9b7d4beef676c3cd7e799423d70f8e3ef058c266f5104a0046e7219d2ddfb7a3

Sharing

Copy URL Twitter E-mail

General

Target
iboplus(1).zip
Size 26.7MB
Sample260626-w3dn3aet8m
SHA256 9b7d4beef676c3cd7e799423d70f8e3ef058c266f5104a0046e7219d2ddfb7a3
MD5 6fe6bd6438d64b5e8402920a1fec4993
SHA1 6882a95172d39d28d4ae0c4f76c7c49fdcd8d999
SHA512 9ac7b07dcda4a87a009dff7e79b585f8b57fc7f9711c78f7772c0439b39cdcfde6b0a5039937e610c8a23e6d6c6186e83aad809701a80a5130ac03828b2c0bb9
SSDEEP 786432:mdtI3MI5DZHRulqkqzv82zb1M5hD3En2Dd5l:m6MIVulqkqzU2P1IrDp
TLSH
T15C5733FCCE6E9052E9898F71D84C6912A42F1126D283593F8C984492E23B5E1BF717FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  iboplus/a/fetch.php
- Size 2KB
- SHA256 56979deba90f02eda9216daebc6bb535ec81e34a458c2ab66aa832d33cea119c
- MD5 ec5edd5c58b3b0a14db7aa9659410d90
- SHA1 65b6cdcd8f83d7ce8b4c708d69c09b3b4417174c
- SHA512 84ca087c5b99160d80432efdd647fc841193e2e8ccf5dcafabb48dfc560e13a8c21bcd4e1c1bfa962de0a6b2dc66ea1acdf69a49efcc909b0b33b99bccf4119a
- TLSH
  T1CB513E32C3E001FBC5A04062069E7986321978EDD1D957DD9F2AD9EC318478CDC33A67
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  iboplus/a/getappuser.php
- Size 7KB
- SHA256 52ef42b34d86285c7eec937f9bd6f3d5aa22d56941b2c0c496fdaa051adedf83
- MD5 f01d2c0a81798d19fe98a1bfe3888da2
- SHA1 80f3fc9055aa6a2c54ee1732b89079a1ced00ade
- SHA512 58f8bec2ce01b470f2b60511cd9dba13b031f252763a44aeef034577ac73bb6995acac6dcd3f11546bf198442eebfbe947f4a7bdeb6273c6ec292b9d2c48d1e9
- SSDEEP 192:b8zluspOpL/uClgQb7/EN0q6mLI0Q1BhKfe/cB:b8kspTMNb4yUB
- TLSH
  T18FF1746478EB4C178077B82967DA60C421DAC50B2780D840FF6E73CA1FDDA29DAF475A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  iboplus/a/info.php
- Size 3KB
- SHA256 f9690af4814650b5e47333f310d32ed0c1e791b362f92ad0978fbb2f42ebeec9
- MD5 80d0a4c9d599e1ec31a68a912c8aba13
- SHA1 a24da757d012a4432ab22ea775aa5c67ffb7046a
- SHA512 fc64c85ee9cb6677cb0a85d4ff97c99dd8c3fe959d36c33709c602e6d9558a0aac064cc675e09c92d677ecf38f359ba2ada78aebc5018851ad1f3d1389b488b1
- TLSH
  T10B81416D24C1912309F6C5D72B206B89FAC36907F61AC902B9ED92EB5FF5C05CC37A81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  iboplus/a/movies_script.js
- Size 96KB
- SHA256 fc5499204b9fb3d2d3a2af0dd117c08d9e14a9583fd7afaf7ab875c5608734f1
- MD5 607d9b0b62ff5697e2b40f94a6c56b8d
- SHA1 e1651a128d738e4d964ce3587b4a0d2aa015c35c
- SHA512 1d3855bc4eab89740e35b3d5a4800a71f8a0a7e917ae2421cb62437d13cd637c9634f73e17045ab03f1b139b614ac54d7c2b5d0c9683bd851ea8319b7b006929
- SSDEEP 3072:jh1fw7aXQDzjELM9btKN4e8BTyTUjOS8Un1uD:rwoezjuAbEN4RywjGIw
- TLSH
  T1F6A3BE312E063E1AD3662D6CD5FE14C56DDC83176818D4B1389CE8AAEB62D31A4F6D70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  iboplus/ads.php
- Size 8KB
- SHA256 37983b642ae772666dc2d42fea895d2f882ae4257499a5d8038c2fe60c28975d
- MD5 504c8ae4e7872e90cc76e108e9770371
- SHA1 d96d4bd456418c786d9955ae91448cd23bf7c866
- SHA512 9476195d73b411d13e2d4ba076a3c50a3e4b119e510eb1a84338e9da61835dfa60534a04cb2bab6429e5a65a43d0c9c092e78c6b6d5dd04c9e84768712ffc346
