f9539bcbb8d4dbcaab9692f3e4227a0cfded9e9126bca104cad3013f12f78d11

Sharing

Copy URL Twitter E-mail

General

Target
Painel.zip
Size 22.1MB
Sample260626-apdagsgs7x
SHA256 f9539bcbb8d4dbcaab9692f3e4227a0cfded9e9126bca104cad3013f12f78d11
MD5 08859f2df088bb7baa5cf00eae417bde
SHA1 706df9ed474e24c0d766781ac1bfc277423ed979
SHA512 d6bccc35b4d97d4d17dc132565a6c192d0061122a57819dbed020c4ef0ca65352d0f35c23cfc9bd17b4fe30b6023583ad6e4c48877afa2b5e591f941986725a5
SSDEEP 393216:nzmi1R7oOFqaBzFfK9gTvCkRD3oWm/gL7yUOeHeQBmeQB6eQBRKyYYTaF6tdS:zxrkOZB57CA3oZejsIQyMFkdS
TLSH
T1EB3733A8F2445EAAF2CB353DC92AE64097CEF379A26339176F3174BE410D1801F9925C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  htvv/api/index.php
- Size 8KB
- SHA256 7b3afc774a7c2e356eacffb24ee0bd503db38e93716608d8c83efe2722ee6b84
- MD5 f35946c84bfb36ae1a76aa60026dbf66
- SHA1 5abbd74a217edf3709db206342414065f8c29d63
- SHA512 e30d3b139c0b897a7318ed6539e3166830af17335f213bd9ec1cff8aadfb50994490ff23934d42d4af747c73b89795bbaff966291cac5d0214a29dbbff7da31a
- SSDEEP 192:9XCk6uv/X/OzzAP59AQih0gqrjR9wxk7wQ9vLYz8CXA1vEcx0:OgXGoPwQiygqrP2kwQ9zxCXA1st
- TLSH
  T15C12A615B257904786B29A3D6FBB9601F9A11003054981457E4DA0CCAFBEC35FFB9FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  htvv/api/stop.php
- Size 8KB
- SHA256 4d3337d6c944c745eaed655cc12a1a9c3fde6f00a6cdb9b48c406bfa36991c0c
- MD5 7a099d9b0cfe95d2e73203699b72e46d
- SHA1 7b094607e7163ec36bed205ea68bbb7f9d5c0657
- SHA512 db5dd04abbb47adc2e8ce151ccf2dbbcb24d6c9ca17dfba0d1fa3d3634932c009e050dff365a7565ac96c3b84f7584396dc4a1c656848a21d4fce4170c32bd68
- SSDEEP 192:9XCkwfw38dr9AQih0gqrjR9wxk7wQ9vLYz8CXA1vEcx0:FXQiygqrP2kwQ9zxCXA1st
- TLSH
  T17B0263167266516B85728E7C6FEF9611B6A13003054AD1493F4C6088AFBE835BF78FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  htvv/app_connection.php
- Size 8KB
- SHA256 70a35682c767053ba4193eae3453dc50d2a000df8e619d67742b7b17faf4b287
- MD5 9a489f11fecb14ea44babff5c66fc249
- SHA1 43b3622a2c77d3dd1041bdede644d5fb75969c28
- SHA512 884aa336fcbc06a2827e0e1259360d9f22509fc3810ff32054b81b43600b07fa7551248ada4473e423dd7b3414c76582f3151e619ad301fe8542c90b09247a40
- SSDEEP 192:Hqg3th9MBbsVYyp4KHTCS3uKWuEfuGBz+xuIc9QaMl:l3th9o+/D+Sqkl
- TLSH
  T13012943074E85A279457DD4AAA8895093DA0C523D25E8CC4F8FD79E46FD4C82DC73ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  htvv/exit.php
- Size 8KB
- SHA256 0f6566d1664ca735400a1bbba675a804b0a5aba3e9b59e08754b7db9bc666a0a
- MD5 0186915d099ff03cd2d1dab0c998449d
- SHA1 181577d6c05859eabf77dc98b05b3b47e78cffb0
- SHA512 fdcd37927df182298a2932391f42767c1859784d15eae996a498b75ad7282dcf2a7c82d370c3733117845bdb0df0594dc6fe0a129c778ac4a488255e7be87fcd
- SSDEEP 192:KXWHRUvTQ0Fbz5Wn0leL9lJoEZCyNyicQsFiQQ5iQxWuIMkiLYz8CGMAFSi19QBN:uCstV5woEZkwlhVkqxC7AFM
- TLSH
  T1100275146DEB302B4D62943C2E97D21162597103058AC90A3E4C218CEFFD579EFBDFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  htvv/hello.php
- Size 8KB
- SHA256 5dc06a86c01fc70e75cb91a4ce2c04b923a9805b0a21965c77ab93e30f6b2c8f
