9a73da8f377d72604ba710476990565de9a93601fb0881a8b7301fc059fe26a6

Sharing

Copy URL Twitter E-mail

General

Target
quickbooks-windows-master.zip
Size 3.5MB
Sample260628-wtsfvsbv7p
SHA256 9a73da8f377d72604ba710476990565de9a93601fb0881a8b7301fc059fe26a6
MD5 7ee99d3abee42e26320322e03b338690
SHA1 25c29625d1f23464bf38e272924540e03ec200ae
SHA512 c6c8127a7f9ae76f6b8998dcdc9df7c8c047547d60f9f79bbbbea54d6053da635331c7d3e798c5a782e5b3bbaad04b00207b7cc19e2ae544e3e129e7c38f20bb
SSDEEP 98304:4IrVOkJ5farIYHPZb067qIxiAubtzM2EX3H4g0uIIZw/x:4IrVpfaLd06GMEtI2EX3H4uxZSx
TLSH
T1B0F523578AFD4440DAA2EEB86501490BF1986FC2E98BF34715F463C069D14EE3BBD34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  QuickBooks/Callbacks.php
- Size 21KB
- SHA256 816da82214ca45e25e946cd12093ef986a6e522f203817ca25fb0894c92438e4
- MD5 8c4e02d661a065db34d86c09837d5485
- SHA1 a2ec6ac1a1738e146e97dec04863059e7c82652d
- SHA512 002211e06380044180c09929e36a70e8c6a2b3ef7af7bd98a169386b126cef51869d05218a3ba8988afd370ada327d31902bbc5c85dba979228d3c07e12ececa
- SSDEEP 192:mOdzqAXX5m/Lh4XxiKQdcxQLezoCcQPRnEfXrQHBhkqW3yiboru4EU1i4LCanv:mOdl5m/t4+cxuCRdETQHQep
- TLSH
  T172A26389DE1FD22ED936E326858FE384BA7CC0317D6E48D37C599B38709412D83A9D25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  QuickBooks/Callbacks/API/Callbacks.php
- Size 59KB
- SHA256 53afba5e0ebf0f1614e38178d132127be791b83f271bb9f98e8657554f33ee21
- MD5 ce4921f60a82db508c7a57d55c5652da
- SHA1 b277c1034f7ebab05d535f01722056ffe24beac0
- SHA512 643f3a17f3bf9859b5ade1c110260755ab6ddf42ed6f9d153755c34c323d9098c2d170dbdbd1c71058e2f812441afbb48dd5033bedc270e6384a4c07162ec0d4
- SSDEEP 384:3OhtGtJB8cgLEJLenx/C8lD0XbQIwhZseXhnJfJ9xthu/GUH0qgFSU29sQrnnEws:3atGtJucdyJYXbQIwhvJ+shp1AUyq
- TLSH
  T18E53CE42FA72D23385ABC155D546CB41FFFC8521B8CD0992293A8FB52FA279E42D34B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  QuickBooks/Callbacks/Integrator/Callbacks.php
- Size 39KB
- SHA256 f99bc9133a701415b288779bf83346d6ea54d657308416f26b52a655530dd493
- MD5 152e47fa52992d11e03e142b34b01e9b
- SHA1 dfae0d76c040d6daf44f43d155495ceaba903461
- SHA512 9575e8cf188dad49c38a49bd863f27ebe8ea6cf6d1f9eb2766fb4694ae71349dc974ea2c640e2dde55bea96b73d476f0d4e3550a9aa57f1f5079a47bd18789c4
- SSDEEP 384:4OCJdDc2wCQyDFVjUcgBSJt+Sj7D8S1ESitwVH5fh8t+V:4pVbtwtFt6
- TLSH
  T110032091FFBDC2258CB56A35894D81809F5DE0B1E6A30CC57A6CCFB53CD140E137AA29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  QuickBooks/Callbacks/SQL/Callbacks.php
