742bedb1ec3ad275fbcb7f29383ab17f014816a2c549c702ebebebdafd5ecc97

Sharing

Copy URL Twitter E-mail

General

Target
birost.zip
Size 20.1MB
Sample260626-anpbcsgs4t
SHA256 742bedb1ec3ad275fbcb7f29383ab17f014816a2c549c702ebebebdafd5ecc97
MD5 8f5be2241ee0de746d65d23515692ce8
SHA1 6927e81103413e7551f2c358fc9cb26734d50c05
SHA512 a68548675279691c15ae887de698460a69080b6a796d1c2e85136f53682224f4542c271bd8794ce38560276ad9d0c41795b56b3684c0c87590ddfd124f4950eb
SSDEEP 393216:y5GZiIXocDA48J9WMvRAQqdQ9OKJrTuquJ0SsRr9E7zuvdhDGwgM1:YK8J9WyVYKOKdTula23uDJgM1
TLSH
T19E273358E54E0F5ED6C07A70612E1FA6CA8E5D0E8900F00BEB8C9C746D2CE715A97F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  birost/Landing Pages/assets/fonts/fa-brands-400.svg
- Size 684KB
- SHA256 4bfc9278d2c7596c0487d5cc6b21600bb6f05f878fbcf72eeff7d6134fbce3ff
- MD5 3396a04e6326956432da16eb3cf3e860
- SHA1 5229b87957059418d12c2285d74f4ca3fecf2a87
- SHA512 d57b692859516a245bbfd719d67d7d1fd7e2b03a048c25433202020386317059f61394490629927ef615cae5847a773b0b5ef35a3a15431b78d1e15fce914e2e
- SSDEEP 3072:wxCv0Rzj36Ggr0JTQUHMzT7yfrBLCQ6TzFx2Pxtxqpch1UzXmSDaM+A:l6/qFk6x
- TLSH
  T18AE4F15CD3A4C2B8FB9B4EE8893A7ED6366B35FF39103254C278A56028727784C4D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  birost/Landing Pages/assets/fonts/fa-duotone-900.svg
- Size 2.3MB
- SHA256 7192fca6eae827fa87a5a59b05e7af3674c1600ebe33cfaeed89a3bfb01cbcdf
- MD5 4e966b0beb03b9730757e28a9720922b
- SHA1 3c2fdbd63e36a4bbb603b634f13bb5ee902ec498
- SHA512 cbd9d51051c2669d4affe982e8f96e4afd0ed0a82c810b30566c56c8c425c8cf23ca7a5c8e282cdf9e86618b264e2a7f45254a20978bc3bad28ea75928bbdfce
- SSDEEP 6144:M/2sGwBAS0sD/DckwiGo91NKpixhckybzTXdbssg77:MqopKZgv
- TLSH
  T18BB5B7A8D350C6F897CA87D6CA353F612A9D65FE33143468C27865A04C367BD4ECE6C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  birost/Landing Pages/assets/fonts/fa-light-300.svg
- Size 2.1MB
- SHA256 0c86a52372ebd6ac1908eedac6e3963eee82eb2394dedb1f2c4bab64ba2da397
- MD5 0a695112e246a9b6a1211c384cc6bb0c
- SHA1 a792ff3cfdc3df2180cb0cfa995ea7b2daa4753e
- SHA512 8172505e3a2d7a099b0ab207b8ae2a205f88bb0b8d276752677aa10fc5ab60b36b97e5f1913214d56904e1bf87bb305d550881824e20a5d1c8724ed1d085bf91
- SSDEEP 3072:nqgfpuo/xSL5EiJY3Nguj56A/4CKmAXWmWC8Rh6f9NOk9XNoYLUZzSc07Toly9dL:L2JLoWxEmJ+0iiL11hU6
- TLSH
  T11AA55368D364D1FCA7C64FD98A3A7E91269E76FF3A103124C278A5601C727BC4D8E58C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral5 behavioral6
- Target
  birost/Landing Pages/assets/fonts/fa-regular-400.svg
- Size 1.9MB
- SHA256 9d1215285ee226cd6e2b4a2a63eeaff95c0975705f80a32cc4feba8702b286a7
- MD5 11291913bc40808aca0e783b2ecf7bab
- SHA1 077d06c80b04fb70650a4d6795884ea51167a525
- SHA512 2ac51ebe063da45517eaf8e696590c5dc5cc112c0c31b8890f34e9baa3f934357301277372af4469888ca454d03a287014a66046b05600e99c7a86cef876a625
- SSDEEP 3072:HicbVikgDONqqhuYcXSyIxrgBTvdAGAFbpCyhDynXSNMdM1BAwrRfZMLPVZMLPIU:x/1pCyhDyCoz5z4PIdlR4Tbiy
- TLSH
  T100957668D364D1FCABC64BD98A363E91269A75FF36103128C278B5A01C727BD4DCE58C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  birost/Landing Pages/assets/fonts/fa-solid-900.svg
- Size 1.5MB
- SHA256 8bb63228ef42b24384151dc44b9f34b3eb62d35f98f64ed6c42aad6c5864e104
- MD5 9c02270eca6427a7f84a01368f9fdb9f
