4cbe7bf7930135d8fa5fa29198c52757bece6a4b7651fd863a5a4560528960dc

Sharing

Copy URL Twitter E-mail

General

Target
arolax.zip
Size 7.7MB
Sample260701-phancafy9x
SHA256 4cbe7bf7930135d8fa5fa29198c52757bece6a4b7651fd863a5a4560528960dc
MD5 94cee5b1c919cc24c460c24bb881c423
SHA1 c857b565cdd30e2e65d999ed066da431905562cb
SHA512 3dd880a0273976d74cb512e4a59bb29acf0849a1509f08023340566f8249a80c7ae16160b6b5ffd4e93d18154d509df6ffc5c6fedbaa761f9080f1246c124c42
SSDEEP 196608:Ihbd0SQOsBTjB9Iagp18wYY26s956mPKHZtvNUHU:IhbUOs1jB9Ita5PS5tvNU0
TLSH
T1568633298D303887CE1FF0FA821D8A9F81DF53146B656C9FA782A711A5569D52B30FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  arolax/app/class-tgm-plugin-activation.php
- Size 129KB
- SHA256 000c4132861066a2ae0f69f8cabe9e5f138d6ca7838b43ff48758c0ca53c7a45
- MD5 86349bd500c5b52cb3f65006a8dcf6d1
- SHA1 af5956520642b642d81e985f2007e54c815db848
- SHA512 21593a587b562c7c0df701a7daa2011c442a337c11820673707b535fb1a6a4c0ac13fdde0b6a186991ae99aaa17aa1f357e834a23caca3345cd4cd8d297f50e7
- SSDEEP 3072:GKkhjV6jma/MgCblJesMXCQYx06KSnUrUb:SUlMhhMYxqSUYb
- TLSH
  T15FD393C172CFB67B38B26341B13592D1E5BCD3B182119895B8EED8143F21179837FAA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  arolax/app/core/blog.class.php
- Size 3KB
- SHA256 8aacdd946ab3fdf205bbdd677468874a97794b214f2f34e2015a2dd13eec405e
- MD5 72971eca5c2c7123e3eeab683fce1664
- SHA1 a847c7d8bcf22e0e839f5ac4c3d3b65f95c9ae40
- SHA512 691b0e71719d03d225e5f4cce3a612dd7e79cc551cfa850b442ca6ce4ce77197c5142c673e37b81dfc96e957447992a07220c204038366d3d92b7576a3cb0ec1
- TLSH
  T11C71300035FF25A746B332E0C87E9E79AC7D9210866984CCFAE80DDC5570C9E9621BDD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  arolax/app/core/checker.class.php
- Size 31KB
- SHA256 334588f3234c0ab5a046bb1ec882cf49972a6c533dab99c43e08916ffa7431f3
- MD5 2d6fae91b31de4ef824c55cae52e011c
- SHA1 35aa479fcb8087f7efdcbb6453cc1dea25dd01ad
- SHA512 c0355009b613d5e10e115685a9712045a1e16190bd9be6c8b04204344c979d5a31ca7d157605aa92cba6a686d8eeeb6c7f954272d7cbc550328688b450f758ac
- SSDEEP 384:KanqLD9jA3xhD6msVV/EygTpmfCyDZfF/2SznwWaSuDUNEZupApg:3qLD9jA3xhD6mYs+CyDZfZ2wruU5p0g
- TLSH
  T1DAE2D085388DDD9717B2A2E5BF331C54FD2DE5731318C146B9EC00951FB0228A6B6FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  arolax/app/core/setup.class.php
- Size 6KB
- SHA256 3cfdae1a5700b0c8a11fb71c1490c861a74aba4e3c59e1b15adea7290d54f945
- MD5 f5ce28dcca08aefa5559f7cf89c3bfb3
- SHA1 1cf64a9016b89df2fc7ba7c5e6c2dc84b2e1b4df
- SHA512 36446b08cab2ecf482225505665b5120ef5f11a871c56dd33f2372f22f1e73f18ac544a139be177b7061d513aacf3944af7c332dccc2634b124dc5f9445c1a7a
- SSDEEP 96:oPMQrL0ZQ15jKgMIAVJroBw7wIlRsrubTuIPWw+bNEMuybpdAys:zCLyQ1hOIAXriuD5TuIuL5EMuyVdAys
- TLSH
  T11BD122482897A933407322F1AB668047D52F2307681A9A86FF7C57C85FB0654DDF6FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  arolax-essential/arolax-essential.php
- Size 14KB
- SHA256 ebc235387e4a72431d86a5cd52be5bd2d052172a049f16928bbeadeed969732b
- MD5 f0c7d2dd07052e0bd085de7113df749d
- SHA1 9d86f65b7ceb98f1f9f32f7873a0d10e37fc5540
- SHA512 cfd60b24b3aa7e67e54e0d15f956e099e3db9c591dba6a1ab7a4957c0c905aaa006e3fbf8eabf07a4da6dfe2f2ab786d5a7ead9826a535238c4b754d990f82dd
