aa0857887a3be90f0781312fd97594b061e88d738c7e2b270abd5b7f39d9d572

Sharing

Copy URL Twitter E-mail

General

Target
UserData.zip
Size 954KB
Sample260704-wtwhhsfs5p
SHA256 aa0857887a3be90f0781312fd97594b061e88d738c7e2b270abd5b7f39d9d572
MD5 1b111f5bf5e47bfc25f0881922de0d62
SHA1 68d9b5bf89f572d3eb36d4d86e6f4ed74c74a993
SHA512 613ded149bbfad94a0123bb5763323c13a27b67fb5cbb74ee8908b2716c28051ad3c6f24e576b670384b63789e0136dcc1a9cac354f4fc2a72db42e6e7e03bbc
SSDEEP 12288:ZTsS8AdxZXqaxfWnmo2AEKomwMlBeCBMHXo2KUP0t4s59xxPqiOHeW:ZgS8OxZaAfTLAflMHKUP0WWvweW
TLSH
T19F25F16DFB2940C0D70F84FA304E594E6185890499EA3C277F592E79CD250963F3BFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UserData/Dashboard.php
- Size 18KB
- SHA256 d0b54070084e97dc55b4773e5baac4892cdcaa4991758b8bb7ae6dc706b716ed
- MD5 8b64be73dac8ddc04425de3155695fbd
- SHA1 72d3d00d34583190d689df126cb2c99106cd9baa
- SHA512 b9b11d68339f78b39737579d1e8c1988d26d5dc21bbd2463ce1215a3231b9881b123f11caf2ba831ae9b9fe1af661b814a66dca5b3b1b1f717474409ed75b44b
- SSDEEP 192:DZ7oehOq8dxioiyJ9hCd7GgkPS6/8XZv/vehyQgMut7UTM:9ch+ohCd7GgkPSAyN5WM
- TLSH
  T1058252A1B4F141731413D0D66AE69E4B7EA2D40BCA4F9A14B2EE07D40FD7CCADC9B948
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  UserData/T_history.php
- Size 9KB
- SHA256 fb271edf86273c4736ea583aa68c233b089820d574b24cebeaa74407a4351506
- MD5 3b3350ecc0ce74e21bdd0781abd54258
- SHA1 878563c4ac88cbe60c78a27ef4f804a373d55bf5
- SHA512 9c118da3434b1e04b9b18578afa9e8c82ceece4087bd7a68548c341f4ce32d04db32e328bdd16a7b867fee8a16e0931254d27a718e2f7de226655f7fde8d3437
- SSDEEP 96:+SmV8w55xpwrM9JrnMqofr8wF/aEzHyQak1cAM:SdLiCnZIrvFHyQl1cAM
- TLSH
  T13712826574F01177100394C9BAF56E5BBEC2C81FC50A892871AE07E95FE3D8ECC6B848
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  UserData/Transfer.php
- Size 9KB
- SHA256 891ec340070eb64bc12502f53d34dbe0d95d85d5fde0ce05e0018fa16250f91e
- MD5 c730206ca152f69d5c41804bc2fff0cd
- SHA1 143ae8606181f2e0ae3c37969a76f0ee5a9fd441
- SHA512 b082f86e30eaed4371defb4b03120be1e22773a0ddbf9a5031c9231c6b35cba5245ade84d6d08a9fd2c9886e51c7aa86e5edd8bdbe9ece6d05c90d7bc3f6e381
- SSDEEP 192:WvdLiNaJBngvLbiOfRrfgYtJljA0cAHQ5yQ1XPEAM:WckbM/i4NjA0B8yK/hM
- TLSH
  T1F122B51558F600572153D0967AF56A0ABE92C40BC78FEE1836EC02D4DFC2E9E9DB368C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  UserData/WireTransfer.php
- Size 22KB
- SHA256 b147558d39a40fd9b57a43d162cdafbd6b07e4eeba1bbe75781c2a34aaf79422
- MD5 b5f00cd369e56583cec9d155deea5cfd
- SHA1 85e4798aa0fce4919def7a4d71fbdc7ebae94b87
- SHA512 26b99a278aadbb14c91c783f4964ca9262b98747dfbcd9a7b3304346a4a88e1fb96fd524a729b1f0da775acce051c577f35ea02f315143c3a0f38360ee5a7e0d
- SSDEEP 192:aTinjTQeQQ5e1pfb04bQJ6w9MtFtLlMPNm1Pgk:3nn5e1pfo4V4k
- TLSH
  T11FB2554BA30C41628E7276359F16E409F724426BC281CA293CFD63E04FB99A5D5F1FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  UserData/assets/img/target.svg
- Size 1KB
- SHA256 314d00c944766e7abe772549e51245110f8d1562416d83f29ddab0cd6595c0ea
- MD5 fe0accbaf4b79ca930feb84ea80faa82
