a0ce84ade8b8083bf4d47d01ec5a3ee05f9b226c5dd71f3d018a03b2e24038be

Sharing

Copy URL Twitter E-mail

General

Target
medics_1.zip
Size 17.6MB
Sample260628-wv2e6abs8t
SHA256 a0ce84ade8b8083bf4d47d01ec5a3ee05f9b226c5dd71f3d018a03b2e24038be
MD5 f5ee04efb0d4053bcf30a1c152f713e2
SHA1 489492db84596a21f10403bb4fd0a1e8c958bd2b
SHA512 05bc1b6d9e6c9a9a7f183d95dfd5f7f739fbeb020e03f90becb895aca0defabd8fafb513b908527ed251b5c92791468f75ceb731b8229e33368073150d269d9d
SSDEEP 393216:GMQ7CeXmu4SRsAdK5rJVf67e/uc4Tf7W0QYYW0VZ/HDGyB5:GMVeXhGTyq/ucKfK0zYWq5
TLSH
T1D207332AE8A0AD36E456DF30F607C7C7F59F2E19A83CB282639906E8DC525C54F1361D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Templates/main boxes.dwt
- Size 52KB
- SHA256 f6d8b6c7549caec0b1dd595abba57e14ccff0b024d2545839e77a8dad30a3177
- MD5 a8b989c10ecee9a5823c72f08d14c0f9
- SHA1 5c09f7e4d93b82397f886bf0594b827ad911537c
- SHA512 fb822bb25cb6550719dabfdf8c334e6729a64e6d14fffd320ebaf61d5b8c99a84047163d709e6b4b0c657ad0bc7726b91097958375e5f3852e9b94f30c33a7f7
- SSDEEP 384:pTc4FZX/q8VDF58UVJvdOKbTCpWIk+QqWPV3ZAp0:pTcaq8+UVJdbTCpWIk+QqWPVi0
- TLSH
  T15533CA2599C1A17750B385C58A21BFAAFFE2804BD71B8A0432FD2B9B5FB7E84DC03515
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  Templates/main colored.dwt
- Size 53KB
- SHA256 3f9b5fa9ae326440c6e09e738748b9b46eb557724f99f52a2d64b23ebef802c2
- MD5 41d49b5bb416aebcadea7f5e03aa839c
- SHA1 b41c079fff8c234f94043a2aaeb5cf447994d308
- SHA512 8661c84cea3250f7d0dc87e8c73f53d056ac369fe8a054116c24f4518bc7ae742fd01e7193353f998dd4e565d8ff8791b9d06281ca0db93198616152894b8c8a
- SSDEEP 384:Mb5/q8VDF58UVJvdOKbTCpWIk+QqWPV3sAp0:MbNq8+UVJdbTCpWIk+QqWPVl0
- TLSH
  T1F933BA25A9C1613751B3C5C58A607FAAFFE2814BD70B8A0432FD2BAB5FB7E849C03515
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Templates/main grey.dwt
- Size 55KB
- SHA256 3784d9494ab23225a105f4213226dfd7cf7991008f33a5ae28eb2237ab3eeb5b
- MD5 2c0e8777a47d50d3ce656c997e7eb0da
- SHA1 c7492517427f2e843ffa67824cb6a733ca7e4eaf
- SHA512 573c556566abe3bd93fd9416b4eef9e2501fac47c987c436e47d5bba26e390bc2df72318c5368a0f8121c8821ce5400f8ca4c6f940a0dd4f1575302d2f7b0cd2
- SSDEEP 384:1TcNFZX/q8VDF58UVJvdOKbTCpWIk+QqWPV3EAp0:1Tcpq8+UVJdbTCpWIk+QqWPVN0
- TLSH
  T16A43CA25A9C1613751B785C58B207FAAFFE2804BD71B8A0432FD2B9B5FB7E849C03515
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  assets/advanced-datatable/media/js/jquery.dataTables.js
- Size 368KB
- SHA256 41594dedc1471374801a8e28badaf60f46afe3bfd240a8f9b6db50793567b182
- MD5 11f1422018f2b9c3b2cda2eb6b590513
