ae344681bae615b09fe7414afa808504cc39583181c0f32b1ff343afd061c383

Sharing

Copy URL Twitter E-mail

General

Target
bustocreditfinserv.zip
Size 13.7MB
Sample260629-pgcrbaey2n
SHA256 ae344681bae615b09fe7414afa808504cc39583181c0f32b1ff343afd061c383
MD5 ca12ecb23b91998f0ea194bc3b0fb077
SHA1 51a7fd28c517545d993026b88a12b1b572a5fafc
SHA512 4110398796b5bbdf4c2b8b207a956466d135570336b8a8e2431a55dbfdbbfbd85b6e46f5d54be5467031463c3bbe10e394ce74601ba7f21bfc4da406869de55f
SSDEEP 393216:LC+btw+c2E0sOZIpWsdHNEWI9RxnIu502XkIu5ugavSv3ip:LnbtwAbGpWKHrCPIurkIuIyip
TLSH
T15CE6330BCF99177EF88E6A3559185B40F81E8D940066B11CD72230E446EF09ABE7EBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  bustocreditfinserv/bustocreditfinserv/about.php
- Size 12KB
- SHA256 5e260bdd7b37ac3026497d7577df789e1879fd79e9687ceff3db5f6798fcef3f
- MD5 47b421a83bd225494b8a64f3f1a5e914
- SHA1 c1036dcbacb16a1d047d1e062dbb230fa4dcdd4e
- SHA512 95fec117a84276be34d31d825fa8b97b52b04b3014606563c90a15fe5c0695bba4d7e8afef9655b5d82a9624a8333c427c47824a0dc9d4b4ddac5e94e07111f7
- SSDEEP 192:qtqnv3l89K7nHsa/dmZIWlVQt8p+S64FEMNcVuT:Y9K7+A8wDQ
- TLSH
  T104421D2094C6113B11B380C99E216B8DFFA28107C72A6A5836FD27DB2FF6C01CC5765D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/bootstrap/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5
- MD5 89889688147bd7575d6327160d64e760
- SHA1 de51a8494180a6db074af2dee2383f0a363c5b08
- SHA512 c2e77eab327af1469097c31bc0daf820c066b0222059d8ff0ecebca974b62b7535e96f1f356643b2b62763a924d040e4ac9b2097e1de2c22226411fde8723743
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEI:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo08
- TLSH
  T130B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/bootstrap/js/bootstrap.js
- Size 65KB
- SHA256 41af969ee00e8132a0040094db2b1a79a15b4d9b7e2bb485012970fdf7b5c455
- MD5 9cb0532955cf4d4fb43f792ce0f87227
- SHA1 542cfd539f0cad650342c8cab8baf1cdbcd5fea6
- SHA512 bf94662d185c86861febbd9fa60d8e8691c9507d20e5e7b68e6b4a1dc2daa6ef578283d0c34bb782b96d748c93bd04ac6fe265495b94b373f25258fac5d1a7da
- SSDEEP 768:VpDChCkWDTb92TihZIbECRUI2ek9BjooHVZsBdGhWLXA:mWDniKekhsboWLA
- TLSH
  T1B56340167BB820618B5B70BA8CDF510C7238951B554BD4283CAD97D06F50B38A2ABFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/bootstrap/js/bootstrap.min.js
- Size 35KB
- SHA256 d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
- MD5 8c237312864d2e4c4f03544cd4f9b195
- SHA1 253711c6d825de55a8360552573be950da180614
- SHA512 e18a5959736a9ceef67b40daf7964c519c678d680bbda8d2c7679281f5d349a286c99b96ca24e7a8e64ce987d372d74ae12da7255c606ccfe27ac13a35b5a3d2
- SSDEEP 768:b8lBD27UwlNBMl9/qahC2+jS1g8ep0skCXFXflcKGf3Z1RQ:oe78+S1Klvla3ZrQ
- TLSH
  T1F5F29606B23031A107DFB1E5515B020B72396A6EE90690BC78B9DAE53DB9C48717BF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/bootstrap/js/npm.js
- Size 484B
- SHA256 c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d
- MD5 ccb7f3909e30b1eb8f65a24393c6e12b
- SHA1 e2b7590d6ec1fdac66b01fdf66ae0879f53b1262