- SSDEEP 96:XOdh/CKpQJQYNxRZXJ+X0HxEJyov3fdRhiXMmv1Irc+tmVuygvFYOjE42P9z:uCz9HxaL5g3vmrcNgvFYOwd1z
- TLSH
  T10712412029F46D6301A790E66E359F0F6D9A8B77C40B880076EF1AD95FD2D87CC1B28D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  iboplus/api/manual_ads.php
- Size 2KB
- SHA256 59842ec0b9732948bfe9d3edd2d248fc10a88f7c9fbc01575291339d81c6d5c5
- MD5 4dbef5f208756b19e995fdd5730d3458
- SHA1 6b02bbc9972d605af870ce351ad72d792ef95545
- SHA512 f99f63f225f9029545e023a765da048fa0f0c09f285ed767d86d990b7b4f5718113cb8acba26d2ff66ff4371d2d2f891e7969bd1562ba12178a05e601568886a
- TLSH
  T193514420AA9218136C7330B434EFC55536FB6152B729CFA83DCD70D18BC5AC465397EA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  iboplus/api/movies_script.js
- Size 96KB
- SHA256 fc5499204b9fb3d2d3a2af0dd117c08d9e14a9583fd7afaf7ab875c5608734f1
- MD5 607d9b0b62ff5697e2b40f94a6c56b8d
- SHA1 e1651a128d738e4d964ce3587b4a0d2aa015c35c
- SHA512 1d3855bc4eab89740e35b3d5a4800a71f8a0a7e917ae2421cb62437d13cd637c9634f73e17045ab03f1b139b614ac54d7c2b5d0c9683bd851ea8319b7b006929
- SSDEEP 3072:jh1fw7aXQDzjELM9btKN4e8BTyTUjOS8Un1uD:rwoezjuAbEN4RywjGIw
- TLSH
  T1F6A3BE312E063E1AD3662D6CD5FE14C56DDC83176818D4B1389CE8AAEB62D31A4F6D70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  iboplus/api/multibanner.php
- Size 2KB
- SHA256 007135f5c36dedbf387d0987b45841b095bbaa9957c1cb8f037a1ddc31ca5e2c
- MD5 cc60fe1286827f486e325ef9de46114e
- SHA1 0890f709df5d69a2ca8dd12f544828df4b29ce33
- SHA512 f4924fdd758c26bac08dd77a48b1a95c69575148e886f36fd863b4d14de7a68dd747f94749e0cdf57d47492b4832d3a4e25203bcb1068a3d2e7179d2053be9b1
- TLSH
  T14041B9615A823018423383B969B1A50AEBB1541F638555F57ADC239B2FBA784CC93FD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  iboplus/api/sport.php
- Size 985B
- SHA256 77f1dd0ad62ace23db0ffce899379bdad1907bf2985b09ca48121584de727e78
- MD5 f5d393a3c710ee05871c54e94868a901
- SHA1 b3018ca2452593d90ca58cfd4c25e77d51cf0809
- SHA512 9fb92af6f12fb8a2a9beb0013ecdb4a38f8ecd78f86ec029da70040e9823e694af7e31c445f3399b1288391cf367a78adf4825d549e22647fcd6677758947060
- TLSH
  T11011EFDB69C2088210B1AB715BE1B048FFA315536741151079DC763B0FF9B8588E3BDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  iboplus/background.php
- Size 5KB
- SHA256 ae58bee97ab9bc391aaf6763bafa926d181cd63bb5410b5fe4567d71b472e937
- MD5 d6112b8d6654458cb406c2abc391168d
- SHA1 bccc9a2ff2998079d975946661e4e7c56b018835
- SHA512 fe81091dcf1d547dc67e35d43034f19e2016cc2c296ff173bcb04f80bc2525cad0425675bcd5a4e2ccdb910e7f2e9738153742187f9bcf29145991ffb8115232
- SSDEEP 96:rPzINBr9Uyj9pXQLYmgBok7HI9im29SS9:ov9Uyj9pXQ8Blo9iLV9
- TLSH
  T155C16318B6C92533203353799B139A09F77650A7890782A936DE73E21F7CC9084AFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  iboplus/fundo.php
- Size 5KB
- SHA256 1f213596b8aedfcb6fc65ccb514c720853e2c34947ce2bdfc186124be710da8a
- MD5 7989d6d48dfada9f0f2194cd3d670b47
- SHA1 0ea558393254bf42c5e45d624428928e0c67de94