- SHA1 65fd980a479cf263103823a3f5017b4803d41736
- SHA512 286efa45c9987feaf55356acdd787cf785219b05d453547fad92de6faef31505e2d94a33726519f9bc2c1763c565d3f3d5c70ec4cb1fb93da2120fe03190d85b
- SSDEEP 3072:+v6IgNryQ30TOZWW2ezj/aMalirNkCIRR7YpBCbR8qQL+QHC7MCaad6CUQB:+y/NryQ30q/5JkB7YpBkR8qaqB
- TLSH
  T15584B8C5F70C263E6556A174B9AE96D8A63C803816A02CB97C5CD92C3F40CBB53FDE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  assets/bootstrap-colorpicker/js/bootstrap-colorpicker.js
- Size 13KB
- SHA256 05c92c130e7e5f576db5df2c8711f9a6bc42175cfb4b46416c904fe4ba2a55ec
- MD5 a37e5cdf00a6105f8f7dc0395bad0c9d
- SHA1 c0929551da581b6ed2562a65dde56a1681d1a8d5
- SHA512 a2f2a38c9533a92968a4ed894ce7b0b336792f3f42c4d644a968554685772c99979c640ed91ea08ce2deeae72b31c970cc319373d94aada9fbb7d77c68a67552
- SSDEEP 192:V5fXHLBsRSATinMMTxc+Hfwa6NREHIEkCuWVhdwy3b/Eh6wU22TUt+bNWCi4K+ZD:V5fFsWxckf+EnNUt+bYCi4K+ZD
- TLSH
  T1045253D8E7DC549B4677608D4C1DC6CDA13EA43AC8098AFFBEAD00E82D94F1C51A9E74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  assets/bootstrap-datepicker/js/bootstrap-datepicker.js
- Size 12KB
- SHA256 893625b9f9715de62d4e8fc1226e2c6c49a6289df56f80a36269b779775295f8
- MD5 dca9f99082ce8b575b8ea1be028741b6
- SHA1 0159ec0d7c2e17d9cb058cc982c60d63d636d82c
- SHA512 be2ba469806b0afcf9b2dd950a3c3cd8e23d9cdcc8ffcb5c13b5ed433f2739d679db7d066a01d667635721882f5d4aa1d75026c73036c8344d9471c066a633cf
- SSDEEP 192:V9fXHI23ikOLgoqLIuVk0qLPI3ZLWMdI7pRx3IJHzS0WDE1aRVUc3TuW16zkF9PL:V9f4zaM+kpKFd0pf6SFPHPeAphxih6
- TLSH
  T1C84231C5D39D1547967220A95D2E12CA563D807BDC064C7FBC6C41E168ACF29A2BCFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  assets/bootstrap-daterangepicker/daterangepicker.js
- Size 21KB
- SHA256 a488522bdaed2a7e459eb5fa8afcbe7e8c5224b40d2f16388465460cfb732031
- MD5 b9298be8f1cfb16d2be2d7e90e343c12
- SHA1 36734ff5cb36ea494ccbfae4f5fc59b31bc27924
- SHA512 9c56570ef851de209a083537fb673aa8f90e328b92f7868e3d1022ae45b73fccba7f87d979ddbf1712a391b9a63628b9d6dd96068dee94a157b063d118ac2800
- SSDEEP 192:oFBOHcSyqR8MeYqeoRA6hSMSC4Y9rX5ak2lM3rl3rrGaHiCz7syNPyWwNW9deF2+:EmcS8Mh65tIkrRrSGlvJNaWR9dhzC
- TLSH
  T1F5A2E2095AAB0532896721B98FCF02056660812B5C8BED2C3F5DA3C06FD493A55FDFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  assets/bootstrap-daterangepicker/moment.min.js
- Size 14KB
- SHA256 e1d1c13d08a6d477e65ce03824e1eb8fc4f9252882f8c07ac1ec727e4e20e03e
- MD5 e8cdc98d1a718ec002f0ba18f2edac0c
- SHA1 84d638fef033968ba31a7e3d7d4bd37522ef102a