- SHA512 81bc329ad688d411fcf3decb28454238ec478c192b6ac19a3ee07e9939556cf15df91fc7e689802927bdef0362483fbf1659a7c92f877bdc625a56983967cf2c
- TLSH
  T1A4F074E49FF9AC543B5209AB105E1B677326E985A358D875D02E08FB59D89CC0B85CB0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/font-awesome/fonts/fontawesome-webfont.svg
- Size 306KB
- SHA256 bfdef833219a6edffd9c3cbc28db72739d22bb4d20cc2e2f8d56a7a4d408a206
- MD5 2980083682e94d33a66eef2e7d612519
- SHA1 26bb1c5ef100a1cd71923f1d5dc29fc797ef4639
- SHA512 6d578a62cc8360da90d650ef50325607420ab85e534f7f3ce118333db153a77f4a1637b29ad2770da84b7aaca0c19bc1e7b4f2882967bf4126fd4e815bafa32c
- SSDEEP 3072:Unw+ubvqCDOzA5vK+jRwXxSbs3cBNKyOAThr3JmqkOEY:VNlFyCX
- TLSH
  T11A649568F95107B9C7DC42C09A7E0D94532E916E18753E68067EE8F05D0AB2E4FCFAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/jquery-1.11.1.js
- Size 276KB
- SHA256 3029834a820c79c154c377f52e2719fc3ff2a27600a07ae089ea7fde9087f6bc
- MD5 3d93b072d14f2bd1ede58f4847f537fd
- SHA1 73e5d044bd153dd912930e8be433059454ce19cd
- SHA512 78ac19342bee3a1c5ca864d702e742f561f629429ff0877572a36831ce83299b8df2ea4bdb6c63dd990975c9320dddc68ec8b5407299dee8345d01d090644d26
- SSDEEP 6144:eOWehmnQcHCAkwxc5cr4OfXKDoZOVJFpq3aK182bHjI1fusA2rM3:etJ4OfDZ2Is1fLAx3
- TLSH
  T16F54B6D8F78D112E4232316AAD2F52CDBB7CD1B1561058AEBD8D597C249083C42FAF7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/jquery-1.11.1.min.js
- Size 93KB
- SHA256 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
- MD5 8101d596b2b8fa35fe3a634ea342d7c3
- SHA1 d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
- SHA512 9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb
- SSDEEP 1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB
- TLSH
  T1B293C8D9B6D27162977730B850BF510BB13A98EAB80C4C60F1A4D8E47D78E89507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/jquery.backstretch.js
- Size 12KB
- SHA256 711b581dfcec53f325f095a1ca72ec97776dcc2426625a491d2a258cccb6c521
- MD5 c1d3683aa2735ddc2f87426d56cfe495
- SHA1 93bfb4c254e3b76956986c84c5cca2cd0496ce44
- SHA512 8350dec8f2d1a62c918a342c0006454dc8d540e7d2a5eeaeea8e49c9608eeeda70048a5593e667ed0f9db21a46d02bf526c3923c48dcc715ea7fee215bce73bd
- SSDEEP 192:RKg7lHK/myoLSZB3zR2gfGoXtJj0hkcPeZRQqiSIGOzMpYPDuMbElqkJeL5a:RjLSZBDDO0JAhbZSHOzDPbha
- TLSH
  T15C42642B27F22063D92762A96B4F6645B739C027520ADD08BD1D83980FC1B3842B7FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/jquery.backstretch.min.js
- Size 4KB
- SHA256 579d9d9773858e863e7d802489f84b27b7f557b99900a3c6090a16ce8431ac45
- MD5 91d4cd427e3b6649cecaa8e689f284c7
- SHA1 8bfed4e534efe706b0b20898a9cfd0dcfb2a8a6a
- SHA512 8d674a1b4e434f2780c0158308486f3d58255753bc1d269ad61ace7af281b85fd07a594797c552126c8bb280110fee4f8240eeb79c48707bd0822a820db5d07f
- SSDEEP 96:2v1TdqYZYYkM6PNLYOM0CUWVJAwlY0OhO:6j5YYAVLq3K6YzO
- TLSH
  T15A91855B37623143D126E1E9520A4B05FA3518297807751EFABC9DF198D0D4D127FF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/placeholder.js
- Size 126B