- SHA1 7449c7811aefc551e773573541660d05c366d893
- SHA512 1db924e1c3cef166886e00fc586f9f8a6bffd6b179f7ff748eacf2de5bbbe6dfaf3be6ea0f399014c3a4800df34dcaa4fdba205690b98577f6e7761cd32a676e
- TLSH
  T14A211205E38F123D06464788322C5119B31E20EFB655616D95FA8F71608B8C8C4858DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  UserData/assets/img/targetBtn.svg
- Size 1KB
- SHA256 62dffcacbe118619aef9ecc092e289370617648862c079e09dbf7fa0be1996af
- MD5 80ba4b13efb674706d0a638c316fd86b
- SHA1 26cca5224c36dee3b7547ceeeb167a86d4b3b1e5
- SHA512 f868db2f11ba65f44e0914fb6c1d7eef73f55b9c6fcb43adcc9485ea961adfc69a45bbc9135fd65c8100c8f1f9b56510114556b3ad4e119de1ace74e340d8733
- TLSH
  T14E21FE11970C81BE8D470348A638AB19271FD1EE39D182A480F60A33B13BCE9E86428D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  jquery-circle-progress-master/README.md
- Size 10KB
- SHA256 1f45c83cd1af87cddc526b27ad319245a966f3e9e8ff70045f5e58cba41a5b00
- MD5 4c359e2f35e5c40ffc27aad36e9cb510
- SHA1 3d91f00197c5c5273335ebd4f07cdab1b85ee96a
- SHA512 428fa5e2dfde3e0ee3e4797acfeebc8689f5d19650eb6cdaa7696736b4a10e7d21cc13247bac060d47f3d1a1e9684367586604715337023f2d71e176835cd6a8
- SSDEEP 192:gY54vBnXzDTDJjQ84dfKYuPQkRScGkoNmPp2K:adXzDuxdfK/Qkfx2K
- TLSH
  T1EA32D9FA79801FE52D7785F2A19A31A5B3231189B74F94DC68BCC0586324B77462F3E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  jquery-circle-progress-master/dist/circle-progress.js
- Size 15KB
- SHA256 3e6e949591faad693c28eed80090b54c666ddb12dbb20af284acedb9f3b70834
- MD5 3fb461c1b082f494c9e0eaaafcf8bd72
- SHA1 55ff6230e8ec9d8c5b38657707d2f0bf5605ba0f
- SHA512 f2d1e1bcd204c098b0eb0403095a1bee10abc1f1022a49e6b5901d3fc25da99710e8e1007f569a12b240cd300be6d418adcac93a1a92d8fde5680bb0938f9ee6
- SSDEEP 384:REuDKgwblE9ka3S5zl8l69pfJY3s7mmom9v:HKRy9I7zfW3ommom9v
- TLSH
  T13A62515A5EF705A39417D839479F2181EB62520F6A1AAD9C3C6C52B80F58B3103BEBF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  jquery-circle-progress-master/dist/circle-progress.min.js
- Size 4KB
- SHA256 d97a637cb2f9b5160b6b7000334833e9a018d33c6f1e8803cd359e9b19133c38
- MD5 c96bb8beaa6eb6a1a13771fadf8169e9
- SHA1 3efe06109f362caf1e6bce5cd8b7b935c18a0ad4
- SHA512 ea4be167fdfd81154b9a833fe89c5b6c95536332ff8276c356c1c008bc7fdf5211114e25dec23bc9e3b4778830f315393299a6ff5ecb31a0c73827fe4efb82d9
- SSDEEP 48:U5EwgSswmWlBttGHw0p1mtw1MNIqAlfgnkdBpBk5VGbTmZfFzmfBQPoMG4DeEdPP:9ml3cmkq2okbnieKmHQiR+
- TLSH
  T1B891C99B72525C12666769B1403F1206633328AC6D1BC1BC793475EE5DB4F0B21BBA7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  jquery-circle-progress-master/docs/examples.js
- Size 2KB
- SHA256 f2f5db317ba25016ae7bb41955d65a0b0f1638ce75afdec0c86731bb9bb7e04d
- MD5 8cce70839a8519101a3ef4396560fa09
- SHA1 47145016a4f37e1c51fb5ec2cfa49335fbfa94c4
- SHA512 81188d553ca9b3ca6acf7f98eb5ecb2a9d541220ba8bc5ed3be8ebce34fba480100fc2e3996a1814316c28772cdac4b992c932b82e046c1cd3aa328779fda95f
- TLSH
  T1CF517526F4E085E335375172929F4060F333A14AA78DF7646CEE23849F51B7B66B12E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  jquery-circle-progress-master/docs/index.html
