91f9f374a42278f02cbc93c49ec21b2ef9bfc60272a84d13ea8835f37ec82b8d

Sharing

Copy URL Twitter E-mail

General

Target
nginx-master.zip
Size 1.5MB
Sample260630-w2evqsfs3w
SHA256 91f9f374a42278f02cbc93c49ec21b2ef9bfc60272a84d13ea8835f37ec82b8d
MD5 6fdda22512a0fe339a1e3101c5a64bda
SHA1 73cca5df6b1b7020649ad45820e15c9b6739b3cb
SHA512 ed082c5aca50f5b95663daba9498739fad8e43c57589c739a0fb7bffd2de456b9093b23c90d5f09bb0bf3103e931d90bb9643575c9790b279676344319c849fc
SSDEEP 24576:jw5TwnLBvUXD831wXXIzzkUlm/h/JPTun4BomPg6KbrAKLjpSwTKrJF+74atuq4I:U5UnLBiDOwHKkUUW6K3d1SwGrC4k4I
TLSH
T1E675F16562E41B35D84B32BFAD0322CAD77AEC805E8AFF011D85C06DEC9B6943F5625C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  nginx-master/.github/scripts/commit-msg-check.pl
- Size 2KB
- SHA256 28aa57a42980d4a59be6030c248e44d9c0cfc0a38e7f7c165c52ff831ef80b75
- MD5 d4e0e0df83cc0a701eca456409ba8cde
- SHA1 f7a850923be476f0cf0b818e61c2726593629ae3
- SHA512 dbcee7d58b1659a2d2a0a41f6fcf9ca80382bb98d3c9d8a01a7d77c4f1e72d46686c65a1375956c7c008228881c2e972493fd6cc5ceb99ef576c5a3359db321c
- TLSH
  T119411E91DBDDC2066053393D7E17F28CD2B5812018D8387BA5FC834962DDEAD8265EE2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  nginx-master/auto/configure
- Size 2KB
- SHA256 df485655b589ead56ed03f38792445c060bdf3cb4026486b434a2a912cbb65e5
- MD5 c88f04af4b25f6baeeb2ee0ed0b812d6
- SHA1 16ccabe02de7824710a4c628810b481a2c6ec8e5
- SHA512 1ba1912848c93b1497c3ae5ce5bca902c08fc991d6206c43c8fa34bd26b31b0f97729f5c8f5d17d7abcf7609000b52248094c18b9fb90701681cfd43340b33d5
- TLSH
  T18C51CD02B904EC721412BD88B3690464255BCAFBC805148D7EEC7DDE5FBCE1096BBAF2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  nginx-master/contrib/geo2nginx.pl
- Size 1KB
- SHA256 710cc6ea2fefe73c908addf6cb84c08f1da1310ddd9fba87f3bd8c87e3d4a350
- MD5 35670709be7fc98fb47013f565f55730
- SHA1 f5b8473781ef13c55f9e9d4df3c615cb1fd58d05
- SHA512 d33685d39c6cd521d6e9fa6d0ab39cee125d9c7484d32afaef1832ac78bef35fc2a7b1908761198e547cd5bd61cdf5cda1e6bcebbf04e928dd13dc73a7a4cac9
- TLSH
  T11E2162DE27C6325C7BB072E42BFFE4A4DC84718206B26760B944A5DD1170E690978A6F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  nginx-master/contrib/unicode2nginx/unicode-to-nginx.pl
- Size 1KB
- SHA256 1cc5bfd4262ea8db2fc575459d1e3b3fd2a4a5a8b2697f1080d7514f5a4d7910
- MD5 140f9cde0e1c5a65dec1099df664e2ce
- SHA1 ef268a90eb276c39978296ea16f7129ca7d2528b
- SHA512 0e4996f3de525c35effc10e32281224406c8b06c3b0e81f9452d28e64531413fd8b00ee906e792661e5f36557dcd5f35f1ceb8428a431e39bf247abf4adf19a7
- TLSH
  T1B7115485C3AEAC50DB92E56C0AE2B205467D5396FCCF7E004D4C039C40CD1B443552AF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  nginx-master/docs/html/50x.html
- Size 497B
- SHA256 876766b4e80133fd490603e073d3567425b88794828a9292104244c9e40875ed
- MD5 5a719a793405561b1a13e6cb1f403d88
- SHA1 835b9dec419c01420e78602527a9fba8c463521c
- SHA512 81a2bb82a89a8e698a267fd925367ffa4bb4ee02e482d670835ae8621751605ce856fab051c9770e8e3cb94f63fb6dd03284affe4e1161f57c1bf9178b3da472
- TLSH
  T194F09E8EB210136B94210310AC86A6527206270812B7857479CAC9B2FAA6E12F9376E8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  nginx-master/docs/html/index.html
