b15aa8942b07460528accc71a5fda3a567bfced6b07c7ea06c481a0509ffcfc7

Sharing

Copy URL Twitter E-mail

General

Target
mbp-co.com.zip
Size 7.1MB
Sample260629-w2ly2scs8t
SHA256 b15aa8942b07460528accc71a5fda3a567bfced6b07c7ea06c481a0509ffcfc7
MD5 7aea6082c7cbc18ad92db5f5fadd859c
SHA1 ddc917c144823c4336f7a7a649fdb6c3429fb886
SHA512 9bad9ca853d01f2d4ea49a66476ebb4944d320975660d7307a6c6af6950c369b9193cf83a56b39d6713e6c2212fc9c59b5335af130e7bfe34bc7b84cbb577d81
SSDEEP 196608:eKJwx+KSTvBgkQWXSkK5h09WWk9rXwcn70:vJ6kTil5H9Acn70
TLSH
T116761263D9AEC813C069C67AE5AE665BF9E183C6FC10D10B26EC54049E477E12B2734E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CMS/edit_pages.php
- Size 4KB
- SHA256 cc975597a674d4b1c3ed1561bc0b61fe646cbc324f9c953008e5189b084cf0ab
- MD5 f14d23bf63b7522a0f8f16a614ea7469
- SHA1 24392432572e3d0231234e34b8b60c5b9e0efc5e
- SHA512 4cf86474d7ba6b63a80efc2dd5149bddaefec1a120e235c150638415259fdfa550ae9e965cb7878ace58205e5fe4dd25f4c426e032119cc3171dbaef5b5d28b3
- SSDEEP 96:zIcv39uYrKGfrH7mzCaG/I91C82+aG/oZ1C8DUW:zIKgCaGqCeaGqCjW
- TLSH
  T11D911103FE54D96AC413109AC7658E0A69D4DC64F386CD8839DED0BE5B83CDE07AF668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  CMS/ewp.js
- Size 27KB
- SHA256 eb19fcda75db3400858f70c90849bd447fe7393c62fac8c4961c9c3560dc31ae
- MD5 32b57e7b5f69468002c899ac380598e6
- SHA1 7f9f5f30c34df0839f7baf30f471e51d66356f4c
- SHA512 bb36a7ebe2610d99d0b3b25cac4a2e146916f9af798a8e6e7e7702d64855d9cbd5739d0a3fa8a9df2471fcab28ef3c7d9cf580af8c59a432f56f127a51d9b078
- SSDEEP 768:s4sn/rCKXE8rTaNcXE8rTViKXE8yTWt8dbPE9ZTcwMFp6EyDq4xX5K5D5S5c52FC:s4seKXE8rTycXE8rTMKXE8yTE8ZPE9Zq
- TLSH
  T129C221917246D13E07639355853A800BE8BCD9612929E0FDF9D8D8D5B070D2D86FFEB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  CMS/fckeditor/_documentation.html
- Size 1KB
- SHA256 ef91991cbf33db66a962ba5560b34aad62e7d82e5422bc8e0f0e9d4901cb21b7
- MD5 7d9c2e23dc511bbe9f34a456b6a56606
- SHA1 05a8a910b2a21dbf51c4208b4f2e3d832c61e854
- SHA512 4f41b3353fe07c285bea1aec09edfb99747c0b6a42952ba731075f53968214ff683712cc82b9591c0f141107be605b2f8de9afd0afae355ecaf480fabc5fb5b5
- TLSH
  T1BD21F04F3405861142B2CB72B5F7F2C9E42186C375E900CDB0E528B39E016496395BB5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  CMS/fckeditor/_upgrade.html
- Size 1KB
- SHA256 77e17bb87c9c909736c18ad8987d3a19d659add4873030e1ccac76c0c5430205
- MD5 1bd698de55288a70103aa846294d6c87
- SHA1 d6d9a7e3fcb76ba688881f7334b2e9a1e322472a
- SHA512 0afde9d0b483cb7ce4cc37c4168189350c6f765b73d5e6d452d7bcfad3570c01caeba76091cc45bce1aa488d75bdf078da1bc43ab989523e529357bc2e3a8118
- TLSH
  T13D21EE4E3004861142A1CBB2E9F7F3CAD425CBD772A901CDB1B028B7DE416489296BA9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  CMS/fckeditor/_whatsnew.html
- Size 208KB
- SHA256 5b63b33aa0a66848086273c9c36390628c9818fb1805b4d4fd52cdd35d4c246a
- MD5 99c77cebcbfb131d9f10d34833968bfc
- SHA1 acf509510766dcb6c0d804bfbac9367b723fa4a9
- SHA512 f20af7db6c5244217ed09cbf23f26ea9ce121b5e23fd3ba1c92f8d7f3bdb5a6b59e07dbed853632ea1c248bb395253ad724a00ca4f5807d62486ff850295ce9b
- SSDEEP 3072:Sn2QMvOlavJJJmEqtL7xXfjwszob4msHazD1RRnOFS:Sn2QjlazJmLfxPjNMiazD1O0
