3ec8bc6e287479e58d8b0929a029fc48b9bd5259d4ae6649c799ae5728fb30d5

Sharing

Copy URL Twitter E-mail

General

Target
icvassessments-2-7-2026.zip
Size 15.0MB
Sample260702-w4fj2scs8w
SHA256 3ec8bc6e287479e58d8b0929a029fc48b9bd5259d4ae6649c799ae5728fb30d5
MD5 61257acfe39f608151c310d2987e761f
SHA1 4e299d0d8a67c80267974b6b4109d583e0f6f4de
SHA512 b9ecd4ac865b5db78c138d39fbc836540103db1cae70e2f62b9712b2cc0f3b8727a091b854b8ac37d31fcf126f44881938650ba7e953ab4ec4966be8cb043785
SSDEEP 393216:fskDv6Bpd0mIId3OYBYAtWHas1j8pdYWZcLe+xrs9:fskDv6qmXd3OYJwHaMIHYWZcLrrs9
TLSH
T19AF633BBEE2C4519E96E23B3A44B158AC49F216A3050F9167AFE17045B373523F32739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  admin/ckeditor/adapters/jquery.js
- Size 3KB
- SHA256 0d9c05d925356f1542257eaa75b3c9d5ec3601e7c989c5454b5f047d99377248
- MD5 bd5af6634f481d6915547b85cd534e23
- SHA1 1bc807d5a4ff97ed189b0fb86f16da41941f6b06
- SHA512 442bfc2f1116a1e97bc4030b428a1e975d9827300adf4ad507b6736dcc561f8de5996577e640499700192f276838a57afefb585819e25a0ef9fa47186f02cdf3
- TLSH
  T1A4616307B731FCA6593E28ABD17F130924AB6C2E28D14462A4D858946F379C4B272B78
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  admin/ckeditor/build-config.js
- Size 3KB
- SHA256 a9cab674943a75c6061148082d6ba7b5b5756d8925ca6a651005f8b81924fe82
- MD5 1d2711c19b82a8c4894f685b34ad77f0
- SHA1 46694a2541dfc22c7f04230d0d7f0dbfd904a5bd
- SHA512 60490675c6e42ef28b956606c211b76d934a6027aa0b0f7842945ac73b0cd7d59b0f8393acd83bd00dfae702dc544b7539d49c7a8f3b90126bea52b3820bdd17
- TLSH
  T17E51EA7E7BC1523F0820C3B29096C7B6D5759F6743F56782A0AA6410262203F2F7A67C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  admin/ckeditor/ckeditor.js
- Size 545KB
- SHA256 0956d58ce12eed54981d796f6cd89199174d5cc759d0cf8dfe7ef3be3f8e1bbd
- MD5 95ec4f79762e8528abda7ab02dc7ca53
- SHA1 ef2180089e18a87f3a5340e89a2b24212c39f0fc
- SHA512 5961f538ab22e52309dffb3bd68d3a1798817bccc2364f174451fbbdb9762cb818c53cf2de2ac8f51b2900c436e6eb202926b55444b9e53fadc351e0e223a42f
- SSDEEP 6144:CGG7Drwu7DfD68g531ntnVdxwQoVaZSgmXxhpGa0l638XU9oUyBIIGipneVlUx9H:S4IY31ntbIJZyQ8sIG+F
- TLSH
  T130C4E59D329236F775A628E810FF0046797EA851E00849E6BC6DD8C46DB89CA3077F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  admin/ckeditor/config.js
- Size 1KB
- SHA256 c971725a63a257891349c2407313839d420a7b0fdf12202ee6fba57f916b711f
- MD5 175e4710b6eb0f2b073ce006a68c10c4
- SHA1 36987cfe8150129a3f8668cd8c25f0276571d335