- SHA512 02ca2f1510d13d0c80f55b168038d893fb7bc0ff1f12bd63eace745727e94bac61cfc92cb4d4260dea6b82b5a33c6af32be15c22f9733447d7032664989190bd
- SSDEEP 96:rPzINBr9Uyj9pXQLYmg2soO7HI9io29SS9:ov9Uyj9pXQ8d7o9i9V9
- TLSH
  T180C16418B6C92533203353799B139A09F77650A78907926936DE73D21F7CC9484AFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  iboplus/fundoo.php
- Size 5KB
- SHA256 8d9f078ef75cc0005f5b018edf6bd40ad4677f0d0f74686c9443e2164facbb22
- MD5 3e9da79cab6cc9eb17b78ed84828a28e
- SHA1 0ad0f8fbe92d09239333c995cc6d314361754e89
- SHA512 c2fd3eda4454ee486541806cf304d6e632b0722aae33852330d44d2057529cb99dda8e57517f591a2b716e08edaa58160c12ce91685eaa6130216213fc351b4a
- SSDEEP 96:rPzINBr9Uyj9pXQLYmg2AoD7HI9iv29SS9:ov9Uyj9pXQ8P4o9i+V9
- TLSH
  T1E3C16318B6C92533203353799B139A09F77650A7890782A936DE73E21F7CC9485AFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  iboplus/gestor.php
- Size 11KB
- SHA256 129f8503556b5d39cca7da28e6b697ca81aef8966f377c39a4843effe83090f2
- MD5 407317b74e98487db7efd18d5ccd568a
- SHA1 5eb9f6fe2c82b6dc3d9540c9f74fc8860e4ef346
- SHA512 d82a29e35b53acdf143af6fedf3180b17dbbe69869c16881315aaf12e8151b6efdc3e246d12b1f74a7f3f5d01ede40990c0010865c5a34ae43d8726b359cd542
- SSDEEP 192:tAm9HNKuii9OnxbCnxXgYvHJ1xYi5p7iYL:d9HNIi9N5Yi5Jik
- TLSH
  T1B9422E5034C46E6746B3D4A9AB54CF1AFD85C253CA0B890076ED3BC72FF7C12AA07686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  iboplus/includes/footer.php
- Size 2KB
- SHA256 9844eee75cb3b3a6164c7109f9f8b2f2b9c99c9c9cd50cd47f27a1a46eaeee84
- MD5 2e4f9569a59e461cfb709e7c3607359f
- SHA1 9559978df333fdaf5b00c697de71b768612d6e8c
- SHA512 141707f506d54c7e4ac2bafcf270a9a4747a3ab8d0e1131d9065fbb3f922c74e19a682b24a9d75b893291e7e1dd06bd6b803b8d680db6995ffcc842aa66236ed
- TLSH
  T12F51555ABD1898ED427275AAB0B5E44CFD5C811B6681FE10F5FD980B2F503DA9CA3A0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  iboplus/includes/functions.php
- Size 7KB
- SHA256 7dd3d0081960e87db47a9434f7a34a7aa2efbfff6938ff790a0e35f7234d31de
- MD5 6a381865c92431636d48728f0e4f107e
- SHA1 fd155d591c83c003b1b007deacc8ee5bb54eb8e5
- SHA512 6d17055e8c734ad572e355ead807c040ecf0990b2a9fa95e56e1da544f8826344d8a40025a55a7120a751ade95ff03ff6778e94b76c85b0c002207e3428fd976
- SSDEEP 96:1p1VsZ4BY+7RJojqeMioJNGOmGhKSm5+DnBpXO68tQBEBjh4P9mlqlrYjW7roRcZ:r8Z4Bx7MOOoFXe6BEBSlm41YjyroRI
- TLSH
  T1C6F1114F3E876D44D2D273A08BB4C419EDBD683A021641E6FDEC45985F2482D79B4FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  iboplus/includes/index.php
- Size 8KB
- SHA256 0e5fb9d947eac21b5c76902fa53391b0ee72f2dfba77ff197b58c9aba6eb1310
- MD5 b96a33c6e79f430b1c78375353e1af8c
- SHA1 0c31a6f41391291b1370a4bab101713b5a32fe01
- SHA512 2858925d8103793de9c01648705e4f81399585af4f792e6de57905c9d1821e3cab68bb438fbb83e9ef8b0239654264377485018fdf8a8c8609a713bfe92327d2
- SSDEEP 192:QxWQ+HYhkCUcCdf/Y83h1Ck+RhhwW3fgWtpiujdQroP:FfHokCUcuf/Y/vfVtpiuBQroP
- TLSH
  T12102B84272A6566DC9394E7F1B37CA05A59400020A53709FF9CE3180AFB4A2DB779EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32