34a631c73619af7904573534adc325dc1bce09ec46971d4d35ad7b208b117b28

Sharing

Copy URL Twitter E-mail

General

Target
shadimall2.zip
Size 6.7MB
Sample260629-pff3cacz2x
SHA256 34a631c73619af7904573534adc325dc1bce09ec46971d4d35ad7b208b117b28
MD5 0ae41335f5476345bc52ad4e2cbb529a
SHA1 6157188dca56298aa940b1b944b27538cc5c8554
SHA512 52dc26bfb74ac9a44f164834e233c31e48a42806f3364960104a7b102627f721aa50c6f497e2cbe492c996423fea79248c46e8342b4bd9ceb3b4685cbc0965e7
SSDEEP 196608:JvIVtI05ZleaEbm3dIdwTXlr2T2f+1mxzxdclDEYrOsMs:JvIE05+aEUCdwDlry2W1mxoiYys
TLSH
T1716633F987E14893E80F8F7951DD14CAC1C95329B11189368F1686AAB37ABCF1238E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  shadimall2/assets/css/fonts/Pe-icon-7-stroke.svg
- Size 160KB
- SHA256 c508f5a34aba76da55d77ad996baf4095b6e9b64b35566e3657e5f73f1921417
- MD5 c45f7de008ab976a8e817e3c0e5095ca
- SHA1 0c9cce08f3bd0a8077951b99b4f06dcd099354a4
- SHA512 62d6941387d84055b991c28b113a475b07319f18dde76aec7a3f4806640ab85ec5be5b1620dc55dbf7c6f3b49e1e48d8b30d343cd84dd2d2a3b5fe3733e67942
- SSDEEP 1536:WAPW/d/gjFq6wCDuQQHkhiVT4JPc2bc3BVeGEm1THsEJ5VZiJwwxPAk+oK4+jEdA:R9qkhiVTCL+9VtsYVUJwwpAkxSynMR
- TLSH
  T18CF395D8EF7056F89DC957EEEB20ACAC343F60BF79228528C23D9F685593A0C460459C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  shadimall2/assets/css/fonts/fontawesome-webfont.svg
- Size 433KB
- SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
- MD5 912ec66d7572ff821749319396470bde
- SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
- SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156
- SSDEEP 3072:PLac0AVfCwGzG8LY4kh53s0eOnz8WjKAOvX7LYvglcD4ZME8xYWDQqJpFDBl4qjm:hCG7bFv9gSS
- TLSH
  T17594C96CE9910B79CBDD42D5957D0E90132D81EE28783E1846BEA8F05D06B2A0FDFBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  shadimall2/assets/css/fonts/shadimall-icons.svg
- Size 103KB
- SHA256 c57bf37fd7a619fb24de3e4bc5688418e85c64407a0d0d97f251345cf6479cf5
- MD5 e0c213f649c11ecef9b04f3721f05104
- SHA1 b0e5787bc83843aa9ed21465b6e2f9615f7a34dc
- SHA512 0f9c8336c85facbdfce994eeb15042fac5fe7a6fc95d1c8fab9a0d64e89ef638faa830e4690ad55c94f4bf29ef0a53414856e95573106546198288bb97042898
- SSDEEP 1536:q0c/5jQtrY+T03WAQ+0xJrwtjZ62HgmVFgc43P8Sihshp8UAhfqCCtpe:qSrYaQrgYCe
- TLSH
  T1BEA3A6DADB7091F46CC9ABAEEB351CA8340B64FE7F72C948C22DDD189AC3D584614D84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral5 behavioral6
- Target
  shadimall2/assets/images/Group 8.svg
- Size 11KB
- SHA256 f40bf75e0c29e613b7146aa6de03159b0ee3be46888a51a55199429bedec4973
- MD5 376529260d810fced59dae7a184418ac
- SHA1 2dc1e137f0eb6b89e3d4c4642aa163f8f0605c43
- SHA512 308493fba15cb55398b0e9021f231e7e1c59fa3bbb481403b8db99bb8c96ada4d3260eddba1f0673edafc14b122125850a55300e0500c15ede9e10a364dc11f5
- SSDEEP 192:FUF+hybliJiQtn8RJF+ck6fAlJY2PIJu9r4wqMC/mz9PlrhGldvuNM5q/pgl:9SQtn8j0dXi2PIE4wLC/mz9KdL5q4
- TLSH
  T1D03274771370D7D8AAC4E3481FA06AD92775A5D9F47350C09B8B5B459C4B9FBB238C20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  shadimall2/assets/images/sb-shape.svg
- Size 554B
- SHA256 8c042b590d7639a6305503298424fe5162c2a2930a695f4bbb85758d9fa0979b
- MD5 e01cb00e74d4db7fde3cf1b10d42eaef
- SHA1 7724e9ecdb0ced8180b90ed808e72c0beb4ae4b3
