c4e761fd272aabe3472a6b3ff4d5c2ae96bea029000b04a4d3ff56d318a9dccf

Sharing

Copy URL Twitter E-mail

General

Target
business_email_review_portal_v2_security_clean_urls_admin_password.zip
Size 78KB
Sample260704-pgt1lae17s
SHA256 c4e761fd272aabe3472a6b3ff4d5c2ae96bea029000b04a4d3ff56d318a9dccf
MD5 e7e8946a27b40fcdbf8b271d6be6430f
SHA1 4f2edfda85892e230f9a73ac70174afe2dde29b4
SHA512 6108b577530066d818bded1ec399f8963aec8c514a04d375b8e7e42f28d319f30dfbfc156467ffa1779ada580d4e878d8864cbed608777e08754fa28163c9366
SSDEEP 1536:fJAog8R+C3LC/fxfD4cKggooj70awCb9AKicVDF7ZzMYGCBui:fuWRp3G/1DJyL70awMm9O7ZzMyBui
TLSH
T1EA73E0BAE64C697FD5EFB878E54A03D7A7CA12DA854137160A106209BD0F6D52F30B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  stage3/admin/index.php
- Size 7KB
- SHA256 7beed76590d48734508fcac8916ffcbe2fbf21b9df020a6f3b450fa21ec26b73
- MD5 086a45eed632268cd6cea311ac9f00d2
- SHA1 5e1c3f02f954ae16c0c6954f2bdda6a37d073828
- SHA512 4151b6ffbced8b2cbca72953ae203a80431c4cf90cf48cde7ce19629d4adc51a351f30eee1cbea7c62df082db598f760c5e989ea05a5d29ad753f99dbd59dc24
- SSDEEP 192:KzaiqiaGie/GrC3Shh4CRL82de8chIuL0fWVUl5/:PiaG9GrCChh4CRL82de8cGs0fWAh
- TLSH
  T144F1F852B0682B7044FF2CEB1467735C28B3A01A3D43080126EF91DDAFF8E95863DA95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  stage3/assets/bg-abstract-blue.svg
- Size 608B
- SHA256 42e493a8f4e15f4a3a6bd7e973f7e13543971abe38cfc639aefe295b7a476759
- MD5 52c0cdc1446a92a4b1378629041ca7ab
- SHA1 44a500007012be3b47e2306f5985b658d79d1683
- SHA512 2520ad2153b5bb3dafdfd0b8ee8fbb84c44e87137858f0b3b1f1861950782d816df47071ba7b6c3281603e31c58a26b9d423c0de1bde68ab3aaba74c907c3794
- TLSH
  T175F0ACB6C09CA92FE306C05DF6E6E0581327B0CBD291B3B88D85DF266051483F91A778
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  stage3/assets/bg-mist.svg
- Size 608B
- SHA256 0de03d2c501441169d83ab7712e81c3013d7b4145d63d25d0f4ec188cc3fb290
- MD5 beb3186ad1f3614c53db13676edac671
- SHA1 09588067817a8aa34b0102d2334767a587abf5bc
- SHA512 21143a2923fc625af69e0af7613281fcbf67f629ccd4bcb95fa01459634c3ac2c019e77660269d25be6f3b45e3db1a712d6790046c7ca62991947de4bc72c1e8
- TLSH
  T1A1F0ACB6C09CA82BD616C09DF6E6E0145327F0CAD395A3B88D85EF266051483F92A63C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  stage3/assets/bg-nature.svg
- Size 608B
- SHA256 1e8ffe843265d0d6325c1735d188e8e6d20f17fbfc4898def5d6c48c0621a6c4
- MD5 ea42a5596be4707c182cccbce6fc253f
- SHA1 5bed0fa7d6eccf8bef88715b36f620f18be26397
- SHA512 d9061b14bed14bb1ab83d539260d76da6915e707dad5fa05b8a57c265dd623bf7db78004e7a8dbaeb13dfd5f8484e4dd744ae343c9ffd4db20879dd0860d2121
- TLSH
  T1D7F0ACB6C4ACA81BD316C05DF6E6E0541327F0CFD791A3B89D85DE266051483E91E738
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  stage3/assets/bg-smoke.svg
- Size 608B
- SHA256 81b74aced0321956cf2e5fb43484000f8ecf858364807b3ec23aee9afae7fad5
- MD5 1c53ff8da67614529dcb46f8fc0692ae
- SHA1 7db7ed8baccf0a1ab16a621f74901f6ba9820b55
- SHA512 45f19045ab977ca42ecc579b87e87faab41a67ce095bf90f74e40a025a641acfdff64261a8d71f98833ebf3f2ef6af15b5f9f7b881fd5d722be3e9800e1959c1
- TLSH
  T128F0ACB6C19CA82B9206C15DF6E7E0181327B0CAD391A3B88D85DF266061483F91A738
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  stage3/assets/sample-bg-logo.svg
- Size 283B
- SHA256 4ecc344e40657ff9b72076b53578b02dee18ebf143729acd0b1675189cd6d461
- MD5 13cee28d9599204698c054c45a37e746