- MD5 4013e452d9f1246c61aa598f16675b22
- SHA1 6e60f971086c586729692e7b00e6b3c30968fdcd
- SHA512 128f495e7f610b4370e74fca3b7f5b6dd9e70445083150be9177aeca98c441fb2f4726898d2e7224db8fcd1c67cca0fbd077216278a0b801059e2f52e46cb247
- SSDEEP 192:mXCk9nvTQcFbz5Wn5CpnneXtSoEZTR9wxk7wQ9vLYz8CXA1vEcx0:ev5V5vhoEZ/2kwQ9zxCXA1st
- TLSH
  T19A1273146D9B302B4E72963D2E93D211E65A31030546D1097E4C6098EFFD939EFBDFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  htvv/includes/ans.php
- Size 333B
- SHA256 cdbdd0c3c8cc3e47abefea88cda39becb540d8cdf7eb4087614311e1fa5996f6
- MD5 db49586ae8337603e80137ca1892971c
- SHA1 ba0e16c35568a9aaed4deaddb694de405cee1cc1
- SHA512 68f814a81c87103d27e124e5e67363421a885fbf6b48e063535ff924a02b3fc720d270f40f89019c634d49c102283c40693bf2e920014cf20fcfc40fa3990052
- TLSH
  T11FE0263C7D9CD46449A23EB3D2B6A61C215A3015512243407E0CB8A10E08B88992391A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  htvv/includes/footer.php
- Size 1KB
- SHA256 394030a8d64e029f8d49f435518504682ec66d5789a4b0bbdfad9dd1c39f503d
- MD5 573af501bcd9fd2cf1bb00b22fe70650
- SHA1 226945f526a64da399e01a71a98974507af4d2a5
- SHA512 99a23cc317f340338f22fc64cbcb47b417ab3439827f6ef29b7eb80009513e16a049bd98caef9a6a361bddc82f7210864ad928479730d958bd87a4d9d1cc190e
- TLSH
  T17E21ED1FBEE4866E50B37E856070B5EC1EF5681BA2C2C5683AECC7460F34FCA840B054
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  htvv/includes/functions.php
- Size 674B
- SHA256 afb6cbf62392ef6d5e5591c851dc832b19149727f628e2a7a87f9012669c0ffa
- MD5 540324e6497e87f0278cf5385f29de82
- SHA1 80cff046d5448d87a53cc22a6b36d7ba694d69bc
- SHA512 2e659195a59555e269b61c0788a2f5bd5cc4c0f02171b4df4ad017e7f678f23025d5f16900db6880d8ead555c07e5cdf6c98997a8858ed0bb074f3ad6056d0bc
- TLSH
  T14E01CB2A2CF0C52CC9723BD24539789E21B66A16A2C4C2203C8CD10D0928A8AC91ACB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  htvv/js/jquery.datetimepicker.js
- Size 37KB
- SHA256 f07d307638df5633774717749c89a819c0d18bb2e422c9b8320e1070d4633fc7
- MD5 d9dc80ba153ba8fd3ba65c8203741f08
- SHA1 1b55aa9e068787af29fe08f07692e080e5ad4519
- SHA512 2fcdc21f2a787b5a76026a67adb67a78dddc2c02df6354b8af4872fe127fa908564ae9a6fb1bcbd221951105e76c833d2d218ef9d429d8c10d0f72faca516699
- SSDEEP 384:hgMphIOdDZxBo4befvHifEGSJ7ZBTnHxMRQtSKU1LePwZ6SDkJvxLF39J7UZnW8x:hbefa6Pj6VDkhJFs+Iwv6
- TLSH
  T1F6038581715D2B5F89FB2396507E2AC5F93FC73B00445033B9599B906DA4C06A3EFEA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  htvv/js/sb-admin-2.js
- Size 1KB
- SHA256 f6f81f1648a5b28a9949559248e1001901140df003dd034cf19b1757ade0c299
- MD5 9ce0f6b1d7f627f711b1c0d54591f4c9
- SHA1 8e3b67bd75347a195a8d1d649f244d77b942fb7f
- SHA512 85dc37b86a85eb3524fac34512fa93b810f05132b6e9cac42aad8cf78eb4adaffb05633d013cca3e22f2f20658663ec70bc5d7e19906f632b186d9ca857ec978
- TLSH
  T13531CE46715039C214BB73B98BA65354EF2D443F91019700B8EE8E982F60734E7B1EED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  htvv/js/sb-admin-2.min.js