- SHA512 fa1cbfa168ad2b8485054062e05702fa6ea127567bf72e460bdbbd5a7dd66c32a7110f1ae92142d1ac22c9fb7c0a68b344d90d98f91719caedcbeab4079d28e7
- TLSH
  T1D8211E4AB0F7A4EB8AF53CB190B2E303C62EC5409630B26674CE719C82086796A61D3D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  admin/ckeditor/lang/af.js
- Size 10KB
- SHA256 2cdc58c7e0622f1207e43294f7ba8fbd3b96208868ccc61a53a4459931f849ce
- MD5 cca0fc8eea9b47267554c8862cc544fa
- SHA1 9a5643155a309071818ee6114b62908ded28c04c
- SHA512 b843bcfcad77315948d134f4ceb3d1674157c3741feea26657325a99208f659af9c523fb56d725bfeeaccaefc18a787eb63345966f8507c1486ac2a9a58e95f1
- SSDEEP 192:z8hnn9J4wROZ9jIsix/MpwWGK2jRDsnWJFL6vE9dxLkss6wLhrcLqAd/xVKxVhVP:Mn9J4wROZiepf2anWJFwEdksLwaLqAd0
- TLSH
  T11332EA4781065E7F4FB477E948CA6E5225D90296E3D11C39AEEBC85800CEFF8721B22C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  admin/ckeditor/lang/ar.js
- Size 14KB
- SHA256 4f25f1a1c1c782bfb88076de811ff1af43a46036fb12dd26c8f85d84bb333e7e
- MD5 ad727a251f3f301a9af63e50cdfebb2e
- SHA1 647073e7fada8d7ca8018d2e0afc58929f1db750
- SHA512 1256c27e12bc438e63a13b88cdac0e75337c6d80f95f98cf4c6567de635564c4b6755fb5d465bfd9033194f3206ffa3266805f05065816b868587d198133439b
- SSDEEP 384:Apm619ADOMIt/7bTZJi5sKA6R6BuOMYECCzV6eW52:Ao619ADOl/7bfiSKA6R6BwXCCUes2
- TLSH
  T10E5201A21B25C47527858E9FE0D7302CE8B25E23966FFD312C975A15C3CB812E78927D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  admin/ckeditor/lang/az.js
- Size 11KB
- SHA256 e4ceba962a07e40badf3415e865841a0133fd73461921ffd9ce8c4ed8c262526
- MD5 3e8cb451342fa5270f78b147a789113d
- SHA1 1a2c97ff2300cee0bc5e88649cec246d675f57c0
- SHA512 604f547dfa3c3c7c6c461dd50c7d939416d9d11f5b87f00ef7df86fa6f3568d0086295e521594cd47fe6338aafc222e191cff722c5109a4c64fcc6e243a03742
- SSDEEP 192:z0Liv+VrWhQNt0DJ9onIdPCVlJ2/43vJpAK+XXUS+q0ry6qWSb2ZSATbGYHoJFey:yivQrWhQNS9oA6VlJmOJpD+XXUS+q0rm
- TLSH
  T10B32F943500ADCBE8B4C53CB08CFAF7678DA0147E0D354299EE98DA481CCFDABA46659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  admin/ckeditor/lang/bg.js
- Size 15KB
- SHA256 88f9086db077cec23cf1fd0b712ba7f5efdb586815d4dcd71540d5550da5074a
- MD5 cc4389040059447176ab541d0c6ebfb5
- SHA1 55de680d646be2ba1a2468ad6f3e32c2d0a9dc6c
- SHA512 6c1e999e9185b32ee500b800a4cb2d5620897c7907527b587fd2cb1d0429d2fa1c5ea4b76052aabc6be0fdbc3d6acfcb623b87457d5eeff6109c4278de531c7b
- SSDEEP 384:5qMKtx+noIRdySELxJcwg5yjy0QH3NKCzTUsGixYpQSSFMuJ:RKtsn7ypcwa4kKCzTUsRxYpHSFMuJ