- SHA512 e09a4e4b31284ef6f7c6c9f5165b7bab5695a8e51cba3697233c6dc01a27bd5721a275b1dd84039d5fba6b3451ce4def8d0ed2798dee23c6bd2519eee2f16484
- TLSH
  T133F0C66E8FC79C7E9951C775627856C253B53087C5C08D9C44F53DBF6983441124619C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  shadimall2/assets/js/application.js
- Size 11KB
- SHA256 f2da5a22b76776de71ae996dbbd8a99016bcdac6b322a9f5d6c1992cce66d3ca
- MD5 87bdbafb4351cd7ad8c9863b2599b853
- SHA1 a5499b0849f11b028aad2de59304cdc1a7c4266b
- SHA512 c54216c6fc7646e0b256270aa3d1c470c95fbe3ddf2e9e15bb333c2478f0fad97db00e5b9285621cef7f8b2c99d06eeef629839fb930c6570c497dfe8b5f6503
- SSDEEP 192:yPahu7iq6e6RFiIV19V3oyeQ6XIQcu5VzarKGi1qWr:wIQcu5V/
- TLSH
  T11032320665B210359473707E8EFF95057B5B84034A8AEE20F98C6A944F4827DE7F9AFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  shadimall2/assets/js/bootstrap.min.js
- Size 47KB
- SHA256 e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
- MD5 14d449eb8876fa55e1ef3c2cc52b0c17
- SHA1 a9545831803b1359cfeed47e3b4d6bae68e40e99
- SHA512 00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22
- SSDEEP 768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
- TLSH
  T17523C84A7254B4A202DFA476913F450BB73B389AA60BC16CB95994ED1D7CD8C3227F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  shadimall2/assets/js/jquery.autocomplete.min.js
- Size 12KB
- SHA256 c6ff6d4624a5c8140cbc19107aa372a233907f8e6e4d55d002d20cae682a575f
- MD5 d426be835b700974b48cddefeb46b85b
- SHA1 94c94ffebbb7e61963707513ee4330e274015504
- SHA512 9168a1d63eaa827e8d43eefd80add55371b6ae6044b12cbef125982d2538c65f13f0f9d3d29b947bfabeb0dab469caa7795e4b238a843bb8df7df65f1ddbc810
- SSDEEP 384:o6+WaCyZKFUC+BFOCvyV/W1yBjKZsJDmv:eFZmb+I/EyZov
- TLSH
  T11342950077823336D66B309EC56B414FA9BBAE597C012890B217C6D49E78F1C90EFF65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  shadimall2/assets/js/jquery.magnific-popup.min.js
- Size 20KB
- SHA256 ecbef0f33e8ccedd2c605816e052cfff778abcc0e30a80b874c097a5fddd24fc
- MD5 be3333626c57af03599abcb59b325e09
- SHA1 3824067348f6485d6b07d3a43660804e3731b21a
- SHA512 5ed1a4755cff703c4d3688cafb9491d8bf0dbfe5f64d2eb7afc933a6c59a2d17b452295ac2bbf96035967ba4b0b9d655e7a2c2d61339b83c35f900d714b89120
- SSDEEP 384:MPhVIFQ2G2XGtqVxRQ1giFCdLtA4Tn5h5/w6l8aZwHwztLCpz3sp:MPCgC1zn5h5o1qkOLCZsp
- TLSH
  T1A7921954F2B2B26383A735B8646F600939729953ED06C855B55E84D86EFCEC89027F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  shadimall2/assets/js/jquery.min.js
- Size 94KB
- SHA256 b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
- MD5 8fc25e27d42774aeae6edbc0a18b72aa
- SHA1 b66ed708717bf0b4a005a4d0113af8843ef3b8ff
- SHA512 87d90a665c15d71ac872bd8bc003d9863964c7ec7ada6370b902b93c0bbd7770fe25730d946c7c6a465baa95efa74bc0e78af3f83aea615af35060cc8702a6c1
- SSDEEP 1536:EPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jqkODZ2D5N9Rag0MOIdSZAgtgoX5Yn:bIO/e2D5c4LgtImLja98HrK
- TLSH
  T1CC93E8D9B6D2706297B730A851BF510BB17698EAB80C4C60F058D8E47EB4E8D507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  shadimall2/assets/js/popper.min.js
- Size 17KB
- SHA256 bf5104790e5c6d7fa06286ee5e18c682bb60ca7e9a4f4ca835fa27ca795f82e7
- MD5 e6ac0849d733542befbc3c51b9707383