- Size 1KB
- SHA256 acb9c8a91e6798409e13736b3ec67aaf26a4fab96b43e7d8abcbc05da354426b
- MD5 8952d29ea9ec62c3855344103465bdbd
- SHA1 eab00d12511793be0a8dca062d88bf55ecb9a859
- SHA512 6e3b044c3e3150438d778145bcba576d0614536a912cafd463a5532bf6c6a047aeaf9c122f66d1ef1fa0f85343031161a8daed1579d7c279c34de634d769c4f6
- TLSH
  T10D21F307670028CA10FDB2E4510F3758791E1C3FA6028799702E87681C14B67A279AE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  htvv/js/sb-admin.js
- Size 1KB
- SHA256 f9764d60791cfff20b7b997eb4cb43551726b30eda2f5177ad92ca6d85f6f998
- MD5 5fe9e32541088bf93463ac6b17cfbab7
- SHA1 858179e301a79d438e9e6a16aeba8cbc3a2914c1
- SHA512 c911016f79e09a3b9f753f4af32781a6f136cb990894d13d99b9706384dd4c3882d6378ab8f97932fa0128beb1f7c21150a0fa4429a44ce0676cade883a9441a
- TLSH
  T1A821E016612421D210BFB3B8C7278744FB29507FC202A74178DE5D941F6073857B1EDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  htvv/js/sb-admin.min.js
- Size 936B
- SHA256 2544c1b634843030964b83452798f2345de33873c77044dcabf5b065eb9159e6
- MD5 2a93bcb5ad24e0fac3804d796aba0ab0
- SHA1 13c33f3fbeaaaef4c231db79be89cee4bb0612c4
- SHA512 385df1e91c65b793d5baff546d7dd07abdd26a179e87d4f8da601a33ee06136cd795c667d532ad96e5ea1d66f6e0ed2f93cf4dc4ce218221fdca801d27bccbf8
- TLSH
  T18511141A6650A1C515FDF3BD410F0F14B13A347EB60747C161568EB11968BBB11B3BE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  htvv/js/script.js
- Size 932B
- SHA256 2914794094637eb6388814dc7456b5afd7efd700cacd21dd88d279053384981e
- MD5 2d600bba81c95f86834c9fb0005fd798
- SHA1 ba48eca1fca3349222809edf751e6d8f13ef3768
- SHA512 d1c4e81a9c435dc260d1cf9b0403982b3572a513f0e993ca25c92892e271c54a9212917e508ca985df5a359c5bbf065eee16390fc2eb85c0abc842ce36d32176
- TLSH
  T19411E147FA6EF09AA737A22C237F0004893EF23390558E79FF7050048A9220931D6D8B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  htvv/mac_search.php
- Size 37KB
- SHA256 90feb220104fe12963fdcd5d0a21bd0c3fc1479cc23df8658f92ce67a3abc490
- MD5 4327399d322a4c6c6ab17f125754c1f5
- SHA1 cb519b3856d4ec85bc28c1af9501f1e0486c7904
- SHA512 4b0cbbb2f05d51f881d6133226d9fecde599b0f5ff4c24c1bf70f3a55b1665d7c3ed567b9d9e6fc1f8c46a9750302794dbc084d6bd33fb2d017ebe886567f055
- SSDEEP 768:RtIyTXkrhOCyvcaJKHBAksfdCTtZKB23U/b0P:RthT8yvcaJyOQLL
- TLSH
  T17803D61131A11561A477E5952FEBA65E3AA4C017C20ACCA47EED03D4CFCACD9CCBF64A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  htvv/note.php
- Size 7KB
- SHA256 72b52e09dd565994ea0b14a5cf0cf186f852d60a30b14ba89c1c1870b9c3c0ab
- MD5 dc94156476d02dc34eca00a20026d7cc
- SHA1 cae1d13610bb215943dc394c728fc8cc6b3cd242
- SHA512 fb91ac1258242a3d983cbae4b84aa28d2a5691ee6e659794d5576d4886da2fee8560045c077c55abbf3ff59e17782a09c2533e44f9715739ed0d3f6a3394ba70
- SSDEEP 96:KwFqPP1P81woHRZ6YgI2lagcUaSHmhrqWXYzQF0qrPXb36Mhf1qhb:NI8rHRZJ0L3jKtU6HKn
- TLSH
  T13EF151349C568A7344F788C00784578FFDE9858BD64ACB21F89D2ADE1FEBC11CAA3654
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32