- TLSH
  T19724638A768D73B919900242813433BCE50FC15CF24A3BFBF8A66635A05D247757EEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  CMS/fckeditor/editor/dialog/common/fck_dialog_common.js
- Size 4KB
- SHA256 cbd0865063307da030df1b431fc5ff331a83e65f4870ed6a10079fa2ea99bca6
- MD5 0f56f384adf5c8a6bb38b9b874755a14
- SHA1 7524b0f2ba6461dc26e2873fea5a11d871468377
- SHA512 e8d4ff919db357830c2558d89dd3b3c49e63055243a7d00c1ce679ea294257ce240c28cb1f2649dfaa3a117796554d90e1d352e83f1a908ab66127b85770fd4c
- SSDEEP 96:mjIlIhoImIT+fuK9gKHrdf7Bp5vDgya9ps4K08C/VC:IIlIhiIT+99gKVBpJRGpRrC
- TLSH
  T11481A78E3617917B0BA12331CA3FB00CA578CA60613D14D8B6C598DA7016C1AD37AFFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  CMS/fckeditor/editor/dialog/common/fcknumericfield.htc
- Size 439B
- SHA256 600de2f78f6ca4f90676f72dd59abd655325c8cff01b7fa7207c789dea6daee3
- MD5 6005ecd3dbc571bcd2cc3c3bdf13dd29
- SHA1 57caac3a5f3d25e73464bc89eeb218cd0983e0b4
- SHA512 0202426216ef7c984b1e7eb7463e22ab0cd53dff63ee212a4f8f4c24eef23ee819af8c963d1dc5ea9675f83a4a9697f7b5f8ed278c13599e464d94ff6fe50886
- TLSH
  T16EF0E5693A93941C61AD37302730F451A6AC8C74C6849195B5F05DE661C9A249BA31AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  CMS/fckeditor/editor/dialog/fck_about.html
- Size 5KB
- SHA256 72c580b4109b7a5a231493d2253e4cb3139486e458a55bda16643e17236c35a8
- MD5 6698a7f87ef97ef9232bc72bb6cd412e
- SHA1 7fefef80b2a60cc7c9ecff84bba15256e0b8fa4b
- SHA512 605e14743067c8f5846bc168ed50ea5831ea91aae4ccb8c4e11b409b0d69c01dcf85a31d681294b2aa43a6f599f906038fe85f4b6adb1633aa89b07cee458eb7
- SSDEEP 96:jjIlIhoImI3fWvFQf8E4rI2YeJhICHC86kNHmeoIcohQzcDl:HIlIhiI3u9Qf89rI4uCi86kpmebmzcDl
- TLSH
  T1CAB1B66D32ADD62642B08763F6B7F6DED06FEC70D2D50088B577287316425135A816F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  CMS/fckeditor/editor/dialog/fck_anchor.html
- Size 6KB
- SHA256 25f9b5f587f2b21cff0be7a4eec445d0bb820ad78c0a2249e3479bcb9e8ea1ef
- MD5 0350fea7a9f50ad193381231c031adbf
- SHA1 6a1a3c6868f16ba49df1dbc9cb175fca90f26642
- SHA512 8a8d17bbb4fe30277bc0e7e16b5671e7c773d71e4f8eef81b58dd5b2e6ea67eee9fb060ced68b0f0c87670bd77f229797e1beed4fb398a5f4f76121d3cc5db32
- SSDEEP 96:owjIlIhoImIboDYXUVjRzOC+oN/dq8bABseKcGdzqSC/0IUdaTxeBdji9QfCf:DIlIhiIbyzdlBdLIUdaTMdHfCf
- TLSH
  T192D168DD312F437706920330E035B5B5F85AC8B1F62995E4F0AB906E7650EC4826ABEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  CMS/fckeditor/editor/dialog/fck_button.html
- Size 3KB
- SHA256 23bad6110cdd2c401b86142df2d290341fdec34e01eb7fa773e92f2daeb23b2d
- MD5 bffa6e0406e99f44a7bf74ef48a06bb1
- SHA1 5f2f241f182517ee84c788e256c9dede8b9478d5
- SHA512 d370ebc08f09e9de0190d617707aa4ce4f3d4aec0b81edd38c33668089e4ef946fb0406ebd9b914ca9eb8a8d12a133ebd560d3a9040e2c2870f9ef1af19349fe
- TLSH
  T1DF51FDD9340DE11143B01362E1B2DACAD5ABD9F6A33520C4F07A217B16C7C50A346AEB
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  CMS/fckeditor/editor/dialog/fck_checkbox.html
- Size 3KB
- SHA256 434f5a702e22797c10e86d9caed8675a4fa2eb64ad2a3847749f36af7f7c0ef4
- MD5 875244c8bfdf00345f8d0878e11c6b5e
- SHA1 0a8a8812137018a817987691cc7df74c72530437