- SHA256 c7bf5f80631feab1eef04163355c00e9fb0460f777f69b78ca2695d0995f6b44
- MD5 525b296f294fc9aaec7a7fd785350568
- SHA1 5121749a1c675cfc79ddad8026178ac1147666de
- SHA512 0e9e581a5d65ea0651b93e48b98d318f2a521039fa658ee414fed18f82a4cbfe4ef335e3b5cdd095038017658dce36a46cf63da08e426f17490da77b7077c31d
- TLSH
  T152B0923054A68A6C8B63411221B247683DC6EAD20D03B800CA647AC93B3DF220952263
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset/js/scripts.js
- Size 709B
- SHA256 42d0eac1dd9340280cb51a527dafaa8a5721195d22022e05254576321a5b40bb
- MD5 535b04ee99aec48027a551d265940cb4
- SHA1 483babe677a849ca80ece073dc3ce723db53cb1d
- SHA512 09ea07bceb422160314232f4ed76abf9e50a6e722bc48ba8871dc513e0bc2ce2956a06595683ca27a263fbcace1c46a8dc4dbc2d31f76e29716cb606505ed939
- TLSH
  T1AF01264873FD98422077313623AB8541A86742177209CE05783E56F43F9465C0A21BAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset2/js/Untitled.URL
- Size 199B
- SHA256 d1abb6f217a4aa267be72b320014d0cf2d764a44b62c004deb158f6370d54850
- MD5 aeb8fdaf616c55aec89c41e8fb2e981c
- SHA1 c93af0b73c98381e838f6eb5184c8c83519103ba
- SHA512 8c9e3abc58986babc113c21ffac35c8b455847dbf382c5394c129e52bef5f99b263fc0eb55b41a1f7e27911dff3f155419007e7394fe6938cb3f47c69539f82a
- TLSH
  T171D022408B4DC2374393104624B2CA68C8D32D980227E90093E66E0C36C6AC94CC9270
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/asset2/js/index.js
- Size 4KB
- SHA256 4a4736381ba60532386eb0f6596da8ed82f7ef6b88ff7e14b466723f16fdb228
- MD5 2048f783c6d1b15502d49a1f6ce120a4
- SHA1 248754e50b969cb5e838d072c471a293a0e15849
- SHA512 c20e0c4f1e9bee6de6c2b45414a1384bf3435c18020059b8a2e6bf8faeb2c0f7c277aa5e295eb7387fc1e2fb010632a667f9441f989f952d141c6f548efcab90
- SSDEEP 96:kU4oqxwqd7NCG6/x66DdqGHvzgH68Qcm3k1lwXbYk+jjqRDx:HpqzJduvQfQbkrwXck+ix
- TLSH
  T193A16109FCFA00916B77397B56DBAC4A73B091379249D804B88D06B04F56FA83B217CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/assets/scripts/klorofil-common.js
- Size 5KB
- SHA256 016e4eebba24ea19eb3364e12f47213a6ddfe1aef5369cea4de59ec5e67da002
- MD5 e403fb7c40e4c2c43df69cf8ccee7ace
- SHA1 2d5e5d701f6d91391bbd8a732aa9e13872677d3c
- SHA512 d65cad0c59f3848f963fa08db01a5355189f1658dfca5e2ace3e1a138ee0a7808972e1b3c406db16731207fc752a9fa511633a096777d272f8f7d98c7623447a
- SSDEEP 96:ZTx0JYy9YQZYL0TNjwWAvFcRLWUtKn5zCCm0hbRBKMCUdIxZ:f0JYybO0pLRLWAOdv2
- TLSH
  T1D9B11408FFBC669045FFF01BA92A18CDD33D846146460966E8AA02640ED539DB77EE3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  bustocreditfinserv/bustocreditfinserv/enter/backyard/assets/vendor/bootstrap/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5
- MD5 89889688147bd7575d6327160d64e760
- SHA1 de51a8494180a6db074af2dee2383f0a363c5b08
- SHA512 c2e77eab327af1469097c31bc0daf820c066b0222059d8ff0ecebca974b62b7535e96f1f356643b2b62763a924d040e4ac9b2097e1de2c22226411fde8723743
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEI:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo08
- TLSH
  T130B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32