7f9a3d1dc1d5f719abb94a9f079350e856e90444dfed5143bba8d6f6a9e36705

Sharing

Copy URL Twitter E-mail

General

Target
cgi-bin(9).zip
Size 2.0MB
Sample260629-w2ly2scs7w
SHA256 7f9a3d1dc1d5f719abb94a9f079350e856e90444dfed5143bba8d6f6a9e36705
MD5 175d530424e167fda611c7f7755b3d88
SHA1 5a24bd670cee84651f86ff042f1118a5700d73d3
SHA512 9ad591b54fbeee124a121d66e79978083b1c97da7c7b655d53431886c267e1da5ea859752ca15e009a32edbf43ef11b84f49e267c87028641894c416a031baf9
SSDEEP 24576:L4F/fcDE3/Zq+Exuf3EMCFoL0mc2QmCxYDUozBk8:oPAsTIoqrxYDZzP
TLSH
T164A565782DE11678D80FD074D416668192B9BB0B37947C0FAF7687E03B1A9C5FE306A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  authorize_device.php
- Size 10KB
- SHA256 72c1aeb86ebfa9d1de9be130a1bf7751110048fad000086f3a87bdbd9fa1487e
- MD5 d46388df0b6f0951f929cff8f794deb9
- SHA1 8d8b318c5e4b9d942fcbeb75849b710dc8c3712e
- SHA512 ec4c0a8fea3c66075a6411293e323f57882b28fb318328cbf1b42f076b872830669bd63fd3c4181302c6422f418e2e7be42b306dcfc2ff1ad0485b7c991e494d
- SSDEEP 96:QjaaTeqVv1KPEsKU0pWpW0U2pgG4yzsogXTeY0vMosPLFL5dz3rsNRYMe:MaaZVv1JGH3gG4XTGvMoslrsN2Me
- TLSH
  T1FD22610AB580106765B3A3749F23D200FA734073A24399593FEC53838FB5A58CAA7FC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  connexion_f.php
- Size 13KB
- SHA256 c2b2d25c9051cb73e03969f908ed046a328ad008d46fdb7990796056b2da1053
- MD5 627f2c935dc5587bfa6d4375fbd679a4
- SHA1 8a4d69c3c4ad299492d3be60bb3403e951297dfb
- SHA512 07ca72b698aeae62028174229f6dbe2c821f1c96f3ab57ed92c9e405aa11a348fd18140c0d98d2772b068b31beb6780b6e4cc83aee29f2800a8f09c730dc83c5
- SSDEEP 192:PkPdDnIzHMOqqIz6MPbyvmaQQk7JX0WPuqYcJ5rNqT2LQa9Jef12dsHaI60ByJl6:PASzHMOqDd9OXh4sZ
- TLSH
  T13C52735639E31527298395347772A2062A318063B049DC193EDD93CACFD8FA58EE33DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  control_panel.php
- Size 31KB
- SHA256 adbc6b826262649800584d9eb518d41b809e17785efb02ff232c929e0262658a
- MD5 7657f9a0ea52d5837365b2bbee6e95a3
- SHA1 4f0c20a4b5f172d178bd6e795f1df51f934802f3
- SHA512 cc60d67421b3d8e9a695d481f8f3266b2f91b406457fb3d98e39c0ad493e960c1ab383bd0c7d09ffc64c05850e0c1f3751f526c2a20fc328695dbc748d678666
- SSDEEP 384:DQc78YF+Fh5bFRtxcEWRPtp8YHsJhA6vnHmsHA:km8YF+Fh5bFRtxcEWRPtp8YHscuHmsHA
- TLSH
  T1FFE2978F71F328B26417607A1B6792017231D007D90ADE183ECE53DC5F69AE8EE67794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  down
- Size 7KB
- SHA256 cbd130671895e23dda35a5c882d794f8ea4d473559ae5fc6a3d0511725cd4e4f
- MD5 19e93c7887cba9e40edccf8fe030ecc1
- SHA1 3ff36c299044f5e0979f7276c2a02107608008cc
- SHA512 4da8b1bcc35b72d8d67c0c1a3601d08dce10fc988afd3d2d0cd368bd7ca486c2334775a98684774825ae67c64a1defd51c0ad823e597addf0dfe33112c22d49a
