1ec858242a79b9c5cc424f5d8835a1a022832a254341cfb1693c2a7612f50f27

Sharing

Copy URL Twitter E-mail

General

Target
heb.zip
Size 2.9MB
Sample260703-g5prsahs4r
SHA256 1ec858242a79b9c5cc424f5d8835a1a022832a254341cfb1693c2a7612f50f27
MD5 81dfc05c32f5092f82f73b20e9e9ba5a
SHA1 c05709d547a3c977fd4b10a6bebafc531c74d507
SHA512 1f05d76f0b475a2135cfd9943f4e6454f18e519dea9032373feb7a7c3367a0bcd3af86d2aa127391c4bff93d4293fb9e90e800ab1f4c2cbd560a382166ad11d9
SSDEEP 49152:Q6HH/y30JBp+zyVriLGFnj6UL/XgfYiew9yt8JucXv6JzNw8qstY+T9vi5yYhJBD:DHH/y30lpiQ64qrgtyhfIzNasZa5jJsq
TLSH
T1B1E53373583B2795C5BEF2B122DB22856EBD70382852B5733CBA88642EC75614F7835C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  heb/about.html
- Size 4KB
- SHA256 ac8ce75592b3df0b339187a29995acb581426b06ab714eba52a5d225011cf233
- MD5 378f88c2751cb993f22380e76a86b9d0
- SHA1 a5315862b089fbde514cf2e03649edc88124baef
- SHA512 4f09ec019a325776d2737972181d09f9d95d817b4c48b9cd5013ea5c4a237df0c3de3c0bf1321cbf4769bfcc608453f1f1af4a97f2a602a98cd0228447dfa076
- SSDEEP 96:MqwkT0gQqqtqDqmMea83+dhipHix2WAAI5ybcGoIPIr9IcSIcp6OSi9wOkiik:M5kFQq2EPNaJdhiBigoJc5I61i5
- TLSH
  T128A1432259C1B50FD1324438F3B41EA4D9FA8055832A9E14B71F30AB6E8B7E59A7376C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  heb/aboutus.html
- Size 9KB
- SHA256 c988216a7a0aa98740d6cdce48841d34801dd669457b6e7a1624882621831362
- MD5 d2df037974006e15498087c3cfd02c66
- SHA1 8526f5bfd24d8ce1d5c8d7df182fca2ca0310461
- SHA512 21ea861ae96caae6858d0bc314c04f8e1c8e7e13aa89cfe61ed7ed32c44417807fc837eea9462aa3dcfa1556b157373dcad561486f446ab62c8bf1a3e731db7e
- SSDEEP 192:455E2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUj7ap3R1TBu5l3IMhwhyjkeyjt:455E2kHHszP5yjO9r9OU2aeZjeKgBcdT
- TLSH
  T13012613B06E017BC002307B7F168DB1496A2AC676786B50871BE157F9B9AEF0CD43A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  heb/assay1.html
- Size 39KB
- SHA256 7d58706382ee658e4079244583c91659fa9749e8bd09b712ca0b28fa02ef702f
- MD5 73c74527cf624c48a423447f7e0738f4
- SHA1 5459c33842df9a06b5f54c91b5b15bd570b1462e
- SHA512 2c83e3e3910e3cecc1751caf698cd2945fb716d985bbf5510774954ef1315c9127ed8d79a6e5460b804c9b970cee01cc06cc3d6a327c51aaffa441e3ee5bcd3b
- SSDEEP 768:eZMl71E2kHHszhqO9r9OU2aexeKgBcdIQMUtYgUyMl7sv+x3KFXMN4uMWFbC2OM0:eZMl71E2kHHszhqO9r9OU2aexeKgBcdh
- TLSH
  T1A403A23B16E427FC015607F7F168DA0581A2BCBA67C5B10871BE187E979AAF0CD41B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  heb/assays.html
- Size 8KB
- SHA256 19c06cd8e1f1666e54e4144170132589b3ccbb910e31fb751988a02f2664deef
- MD5 10e1c0803a2f6d41ff2833a78b7bf591
- SHA1 675e007057cc7f7945b5868ea7a9ba56523230ef
- SHA512 9b8bfee2d45a086a932d2dc35ec1713355698c9329ae595dcd54e76de8fab8cf11b1d641f4d2ce61edf68b3aee5ebcf82c280834db28450457c4acce7edebd07
- SSDEEP 192:/jmKU2kE2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUjiap3R1TBTjEUR+jveyj6:/jmKU2kE2kHHszP5yjO9r9OU2aeZjeKC
- TLSH
  T13F02B33B05E117BC003207F7F164DA1496A2ACB76786B50871BE157F9B9AEE0CE43A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  heb/bin/MySql.Data.dll
- Size 140KB
- SHA256 5b7fd0c78faff59530ea27f2b752eb97c6d329f309865879ca50a82bb379bee3
- MD5 dfaf35d184371a9d6cac8130d6f28e02
- SHA1 b141615c7d88826b434d165a296aa1e6a60f57b5