- Size 896B
- SHA256 201cd1bf3d32e7f5fd8aa22c6de5370852fe03fb654ee22d345dd82f16a246a0
- MD5 6bb03ae5bc151ad04e3875dc8992e270
- SHA1 6c632430469361e39aa0a0a457c9e30d90a5119b
- SHA512 c84ad5d7c53626ed0b618fcffe8c6a71cae735dd822f1b024ffc6fb9353b351b0913e4f17acef1a548d0a359ea7d645b5d4b48c7640feadf90777a8d65589f43
- TLSH
  T12F11637BF382210B9AC34341786311293B2503410762DF1A398A0ADADBA3F9BE50B9D4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  nginx-master/src/core/ngx_thread_pool.c
- Size 15KB
- SHA256 940950f15d375b3696ae385e510359e2ad0d1f8996f7d3adede2e057abd1a532
- MD5 794aaecf1b1cf43e1e1edfd2cf5dc8f3
- SHA1 ff8da961c7ccccd281b4d5a705986ae003613225
- SHA512 6704bd8f88bbde9be6cf11f1d8b5cce6bb97166a46ff564e4f2c3b612a8c488f050f9448383a98162f6ebe132b4bf4f6802b110f224d60f8b711f0f58c088dac
- SSDEEP 384:Wm/+iSbkba0gUqg3ykaegITwz6Yzx1z9jz4:Wm/nSGnR3ykOITwz6Yzx1z9jz4
- TLSH
  T13462CD4918FF9792958A6E1713C6400AA77FD94B294ABDB3F84CD0E80F4D921F474B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  nginx-master/src/event/modules/ngx_kqueue_module.c
- Size 18KB
- SHA256 8c9eca0e2d25cfa2c7340bf4424083828f3782676d1fb0b623339af3313ed1b2
- MD5 12ec66782eeb62ce2fa8dfdd193a24ea
- SHA1 4ee4afcbc0228d152bb722e25987b1e3e13daa46
- SHA512 6c7daf333b0e38eac4c2bd846c824c093e8910cc2f1c17b5b04d0b523900e69d2c642e0a3287a5014b12e1a6287520fbc633882484e54182bd1b5e6eb25fca91
- SSDEEP 192:58zan36vcXpLVnSMd2KIYt72PXdQwK70+IHf1dPoXSdDFY4Zln1QF:hK09VnSM/tBNUf1dd1e
- TLSH
  T1C982119558ABA36200CEA81E53864006E73DE1CB6789DE033A4C5DE41F85E2DF9F9FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  nginx-master/src/event/quic/bpf/bpfgen.sh
- Size 2KB
- SHA256 68c32d67dd4ff05d968b4ba1f95c8bfdf991158df016d7d56322a46a9364af82
- MD5 a29cdcc20e24229e64779ad5e76e17da
- SHA1 7746ace1acf790f44733d242f4a244296f28272d
- SHA512 c1074237ff37dd7e2695b482947e37f502f409ab6316fff71b148689ae8937e76bd1316a5b92c2adec295a7f40563c818e88d496fe920288d7c6a5fdae41a193
- TLSH
  T15D415315B41CB8661B03189E6E43123C3412005F07B4EE3C7C7E132CFF411A8A1DEEA9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  nginx-master/src/http/modules/ngx_http_upstream_sticky_module.c
- Size 41KB
- SHA256 dd1bb7f49a05cadf6c0636aa4772ea3cd722da5551ea8f796eac673035148305
- MD5 3dc0564f3f3096c22c7e2220ab3b23f7
- SHA1 cf0de7d383c52535de0794c0d2f945c3cbcfc2ca
- SHA512 77b319d839ca7a98ba70c4aaeb139f54fbc871755e373b7e69d3bea3a4f5e5f1342859c70b5da118882e23b085ce64ecfa8a71ece64da57961f492e0f6362a2e
- SSDEEP 768:/k82yO1/EC1X7KJhRjvCYFjYxqpytZkd+cc:/k82yO1DcJhRbCYFjYxbtZkdFc
- TLSH
  T1DC13D8D526E393710041A42B2BDF4124E9BFD48749F9AD1ABA6C90601F52F24FAF4F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  nginx-master/src/http/modules/perl/Makefile.PL
- Size 1024B
- SHA256 212b1d6c8aa1e9e1f5f7585512620df9a6133f2b85cbbf231c7a7b02c0833b96
- MD5 e444828c9d73faa1a740690d25e88025
- SHA1 c0a079f44dd5fbddc223fce0d49ddd8fe4f6c7d6
- SHA512 ce7b6c58598c5d50628b6a534f3d8a05bb70cbae2872bdf4a31e91bd907d9d216c80a605498ee90fa9a436724fb8e0aec93f469c38ba979ff4524d0f3fffd344
- TLSH
  T11111AB7B11BE1473195BF3131C8F880836C82E07664D5E0B351E77A95FA46757AA4358
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32