- Size 400KB
- SHA256 057e76a6d90e5c3ed2b72ac973136297c62e7b802fc599625887445daa30faa5
- MD5 d30a6575ecac1876404b7c5b17b8803c
- SHA1 fe4327e84702b0d040ae2b82f8fd66ee3c7d4b6b
- SHA512 e74d0e8e11761f3292414c9a41ba426d43caa46eb63c4d6be36afadfdb2e806243b39d17b9271b1eb80bbca041337adc8e2228b144b353c37f7cb4469fea194e
- SSDEEP 6144:CG1tPLEl9ILd1Z1oeX3VmLQ+rkLxpzL8pXcXCgvS0J7SwcdqtvWUOf9XlZ+5vhtN:CwtPM9gd1Z1SECgaqCv+5vhmY
- TLSH
  T1FC94C646EF6DC72B896380A9D81DC690EFBCC572F49A4882FD278B747E8069D01E7075
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  QuickBooks/Driver.php
- Size 38KB
- SHA256 118ade085cc03691cbbb71e58e0688f12256456d1a13366e965bdcbd506c9a7e
- MD5 b9c13f8603e1ef5cf7e85e1286029139
- SHA1 415a5d31311bf410cf819049420af19d0382dc8e
- SHA512 1f720bb13c0d617962f56e7d6d6fd8f7bf86204f72aac6d6e59a09ffbb0674c8b74b50f4468ab336b7d7e66a8015c42ca71195c372a0ffddd4a648c3ebbb2d2e
- SSDEEP 768:nMsZdR5ALHjdKY4UA7tlcyV+UWBsIbEEleG4OYUSl9zChWYlJFEi/VQuEUZK1soG:nMsZdR5ALHjdulcyV+Rugpled1zCnlJv
- TLSH
  T14703869AEF6DAA53C11360B88D8FE080B8F45531B2F24993B492F8347DD52BC51B2D76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  QuickBooks/Driver/Sql.php
- Size 93KB
- SHA256 f9053871c962193beea55934526346963f93516d3309dfb6a4f187838a13555b
- MD5 a413127bb725b1ed446a417904b1312b
- SHA1 bf9fafe879b40ed5393966bbec63ef826f24431f
- SHA512 5d17705dd6486f150cf9c1a23ae7e3959bdab6bdfcdfd4cb4c25fc5b7e7d34edcaa4749f6f31e873921944f64deedd032bed10b382be0dd0315833ec9d9f5b05
- SSDEEP 1536:+mt4i9F8tYNSoJviBARxbxb/64Cy6gQP77yut+VWJNAYGzhRVNNjtKMEIMnJLQ8:+q4i9F8tYNS0dRVx6ZgQd+kJNAYGzhRa
- TLSH
  T1E793A756DA0D9D8FE05300EC85EEE1D4ADFC9633BA725AD3FCC6B4646C4027D81A8879
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  QuickBooks/Driver/Sql/Mssql.php
- Size 16KB
- SHA256 67936dcd344650a2a98259e61cbf0939fe5333512da720cdd90bfd1dc9ac048f
- MD5 f5a1957d6b52a9b73bdec5ce54a7997a
- SHA1 d6dc8d87fdee01a522a0f33ca3000e57a674da44
- SHA512 26f84ccded28f687996be9818058e17e3a94162d99fd3375df8fef2312f495caac0e6350983270aa79df5775b3e69221b4542f14f725bb18f7ddaac0d57510f3
- SSDEEP 192:DOdgiOGmxYEUdfcfMGNcsUPptMEDrnZVNamt0eSf0iCTSC0uTSfZ0uTSP0uWc0dV:DO+nGm7bFqL7050D0h0/0jc0U07
- TLSH
  T1057220C9EF0CAA47D19340CD50FEB1569CFCA9B79E218993FCE55434AC4137DA068CAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  QuickBooks/Driver/Sql/Mysql.php
- Size 15KB
- SHA256 c45dc27a3faa6da52e0a6ee5324242ae8e532e7250154b866549f29d062fa45a