- SHA512 409004111374467c7801111f85abf16e87f91605a1f212453ee0dcea0e40010e19b28b6eed65dbb4692a93e3ec9a302e2d9f33a5f5cb4795182f7025fc6921da
- SSDEEP 3072:P/d55HHoGUU7x73lJ8qrQKJ2XA4nR7P6LUNWnDr3r:P/lHoQ8qU3XRntS66
- TLSH
  T1B9E33B2073EC46ABD6FF5A79E076801957F1F6673637E74E1C50A0EE1922B806A31363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  heb/comingsoon.html
- Size 3KB
- SHA256 37bce98e93a99e2d3d6c5a2983e29637e63b9e01558368c09bda13a013b5da93
- MD5 e70fbf86c0e6da44d390dc2de9d679ea
- SHA1 ab44004221ed4bfe74ca30b3de210ad7552b19d3
- SHA512 4a8b6e85a896802f729df58c82a918d6bbef74df3a88f62e41b7fecb91654cf1d7cc0e603564f2b728381143ff2812636f8926a30c6fcfc23aa3290fe31fb66c
- TLSH
  T18771222255C1B80FD1624439F3B42F64D6F6905583299A14B61F316F1B87BE48B7376C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  heb/download.html
- Size 10KB
- SHA256 47ce58bc23dd608a8f20a8bd5463710bcdbcd8666aac4fa1a99e1b51f1f57c3a
- MD5 f936bdca8202980d389ecced03c785ad
- SHA1 82d5384875d3d6e340588f3e3250412a34c59a62
- SHA512 01d95fb8664bf6328862013285e22a313e0637726800c7477c962d7d089cd191a193facb9c53fd1dde76d3c3371c5ddd668bc14d56d70b2132949b07118baba4
- SSDEEP 192:Fq/E2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUjiap3R1TBEfqiqRBQPUZGpueA:Fq/E2kHHszP5yjO9r9OU2aeZjeKgBcdY
- TLSH
  T15B22D57B06E027BC003307F7F168DB149A52A8676786B50871BE157FAB9A9F0CD43A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  heb/extra1x2.html
- Size 4KB
- SHA256 5aee52fd481c7c3bc0515fd7e688069546eabb2b566125ea056b6fd3fb91bdc6
- MD5 91d9c0b15de15407686233aade3bce82
- SHA1 ab6b5aee89ae47504d30e45ce13192b082057ac7
- SHA512 d531c1655d6bec538cda49b811c606cb1b24e6bdbb133573105e6a43705d1b559fc82a1124c4384f7021dd550a049b9ea0c9f359d0904aaf367cbf304e117420
- SSDEEP 96:MqwkT0gQqqtqDqm6zGcFqyixEAI5ybcGvIPIcSIcppIDO955ayzzEWmObdiik:M5kFQq2EP6ykqyihJ+IWC5I8Bq
- TLSH
  T1C1A1632255C1B50BD1724434F3B42FB4CAB6805A83298E04B60F306B6F97AE59F7376C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  heb/faq.html
- Size 34KB
- SHA256 8e42e74da022517d1f4dda52f245d1175ef9ab679933544721b6547a5c26f748
- MD5 91401354b0f6da97cfd10ece116d28da
- SHA1 2e7d4a777a15e9ba1ffa2257df7e84abd838f0bf
- SHA512 79891cf7d9d53e29f08ab220442f642551229462ed2510c50cd9a4b4ef290864280994256c2cca8ff7a18332fe0a2d46cac0846265e735d7ace346afe00f85da
- SSDEEP 768:BE2kHHszhqO9r9OU2aexeKgBcdIQMUtYgUJxA6IyQJUtRQ4uD8pqLxU2y7LUpUqc:BE2kHHszhqO9r9OU2aexeKgBcdIQMUtw
- TLSH
  T198F2153B12E427FD006707EBF068DB049192B8BB67C5B108727E197E979AAF0DC41A5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  heb/index.html
- Size 19KB
- SHA256 43b2d23bbc027d8d0933d61e82ef468337d79255e09f31f1193e5c049ab3a0c0
- MD5 d552eab920c556785ed8c646d3dd5df6
- SHA1 366316712db885fa9c6b66fc1eba9a67d9233e7c
- SHA512 3f1a82c4ab134a6212153ffec72c8d29a13c355707794e04dc5d72daff8607986aec992fc220d6a3ab4cca6bf27ff09fd3102f7a62f39adcbc84473c42ac28c4
- SSDEEP 384:CBwgE2kHHszP5yjO9r9OU2aeZjetgBcdIQMUtYgUFPuth0/HmRU99yjrOV5aWS7b:CBwgE2kHHszhqO9r9OU2aexetgBcdIQz
- TLSH
  T19092293B16E027BC006207F7F168DB059592ACB767C6B10871BE157F9B9AAF0CD42A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  heb/index_save_100318.html
- Size 19KB
- SHA256 02e9d4ea7e1789bea2434531e18424e30350870ade93a42ab1fde1d788921cac
- MD5 4d0f1043f8a89016d11f1cefa86fe658
- SHA1 8d186aff171d4134d08f2ad1a4437ca88bd12367