- TLSH
  T15C62FC61164E58BF4205E69EDC487A073FDE00FE7FD3869246B4AC9C70E617492BA70E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  admin/ckeditor/lang/bn.js
- Size 15KB
- SHA256 6a142cb07b11195e5966abc9c0c58562c10a823c686396861253bef63564b9b0
- MD5 288878bd9457dd8c424b698972e0f7f7
- SHA1 bdd82510af71e1279ef422d1939f74f74cf9ab55
- SHA512 959c4e88bd59bade481aa9db0fd6ebfbd425c97e8bd2b1d0f6dcaf6ebf7c70f0f4c5564f2fd5752250be93a8a4af21fead92ee38d870e814b983a36952d3c934
- SSDEEP 384:/jBfvSpuKLDk2kCNrjJkJh7cUUvIqzVyyqMcenDTOI:/jBfvSpuK1VkJh7ivIqzVyyvcenDTOI
- TLSH
  T10D6245009C2D64B7AAD2CEDA178C1720A4971D83C3D1F64DCC6B954831DEDBC5C9E9B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  admin/ckeditor/lang/bs.js
- Size 10KB
- SHA256 a69e7e4f8e82a65c3537b2e0ce23c90337bcca4cc93fe5fc0f1106fdb61058f2
- MD5 0b72eff679b3815748014a5e69340d23
- SHA1 66c6f023f30914ea159ea2c667dd692cd7f6137e
- SHA512 65c024bc9098d520054e7c35f1e522ae8dfff53f953a59c043210538220d3fad7cc841e5cf7a874a9638b35de4b2af86588cefb21ca3d74b3067a43042c012a9
- SSDEEP 192:zBUXlbF0fgSpuKpsKcSGjRAKk2lm03jJkH70vKDQdaYr/HrR2kLgjbgAAL7luEoT:yufgSpuKpQDk2ksjJkb4daYr/hLgjbg2
- TLSH
  T10032E80656259E7F479A43C668CE2E4238F50183C2D1ACB9EEFDD88D02CDEDD7157229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  admin/ckeditor/lang/ca.js
- Size 11KB
- SHA256 84dcef8a9479579e1c167dfbea5d7292ce89782be817ced914507e46f0b885eb
- MD5 c153490d3f305cf94ee2610375688e90
- SHA1 fd627f23e4f6d85ed0b48490827195282f0a8f73
- SHA512 82a655f05d903d8bf364400a07ae8404d29c8b01c205033186fb594368f5a84a68e76395c35f27c5eb9d80011228d97cf0e69caeb2afbae18aa88e6394ad2c70
- SSDEEP 192:zgh3OaSRtEkz3CNTLIlwspJQwDsj8O7iBmPau357HB+4fH++F22KqolQmPc0HVMJ:ZaSRtATLOpJQw4IO73Pau35LE4fezlVG
- TLSH
  T19B42E80205CD1E7B5B9B13E959CAAA0760C449C6A182F8A4EAED5E4901CCFDCF91F37D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  admin/ckeditor/lang/cs.js
- Size 11KB
- SHA256 9a2113d002596b1a6f5ecbe2ba249fd1dd0bbf1d68343399e87dcdc64aee28d6
- MD5 f3617920cc5736480f3ecbccf36adfa5
- SHA1 24487a9d05c8819ce993374d6f95e284d3510976
- SHA512 0be1a3deb495c3adc816bde2dfb2754889dcf9f5bbdc8fb4e8bb3d9ce12ae8775244ddfb388a9ffe49b0ab2d684d201f50bd5a5a8f0a3e3d4882a020ac4ea58e
- SSDEEP 192:z/i9fzwxv5Yi59L79KglOnSWcxwdxAJd8Y9ji8vSbyw522safPCfTQHJl1kmAf7F:1v5Yi5tlOSWVAJdP9ji8qew522rfq7s4
- TLSH
