Extracted

Extracted

• • Target
    awmdata/awmlib0.js
  • Size 51B
  • SHA256 f21a184323d6a34071e3eac9d4dd986197f7c4c07d1a887106c4da12bafb57f4
  • MD5 70dd8b8dfc66091f270ff8f5f36497b7
  • SHA1 41d68bd7cdf52f98b8bb891df98fa6d9218a7006
  • SHA512 628e4b2f43fdf68ed202af83374cfaf14234fc3aa0c62ea049f73071b05842b26cf4cc16f3fb104af04164ad9d5d65dfa865b32b366c50c301064fd57b91ffd9
  • TLSH
    T1DB90047C0D534C7444D445010145C5D71F551305DC110D570CD57F74511D15C0740331
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    awmdata/awmlib1.js
  • Size 78KB
  • SHA256 13bdbf48f4c47a6c45e07024736d991f81c1cc98827af2c55b505ba7500d2d8d
  • MD5 6b4fdc11bb2a83a9ba84839c0156f0ea
  • SHA1 31f3882dbb632d7f087a7bf590d5001341778191
  • SHA512 c6767624467609ec20c24ffe33dbbc9f8184b8c0a3f86fdbd5ecdc03c5976efeec5dc6b03d0305fd1206d50b27786f5d26180260f96b83dc58ed661800a02432
  • SSDEEP 1536:iWMDWRZICHojmecQf0JjgVdt3N3Br0VH66ngKCF4vMGbH38jkVJO4:ZMAZI4qmecQfGjJH67FEr3j
  • TLSH
    T1EC732A2423C52017E1CAD169645E518CB0B555692A02862DFE7CF8EA7EC8F49F6F3E3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    awmdata/awmlib2.js
  • Size 73KB
  • SHA256 78c6d8ff9c6b94a32ff4ccf91abd571f3007eb7775fa726f5d714a4fe54766dc
  • MD5 7fbc789c42434778e6eac93b7fec9941
  • SHA1 daa18f0f168473b6c559be31412229008945af11
  • SHA512 786c1443867f7ad7153a505a097f60b6141d897a9e43cb638241887e8546bc0f1d5eba0d74336b1acdb916d0f1c809a164947d4c6985611a4c7389389443e6e5
  • SSDEEP 1536:iWZVWWS5SsTouRzgNzBnaqztZ3UgxLNuOnejwrh8J8wNKr2j:ZZPS5z0SgZ16gNA9Jbj
  • TLSH
    T19C733A1423C9200BE2DAD1A5550A208CF1B5554C5A06462CFBBDF5E6BE8CE4AE6F7F3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    awmdata/awmlib4.js
  • Size 69KB
  • SHA256 69bb3752436ff516f5e8fd8e34a5261f62add44f00ea1fba4bfc96510d6c8b01
  • MD5 4a35c02ef11f02ae9eefd73ffc40d4b9
  • SHA1 37c5026c7ac49346efdcd9d522df57b7327b1676
  • SHA512 bdd98285711c65f3a28f49e789119172b4005afedd619d210ee557cdb6dbfc490c775e225ba3bfed212847d7de37eedb07546241b4bb7b554f906a0b3dce1ee6
  • SSDEEP 1536:iWKnWuoNUMYl2Xz2HljXa/a8Q3X9nwnaINj4jBrh8J8EFK51:ZKVoNRc02HljXeNMMJ4
  • TLSH
    T1DC632A142289201BE2CAD165954E108CB1B555585A06861CFA7DF5EABF8CF8AF3F3F3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    awmdata/awmlib7.js
  • Size 49KB
  • SHA256 8e86becc9cbdd2140e6396a1996cffd48eafde4391181ac94ccb7da7f92ffe3b
  • MD5 3c8c1ce12a89bef3099cf0f7950d8763
  • SHA1 b5b1ef6cf7cb9da985f278ff01476f2bfab5b96c
  • SHA512 8bd84eab73e106c03e45bb6f5b02a2eebf027da07f086da334280bbaba03c3bab5670ba8fafa275cc5601548c493372f7984a10c90426cc7bab87e681e8b5008
  • SSDEEP 768:wrW2JzN5fWgasMjNx2LpLa0siXivlFBbrgepjOlUFn0COZ37A2vnrnH2fmqKwfh:iWkWgasMjrlfWlUFn0zvnrnH2fmqKwfh
  • TLSH
    T131331A042689601BA3C9D224908A158CB175565C5E07461CFB3DF5EA7E8CE8AB3F7F3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    cgi-bin/php55.cgi
  • Size 138B
  • SHA256 5279492bbb80ccb4646d9e236e0f35341d8264f9d43b7977ca5d7c7c2258e630
  • MD5 183050bd993466bcb778b8074df6a399
  • SHA1 371f667217f02b3d80a21714be4183581a76aec2
  • SHA512 217ac7ac9142a4605379ccae60e69373a6ac79c322dc7b77147f5bb971f4e7c99b20502428f3bcefdd71672b4deb350f879e15cb604ab3dc8bbd6de50eb6ae45