- SHA1 6d9e7eb6284fddf0a8cb6f750f6452c353c0b9a3
- SHA512 cea97e12ca5f5422b9630302a686ec2a223a3f12f9bb368f38ccaeacd35ceb2b66bd3d3350b8d19db20baaa1942f28f4dbadd33c41fe505409284e5a1e66f65f
- TLSH
  T127D02BA7704D94088E9C877606ED74FA721FB0C987C8027AFD55B526374A64738712FC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  stage3/assets/sample-main-logo.svg
- Size 467B
- SHA256 7649ec1756bd3d7004f396d652ba0a7b5877a8cde0d900f04813b22d5689d342
- MD5 9a08945909ba3c79f85a9777b9817b1a
- SHA1 b4a966c7405d000045d4e783b5787b9dca51543b
- SHA512 496b2ace41a000f988c9519934ea6f068d136bf03505374b3ff735953de0d12ca0560046f5c2453cdc3e60ab835099c544993b30d5aa6463acbbdb2a64b10a94
- TLSH
  T195F0DCA2B05CD825D7040B0A6B0FB1FB716EF1CC4E84882CB98C5026528A9B77499358
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  stage3/assets/sample-option-1.svg
- Size 257B
- SHA256 a6bbfbc10a9fe6745c3476e1bdbcab9af190e0eaa8eb3fce262a58f6720fa5fd
- MD5 7e43ef025c4d285e74162721fb413843
- SHA1 84275a2588ff63815134211b4526e960c7377883
- SHA512 369d91f3373c3e401d1450340c512ba75b282e7bb148fd12331824d6a9ac12d463277e98edbd49faab6bea7511ac589a9f07f918adc71d3544239ef830603e24
- TLSH
  T1B1D02B76C08C9614D2444F021205642563CED4CC89455D38F18111C7948485335EC35D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  stage3/assets/sample-option-2.svg
- Size 257B
- SHA256 c7c998c8bce05d3dc4b3739605db6cfa22e2e1623387bf26f94bdc4652960ed1
- MD5 a5018b6416f83cdd1f995c5067a2e7fe
- SHA1 346aa6bb1230b240368158ca1d95f0e807067f64
- SHA512 45d2681368fa45ed964f4b26e97e308f4cd9ebb04eb727f4c813adfbbf7adab9e51023ebbffa45b371d0ba90fb3478ec421328b0cc419a16611fdcb8bd32c44e
- TLSH
  T146D095F5C08C9618D1444F031305241977CDD4CDCE815C28F19055C7A4C5C5335EC35D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  stage3/assets/sample-option-3.svg
- Size 257B
- SHA256 d39457dd822bdd080f6663fbe33329a767c2eca6512d5046a80f522831ba081a
- MD5 d999562c182f6d11bbb416e7e2c1eef4
- SHA1 f282921f300ea858ff7205658ded97353d586d87
- SHA512 7344b2535127ca0e7005845ac002e571abe373d0d43d0fdcc5ec5cc82a6dbdb74631a92524015f0957d7fdfce4d245fb5171f979f89a0609845490d6e688f893
- TLSH
  T169D09575C08C9624C1444F122305201673CED4CC8E857D2CF18016C794C4C5339FC39D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral19 behavioral20
- Target
  stage3/includes/helpers.php
- Size 15KB
- SHA256 819312052c9a6e4eae6bab84e35e9ed712e9f298d1e8f69124d82b6ac3c201a4
- MD5 896fcf3e0205b44349fd6d273d8f332e
- SHA1 01f28ac022bac4ea52a88592ab3d5f04d201cd94
- SHA512 137c6039bdf002d8b626da78e7a2a48a3c84391a0b06cbb4cf8b0056dc7b733636c8f799fe058431bc5b1614ac77b47bf473339d04ebbe3cdb9fa0e12f450a82
- SSDEEP 384:BPZJRMLFrG9Oox3zNOslUHzNcbtjaK+Zs:BEFrGMo9zNp+TN8tjwZs
- TLSH
  T10672B5A538E324354163E43A1BAFE51477758907981CDA40FE6E03D83FE4A38E7B4AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  stage3/index.php
- Size 12KB
- SHA256 7e95e5660f76349c995fa944c3ff5c2476700bc6c25b373e56c8fffd18a464f4
- MD5 6e4de1fb472acd0e7f5957c6160375df
- SHA1 f5b3ecab912f2805d547b4344483fe3d36f6f38c
- SHA512 08590340926e19b16d873238b809c65d2b5856fd1731cb792f02b496811b10efd9d5fa98b436aba5b26bc043523d0878cb63d6c4cfcf78351a63f7f693116fd6
- SSDEEP 192:TX2SCYaBCMbICBkICMzCoQBJPT7fyiW3IveI/7h2IEe:ySYBZIHIrmPvk3mPIIEe
- TLSH
  T13552B9E594B2AA11A4E384F2F49AC30651A3C10F5D0B9513B6DEA3DE1FD4D90EB3F681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24