- SHA1 acf7b0caa21f014ad9a6a3d08a6d57bc9c3d2c67
- SHA512 e98bfbd74fc42572a74619072694c7f771bfe936c0c6851e1b65e72beaf31bc5ce987cdd223a742ad1445c9f2a84879c6309be69b0720378148cc3d66ea95af0
- SSDEEP 3072:uABFoBCyK4Fl74up8bG3ZWUUGm1LDK8/lVcALx48j3rOkjvr48j3+WjhAjPa7uoh:NfomvA1NY2GWGIQ
- TLSH
  T18175646CD364D1FCABC64BD58A357E61269AA5FF36203128C278B5A01C327BD4DCE58C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral10 behavioral9
- Target
  birost/Landing Pages/assets/fonts/icomoon.svg
- Size 42KB
- SHA256 ddaf4f9871768b1cd75cc32ffd6d39a47a442e02f06cdee45654cc97ea27bd8e
- MD5 95283c12d980b11d1c18d875c189d80d
- SHA1 bc5f7249471c9a7c9bfc873039c6debdfa9e1c97
- SHA512 44fda616be01b0cf4725905d6f023613ec81dd7ca637f637053977b770b04963ed857485e7bc0c31f3bb11bdc44f06722cf7d3e62e2527b300f958cabff5eb1d
- SSDEEP 768:TbDL0lKY8qHwBetrN1bJbLffHrKWED1Cl29jIh9RdCb8EhewqZ+C00:bIbQY1Lbt7OUqA8Uv
- TLSH
  T1BE13D9D8EFB4E2F0ECC5679FEB145CAC395665BE79228A2CC13D5E8859C3D0C86188C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  birost/Landing Pages/assets/js/bootstrap-select.min.js
- Size 57KB
- SHA256 a1b2cfb8b839c71376302daccc46972da37cb4429881e08c9fe4d23ccc6a39f1
- MD5 bb04eecb5c67eee0fd40f9306a0c6113
- SHA1 7086ea702c2dc567591d055cf2a24f2001d0c666
- SHA512 cab3a68cf769f2a1fc8602df5a9485842ffe47d0a3f5448bf2e271608bde25918089e771c88c70370e11b0b0e57233652114789241da0c74a6347024c454e682
- SSDEEP 1536:hm8p5hguwv5Eqy2ITAeMO+HFH3tzn7vwyZeDGXn:YTP
- TLSH
  T12543C75E72122A3652FF10CA5C6F919D7133A77CAC028098B4BDC6DA65BCD44A0F3E76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  birost/Landing Pages/assets/js/bootstrap.min.js
- Size 78KB
- SHA256 35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa
- MD5 21d4551af5cc4ed4d818bdbdfea8c358
- SHA1 df272a07ed30eaf8025b699c45736ba9d284e4d4
- SHA512 4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da
- SSDEEP 1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj
- TLSH
  T12383B5593244B8730ADE85B68037430BF2265998B14B812CB57CADDE2A7DCC67277F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  birost/Landing Pages/assets/js/jquery.min.js
- Size 85KB
- SHA256 99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a
- MD5 b83db83a1d89113ee03ab730efa48c7a
- SHA1 2fccdd3e43db21bbc8448ed6d6311c4a6eea1166
- SHA512 10d6f09a04eb135eae12c890be0512ead801e213614505937d1e782d5a6af86550395470ea31b3aebd85695f07a8fe903eda4941e52bcb7278cce02eacb13800
- SSDEEP 1536:3RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GK7:vHNwcv9VBQpLl88SMBQ47GK7
- TLSH
  T11083F8DF77CA702247AB30B9006F550BF276199D684D4400F159D8E9BCB8A4A827BF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  birost/Landing Pages/assets/js/progresscircle.js
- Size 1KB
- SHA256 8232b70aeeebdaa6293aea93b393f32fba67889cff028fbd43725779874d8e8c
- MD5 184d1b611a30a7e2665d6233fab94e71
- SHA1 e8f731b8c439e586520e654a5b7e7d8d4c508256
- SHA512 b7285c4707316c47bc7ece5e99e02396bc3c8b08b3795e1e253e99d3d04aedc8c14b3b7c1fa9519ab8b1a9b2254b315d8a411fa37df2fe11bc330cf470269e73
- TLSH
  T12E216839FCE5293790236A68601F753136BAC05B8108D61C30ECC168DF96DAE016ADFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  birost/Landing Pages/assets/js/scripts.js
- Size 5KB