  • TLSH
    T108C09BB7915FD4241D041C10221A5572D397A454758554968801554995A5F5B7D8EF40
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral11behavioral12behavioral13behavioral14
• • Target
    cgi-bin/plugins/clusterinfo.pm
  • Size 3KB
  • SHA256 631120f42bf08eeab1857c424add6e3b99ddd5ed7adbba02d85e6168b77d22df
  • MD5 1a0501e3d4565c275742b36e394628f1
  • SHA1 fa1a95fc891b3fbf6ac89d5fd2642b0a1d4dc880
  • SHA512 c27dd952c2f8c4cf658be30c4bb487ed07fe44da886caedf4032d652ae0ccc3e75a1a653fa3f8e8efefce2b0bde5a0461186c16fe8b18b90b3608018307051a5
  • TLSH
    T165716F32AE80C42F6E36F735907F80F0D35AE1173626A9D4259841443A32D3DBBBEA46
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral15behavioral16behavioral17behavioral18
• • Target
    cgi-bin/plugins/decodeutfkeys.pm
  • Size 2KB
  • SHA256 c4a2830bb2ab6c9cb2af4c8e14eb5a83493f1fe41c09b5576144117e84b04914
  • MD5 1f1acd07daa73f0c898fc18eedfa2e05
  • SHA1 08560c1b13f7e10e8bad111be4115761e7af4d8e
  • SHA512 f0227d54e5f4551855b4837138fd1dd8ed057fecc198fde45834fa18a741b5c07bcfe2a8670c6a29eb560b2a0b9df29ba12c2411db85fbefb176ba77a8fbb203
  • TLSH
    T1445171603DC2E0DB1FB2E65220E61586D3A9E1473B296DBCACE953587910D284DFF115
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral19behavioral20behavioral21behavioral22
• • Target
    cgi-bin/plugins/example/example.pm
  • Size 12KB
  • SHA256 a72e33afe3a0325c1da6dd6b7a7d924217e47e5078718a8ca76d2b552ec9228c
  • MD5 eca7a4e34f6686b45f152bc96fe98313
  • SHA1 204ba5e4dbd73c099c5f4dcdd438dec68521097e
  • SHA512 fe52189e2fd5c1b1cf812876c7d8fad896aa23a78fb406d787fe91a1c31e61c46aa11d0bf4875200c6f49252b0b0a48f205b5e3a30dc3e7a67375c3cb703951d
  • SSDEEP 96:7HafgLxLAh0lntqQ5Ing5MCtYP2iRkqKDcePQclMauCmF/4omiIm64iFfekOfA+q:DafgLxLN937WwK+
  • TLSH
    T14142961A7E986C538277E47615C68295E3B84133B3BC0D423C9856082F30DAD7EBFE86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24behavioral25behavioral26
• • Target
    cgi-bin/plugins/geoip.pm
  • Size 7KB
  • SHA256 2b69cb11d0231208b56818c889c70e6f1eb7b5e78f8d0d5a557eab00635f7b76
  • MD5 1fb6a113ee0d638fc110f88dd3aeaacc
  • SHA1 d6a081a3d18f7c32a332f9a091c0d652548217a1
  • SHA512 842476cf7956f1c9de6a5c2ae4546feb45188eaabc995ce3e1071c43804c0fea0d36059e40bdd0fd619a1c84bc8b7d4526a6cea9c9a1389a325e0e6e11416435
  • SSDEEP 96:EM6aFh0lntqC0ituc1NLcRV91reRbBX7HrIO3TqAT8sVb8FgiNeNo0iNPh:l3HuBLME8I8z0+Fh
  • TLSH
    T190E18604AF99CA43907BE5C869C7526EF35D919376255C00BCD89A307F48DBE793EA80
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral27behavioral28behavioral29behavioral30
• • Target
    cgi-bin/plugins/geoip_city_maxmind.pm
  • Size 110KB
  • SHA256 f3aa21387b4d260c9dd816bd3905f08d22caa4c6c2e8e82f0655665cce9157fd
  • MD5 74ae4ffd0f83e9c8ab39266a2c7ccf52
  • SHA1 7f38da75feb2392dd74c419b7373dcd4b1884e5b
  • SHA512 8a140ea6c6ae0899faca81839858af3f5fd291d680072e6f8d15b7d39b982354cba18f11689c7ea7f95c83d3b06754dc705e774f18a21cb85f620ee123c2b1c0
  • SSDEEP 3072:IRmDW4mij+igjonrL3UgxmtUwSWS+fWr3pgjFN7G7K0Z:asW4mij+igjonrogsWWS9r38J0Z
  • TLSH
    T16FB3B4EC5F959EBB8072CC981B96EB64E12E036648468C5374FE11EE23D61DD31DE80B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral31behavioral32