- MD5 6be5f3448791c90b0408593e4269392c
- SHA1 5c13a965577b541d41bbac30570775e373f7fcf2
- SHA512 6e43d0ff35314a6b0cc53e5186070395db268e1a9a27735b131c68bb7523c25382e8359de60fd3da6f50909795c0210a39f955333e753e8cf0da75ed0176767e
- SSDEEP 192:6OdCTOLmxAzm5dzVsoEIRR/tMEADHWtc0eD0xZS1dWsRzSh:6OISLmgmXJ9vc0w0G8uQ
- TLSH
  T13E7254C9FF0CDA56D093448D41FEB0229CFCB977DA294992FCE55438AC8137EA164C9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  QuickBooks/Driver/Sql/Mysqli.php
- Size 14KB
- SHA256 a36d84c7ee0180d5d2aa9ba6e6eb696cec3172615bb6e3726567e9a5a78096bc
- MD5 818001efee0e4024459898796b1bca7a
- SHA1 0d6ad6f17f3c6822bda7f0d3a5891797766ca7f3
- SHA512 39d139abcec025e46788f713f5cdc031debabf6b7027a6242521f9d970f1291e668e9cbd77044a6c9d36fa11243f5575d1214b7746f7375ab8f5dea3ee078e02
- SSDEEP 192:NOdC19menbpp5dzvfxo9tMxDFz7VONc0eD0xZSLdWsRzSv:NOq9mappXBVVEc0w0k8uo
- TLSH
  T1276242C5FE0CDA57D093448D41EEB1129CFCB972D9299483FCEA5434AD803BDA064CAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  QuickBooks/Driver/Sql/Pgsql.php
- Size 21KB
- SHA256 69efa1ca2767e860251c72a004d6baab2dde9806c1bb50b6001c01baecb13af2
- MD5 4e7edb67cc8d42f46da06e2472bf5f6f
- SHA1 ada6c11ef472567e9a5b5c73ace04e1f55e9f200
- SHA512 6d83ad245ae24d9ac3293ef7ea23e732543a0e9154c8a7f882029dc90064faca5255b016bb94f4bb3ebe5d14e151531c4fbf9e5bb4d863151bfb08957358c3f7
- SSDEEP 384:1OaemFu5g1bE2Ci5viecVzRp9YkF0G0G040z0ic000d0J0gU0:1B3FYgEMe34ZZvIirDGKgT
- TLSH
  T139A243CAEF0CAD46C053408D41EE715A8CFDA97BAD2149D3FCDD6525BE8033E9068CA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  QuickBooks/Driver/Sql/Sqlite.php
- Size 17KB
- SHA256 82bbb2edee1711a1e2333dc3eaf5e7f73b3b186368ea91efaa43fa2dfb18d03f
- MD5 21b428e6cdb0a71e7495060eba8e8925
- SHA1 2fee0a2881450bddb3baf2a47dbaa87de0201d5f
- SHA512 4054c84f7f849a5b78fc789edc41075719789a93fa43a1d15b5ac39c10afba9f0799b07d063b8e9fa485fbe5b4b5fd025b660ae7c0cc79ce61d1ebeca67ab33c
- SSDEEP 192:mOd0pXW3u7AQp4unlz3hN3+KCKWhZB+ZZFvzIAz6fyrIIR3YKjxpiEU57xvYssPw:mOw9jWsfC/sPoPOs
- TLSH
  T1618252183ED94A22D18380BD43BFA012FC79FA6B5A269541FCEE41708F4137CE5A09ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  QuickBooks/Driver/Sql/Sqlite3.php
- Size 16KB
- SHA256 b72f962a5ec2641c78340a3adfbe71ac525cc90e8a5a501262aded4e06755be6
- MD5 c829ef6d0de6108a6520dad12c323c54
- SHA1 607cf0e5d26693ef3155408254f0ec5addd84d32
- SHA512 b678aeba0b0b4f4102c370236bdeb0d02ba2546bfc5be44fed7b8984e8bc9eec33930e56761da682894d23c98269b725dd8c3d4735b426927ce8ea0d8c78d710