- SSDEEP 192:olVZHCkA26xd3Q4JRveuTtMy47R/Ga0kVhFuPwf8Pn9wHHyJT0:QJvVGaRF8I8w
- TLSH
  T1A3F1E8A72AF3000BB40712A87ABE2216EB55A507911ACD607F0EF6E9CF879C0CC5375D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  email_verification.php
- Size 14KB
- SHA256 a8010a56677e74e3aed5f509cd02591c80a623bbc30ebb1e37e72634e394e74a
- MD5 964c1280aeb9feba2a1baafbc2749249
- SHA1 175305b25195de64ec6a61dd836e176af14e6345
- SHA512 e0f082dbee25786a718a69c1fc6e8b023d97b57c7a6415d74665005ce3649b8d4dd99d9a6eabff9d5f46ef0d3b895b3449266c0ffc47cae5e1a40cc20410dd3c
- SSDEEP 192:Pbd3AaQQk7feg4Wj9FkDFGToyXqhI609JeM8ByJrG4GAgFFBs4VsKa6KcC4ILIRu:PbdALFMFl4KfsCsL6RIL4sf
- TLSH
  T1B662504B25F320626953A4B92797A20132718013E88BDC197DDD439C4FC9FA9EEE77D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  js/script.js
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  loading.php
- Size 11KB
- SHA256 3b64d4e0e0459ad9d8d45d37874e3bd1a996c1c3999631aa657a0dda3d06902b
- MD5 ce0cdb66675d0ceaddef88b26183453b
- SHA1 a2c0d6872db24e68bd600a1ed7079f56ff8a9b36
- SHA512 07cba11a0f4efcb65572b7c2d5284d808b9f0cef8025be3b3a25270967a942de0de76e22270ce14d435c6ea0040fffb2c415adfb2a94f693216ac5156c82bdd2
- SSDEEP 192:J8I2SOHIz6qy88IHSOE8IzSOJaQVKKhpfrdy9rWBbIxByJs1/n7JIRsGdxI9rri8:72SOcHSO8zSOJmV4sGdxA
- TLSH
  T1413273553593223A754398762B9B710422308023B58EDD0E7EDD53C88FD4FA9EAF63E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  password_incorrect.php
- Size 5KB
- SHA256 9fbc69c841ad322e7deb75474c543767b1d9278afe41e2dbabe2adcbfa3a30a8
- MD5 c130912fa6b7bbeec7200ecf1f98ef49
- SHA1 71f442dc9fcf5cfe07ada3bfb637bec7b5d5ec50
- SHA512 04a06ea8dd78bbc0e022839eeb41d73b36a69246773a948208cb14b39ab035f7a78d982128bb5ef6535b1c61d3a5ab1832bb19f6f8ae30229d0959a5ff974acd
- SSDEEP 96:6CaQQdW7w3ABqy9nj5fZz350ZIOyJm1nIRs7wjiiwz9Q:DaQQk7w3kj9nNf9JeByJm1nIRsqiZQ
- TLSH
  T18FB1304B79E3202A7543A4641B63920132B18053A58FDD593EDEA398CF89BE4CDE739C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  retry.php
- Size 5KB
- SHA256 d94afa5d3c9d45ffafbe755f2bb9ca91f4c44d868d477a976e924c174997af82
- MD5 9f339a6cc186908f915cdbfc3d51730c
- SHA1 1720b3481b295f906368681ef73cbb677f5d1f74
- SHA512 1aeb843165ebc2e357d2c1fd13c62ab3cab1a9c732c192646f48b35452f24d72f8fa414e472d80961c779a087a13ca7ffb74c539de2133d74b1ae12d9534bf9f
- SSDEEP 96:6daQQdW7fPmxNHnj5fZz350ZIOyJrG4P4h3nIRs7wjiiwz9Q:iaQQk7fPmxNHnNf9JeByJrG4P4pnIRsO
- TLSH
  T1F6B1515B39E3202A754360A82B77A20132708413A58BDD893ECD6358CF85BF49DD739C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  sms_verification.php
- Size 14KB
