cb2549bbc7a32cc481ca0db033d1e771b7056cb745611b677894f600f0ed2921

Sharing

Copy URL Twitter E-mail

General

Target
galleria.zip
Size 12.8MB
Sample260701-phancafy9w
SHA256 cb2549bbc7a32cc481ca0db033d1e771b7056cb745611b677894f600f0ed2921
MD5 617ed065ecfe356b2df3c992eb4925b9
SHA1 52cd66a47fc3e3173c07f575a539bad0d735d7b9
SHA512 00475923a73e8fd6ebdf67b0268ebae23bf5edd678a75baab13a13747f6c034d99dcaa70f4d04a73262a5f8854542e1e776beae9f47d0a3c85f67c52a4140d65
SSDEEP 393216:6H5TT/HTV2sf4A80+qzIfinHMvM4LgpcP:6HVfmA809+tLgKP
TLSH
T15ED633DC96354C70EBC3A739C67DCF4273AC49843A09A8797B16439461CA8BDEE4E874
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  galleria/cms/products/form.php
- Size 10KB
- SHA256 cd47247b452177b82390ed6fbce24c03dbe1d7299bf76345f6b0392b2b71c267
- MD5 1fb7d33cc141e5ec94c5f40179e637f6
- SHA1 1b945089250219c002ebb07c5f11edc8f3c89068
- SHA512 ef7988198eca05ef06b9d1da3661ac83624692adc422535e65b34d0f56af0f20b452b18bcd0a42838cc708516eb30cb6ac3ba3ad1e1cc1dee19b2ca222e03460
- SSDEEP 192:nWAVdG7TayxdibJ3myFqd+g7G/itSr/iZhfqOo6oVsV:nWAVdG7TGJ3w8g7G/WSrqZhT0y
- TLSH
  T1D822A760F4B98C7250E7A8EA5FD99B4A3C95C3079186CD84BABDEDC04F91C42C93B15A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  galleria/includes/conn.php
- Size 403B
- SHA256 6fff9dce92f0ebad01679ce45089e1247441675d5bf8f20ecf4f8181791b7f7f
- MD5 414ea94b4412c0a57e8e9041e9a08a4b
- SHA1 0986af288289f2ee57cdf807a9ebf4d25a71a27a
- SHA512 a5fbe772f3ad02b59c453ba8f08a2347155e996358029854170a955eb785798fc94ce4c3e2159b3bb3dd0d445de0868623c4531fe2ba30e7ded5b9ca04a89311
- TLSH
  T13BE068B76003D90A18B111C06E002244F761E4139919B662BF7DC3CEAF726A6CDA314F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  galleria/index.php
- Size 31KB
- SHA256 b38ed6c5142f92caff4c9a8a7c64e3d3b2adbe4509e7512c20ebca39df64e5d8
- MD5 8ec3bc62709bb63258f0921f4350c677
- SHA1 47e8bda6e77a4dfb18674198f5e3260f6f0ad8b5
- SHA512 f8b0ac2d088cbb3d19adcacfa227192ac00400a7533de1e8763209e40670fff525ebdc7263e1310f306b60163f81413e7d558e21be0a30b5a53737b7358f3f76
- SSDEEP 384:zgJHICn+0VKHogYvkpoQr+TbKEr0/A1TrCDMbrulLhdbrR9Dbrx/yI6CT90E2/0V:4Rn+96svPnt50t/0zx18ws8
- TLSH
  T160E23D20A8FA543781D390E66A215F1BBEE1EA47CA5F0504B2FD0BD61FD3D82DD13689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  galleria/js/bootstrap.bundle.min.js
- Size 78KB
- SHA256 e4fd49181388c48ec5040bd3fe66f57c29c8e67fcd8502b3354b96ec7ab47cc7
- MD5 5cc1b73e70520fa84b1846afe0ec8fb6
- SHA1 69f688858b7149c561c4a1fbc496e9e66b3df2fe
- SHA512 1ef3a326b7703690db9062481b664da83955a8ca3beea6ece0c7b871a8741e80eb7e1adb03ef12065667d4aaef010c3b7082cb3c526f770220a61cd098c9be3f
- SSDEEP 1536:oH5mi07eR2tgYR6ifTGqghZxBMzFhhX1fhKCywwPesX5L08g:yNwhh+CywwWsXZg
- TLSH
  T17673D6593245B4730ADE85A68037430BF2265898B64B812CB57CADDE2A7DCC27277F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  galleria/js/fancybox.js
- Size 218KB
- SHA256 276818ceb6aa417e028834189ee84a9101ad3e7612900f811706db5f0eb8dbb7
- MD5 b60a7551b309bd20400ab65014d277bd
- SHA1 bbe6c862e271b1c8b5962bffa3f0133ec42e338e
- SHA512 9ff6472d5cc5fb6998ce5353bb440de689175139df019875613e1965f7a4eb94b272dd7ee666eb908e47fd834adb17e2f57ebe6c8a2acce062dc7e3a3f612f88
- SSDEEP 6144:WpjfPB3MI+l6HmOh3p5cAEQk6jLdSKRnUhwi/jH47g27yIQb48uh:WpjfZ3MI+l6GOhZEQk6jLdDUhwi/jHAP
- TLSH