- SSDEEP 192:jOd7lHO/O3kIRIknlz3hN3+KnRWhZB+ZZFvzMC2Yz6fypymIIR3XKjxpiEU5KxvO:jOL9/WsfNssPoPM/
- TLSH
  T18C7264086EDD4916E19380BD53BFA011EC79FA275A269582F8EE41708F4137CE5B09F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  QuickBooks/HTTP.php
- Size 11KB
- SHA256 76a00b527507659960fb7b17e941e941d9aef2e86894c327eaad7ff3d2f5e6fe
- MD5 69bf76627fb6a237e64e2b7df9692572
- SHA1 4288579142533d3768d2fdb594261215195fb2a3
- SHA512 14db99f9de0797b6676c5bf3afe8a365522ad283cf4767dc56556b7ff92f62e6e031db99ce48ad62b6d2c57941f85b3cf0cc42970c1dc174e8ee424358519caa
- SSDEEP 192:JOdTFG3o+qCqvSLfN8BXjEoOLxhTlaMXvgMejiIMk:JO5FPCqvSLfaBzEfdN/qj9x
- TLSH
  T1F44252CBDE4AEDA7B25700E597CBA84590BC71312CD658D3BCCD856A2CC073D82A1C7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  QuickBooks/IPP/Cache.php
- Size 1KB
- SHA256 b66ac318f770babe0dc047c1358e001ff75e1b59184df8e5255f556aad32f003
- MD5 1530d73f2472c3c337f4ed9786b6ac5f
- SHA1 3df952bd26614a608fe6e385aeaf1c89ac1dc37f
- SHA512 98360569491fd7d3d90585bfe8d077fa47204d0bc37dc619135789499441c84404e9562ecc224f7ded3b831877e2337a8bf71990fa1baa0b10b76f0ee739d33d
- TLSH
  T1F331CE07E766F83B806240789D0FEA82813B5131F5190416A68EA71DDCF2E6D7262DAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  QuickBooks/IPP/OAuthv1.php
- Size 7KB
- SHA256 789a5183fb2c6cb014f69998d22d9d543516f83a1a5a7a6e3ae18e3de83adfa0
- MD5 06e6d026228fb73819c8e55af6f92ed3
- SHA1 661a880636faea33e1ce5c7b8e90a3fb0f2fa34b
- SHA512 80ddd90f32422822e348136149c9e52e1bc76cd6c405b1db9e7fc74fa00e3cec231aa907bbb33e7b6a6d436e04a7a05497ff64410cf87542f4e5bbf71a1bafb3
- SSDEEP 192:uMOdLwbwawLwDZXnSlGhhddg0wC20oQ27h3azUH5bv4wvXHIKJXZ3qu24EjcrQfg:tOodhddgJtTRH5LHIKJp3qRIr9
- TLSH
  T1A7F1411FDA2ED91AD85904B15B5ED5D68A7C507238B28CA3BC84DE1C38C8D3D8364D73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  QuickBooks/IPP/Object.php
- Size 13KB
- SHA256 e6be9814d95e8c8a770015ef719b2490e0246345ba3bbbb68b0bf33d5f2097fa
- MD5 173e76df1a9ef73e466fb81138852e89
- SHA1 a56085c8dead923156e8a6d5fa82a109da0c8f8b
- SHA512 06794fb74cebc93547c684fb0e8def879451f13431048b2f29061c4db42ab0f6aefb49575993be32d640ccd7ae69579d2407f5a22da0dd71f2208241847d2416
- SSDEEP 192:vOdakyTt+j0KrJlo6dVLmB1JQak/cuKqjSNuaJIVtY1i43rw83tqwEtNREII1Y+5:vOYDMjfrCZkg0SMz47w83WGY2
- TLSH
  T15F5220C6FD5DC89D9426027482D5D48D8BBEA8329CA414E3FDC16938B8F851F936CA73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32