  T19E42D90EA11A9FF9871D43C96CCF995220ED0BC490D1BC689DDDADCA40E8F9B7C5291C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  admin/ckeditor/lang/cy.js
- Size 11KB
- SHA256 c70afae0eda41a723758c3db51aa35bf8a1f4e78049f020e1c1ad961ce5308cb
- MD5 1d30526a6a3e532754d94fe5e515aba5
- SHA1 43932a8428986d24273abd96305d302aa5ac451c
- SHA512 5df8983717460dc61feee23c0a9e93b7777c4fa12d6d7b7bc8514a0f1a39576399991843c1857151bd8046f91fec0841847b6ad623fb01f414cdda71bd9eeecb
- SSDEEP 192:zrk75kmMl8My/y5vzzVspPd9hHF48yJ6ozjwEwtlf1zo15/PK8xvWMJfnvX3b96k:If5B/y5vzsPnBFTyJ6V7215/PK8NfvvN
- TLSH
  T12C32C703D10ADFFA0B4C9BC358CB2D2A68C904D6E1C16C4449FAEDA846CDBA5B85E71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  admin/ckeditor/lang/da.js
- Size 11KB
- SHA256 4f3476ad8a27fd377b4a62c71bf2d5541c9f50d97288f7faaf542244f88e9e89
- MD5 bf73c42533ec7c82bc764895113b7e2b
- SHA1 d2dd2e93428a40b5b5fef00ecf22231d3038dc4c
- SHA512 8032942a7bbe291525224b44d6853ccd43708b853edbc5d86aba6ca90f692363845e9dfcb24662f70a071adeff38be48557d32e6a2fee820c37f9161eafffd5d
- SSDEEP 192:zGH6Z85+rC3UnEFPaMNGMQGliP9i4Qn1JEzncQr0EqAIipil3ba1mGAmYkd0UoNx:1c+rC3UnEZSEcZ81JEp0bAe3ba1mvm0v
- TLSH
  T1A032F84383369F3F9BE917E569CD0E6199ED0887E2C1589E91DCC8D800CAEC4766F628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  admin/ckeditor/lang/de-ch.js
- Size 11KB
- SHA256 5eab53dc572b518613c9464d30b1ee720aa55540da4daa129faeb5be43baa16f
- MD5 4346990274690a083e83c78b4f933e1d
- SHA1 de3f2559b590283f14c20171deec295f92ebf5a9
- SHA512 03529b700060bed71311f8d9f967ee5fc604fc47910a815c70b5d40abcf47e418496a6591c162bb78ddf477143a93641264908d8fc9191ffe16b063ea343a069
- SSDEEP 192:z8EFtmb8tqd++HLONaONGk+PfnX/Jjzm/WvY7Loi6qY8ikOoBE9JIOvNAJBlT7oZ:pXI8tqd+DNjND+XX/JjMyY7LoiDY8ik4
- TLSH
  T18842DA4BE02A6F7F9BCB63D528C55E7E76D44212D0822424A9FFD89A01CCAD5F10F639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  admin/ckeditor/lang/de.js
- Size 11KB
- SHA256 efa34653906ad500feb52589dc15cdcad48c346a21710ef7a893c57a565df311
- MD5 c888f6701120ca1b552ea5650713c974
- SHA1 747b718b3145528d48f548657b785fbd6c518a4d
- SHA512 9cffafc17fc849db089e8fc7005122bf507ecea2e0ae07e16c99629d6760ca22421d667826a4bc79c8565bb1aeba6251d9d2ea06959bcce0912b9e5e483d91b6
- SSDEEP 192:zqEFtyriG8tqd++HLONaONGkhPfnX/Jjzm/WQ7LiiWqY8ikOoBE9+EOvNAJBlT79:nXZG8tqd+DNjNDhXX/JjMT7LiiHY8ikY
- TLSH
  T13C42B78BE0266E3B9BCB63D528D55E6D36C44212E0822428E9FFD85B41CDBD1B11F629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32