- Size 2KB
- SHA256 9567e12b71110fa37899e0ee86fe3ff5b072d99fe9e6446275a717fc99196216
- MD5 72ca9a21f7ae87c2d5176c758bf91840
- SHA1 83733687c5783740293ef89697998ac4877e2559
- SHA512 dde3a8ca4ccef1fe29dd34a9645ef779e69d091875e918afef0c6014ad5cb6e42cc6103c1c4aded3b43c5ffadf42d529686fd7567c491d6223996eb2569c5224
- TLSH
  T1CB4133A191F045B60C39E8C2D5A83B1A7DE3F047E38B058878FDC6808F65FA2C9535A8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  jquery-circle-progress-master/karma-saucelabs.conf.js
- Size 1KB
- SHA256 9ce75291148fb52efd84a0f7e186a3a6bdaefe2585a7e3095fa1b4ca48fdb379
- MD5 72ce08b2c07d357018d50370d331079c
- SHA1 23452b055b2968f78209aaf2c1cf49ad81b1cd59
- SHA512 bebdb7c0f5c29218a455519ee5a73e66541aeb11623c39030a71f24c77f75406a4c50b5c814c0a34d5080fceb84b1e0b29a9885f2f747539a71b37bfc8a1aa8e
- TLSH
  T108319BF8CB7B4C9365B16607512F112233B080238C1B7C3EBC8E03A85FAE55D42AAB64
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  jquery-circle-progress-master/karma.conf.js
- Size 414B
- SHA256 02229150c750f768b14f363d5d910619e9133ab2f54a3cbf1af204500754d54a
- MD5 0173ff0b5e3766c19d18b221b81ad312
- SHA1 dc6cf3183cf5277d1a36b4ee8f106a4fe8d1765e
- SHA512 673303cb3977bb8f857010422902bc8923fb9cb899bad24e4b704aac436ea8fc7beadca1a78c2d3b4e955561695a24d7a2a4792dd546e48e06454d986a07e920
- TLSH
  T1EDE0F11E04BF1D7309112017E70D50136DE1D463D6086819B60F033C6F1F22CC35A75C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  jquery-circle-progress-master/tests/index.html
- Size 528B
- SHA256 15044e3ce343d7fedb8dd484a711d37c8b6c9b2c07ce5e3be32d63085d4ebd66
- MD5 0ef21c45b6cac56efab1aca9a5234f92
- SHA1 c221ce60ecf7ab901d8f67fe4b760d63b156216c
- SHA512 559459302b86c752bee55320d4ff3c1d015f488184b167e982a4c93ae985952361d7c7c456f817a2304478634c930987cd70927568d38750f7cdc1ef4a451708
- TLSH
  T1A8F0248EDCA2C5C799242C42BCA2F20D21EAF50DA2998CAC00FD8871C9443EC8C47E48
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  jquery-circle-progress-master/tests/test_utils.js
- Size 2KB
- SHA256 3c4d37d62ad29948bf69c0f3906617d2e665421acfd67d7c5e7fdb2dff694c3d
- MD5 2734318e4aa7754b66eb8fe5475d0fce
- SHA1 955cbda7d535c63b226a2fd1b637d4827b42f86d
- SHA512 551af830e8d5a9cc98c8a00902185ca14d4e453a4a74e521b7023cb0598054df1357a3806e354a1ca6fbc6c8c6e096117583352a8e1972631f8b2c562bcea090
- TLSH
  T1B551F21C68A6B0188133B0D9693FD416A625F977984DDCA2788C01303FDD4BAF5B6E34
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  jquery-circle-progress-master/tests/tests.js
- Size 9KB
- SHA256 beaca1fd8776bc52fa182a0079280e11be2f7084d543b194f73a016f8a101c71
- MD5 bad85722168860a65f95e9eb1cae36b0
- SHA1 3bc41b01a850c78648b0ee731e1e208153212ae3
- SHA512 197827bc1c360bc1bc968095164b59853df3ecedfd005af5f9d30cd2c21f809ad2ff0295a2cec730520d50f6389a6608803c42f828de5f24e491640d999c5370
- SSDEEP 96:XdNwPkK4EedGZWrSXtWo1URWL65lMBJOOhzGKrScxpxw:tG8ysSX/1Ua6vMfbGKrZxXw
- TLSH
  T1FA12AD1A989339601863B27E473F1C16B592BE1F7229DF9D38BD43046F1D763A352271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32