- SHA256 b82a5ebf0e1fd0f9306a070bd23da8e623a777fba0f08e3a78e96846a4c472a1
- MD5 214499a2cfd235281566c6df2395c4f4
- SHA1 a79016d8a76be7bcbf08192ad0961640e6648035
- SHA512 58eea39fdd2757113e688cce759d81d9172d7a2f288dfaea4789f027daf081d93f8647f333e98ac5552c1d64f6b78d61d4dcc2ae8c0b91738174e8967aa17406
- SSDEEP 192:i3d/aQQk7fjrjfj3Wj9FkDFGNIuXahI609JeM8ByJrG4LFAb6Bts4asKa6KcC4/v:i39j/7AFMFD4Lx/sFsL6R/O4sC
- TLSH
  T19962844B35F31022BD93E4792797A10132718013A44BEC167EDE53985F89BA8DEA77EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  technical_error.php
- Size 5KB
- SHA256 34a88fb22fbe06a402612a2def948187ed3399f72d65cb76964f9b6b0f06e163
- MD5 2fca6b0ca51aab83ac7341e92e5d0242
- SHA1 c552dde077e26414b9231991bd37f9c158ff9714
- SHA512 bc1a05ab305da5bbc5f86a6eca98ad2b594c820297e82f644865b94f6b61241aa3530d4cbbe36bcc7926b833e9cca1d927f9fe4ecc675a9bf57b3a2a6539f62a
- SSDEEP 96:6zfQaQQdW7f3VE92wHnj5fZz350ZIOyJrG4SCbjhvnIRs7wjiiwz9Q:sQaQQk7f3VE92wHnNf9JeByJrG4SehnA
- TLSH
  T196C1414B75E320263943A4A52B67920132B08053E18FED593EDDA398CF85BE49DD77CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vote/.git/hooks/applypatch-msg.sample
- Size 478B
- SHA256 0223497a0b8b033aa58a3a521b8629869386cf7ab0e2f101963d328aa62193f7
- MD5 ce562e08d8098926a3862fc6e7905199
- SHA1 4de88eb95a5e93fd27e78b5fb3b5231a8d8917dd
- SHA512 536cce804d84e25813993efdd240537b52d00ce9cdcecf1982f85096d56a521290104c825c00b370b2752201952a9616a3f4e28c5d27a5b4e4842101a2ff9bee
- TLSH
  T125F02781599AB7374046051BEB2CF6AD9880D8D893926F10A0EC4938B67F5E862FAF51
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  vote/.git/hooks/commit-msg.sample
- Size 896B
- SHA256 1f74d5e9292979b573ebd59741d46cb93ff391acdd083d340b94370753d92437
- MD5 579a3c1e12a1e74a98169175fb913012
- SHA1 ee1ed5aad98a435f2020b6de35c173b75d9affac
- SHA512 d6bb7fa747f4625adf1877f546565cbe812ca7dd4168f7e9068e6732555d8737eba549546cf5946649e3f38de82d173aaf9c160a4c9f9445655258b4c5f955eb
- TLSH
  T1C81127DE95656BB6480701011E1CB3F96D40D63C42C5EE10E0CE983EFB1D85602B9FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  vote/.git/hooks/fsmonitor-watchman.sample
- Size 4KB
- SHA256 e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0
- MD5 a0b2633a2c8e97501610bd3f73da66fc
- SHA1 0ec0ec9ac11111433d17ea79e0ae8cec650dcfa4
- SHA512 5168643c1768ec83554a9066754507a781b6d14251a46a469222d462efc6ca87a72c90679154e8a723349c91e7772b32ac9b08dfe313cded0ee0a6f17885079e
- SSDEEP 96:GFCscBOvOFXDgRvi/3UCwN4ZlkRo/j5SpoNOBoi+geBIzCa:GFCsEOmWRa8CwN4ZqRo7geEk3IzCa
- TLSH
  T122A1A6B0D38AD363927A74C9EE4845B43AFF40B023705C68693C463167A8536D3B9CF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32