023b5ac3aa5b6347c2af5c4e6a66e903
- MD5 5a78bddb633eedea75756fecce8e9fae
- SHA1 4fe52afb4a16cf56d3a27810debbdede4c18096b
- SHA512 b1bc39c07b420b573069a32e689a2a9e29b3e8aa7866ba85e5784aa0bb5f2ff0b10ae40940b6d6e33f6512fb64e8ceacdbbda50d2dd29013e0bab64f1b01ece7
- TLSH
  T1E8515521AD5DA156832351966936914C219FA172EF0BCE0872FE20B1AF85AD90837688
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  ads_create.php
- Size 11KB
- SHA256 f796b4b5311ed3c62e0ba1b6e64103af9f524a7cfe1e253bf269832acc889a79
- MD5 ed7ab2257e8d50192cabfbf69dc4b080
- SHA1 1664d40051ca829e74ee3595657b128b6847e15f
- SHA512 ba8caf9ac3e8421b8347adf9857239a3e0acb48844fbca377daa2467d0c8d6613c92fb17f0aa72ff6d00bb83e68a124ab919dafded66c1913e9297900e045fd4
- SSDEEP 192:LGbD/fkZekmLbZZRkK2mjmYXlnpcUdBhUQjVmSvV5UU:L8LHTRlnpck/cSvl
- TLSH
  T1B832D6247BA14A72432784D97BB17A0839EE526BFC0B9E44BEDF05E05FC3F859A17601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  ads_update.php
- Size 13KB
- SHA256 42d5952311d0569c6a775944df167de29f551e1697cbfbdee30bc821e7870d39
- MD5 73425929c1da91048a045a5b91def26d
- SHA1 3bc4437eaf313c09242df144b3781938bc33bb8c
- SHA512 9841585e7e05da7fd24eb9894219ba700a6b38e58f39e44449897f08d03eaa5d3cdd5c418b67b98dc5793191260eb6b14c97d711f07c77792f51c5e5ae102d61
- SSDEEP 192:TebD/fkZnOldLbZZYfOJ2mjmYoAln3HdBZPPVmSvV5Ugg:TE1H3bln3FXcSvrg
- TLSH
  T12F52D7247FA14671432784DABBA12B096CAF5267EC079D48BEDF06E05FC2F859A1F600
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  bg2.php
- Size 1KB
- SHA256 64a86b9ecf9e31c9e5c1ba2a44412e341d5aa6461c658a6fe33b105439615507
- MD5 c2c2e00df959718877edd0b123470b39
- SHA1 148277774430c00aa2b41c51d6ab89e3c6bbd7a4
- SHA512 114abf33c938f707832ca25e4927f898ad29917f2e112f5401eb189b1ce93535d42bb7b53b39b8e2e758d42c522fdad9d5bb3bcace943d5ea2d5c0d59e987d71
- TLSH
  T1DC2132BA3EE710861562A7B147E7F1192A427517A241C85039DEA3984FCE74AC0E33CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  goodbye.php
- Size 9KB
- SHA256 410cade74147be790d6c814925b579785aa35cac6b8acd53e0b4440a522693d9
- MD5 215bdb2d66d3ed9fdec41ff69fa27864
- SHA1 508fc5a01ad1b21b958ab177e46f657bf21ff70b
- SHA512 6df1c627273226c9b0db17afcec1db5e7f97cd4582dad9aa12b094aadcf4ba143ffc786fefdce9cc894e2d312c4819330dcda8ea459da6415d79380cb4245b1b
- SSDEEP 192:hE2Oo6+3hRl5Qsmq0vW+BOwHcZ+atnOoJ6w8IM5H:hE8vRRlusmq8lpH2tOS8IM5H
- TLSH
  T185126239F5AB40866D2AD8E91D15A215728B0093E8437C4F7F0F21355FD33A97B2CEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  includes/egz.php
- Size 440B
- SHA256 a137a16895c2943828d19ede7e82b917660d0dcd861e63d565bbadb1c470e563
- MD5 8a65974c19ed5aee18ae8ea3773f93ba
- SHA1 a63df8442b5cd355e5f5cd5982fb222b03843074
- SHA512 4ea07d7d32b1ab6a46b6d684a42fd4cf9af2da4a711ece5f775acdb61c50ba73b71970cf338adfb4cc3e844ecd397db8ee057f1362d7fa0d0951dd22afbb083d
- TLSH
  T132F0397CBC64C4847D41E8E34D6A9018366B24C7B003AC087F2A58F20EC77C4378AC00
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  includes/flash.php
- Size 1KB
- SHA256 5c31fb1b98947684a21116796f3de817022f34880650fca038cd7d8684f0fa91
- MD5 48c7ccb89ac2235aee501b234ebb2f79
- SHA1 3c65080a6b3526edc49dad416b4ceedef3c26807
- SHA512 02fc555c68479afb0f1065c23546b8e8141ad182e12ce34cbb37f5e4e8093d80d22328eab25b0cec1a04f6d667cd5e083627d70a32a54f84c852272230ad20d0
- TLSH
  T1962159BEF852D5507E8AE9E65D2A8158396721C7A002BC8D7F1E69F24ED37C4734EC10
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  includes/footer.php
- Size 2KB
- SHA256 2b022caaffc2192b38f377a36d61735b06b604d74c161cbfcf3d35d872ae0828
- MD5 2c15beb76a095bc690ee97fb7b9250c1
- SHA1 7c39cac393ea01a2d8f5b48f96dd342341c89703
- SHA512 75c616d43a90e3876412c8429ba46ca8514990b540b0eaaae4815d09b1d0e8242df8d844220556ae13c3261a9413148356ead14ea139d0e053abfa60e19e1bcd
- TLSH
  T1EE513D3DFA1085993962D9D52C69A458399341CBF043BC2C3BAF22B21FD3BC87B4E801
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  includes/functions.php
- Size 2KB
- SHA256 eccbff0183bc78b3c0b4c4f686e1a2ae9b6e985626c7ba44bd5edb28958a4d49
- MD5 e28a61f9afab56548a4e8f72fe56de7b
- SHA1 cee89b168f3a6327632abaa13a2f577f80b34111
- SHA512 2c771045654d2e810e4d258480faecf48aa28ded1510b8705952837e6cc7d4d2c33c40b6cb14b7c98738479d37776609db793dfe0b722c94a6756f1fd3c1395e
- TLSH
  T105511C3DFA51859939A2D9D52C69A488399341CBF043BC5C3BAF12B21FD3BC97B4E801
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32