cfc437a0581d976d67f4e5db679369095e71f0f0dcca4d97235b5bbe643e7407

Sharing

Copy URL Twitter E-mail

General

Target
smileBird (2).zip
Size 7.7MB
Sample260701-phancafy9v
SHA256 cfc437a0581d976d67f4e5db679369095e71f0f0dcca4d97235b5bbe643e7407
MD5 2bc6ce6fb819a3ae823116bc06125d5f
SHA1 131ace65390d43db656dbb3f7dc02530c2ab4a34
SHA512 bc23c5d0ffc543cb99f9e00cb9997605fb3f8810754de3e72c35f61e244795992db2740bc2d421579159bd6f2e1881829738c4b35d17f873fc08f216325280a5
SSDEEP 196608:mF+2iQFCdxdjNmjfKfEfbV73fCH/fqvDe1sWPU3zrg/xMBCaSQpJ6p:NKFCFNOysDVL6H/fq+PK3g/WCaDpu
TLSH
T1C78623779758E492D92399B338250AD3E5FFB107207BC1DA65E011819A87C885B2FF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  smileBird/-assets/js/application.js
- Size 16KB
- SHA256 e88e132a0aa98c43f5b77d1c3f79256b6cf3e8b95afc6ab839ade5cdc513cf68
- MD5 8bb692ec4554b6d2f189015245f7a64f
- SHA1 39a1247538de3f81f85d9eecb374fb678943311c
- SHA512 8e2927c93dba8054cb981aa6670e376fe906b32967d6f2e19aa0e4384258e53ad3f33df0da5b8673a766b62df003ac4f67302aded7060a558e3917cfc9348536
- SSDEEP 192:Yrp2nAz26iJoRHsu4puOIV2BzKedNHTG3J1tJRB+6HYNruHVrj2:+wnAz2WOaOeeDwJjJPnHYNruHVrj2
- TLSH
  T19972CF9FB3A4B131C33F566CA86A27E0722B48425C15449DFE340CC5ED65DDA8632BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  smileBird/-assets/js/application.js.download
- Size 16KB
- SHA256 c08391d57249be6024a941ce2c4baf56c136b32baad073553b49a92c47519c7d
- MD5 df7048489893a3a9a2551e36d18950dd
- SHA1 fa63b7a683cfc7c1aac33e8d5df1ab29558d6c7f
- SHA512 cec4dcc6c09ddf2512d4d894455e69efd72847d67cbe129dc097b0275269402e827565d0c46c2a2614c4b3de8e1f9efe1392ec26f6904588fd71ba28a7444c52
- SSDEEP 192:Yrp2nAz26iJoRHsu4puOIV2Bzjed3+HTG3J1tJRB+8HYNruHVrj2:+wnAz2WOaOne9QwJjJPtHYNruHVrj2
- TLSH
  T15E72CE9FB3A4B131C33F566CA86A27E0722B48425C15449DFE340CC5ED65DDA8632BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  smileBird/-assets/js/bootstrap.min.js
- Size 49KB
- SHA256 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
- MD5 67176c242e1bdc20603c878dee836df3
- SHA1 27a71b00383d61ef3c489326b3564d698fc1227c
- SHA512 9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a
- SSDEEP 768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
- TLSH
  T13533B649725078B201DF9176913F460BB736788EA907816CB95D98ED2E7CD89322BF3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  smileBird/-assets/js/jquery-3.3.1.min.js
- Size 84KB
- SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
- MD5 a09e13ee94d51c524b7e2a728c7d4039
- SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
- SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
- SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
- TLSH
  T1748319DD72C6B06247AB71BA00BF550BF2361999684D4410F129E4EABC74B4E823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  smileBird/-assets/js/jquery.counterup.min.js
- Size 1KB
- SHA256 26d40f8ffdf1b9bf286a954c6888a33cda0cd031e802d821fe0c0562e379ae29
- MD5 ef36cca760bf1cd76cfcd0e4dc10cef1
- SHA1 ef38469f60d58850fe55c4de2ec7e289a2415d71
- SHA512 77c175276932891a30041ffcfe9016b2a525d304843a41b92804e4555e2c95f6e5abd55143a3320d95715a5dad59dfa63e1b826e94c1e0ceee53fc7d165810f5
- TLSH
  T137118CB93A0A298DAA80E459F1EFB0989176BDBC0C80884B91C558401FA5ABC3B5B730
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  smileBird/-assets/js/jquery.smoothscroll.min.js
- Size 615B
- SHA256 0f51bfead7052eac831501b4f5ef860b8b77c1c42ff1a91021a6db6879e8148c
- MD5 0dd8e823e665c8f8ad47a8f9804e1617
- SHA1 25bf4c2e7daab68a6ead5076ab2364fda5b8506d
- SHA512 8eac6e7a61117df23740d19f73176b22143ef973f31337c5240f94a43ce31de52735b8a341a2939c102ed8ee2070f36260bf13d99b3973b5f6ac5ccd790ed958
- TLSH
  T193F0DD957150A18603E9BB69E06F8E41B53AF0C73E08344670482CE93838B3C029AD9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  smileBird/-assets/js/jquery.waypoints.min.js
- Size 8KB
- SHA256 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
- MD5 7d05f92297dede9ecfe3706efb95677a
- SHA1 56bdb149d9baf64474a4c24ae66445769a28254e
- SHA512 df25e4c654002bf66cbaea0917976f75afd9e16cb22d995f371de879d83d9334391bf9e921718995664da8fdd643239210205841fda0ac691b751693d505c759