- SHA512 7aee900d5bfbd22a1b64a756c7b3bc044cd28d1b37ccf456455b4e44910edcff201e16789da07a9c6c51f35dfc437ae408ce9e07a43eef6292ae37580eab762a
- SSDEEP 384:rwbE2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUguUh0/HmRU99yjrOV5aWS7JnF:rwbE2kHHszhqO9r9OU2aexeKgBcdIQMk
- TLSH
  T11892183B16E027BC006207F7F168DB059592ACB767C6B10871BE157F9B9AAF0CD42A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  heb/links.html
- Size 9KB
- SHA256 3e693c67f45a5f064a76edd8b86affafc7e0724866e0189a932b2c491e4c59a0
- MD5 302be9c5a45a923ab58bb79a92613955
- SHA1 ed1ffe5793ceb7977a0bfaa3d634ecc1e340656c
- SHA512 fdd955bfa341d8dbe167b12ce3f427013dd2108f2a184c9c657bad36adb0d5fc52186226e7ef2630b0e3048e96e306216828f23d8ab005b6607f877d752864d0
- SSDEEP 192:t8j8jgBE2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUDUap3R1TB1zvVa7Q/4+Mx:t8j8jgBE2kHHszP5yjO9r9OU2aeZjeKb
- TLSH
  T1CD126B3B42E1177C403603E7F164C6549A92ADA7A7C2B148316E247F6B9EDF0DE0365C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  heb/links_orig.html
- Size 9KB
- SHA256 deadfd83c68f04ee9ddee9d2494f5c51879e28560c72cca9e07af75936a258af
- MD5 c6ac596209eb1b05d6b609fe4a719864
- SHA1 4b8901824bb286fc022d61190889985cba6b695e
- SHA512 3a8b0325b20a73c7e8183b393c390e4f579738961bc99bb85e8adcd459d58b7d9a67a63061614fc9e44f57dc8a3fa5a01e54afb1519719c385ae114305161399
- SSDEEP 192:N8j8jgXE2kHHszP5yjO9r9OU2aeZjeKgBcdIQMUtYgUDiap3R1TBz+iU2LjGw+Dt:N8j8jgXE2kHHszP5yjO9r9OU2aeZjeK9
- TLSH
  T1D212057B46E117BC003347F7F174D7149A9268A36786B50871AE156FABAADE0CE03B4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  heb/manual/index.html
- Size 67KB
- SHA256 972436dd11aa7eb141acfe98ebc41610e850aaba7ba121c3a8d66a3104f09706
- MD5 a1549da72d63239261c2b3474cb0e695
- SHA1 30847cd93fec729fb01d7514ae8f93418015492c
- SHA512 ae7a396dfc788c320544a6d63a317220edf11a1196f673e9e77064defe5a7f4dc0b3b6bd065195f3935f11b0f62cf04a003a3b1705e39e28063d40e5f1ebd4bf
- SSDEEP 1536:dodUqCgKOLYlTnDztNsGUIvCRsGCtzPpsGCdzMAsGUBzBisGghzbysGgIz+PsGUI:dzfUbCbClU4gegxU2Ucg1gOCNK0FZigj
- TLSH
  T163636461C116250B80BBC0FAD0FF2B0060A4535EE793B662D73F7776B4DE86B365258A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  heb/register.html
- Size 4KB
- SHA256 8c649c5696157645f65563e9866f6474c9b99f417e0e99a53768f73f2d48befe
- MD5 f3c2d6ffb85e26aae1b087e408b4cf04
- SHA1 225978a00449763742327fd3c4c2572dfd246eec
- SHA512 3fb7e71e7447950d7830a81b60110248b3cfc1f4b3a32006cc1b6e5f7bbc1f4c21bb59aff39250fb4f45224aeafd8ad85660fd29146e2d0a5631daf559869724
- SSDEEP 96:MqwkT0gQqqtqDqmMea83+dhipHix2WAAI5ybcGoIPIr9IcSIcp6O9mXe1b/POkiX:M5kFQq2EPNaJdhiBigoJc5I6CmXh
- TLSH
  T16AA1422255C1B50FD1324434F3742EA4C9FA9055832ADA14B71F30AB2E8B7E59B7376C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  heb/sendguess.php
- Size 5KB
- SHA256 ecf8cbe3ba5f563a5ef149f17f7b4d32326e3f38a7184ae0093a89679d1cd069
- MD5 973f3d40641de96c96e36baf4eea70c6
- SHA1 051f6bdea5e208aca4a5dde7b00b8e8881a3ec6e
- SHA512 88c12786438cfd84eb973cf9c442c6028fc0de1718f4ce89c12c416bbe67b75a46601a7a5b08a22901ac5e6b737a07273a38271d66edb2a918d906be0ff911c4
- SSDEEP 96:M7wkqIgnXjAEiOyIxBd4gDS0VDguPUDcCxFYqxQWtiIObdiik:MskynXjaVOguPkcCxFYdnq
- TLSH
  T128B1C4433E839B1DD3F2442092762ED1CD89C03113799CB8B456149FAB99A14A6FEAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32