7df6489c7c657ede70a4e72060f4557efcaaae5a1b92edfccf323497e5ebed76

Sharing

Copy URL Twitter E-mail

General

Target
GENIUSPAY.zip
Size 498KB
Sample260703-ar1tkag17t
SHA256 7df6489c7c657ede70a4e72060f4557efcaaae5a1b92edfccf323497e5ebed76
MD5 af24da858257a9841aa7183b05bfde85
SHA1 3f1ff3d62f1412a9b77daa998fd93f99161e1c85
SHA512 da4ff64d99ef2b35f3c096eb583d7dd1f49cafb452089441607a966da33b79f5803d67d42f98f09debb5f6acbcac49660cb0c0ce7551db83f763fb7992be19c9
SSDEEP 12288:ilQV2cnCuvmbGZtLnaPps/C5xbE4RDbGZtLnaPps/M5DS:il49vyGZtOxF5FNRvGZtOxddS
TLSH
T1C9B413B082399020DADF8F355C4827ED32D59920C2963A7E39607750FB6B3797BB6358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  admin/assets/app.js
- Size 353B
- SHA256 b7aadffbfffb08eaf2469d93f500d95e9a900b96dd745ddf02d846920b9fdc45
- MD5 6e26e6c975e2825a664fb013c6626a06
- SHA1 fbc60a56fb465594aad3db3e2d23b144711f6f79
- SHA512 d4734165c37d735590fcc2fd7e6a2b463f3dee347919a014ba9428c272a9c20d4724fae4a268bc16ebe2b83fcf5b02f98c10f08af1ae483b1e3b6a3700e7a2de
- TLSH
  T1B4E0205A716231F07EB36159DB4B59285806C4123447D568BD0DE2135F89C2443FF5C9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  admin/index.php
- Size 12KB
- SHA256 ee5c1237d2e02ab77b50cf001e9008fe97882669cd95c9e60c9b4de792ff6644
- MD5 823a20a6d8322ccb90c0de20f01fe285
- SHA1 71ef5e51eedc432ae21459498953ee59f6bcb888
- SHA512 40dfb0c5ec60edc7312b93aab7aaad07f06a703906b5cc23b868a65c3c6a0881172f62469474a18ca201912be9765ef968dd9f316b2ad3edda2f6319c9224cd5
- SSDEEP 192:dJpiQbgysUm/qEUNXaYRlZw6oy0a9V5BuEyHGpZ1yTEb6u:CxUNKYRlZw6o2VBuopZkfu
- TLSH
  T1FB428231B0E2667218A7A9EB31561B163DE1C907FD0B0011B9BC4BD94FE6CA5FC1F925
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  admin/qris_developer.php
- Size 9KB
- SHA256 cf2873ec36369ac584528447ea8a6779cac803a199cc5d38b9d3b895da941fdf
- MD5 417c7666010407806e0b411c8d03ed5d
- SHA1 fa374fd28a9f8bf0066c5494d77c499b5ac94194
- SHA512 4963998846ff4bead687bb542cc8a7205a070bd902539fd5ff3ed3137504bd331d67dce084f159132946cb6c8d7343a6af22d355f5cc9b8173ec9e496fb3aea7
- SSDEEP 192:5gqTMx+Xtfienl6hTByRGgmgoTJ3gcLibmePGaA5Xh8a:kngmxgcAFA5ua
- TLSH
  T1A912627200C3756214B790DBA591AF89FDDAC69BD902060179FF23EB2FF6C60AD07119
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  api/qris_callback.php
- Size 3KB
- SHA256 66ccfca50b4b677180270c80fdcdfa16c7d4c05ab07244fa6c3692dc89f5bea0
- MD5 fa9faa735217b31cc42ecda98734fb34
- SHA1 6fe28ed5c297ae31003c69173540512d9355efda
- SHA512 2f3b6acf9edea7be3ec9636d26c75943a2f7e1915497ba4e49103f855acbec54cb6bdfe1206a3751fc6580d7c781b039f52475b147574dde7b63adcf794d3a7f
- TLSH
  T112817682BC1616D16877F2302E8714DBD7D2842B81045B53F9BE83982FF12C5C9E4B69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  cron/qris_mutasi_check.php
