General

  • Target
    ibouseroficial.zip
  • Size 19.9MB
  • Sample260626-w3dn3aet8l
  • SHA256 3abd58f98143d824655d89da929a6b5fd6ebb8ea3e2a37658fcee7a91f04f5a7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      a/fetch.php
    • Size 2KB
    • SHA256 56979deba90f02eda9216daebc6bb535ec81e34a458c2ab66aa832d33cea119c
    • MD5 SHA1 SHA512 TLSH
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target
      a/getappuser.php
    • Size 7KB
    • SHA256 5b33746b4c73df0e4eeabf49d054c4421be767bec42a37afc2568aba99be4917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      a/info.php
    • Size 3KB
    • SHA256 f9690af4814650b5e47333f310d32ed0c1e791b362f92ad0978fbb2f42ebeec9
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      ads.php
    • Size 7KB
    • SHA256 5f1812c156da4ac707ad8f03c0e9d815f14ddfe2b46ba480dd91d7adeede3f0a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target
      api/esporte.php
    • Size 1KB
    • SHA256 298987069296a14864cfd696b7e683286fcdd9b0ab65b4b6e1c34146dceb5249
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    • Target
      api/index.php
    • Size 1KB
    • SHA256 0ca512e8a96630b8f672914072056cccc3fddf75c502ce27813fa029adfe77a9
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      api/manual_ads.php
    • Size 2KB
    • SHA256 f3c11252dc78839951caff2775241b02d560d39aff83a8fde9c4943ddf5a3219
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      api/movies_script.js
    • Size 96KB
    • SHA256 fc5499204b9fb3d2d3a2af0dd117c08d9e14a9583fd7afaf7ab875c5608734f1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      api/msg.php
    • Size 3KB
    • SHA256 540edf8e174a71394758311ccc72444403e7c352a401b89d7292ef33e3e56324
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      api/webview.php
    • Size 1KB
    • SHA256 d215193a2690d0b9dfc280b0c89fe705c6a282f330e7b8615f62a19602bcc094
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      auto/movies_script.js
    • Size 96KB
    • SHA256 e2553fc0fde2db73d33b7bb07e360852da8878b1205dbf4488208bf3c0d074dd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target
      bg.php
    • Size 10KB
    • SHA256 85cfac04c008ae369b0bc87a55d079dee91e255ea7d3edadac1d0e3144661ee4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      edit_texto.php
    • Size 6KB
    • SHA256 44ef2e53077702ae46b9305b0bcbea2e58f93d894e1b92aa4b4d7b29b5fcc844
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      includes/footer.php
    • Size 2KB
    • SHA256 cf5c66438c135d5f60c9c8fe5db6e8c8a8e848baf3cce2a76110f3aee170d19d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      includes/functions.php
    • Size 8KB
    • SHA256 46c36c5e1106ac230337dd84422b89b6d736cbdd79fadd29238ab2b7e2b6e980
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      includes/index.php
    • Size 8KB
    • SHA256 c1ec2e02c971990dfcfb24c5794d8da6ff964e35dc748ba756f5f792313c3efc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
1/10

behavioral1

execution
Score
3/10

behavioral2

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
4/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10