- SHA512 76c4e0b53536158f1467b449f48f319cdad77ee82ffc934d504b11378f86d2cbc984678fb49ee0803cf513363e2510fe4f6caa9d37ea926d56e0499e99bd6996
- SSDEEP 384:CHbg0Lvc2tVTm7aeyJcw2359roT4V2LvDlz:Cc0rVTmPyG3j2cM
- TLSH
  T1B16251CE32D9B5020327A175482F250AF37A9991194E582CF229F5D6BC78D58433BFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  assets/bootstrap-datetimepicker/js/bootstrap-datetimepicker.js
- Size 51KB
- SHA256 85f264b122fabb52d52681981758264fcdd3c1bb3b715ee5d8ce5f26f32bea65
- MD5 f2baf873ce26378681dd1d57fb212bd7
- SHA1 e08905b454058069fb52fc43ed51ccf5039b174f
- SHA512 0506fb4c4a0c11ecfee0caee1a8498bfb3ee99768161b76d0d4bdfbb343014f7a4c0026515273c01b118b86596af5bd9f2f93f312070cc8ee7a56e3f83eb6c9d
- SSDEEP 768:OPEr+SaPghgwpNkrQvVR5fVXEVJ3J9UXpyVsq+Fv7I+s47pV2WjIXR5wHLV2WjIV:OPL7r98sLrF
- TLSH
  T13F3374C6E39D26829676206A891E12C9973C80378D850D3F7C9C51D42B99E3DB2BCFF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  assets/bootstrap-fileupload/bootstrap-fileupload.js
- Size 5KB
- SHA256 a7a0a615f5424f3ad6c0c7032e6d6bf395c7578bcd8251b99b1bb45fc3fa01f5
- MD5 e6f0d72786a23d9be7a9996a56ed159b
- SHA1 e11367ab56882c5ec33b1ab14bad449bb6f7091e
- SHA512 4a43dc5d3fac30d397e6edf39a38e910b1da1f69ac1e2218663d1c0aff3c1d3261f4cff9bea9a1de89f2589ec89821146042df29b8b97dc07d2a95981768d31c
- SSDEEP 96:X04X/XHFCoRnh5eQhxlGgWbRA9Wz7JZjy1JkKYrF07L7KOJI0IS00GZj2zEVh8:X0eXH9nhAulGgCRMiFCL7bI50PAVh8
- TLSH
  T1CBC1FF5A77ACA0518367307A1ECF81443525906F998B46187A3C46F5AF20B3876EBFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  assets/bootstrap-inputmask/bootstrap-inputmask.min.js
- Size 5KB
- SHA256 5cf6eccd2be7d69feb366838bb01285e3dcacd2244b992488776b5c909fbba5a
- MD5 0bfc31f4a9ba2cb91150dee1b5098fe8
- SHA1 ef398609bb133822c15d935b9704946246b85f11
- SHA512 b4963e7533b8003430973bccdd754ff4dd4ce8e33e2d3f5002bb841bfab25d5efbabb0a302cf3bc289b2b304a5c92fc5a0dc7cb153cfe7c2e72ec8d05d2c09d0
- SSDEEP 96:LOY4SIITBVJAX/MSMbqhuezmbIHwWHt+Jf98Ck1rVE4C:ylINcThue7QWN+hkJVE4C
- TLSH
  T1ADB11058B0E7236182FBA067055F4B8A763BFF19288A421C742999D7BD34D05B1BBC38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  assets/bootstrap-switch-master/build/js/bootstrap-switch.js
- Size 14KB
- SHA256 54936e7b81e1a874673f4e1aa16d7984f8fd8f3e33e40cc9afec13951c4af7a6
- MD5 96c173a0330888a17f2a7ce96848ea39
- SHA1 08b9f694a3921bb1af2df7ca1334c2497bdeb3a2
- SHA512 1baaf02692cac552ac211cf7a828b6c405e09b2bfcbc3b95edd7ecd02e1dddb5fec72ae3940dade877c6eaa8c7fb8fbba33b42a05a50b779b251a3c7f116ad8e
- SSDEEP 192:UHvXHjjYXheWrTevOWC3eRURfjDekarYtByTcdDxYAa64+N6dJ4iO98ZvJm9C/kh:UHv36vrwOWFE9W6A4T98FFTTUT/Wm