- SSDEEP 192:cMcBjE/KUNQO24OXRGIV8YBQB2Y82+9Gp/jMa2DJY53aJaQalxQjh5IKPuvw1bp:cMJNQoG8U/9ROaJaQalqAKPuvqbp
- TLSH
  T14052878039EF67738A776298513D44429C7FE182A16081C0B9BD1D499FB72DC43EB67B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  arolax-essential/assets/fonts/icomoon.svg
- Size 32KB
- SHA256 6ba9fb258c91e12d1897eade981cb437bd0870717508f7e7454c0e26b07bd030
- MD5 3a09cca0550b955724ea056e6704ab3f
- SHA1 9e99177c44fa33e611e84b93987a4fed76358f09
- SHA512 1bb062d51eb9edeefce6d231054bef79adf2b1c5af46dc4df0a65300511d2f5622fe06e67f198a2cd9e5903fc46d05ad6f2b58f7a7f99da9829eb4c506b67133
- SSDEEP 768:cSpEjNpb8FMH3ibmGezc5VbzEusG8150HxrOrlDAXfXK5Be+1EuDmKj0:PWjNp4FsolEnGGOvX+EuDmKj0
- TLSH
  T133E2939CD3109AFC9E15D7B0CA3815387A1E92EF60A52238CA54DA707A731DDC1D5ACE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  arolax-essential/assets/images/elementor.svg
- Size 5KB
- SHA256 bf642340919d1c5d43a374dc7fdae73a6e95fd891f3434b14cfc646fa2a794ee
- MD5 2f5b3c480da633f96da7574b5d162e3a
- SHA1 b85f9d44778c5336594f25ac4c6d65196ffce801
- SHA512 05397b327be0a7d8eda6667898f21e53a892ade5221a5b3e318bcee444a92c1a1371a1e3ab94a314d87d213a2248c554fa7535006914a5c6c07a0de5a3e1469e
- SSDEEP 96:vHUTiAhCPmLG8o2pO9pP49fu2hjH1RUKd6MKISPUS6F2QWCWRPdX:vH8iAE98oAO9pgo2hTjU6jIcIX5dX
- TLSH
  T188C12EFC16B620C689CCCFCB3F9962BA542392B7A83DCD00D66C6F6C2C4596D29516C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  arolax-essential/assets/images/logo-icon.svg
- Size 487B
- SHA256 32bed375a0bc3c0b4913bd1722663790081bd1f8c47f4a744b8db153a9d1165c
- MD5 6ffb4701f9d924450fe475a1051322ea
- SHA1 9a696c28f74b84c0db96db041ba9021de617e04d
- SHA512 f970c04f708eb47b8ef9ca7c5000ee1e932395df6226a9dde4022b8c94a4f4c38fb702a717474bf4c25e9216503b91b970a71f8f04f35544c5220855a9240e74
- TLSH
  T192F059FCA4882F6D2660C32AB72874F412AB2AD4B1E05195E4C93303A0894671D2A2A5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  arolax-essential/assets/images/patterns/custom.svg
- Size 8KB
- SHA256 e6a80381c1d6f52e86a848890837a401b141864fa21d78a1bc0d93f99486a4e0
- MD5 ac45b55f14f7f9aa5e9e9d1c47b881dc
- SHA1 e3c70ae295c9edc719f1bcc203874bc98f991e8d
- SHA512 d9e2f6b79a33563e221616ea2c3bf85489cd4ea77cb867839883863abcbaf46b391a89cf63d1f42cbbac6a305deabe7cc0d2dd4effdf18fa24a3b0b75400317e
- SSDEEP 192:vV+iargg3mzBjmsd+K/HI2Y5jDfFz0fy22dZAyyUq:yidI2YNFzs6ZAyy5
- TLSH
  T113025162DAF6DBB8941553A4917149B13EAF486EFF27E1ACC26F8333FD00B8141546D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  arolax-essential/assets/images/patterns/default.svg
- Size 7KB
- SHA256 60dcda3b1fd2599ad2b43bcbf0399aa9a5fa381139f94e51457f38abeaa610e7
- MD5 9e974bab72aba604344b423190db5022
- SHA1 499b190dd6a2469e9a316d336f1b2e07f215dd08
- SHA512 87ab4f959e5b49c705ab8ef734e6a50278ff5fa47cf8ba06b021b01b7b27af616f6148724a2bdbf1665bfb008e7fb107c649537d79a5d791820492b7a70fc8bd
- SSDEEP 96:lYeDJFLp66+dhAPwwsY+oMMyu+yqRbRDmmX4NAwEEuTZZFglQ0gUHTPP7EYq:a6vPPwwAoMMyufqRbR4q37Mq
- TLSH
  T1E5E15365DBB5C9AEEC214264827201A13D9F997EFF12B278D1AF8321FD15FA205805AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  arolax-essential/assets/images/patterns/layout-1.svg