- SHA256 b8febb22c3e50090572bee2d2581966a55c803e4ef5e7647ee99375f1eae3f10
- MD5 4e25836198b0943c0a8f35879a8aee37
- SHA1 3ffe60666e65dde206241460f3279e5359fbfb4a
- SHA512 c3c2c591937f1fc702bed078f2db5d849b511e0a9ace6ea30b408fb3abbd8fc0e041209e80f781a16bfe73c4aa6bcf828d3901c26a44be1d4290c57c8d29b79e
- SSDEEP 96:iBa9yUqAzEzkKIqrCSdhiJv3hYWMXiCD/gzl2DcOzeozfHMA:iwnqAzEzkKI+dhWvhY9iY/i+cceozfsA
- TLSH
  T1C4C1024375A05135463B336ECE77B268FF6A030B824556B2B8FE46843F70119A2D6E9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  birost/Landing Pages/assets/js/slick.min.js
- Size 41KB
- SHA256 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
- MD5 d5a61c749e44e47159af8a6579dda121
- SHA1 3b41b3bc956685015a347a2238e71db29dfa0dbb
- SHA512 5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e
- SSDEEP 768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH
- TLSH
  T1E513A549D205276285D721E62105C40EB3F7FB3CBA22C0E475C9D3EA646EC4896D7BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  birost/Landing Pages/assets/js/tilt.jquery.min.js
- Size 5KB
- SHA256 6951eec0a8c0c9b2eab72c4f579765e0f190165822919ddc791bb391096fd7c0
- MD5 034d38aaa44f4ac1723c041d215eb146
- SHA1 6dccde4d78b77b035d9da0396385ade6141864cb
- SHA512 bb52fb0e9dc12943f78228e0491a0c4cdc660e5ff9a3e5ce1eea70c1aee3b08d6b3331eb96548b2ac18e7ea8d897cbeb106fbc8219d13cd03f48296d989099a5
- SSDEEP 96:H9HqJXyrg9U0S2VcjOB/MjvENOtnUz3FbyTXTyVyURCD3jgupRc:dH8yrbTIMjLtnUziXkRCYr
- TLSH
  T1A7C140847111711E59CBE324D18B0E06A23AE0155C22A87D75FDC9EDADBACCD127BFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  birost/Landing Pages/assets/js/wow.min.js
- Size 8KB
- SHA256 37461d9b50fd93b2e6d064c4aa48cbc16d5b1e82c27f47270b87a39225cc00ac
- MD5 e1f1ff6897992a9165e8ce009b4039e3
- SHA1 e297207404fea99863aea60a1dcd3770f8ecddee
- SHA512 9cfad3881d20ef539ccf5c90eb30009ee1313795a03aba7ea52b9124cd6c5f9642d964f9b57badcadd639c2debef6efe8039d662dba8716887d03193a2d9c934
- SSDEEP 96:DrZgL1xvPV6GqKgR6TYLWHFMLJA6pOROVEE1fosvGeaMozHImBaoqbl:Dry9PVfIFrlAJROVEEdos+eatzHILoA
- TLSH
  T1870267C97A967031D75796F6833F0106B6361AEEB028047CB5B88DD57C78868523BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  birost/Landing Pages/index.html
- Size 77KB
- SHA256 17a2d1a396cf3dcd152f6d83451050f802125d2f637e5f009b28107ccf3dd545
- MD5 65dd375aa1575da6c877ec8e8b339317
- SHA1 652c04f17048fecf809c88d01cd6bf9003bd655f
- SHA512 208300a94deafb4efedf9cd215df59d0b1cbc003fdab8ee1fe5c9365c63aed19907c0d2ed5cd38e2ab5b60db56c08990ea3cf37370119d8ddcf73025b93de4a1
- SSDEEP 384:PJO+dahIXaVjYIXaVjkIXaVjSnmtIvAgNszs:Y9gsQ
- TLSH
  T19773DD2059E1153B417381E56D729A99EFE1C007EA1A824972EDA78B2FF3D43CC836DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  birost/Landing Pages/index2.html
- Size 76KB
- SHA256 963727b9356dc523e0a2694b15238547526ba3f638da1bb9e2933b8e3ccd07b9
- MD5 54d9c0f7ef501f45ab5626ae6efb7d79
- SHA1 4c55bb84e35519005a8f36e7206e3501cda28cae
- SHA512 63b3cedc9541bde80b64e3d3c2fba56b545e743b0b73ba786e877813599ebe3e4a8fe8227dc4cd7c28d962ddda1d278325e995d7b4d8607c0b5e208e9f715211
- SSDEEP 384:iEdahIXaVjYIXaVjkIXaVjSnmtIvAgNszs:s9gsQ
- TLSH
  T19273F22059E1153B417381E52D729A99EFE1C007EB16824972EDA78B2FF3D478C83ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32