- TLSH
  T190628C6C78E320A1E26BB02B4B1F948875794A2B400CDE14786D09D1AF79F14A6F5FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  assets/bootstrap-timepicker/js/bootstrap-timepicker.js
- Size 29KB
- SHA256 11ecfcb2aa94ae19dfafa227980a80af2d09d02f187de452f1d7816ee7a5d4ea
- MD5 4f8cb3f1d60199df04b00fcf74d74ce8
- SHA1 569bddf33edd806b9efdf674ba819a070f19ebd9
- SHA512 b5235516b6e95c6eba70845ee9d2271a2a3250661b1baea1f1ad98e08248fd15850922abb5536e6491c72d8a6459b5c304a423d7da2d3650244b4d30a2cf568f
- SSDEEP 768:VFy4Q2R5jIjB36XPl2daBBd7e9Zm4G+XVF2yzdNTyvlG:VFKx2yzdNTyvlG
- TLSH
  T1EAD2B75963EB2162D67BB1BF9F4F29143630441B680ACE0C3C9C92C0AF55A7857B6FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  assets/bootstrap-wysihtml5/bootstrap-wysihtml5.js
- Size 22KB
- SHA256 9ee8fe95eab50ed3738736c8c8bd04fd86f22816092850d1c7a99bb6fa9ffba9
- MD5 1c95fa356c860377e6364e0782885925
- SHA1 5252924e14ffd0888c18412ff42029bbe3cad22c
- SHA512 fe15da22cbc709dfba73e7398924a81b3426fe1811c3df653230345098a072840c3a91aa1294cfb62802b86ec26915a7a607499a2397c308564ca590aeb2722f
- SSDEEP 384:ojsCSlpEqPj0KBwdrVkbmBX5/UwEekQotkwq:opSlpEqPj0KBwoW
- TLSH
  T1F1B2DE09F4F72C62416331ED9EDF0F11B461DB17480AEE063EEE23981F89959B59E368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  assets/bootstrap-wysihtml5/wysihtml5-0.3.0.js
- Size 324KB
- SHA256 77c08edea527c884ebfaa07e672768b450e1a52c5093ceaccdc5068fb8408a01
- MD5 6a43f93fe8af62dc7925275bcc417602
- SHA1 cc1f96d99625d5285e12d56d1ab3baec75eb4f9f
- SHA512 af0693ecc2d0b18e12191a2d2eb70bafc0c6becb2664f8786d7e58c410086c3841391f386482581b321c47465df977c08cafe03d36534f088e28d30a1fa8ffbc
- SSDEEP 6144:R+HcNR2BYOCiC5KXdBph+C+JDmwI3gZMvP9uPkPm5Ib7cKT5+GSrYm7v8g2gQeJJ:R+HcNR2BYOCd5KXdBph+CoKp9Gsm5C7U
- TLSH
  T1FF64B5097DE62237566BB03D1FEF5144F539404BA808DE107EAC96942FA4A3851BFFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  assets/c3-chart/c3.js
- Size 91KB
- SHA256 863eb3eb180d51fdc2b7a3d88abae5b39663ccaafa4d995bcbda6b749c726a5d
- MD5 773bbdf4195517d6e4e517d93a3b18a7
- SHA1 5a6b741099ed57142e075d3730962496f8f1f6b9
- SHA512 4633f3d93571bbcefb60f9d36b9ffe70e89c07c3ac33c92920ec85e4af3bb0ebf31b2cf8abcd70304c511cebf3aedab14b9932c7f6f6f7d4552cd4df33651627
- SSDEEP 768:aNf0fr7oSGhXP9mzYWe4eKlL4URzaEKNz0eW4cv2xr/jP6mgbycOIBW0FxcFFUWS:1r8SGhXP9f1KlL4jeeW4cexymgbyrkyi
- TLSH
  T1CE93631AB6E320619B1330FD8BEF94057379C913460ACD14FE5D42E19F914349AFABAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32