- Size 8KB
- SHA256 50240a2dc413d2a58924bbc2cccdf1d7739cef65dc245ce658210f72bba00849
- MD5 b9dc8fe945b600803fdaba2ee8aaaa72
- SHA1 21fd619f181b7417337fe47a443b50d3b3ff3990
- SHA512 cb2e51b7c988c0a85707f7214e172363e4b3423ec4e77ae6d48e45298de994e846fbdb1da147e76e65e8b032ae61b13c5640793c31299dc03b7eb3f5793a32da
- SSDEEP 192:nyg6Fu7dWjUUvXOxg1/3RNHN+qxZDRH4l+nvaftPU5jScKZKoJ:nygX7088HauFgwoJ
- TLSH
  T1E602A6C1390390B12975F325BE87885BEFD4862751152383F8AD45E82FB518AD3ACCBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  id/api_keys.php
- Size 6KB
- SHA256 ec67d33baeca428b9666c2b7b9518526259ef1262142edd2fcdd32c571ec13ec
- MD5 76a0ed68fccd82b1145fd0f5b7e9ac3f
- SHA1 12d905f92dec0d6b9e9770520d039f2bf8041491
- SHA512 c396bf3e6b262be6f0ee9d100a37a75d4c1431021daeb0f2fdd43e75c16e6db8392798b9f1092cb23394cb46071f899c0d5f7046c202ef1a092f19cc4ffb7b36
- SSDEEP 96:U6/fKk2jFA/17A4rooASe2SusS2Bu+qRGE3kOm1LH085bElQe8rKHZ9ubfq6:ZZ2jo7A4r5ASe2SusS2Bu+qgAlN8bfr
- TLSH
  T13EE14F71518625367033C5C39492978FFCA88207E90B4798B9FE23DB4FE7CA6CA07649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  id/docs.php
- Size 8KB
- SHA256 c610a19196894e4d1e4f045095de15015830d9f2f15526f17ba559f697ee2b8d
- MD5 adf7a6d545de1cdca271081a797baccc
- SHA1 db4e63f889112f0d7f9a91c9197f63d6833572b7
- SHA512 3bb7ecef39a81bfac80aa4ea243a01a8d3f9bfa8d1294faa42d170641504d467599f49ee613a23d824fbdf16fae9e1a436199eae501ebc4f69804932f57499e9
- SSDEEP 192:ZF2jo7A4r5AsS/sSUBuF7MCyog6mNpmrFr:Gjo7ALsJoZ1g6qIFr
- TLSH
  T11202C571508226233473C1D36492A78BFCA8870BE9074745B9FF23DB4FEAD66DA07658
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  id/setup_otp.php
- Size 9KB
- SHA256 c2e6e6e6dde3e52038da5264db256586f3f147eebffe06a5c9449e422bee6ef5
- MD5 a7297962b5c4e6f4de7af5dd2602cf63
- SHA1 10c0d9e2c71bcdcbb0141d950683babe50c5c0d0
- SHA512 7b5a8764f6d1d0799b9f5fbe35cd9e5c555e187cfffb7bae13c2a488ec59c1eda1c38e9e54f4522efb5f86461de8d6301dbb35c6a9f82b02eb6e17ca828d931d
- SSDEEP 192:dZGrE/yZK3cw/rJHnc51inc5JAkxI7WvkXm3X89cURdvD3Nhyoh7jpn:6gBcMR/jsMfyotpn
- TLSH
  T18F22B558F8421563A133CBA6E756840EFE6440078603A309BFAC139E5FB1A49C7B7ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  qris-static/waiting.php
- Size 8KB
- SHA256 dad0661ab056422392c98341436fb101fb704199a873808cfa5ef3ed8acd51bb
- MD5 16587a5963d1ede9334c42388891d286
- SHA1 5743df3ed809f3910ad88bab91e0bfaf20fd8c16
- SHA512 04a52ed8a4c6197de0aa05151ab3aead5af6ecea173103540390bbdc6b1116ad5a86ccfc244b28976a520a6656b8bffad63e7ca0dee498a21104a6300b39efa3
- SSDEEP 192:ADq14xSKqXLpoyyLt4ZcdQw1MPwfm0+UDUHoiyne:wIpeuZcpQ3fUDUHoiye
- TLSH
  T1D00285A691850412BCB3E9A20B224749FFD5A0039E07E308BDDC63936FB59D5D24BE9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18