- SHA512 90a2b298af721ff1ef2187c1f9a6681577725570a36a301bca30b9905c42822fc5faeb903d338a83629ec3f57287ef848f1a99c4e1abb7e59609f94784c6347f
- TLSH
  T1B65103AE344D912602700323E1B1EEC9E97B8DF6677905D4F0B5203B5787C44A75B6EE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  CMS/fckeditor/editor/dialog/fck_colorselector.html
- Size 5KB
- SHA256 07bce9e668dbec8d99810358401f5cf65b6d68c0a1fc2e0cd5fef9d1d96b0b52
- MD5 1f42ad8374d0f62acb3e5655261bb02f
- SHA1 6777265af3624b00fee912cc57b6820122ee7005
- SHA512 f345397df4882e1d79bb06a17039e630ea8d6a8f8736e5694140bf3a219db43ff772496e0a85c4ef4973bb744d4ceca092cd4b2cc63260be6058d2f129b55480
- SSDEEP 96:owjIlIhoImIoKLZjJZgM1sWyRxRtJlVCfCfNpEytVxrUVLJ0I1SDgpYgFFlfCf:DIlIhiInLZjJZn1s7z8fCfNrtvoPTDp+
- TLSH
  T126B166DEB21D46284EB713AF5179C2CEBA1BE830279542A4F47D2037A1509AD512FEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  CMS/fckeditor/editor/dialog/fck_docprops.html
- Size 22KB
- SHA256 fb74bc88bfa2ef853ee9078caf9e7d88e0d94f4c123f222e21276520c7e039a7
- MD5 ecc4fe24929bbbb9700ec602430a7a2a
- SHA1 071f6be9f94b903afe39bb0a0297a004d3598597
- SHA512 ea49db9a214675c4411c466d7e48df3c20e34f047d8dff37c6d7130c01cf691a9655647263bdc4c9241ce6da5238dd0a984365bd735bcb6f0898aa74cd206ebf
- SSDEEP 384:VGV7pR7cBq/DSSrg6JD96BD1kHn1WwuaL2etejS8iPqLy+EYHyg/OA2fC9k/66ll:VK7pR7cBru/Wwb2etejS8iPqLyoHygT0
- TLSH
  T1DBA2A3E4301DB17607B31B8AC2F6D886F42FE9B142121188F53AA1335291C2DF52ABDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  CMS/fckeditor/editor/dialog/fck_docprops/fck_document_preview.html
- Size 2KB
- SHA256 a9edd91545713ab30a2b349f98c09ea26eb60edbcb8592b618ed7b698cff75aa
- MD5 ebbacac8056a0b2b74854dc47e792e8e
- SHA1 83a270e419091f9af5091436bc43e042b15df525
- SHA512 8bdf703ee368931d594d090d5c1e739fe722367663cde1a3f26e6a58ea8a77948a718f6955f98bbbe37273a0bba77e596bf24d4f3aefdce466a9e913d2cfebf5
- TLSH
  T17051219F7509833605E31B7AB277E2CCF863AC907A182209B46F48730710F56AA53DB9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  CMS/fckeditor/editor/dialog/fck_find.html
- Size 4KB
- SHA256 d0e8b94869da5c555bec2455f78f4cfaacc855eda9ae47b062ffa2a072987f62
- MD5 596afecfcd62c0fa79b8b52e8f347cc8
- SHA1 939d6585c04af8edd7536e6a336e19a20fc0f6d1
- SHA512 e69673dff10297a909b5ec1e9799dbedf7bb19a0c734ff883480ca017cebeaf6cfbe01201611b2abc206aa900e8ba29f0d4585a7d659ce53c4b9d8b3c0ff581a
- SSDEEP 96:jjIlIhoImIHa37lA2pDcyy2bmxtnFKjKcONcOiAcA:HIlIhiIHu7lA2pBzGdFKGc8cOtcA
- TLSH
  T14691418F300A856B07B11761B17AA38DB839C892761A1854F2842877B621ED556BFEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  CMS/fckeditor/editor/dialog/fck_flash.html
- Size 5KB
- SHA256 cf797489a614edbd2d7d5cb940cb54941d41d400b7662e9b5e5656d0cd50b0b4
- MD5 8a753dba5de077e21b10afdf1db01fea
- SHA1 bee26c2daf469dd15c09be963318902f76ae1256
- SHA512 c082023927fb79d65bac2239e207587b8ecfc88d92c494c29e78a357ad48a6621a5ad74719f33bd74b3b833b1ab840afdf870fa26a1685230cb66d12c107dec1
- SSDEEP 96:jjIlIhoImIHDOMgfNODRr2lWcWJ22hIl0DqqWJ2vcJfz7iauTWJ2z/Slp6Wk+DV3:HIlIhiIixfNODRr2lWcWJ22hIl0DqqWh
- TLSH
  T129B1538835DCE92982735193E5F09D8A40CFDE72A35044A8B13B363763D48686BA79BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32