  T11124EA9A269534398037F37EAF5AC509FA26472F0285870B3D7C81182F7292993F5F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  galleria/js/jquery-3.7.1.min.js
- Size 85KB
- SHA256 fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
- MD5 2c872dbe60f4ba70fb85356113d8b35e
- SHA1 ee48592d1fff952fcf06ce0b666ed4785493afdc
- SHA512 bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe
- SSDEEP 1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr
- TLSH
  T13983F8DF77CA702247AB30B9006F550BF276199D684D4400F159D8E9BCB8A4A827BF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  galleria/js/pagin.js
- Size 1KB
- SHA256 474c6f37855808013603031cd7835484e70d3ef60b1712ecc98ebd23efb72dd4
- MD5 ee79068972794b42f21dd9631e3dd9f5
- SHA1 70a3c1baaf9d6557ac784ff051a86206cbd90eb3
- SHA512 73ab7560f9933cd50791d884921e51638b7f8bdddfc1eeceaf44a57f4f7704282f394e8bb5dd94fe315378a03a77d6ab40c2e590fd2759b3036213d388b0b6f9
- TLSH
  T1CF316788913625618B377237BDB58258EF3AA80FA041EF5475DC80843F369A943D2A2E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  galleria/js/products-page.js
- Size 7KB
- SHA256 1869e4a452414628dd1a28643843c324a8e6442af917d4dcea9a1cb0c20fcefb
- MD5 ac590b3b65bd0eae8045cfb723e42199
- SHA1 3d9e036a7c1c4419fbf9c074df7292e8382577e8
- SHA512 7d51e85cb572e0673f931d8e7e70a7abbffb891df99a37573f7470eb8fc2596ecdd6ee3ca2e1f6bbdadcd8eeab4ad85a9f83816ee566ace3cb13658f6c22b2b4
- SSDEEP 192:QxH3N79JUc9YAoJCyfgvN6jdLB4yCMNIIzBeHypCVT:uWgALXN+yEVT
- TLSH
  T1AFF1512A3FB6143604B7D2BB77C757D9FA1600477581C9893EAC86040F80FA4A9FEAC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  galleria/js/script.js
- Size 10KB
- SHA256 e0b257d99de93e507237b90b9da313b6e01e6a7c46e69b70d2a3724ebae913ab
- MD5 2c685ea2d49204a82363657e336d495d
- SHA1 4b0133239b548b0dc845088af25beaae8f0769d0
- SHA512 29b72913a1e1252b68eed143aa2b9fba8bc40a30813414e967312beecac83ebed308abd0c76acd75c975f97af514446854c98c95b2a3822e3c0015f8b8bd4e92
- SSDEEP 192:Weot/9pKG6IQqn2GNAPMXX/JkQjCwoJduAOGnYxouFKUs06efqDoXClgAVkMx:Weip6Etm0+QWTOFDdO2CSk
- TLSH
  T1C6225F5A2DB5043601BBD77B738B6296F62010073545CD6C3EAD86050FA4B3955FEBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  galleria/product.php
- Size 11KB
- SHA256 8cbaaea06490a6c923f8e2157d35c47a13d28cb224a3436ecaad4cde33bdd33c
- MD5 bfab407af2b15eebfd4021fea0e103ba
- SHA1 4c8440f8c339f4c238675c172f595a1f6b53501d
- SHA512 f424f3dabcef850564bfb71daaeb47817bb80a80b429457fba811c87674f405625b3d88e70647d37d9cc5b403f7465834d18db6bb5ba5d22189c79b04ea12096
- SSDEEP 96:zs72ThhTLHZMNroH3ymApPBBjnXU2PdxPkzL2F6BS1jlgtnrB5HiJVWR0m+truZS:zK6G0HnAzBjPFFD1ZCrDozyH1GsfM
- TLSH
  T19D327211FCF9A03B018394DA6A705F1A7EE3C447D61E291872BE0BD85FE3E418D4B58A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  galleria/products.php
- Size 11KB
- SHA256 3483abedf2b16e68783c6c264a1505f43b6da52ac136cc91f7e3026a24727a90
- MD5 7663faf5fa2820233af2c950e4a55185
- SHA1 2dd4871c462493fc7f0c9c50d42cc0d3718f9295
- SHA512 c16b49c31dd510ccebd4a622d9500dfa03fe76909066c7c5aab8573fddc6362fbec857d88c658be5a436a5468f54920e7f50e4cb20f57866cf7ead7c73925ef0
- SSDEEP 96:zG72TASfTeZKzZU4oH3ymApFXb/X82X+2gXgCWanEUunD0m+truZH1nGsfM:zQ6ADHnAnXjkmCTuSyH1GsfM
- TLSH
  T121323221ECF4603B028395E96B706B2ABDD2D44BC65A6A1872FC07CA5FD3F418E4395D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22