- Size 7KB
- SHA256 97f9be86d67cbc030c2395cfeb972fa941fc1cb7454e2afe65068af946b9fceb
- MD5 3fc3c2a0bc77ad1ec38d51fb2ceebde1
- SHA1 688e76674f4c51103a07260476f4249081d4943d
- SHA512 32c3c10ed9549f6c03e00226bc5cd379297efae65867f9407814a77c27248dd9dc83c3a43ef12709f909514cdc1f69420f0d14288f915a4b6b9ef2f8ffcc237a
- SSDEEP 96:AFebjQ4Xaf7DPbkjidyEC57LDDk0FkBdKMs09bhKOOsbWNi8m33bXUVbo5I7pUYq:cebjNATkedyECLS9bVqY8m33+MAp/q
- TLSH
  T12AE15F22DBA1D6FE55590298243281723F6F58BEFF42B2F8CA7EC231BD17B50C511998
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  arolax-essential/assets/images/patterns/layout-2.svg
- Size 7KB
- SHA256 724661dda3f36b3a13765d69603f5087ca75d7207ffa2baa80378dc487443d49
- MD5 f07a09fcdf7cc97e10147fd19968d662
- SHA1 17d60be3d60235d4da399563436cee804a43d63d
- SHA512 7da6a3f9c67abcd6d3496e4159e7fec4a21e8c2c464a87a1021489d2319303221d581b8948b8a7e147b42b2799d25be0b4f749dbd99e4b7f0d3db59f59f27dcd
- SSDEEP 192:gZX2L6+qrDBJJ3CutvsoagpEBmhLS5+dvlLS7kiQIHq:gxBJJ3CutvagpEBmLIK
- TLSH
  T113F17416DB65EFB9A5194288613644F13C2F19BFFF52F3B8C27A9322BD12BE040544E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral23 behavioral24
- Target
  arolax-essential/assets/js/admin.js
- Size 2KB
- SHA256 07ef63a8ef7ab720717156310c5bccd12320e72fbcbd94abcf658675dcf2275c
- MD5 cbb04961b83c68e05ef09ff2a113567b
- SHA1 f39dc5c28d4f779a5ca852ca5a4399591b2a25fc
- SHA512 511ff5468daba8b09c667636da645312e705e8867412dbf9c2a5d81fc1f55a268e0db398f07eaaf47558bb58aac62e816cff3295c81c352c9fe4055958a72890
- TLSH
  T1A2419D4E7CA0C662C63732D9D63B8504FB25A34763459A07B9FC99C05F32524E89BF8E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  arolax-essential/assets/js/basictable.js
- Size 1KB
- SHA256 7b52cbc7779833649ba9f638199783a7e4fa35f64e8cf3e9cd58185f246c6037
- MD5 1172721c67ad2e2d4aed1f6fdd64e6f5
- SHA1 91198ff4149f72279905fcd16e2efd75fcd9dc6b
- SHA512 27f33e8f90ecd86cc22329faad32f6aa2afe60696469ea48d83bb2a405e87e4e6d81123fc6de0e9e80bf1d7ed5e9566bf8b8e28d99bb140f4ed7c42083693e3c
- TLSH
  T1A3317E06375031623372F4A431CF97269262F9299646213CB0A5C4B67FF5CC12386F26
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  arolax-essential/assets/js/counter.js
- Size 1KB
- SHA256 896688d966de7f514e72b6c5b156de3fb6dbfcd61436e6db46ce3b0e4f52426a
- MD5 ffa1c1c1632e8b1ef25ae00ed94385c0
- SHA1 d41504626fcbcd03e5b44b4c8f7d8b02d56ea1af
- SHA512 df18cde2a7c51bbc3bbb1496291cb8977e3e1d565f7316b85b94719fc4017ab3d3edf1e18292d8314b902187e3eac4477f8ff5c585ddb66520fdf7db223696b0
- TLSH
  T11A4172F17E1478F30B6B24AA04390042E9305AB4227364C0FF9EA92614652677DFFF39
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  arolax-essential/assets/js/editor/editor.js
- Size 2KB
- SHA256 b0de42d65be302a25208ba1f2105471ec995d58399221209412fd4d6fc5a1db1
- MD5 5043e1a3c0c45365656f6e0c8d8d538f
- SHA1 f2c5e33d471aa151fb301e5f0efe271514d7f28f
- SHA512 1f64ceef5e08c5d14a2f961ea8784159e518730c2f613152b8c358c74cf80c8169116c0ea1d02bb3a8487347956d8858d1ec5f62091f7bb17f7ad06bf906ab77
- TLSH
  T1F2417C09752F6581407B153B7627BD4DF42C98B68166A30DB01CA83ABFB5E0277B7DC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32