- SSDEEP 192:mEBzxsMCm1nJDl6hj8E3aPEGnvfiaaLkYluY4pLyUcDWZPeGz+nrFr:mEFoWJDlC8eaPZnvGLkYluYTUcEPeGzs
- TLSH
  T155126189750134221BDF50FAD91F474AB337582CA80680BDB4C8D4ED29F152D676BFBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  smileBird/-assets/js/main.js
- Size 2KB
- SHA256 187916d4dffb019ec4be91c0a493d387a0468cf1945ae6b3945235a60247104c
- MD5 d94c538dfee0b5be1fc92ac92b96fb73
- SHA1 c3f02614bdf0bca9255a791ba37f6af10c74a827
- SHA512 e367428cc983edd2235f91415e4413ff2f70d9898677be3dec15bca5add223c04a6a2c58bbabeae80406692eeb93ff142b7fe2568226420cd2b0c0ee1ab46d73
- TLSH
  T15441234B8803507B64BF527E9D32DB06DB9B2723424986937AFC28480F7005BA7D0EF8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  smileBird/-assets/js/popper.min.js
- Size 19KB
- SHA256 f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
- MD5 83fb8c4d9199dce0224da0206423106f
- SHA1 d8503645c17f9856868a7def3dc0505e19a95ec7
- SHA512 95d735b0fbb5159f2c9a0920a7e1f09d8c956f57919f6c0498aac383526a3c46f4dbe122e243730c843453087400954b4058c9a16c06fbbeb8c7bd33cb94efe0
- SSDEEP 384:fYn0vf4wzTC9nNbR1PTM4CrBEQxkxpOxvYLmD75zfC5vIfg3rzGp/TidOgHhXjE9:w0vAwzTC/nM4BxpOxv/D7pC5vfzy/TiE
- TLSH
  T18C92A3DC3294B06647AB91A7A07F960EB1335875610E9410F19DF2E97C30EF9613BC79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  smileBird/-assets/js/slick.min.js
- Size 41KB
- SHA256 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
- MD5 d5a61c749e44e47159af8a6579dda121
- SHA1 3b41b3bc956685015a347a2238e71db29dfa0dbb
- SHA512 5ed98cb4311c373da3ede92bb47bce551e22c30683ea8fc55097baf99abe1e0702b24de48f8b9241047cc1e4364158f5a343e4e8fc182e8866db4e99ccd7ee6e
- SSDEEP 768:4rkkX123A5YHi6pWzYdlNWYcx16nnYdXRRMd2KYCQCsPShb1ez7RFmYH:EPrYdlNixEePiYH
- TLSH
  T1E513A549D205276285D721E62105C40EB3F7FB3CBA22C0E475C9D3EA646EC4896D7BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  smileBird/application/cache/index.html
- Size 131B
- SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
- MD5 c92aa5f16d78423a983a5d7ae44428e4
- SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
- SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
- TLSH
  T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  smileBird/application/config/index.html
- Size 131B
- SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
- MD5 c92aa5f16d78423a983a5d7ae44428e4
- SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
- SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
- TLSH
  T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  smileBird/application/controllers/Auth.php
- Size 27KB
- SHA256 365a868614c250d10b124c7c3eb6e031e8f84b57ec81673bc85813d21a0faa89
- MD5 3481d656145666e4f59d53a6a545cddb
- SHA1 e0c2fbd140607d3bc9313193c4a04a9c4c59f396
- SHA512 882727604671ad540f36738e36ecba414599a60494d849932a15660a40d4ec5dbccac6c68011ec54cb1991917dfeaa27751d3534b628e08336f3f03178e7ea40
- SSDEEP 768:zn9vuw7tT5FOGVZyzHBuXujSoUgs6zxfJ1BuiadBXGkCbCH1hHnA:zL7N5FOGVZyfRUgs6zxfJ1iBXGkCbCHk
- TLSH
  T1AAC2645BA94C1CE6BC1354FE6F97AE0086BE70F660A32853FEE4516C16D073E9724632
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  smileBird/application/controllers/index.html
- Size 131B
- SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
- MD5 c92aa5f16d78423a983a5d7ae44428e4
- SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
- SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
- TLSH
  T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  smileBird/application/core/index.html
- Size 131B
- SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
- MD5 c92aa5f16d78423a983a5d7ae44428e4
- SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
- SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
- TLSH
  T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  smileBird/application/helpers/index.html
- Size 131B
- SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
- MD5 c92aa5f16d78423a983a5d7ae44428e4
- SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
- SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
- TLSH
  T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32