- SHA1 7d58d162ada54a8aabf3ec8ee3458d30afcc3433
- SHA512 6b51982df2f25599fda0f3eb2e893412a0344c993c211c8f27b4b09207202e76a10472c56fe2846afea5466b0305a44e68c9bc85d2ef88b6e8bc0628512a4acb
- SSDEEP 384:BMhfzshIGoUDReRvqgLqHCZ1ZXhxH5GP6owtGRHXwQ65GTHSwW6rx1s28PQ+si8H:iUsCgLqHKUx1OPUJEB//Y
- TLSH
  T1BC82A598336178A7865B917A80AFA60F7132D4676507A2C0F48FE5D42C38DFA427FD78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  shadimall2/assets/js/slick.min.js
- Size 52KB
- SHA256 abc1f3b65bc7ecde54231a83c337e9f0b2dcf1c9eaa7f65b7b0e9e3ea8aeecff
- MD5 b87c79035aba5a8d479fe3bc2d382330
- SHA1 e0815d8dc17842aa0605fe87ee15aa115660637d
- SHA512 c0f25878af078987c2927ed5545c5eb0717bb539a5c05db1b29eba4684154444fb32e21e9d8cf1036b357f7dfb2166d36b146187ed7625f632b9d2ed1109dfd8
- SSDEEP 768:TMwCKEZ8pIWbWqEg9k0aMSYh8gS1T0pBT5VDEvm7K7qfpsrIb1DKNQwpuiL0ywou:SEk0j+074qxd3Mn4
- TLSH
  T170334206D6E12723859771D5A53AC808B3FAE73B9A11D8903A8C43D56F1C42CCAFB7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  shadimall2/assets/js/tipso.min.js
- Size 17KB
- SHA256 c3fcd69f4ca961552fee2326b46921c7561f64cb4e5b2ddaafa62199b7aeaf4f
- MD5 8d6e77ce486f6756256077a3eb77c0a9
- SHA1 e14a28f20d455cb63853ad5c5dcaed3ae2e25503
- SHA512 b9f7de5ddf93721ddded258292aa91839e888832d8567b17489db6b832790cfd4d879e57a61a4bd411cbe1cd8d6e906b8263e31f8c3d0bdce0610cf00bcdf8df
- SSDEEP 96:1sSwZXfMEQ1SK773EAwVMBKaOeicRpcDqcQ5xDxrgxHxrxxdxLxdxuCxux0xDxmO:ySwZXs73EAwVMB6OQgE+pWOguonMB7JQ
- TLSH
  T1057234837154283F516BC2BBD0BACE48500B1A35EAE3D6387537D86D0860ED55EA3FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  shadimall2/categories.html
- Size 12KB
- SHA256 e5877b40f21cde58511d1838cdc8fd4a3b6dc85b5cecbaf02a5d6826b46d5c1e
- MD5 3c7e23ea8a9fafbcfa9fc2427eb46bd5
- SHA1 acef9604b131163ab300ee02cbf3224db370ee87
- SHA512 740e0128c2d104b0016ace3d03aec51f098b5a291685a0bb8d4d14361cd3da6e50bf9a3fbdf0d57ac5c8fb5e549e68a3c699e41289e66b69e6907630ba50a929
- SSDEEP 96:b0I7nYQEaP/3vLHfHoGuW9VoSPOQay+V9Vlu4qq4at4M:b0I7lP7H/upyOXloMZ
- TLSH
  T12142646844F814B702A291C01AF06B5F7F91DA87DA5B9B8436BC9FD45FD3E82CD1390A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  shadimall2/forget-password.html
- Size 819B
- SHA256 3dfa6e70f3b6744d3caf8a92dca76b7326c5bc31cb3507ee35cc625b2512e68a
- MD5 576aba2c50ca5264d27af94d2f846e33
- SHA1 5ed07f833dbe5e1f52e8a241fb13c643c6e95dc6
- SHA512 8c472b18af8b673d0c833416fff4b5c3810278a680f2df765c2a74cb526d8a0fc30c50a889458816ead3237406dc5e103a7974e8061b1464258a243f957d7546
- TLSH
  T1C001F66121F1293305C389C4AA682A0B3EC8DE13D80B094676FC9FD55FD7E83CC5B65A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  shadimall2/index.html
- Size 28KB
- SHA256 4f829a9675e60b6c285c7b478d54d474477325289f27898ec4a75e3b61a0d546
- MD5 b6f3d09d7d9f5034d0f03fa179a2092b
- SHA1 0155113f823a9539515971f0557e51dd6b08fd8c
- SHA512 f349744c5571eefdfb82d76612bcc0a5ee4c45a5c1b4f4ad13f94d994d02a53963be9c9b68dcc87ebdfd0cd2f4e7caba27117b9ad45864a9ce19556b32b17d85
- SSDEEP 192:b0hSxPpHj2sGpyOX/kywcOyI1nPyHypypypyfoMkXRCQX4:SSf2sGFk/cOyI1MoMZF
- TLSH
  T189D2A6A484F410B70592D0E06AA16B5B7F91EA4BCA5B8B4033FC6FD45FD3E82CE13959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32