8ba5f2c15c303214de4f8606ce47a29e082042ead3d4c6b44b47ab9b2c676a59

Sharing

Copy URL Twitter E-mail

General

Target
server-data.rar
Size 300.6MB
Sample260705-3mmelags9w
SHA256 8ba5f2c15c303214de4f8606ce47a29e082042ead3d4c6b44b47ab9b2c676a59
MD5 7b1206db22efa18251735d3281ca7347
SHA1 1332387e03a4f870c938d6b17bca1c9d668bf41f
SHA512 a351dbfedbcd74bf745bced537aa88b116d10c6e22b387e6ec381f9404786b18c240861e05687b890e51aa0a16732c655a63fec165258a0945e659460656b9d7
SSDEEP 6291456:G28xlcbHcpkPWp10738UeoZkB63QAldDpXCEBA5iB0kGZQF:uCSk+kMo/3VBBIiBlGZs
TLSH
T167E8334A77E2643BCF77283060DFC3A8935FE9988EE0F31CC7A8651354A654835E59AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-rsa/index.js
- Size 1KB
- SHA256 da9e4007152e7948ad238bac946325a5a9dedbc7d741bff3c2efd79c98884779
- MD5 f901922e287bbe3c02db6ba6976c0d2c
- SHA1 d35bbe67f915ec5ae3ca34e2150968d4c3d654d6
- SHA512 344b800e3a79a7e3e5adb745a63dcd162abd4b61248a70bbf055b4cd5ab19d72f2f3dbbd8df22ece5792f7fb26758421625e49c753126729e2aac6bf72a8419b
- TLSH
  T16E115BE40FF9A898F32A40B0F0EE8528B0F6B411252CDB5AD531F8C5A91589C13DEDCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-rsa/node_modules/bn.js/README.md
- Size 7KB
- SHA256 b710c53f83df06aba78563ae0d3af19e2e94f9ba50e3fc1de775a6c0c38de923
- MD5 5107feecf4cdd2bb536b0a7229a2e531
- SHA1 0fb95857c564de5f5c5ce8c9c9b35bce1dbfbfaf
- SHA512 6087b85ca8f0b473175ec23f2d176c3293b58c09b1a67a3e9a66fcdcc581a88fc88496291c144e011886333348d953cfbef1fed78092ee23c947e11c90cf7e47
- SSDEEP 96:XR81bGFSAvZm9aoeEDUd5Vyzrbg7LF64Cc0DGSCBcpHWvsLD78MBsePutRQH7WTD:X9EAkaEDVP0LFKGSDF33WXQH7OD
- TLSH
  T1F6F1966D328532677F0B0592813B71B8EB2091959B96A598D04FD0DC36439FDD2F728A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-rsa/node_modules/bn.js/lib/bn.js
- Size 87KB
- SHA256 1e2f270f939e24795b6ee23df03f4c0e711b6838e58d9b9aea1658a2206901fc
- MD5 0cb92fdc0422c86437f6fa2a665aaa48
- SHA1 736ab730d3cd4a900fb5bceff0fc2c66f3a61f13
- SHA512 e3dc05f22b8ef3d61d0c534ef7ab3785b428581100bcfe7b0ee52eee6ca819eda53433ed4af274e3a9e2716de4ef438f1ea0855e66a3d7a297959587b4918c64
- SSDEEP 768:oiEKH37WIWDVUGZsL5hh/4ftoL+3iPrztvYNjACc+upvpb4l4nC09IyqqDn:oiEFXrsL5b/rjCTupvea99Iy7n
- TLSH
  T1E1938944ABB720599A4B757C4FAF60886A74F41B5847DD08BD8CE3A06F5102482FDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-sign/algos.js
- Size 54B
- SHA256 d71764fdbd7aae0d61988af6d3702ae0a342f564d3be01a9f4c2b38b2d0d9ae7
- MD5 aa34073ad3f498390a6c3a68ce6df871
- SHA1 e0cc7bdf3f93646d782f48ae3a9c38049f46217d
- SHA512 3a2e0d8ee6d11914c580af87fd947059734048ae267258f0594352078a21d0441aab861a2a1fd97a63d09594975f44a8cb7754fb3c17ee463896fe5a7113a7be
- TLSH
  T136900282199871C525C87159DA98454274C2D54201A4551995054ED50440C418907DED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-zlib/karma.conf.js
- Size 295B
- SHA256 32d4949e5190fece45ad3d484b6c9857aa3b1d699f34da7760b81238b8a90d3d
- MD5 9aebcfaa77ba7f91584b95ac4a566a06
- SHA1 e90caa9ee0cf33b24667613262bd9527475929da
- SHA512 85abc16b0ce9eb18eeb336d42d3afd208f36eda2ea33ef03f584483218a10c03d0a429618758d5749f7d513f9874bed60b56b2c166d62b99751f615fb852f663
- TLSH
  T17DE0C239BC990A030D42B7ABD75B01523EC0500B980476223AD7A6B13F6A6EC2729A9C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-zlib/lib/binding.js
- Size 10KB
- SHA256 e8b078206d7645916f27c4c4eca6dc385eccff368e49ef2d9374225d37f7e6bc
- MD5 b8d809b8f11197b1ef3e050d58dd433a
- SHA1 dd48492ed04e75c3c681cd196d1abdc76d8c8186
- SHA512 329171629a771a5d1683116993a2750147cebe68972c1623b068766b0e1ff967e2b82ca238dcddd74f16a03cfa5292f09cd481e94ee5c78230a5b4d1ffdcad36
- SSDEEP 192:1cDrAyIVKa8E1SWUQH/pv+q2iarplQvAZEQmXH9oxAULZqhkQ:ODrAXVr1tAP/pmWG9oxAwZqf
- TLSH
  T11732005F62FE0592932935758F5BE0961A318807441F8BA83DACD3E82FE41781E35DF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-zlib/lib/index.js
- Size 16KB
- SHA256 8e31cb517da61bd455e1b3e45f2dbb83a5bf70f0ccc4e0e4a983d14bb2820ad2
- MD5 a9f2eb00ea78f0c8061967d887c2e280
- SHA1 96f0e56c52918e8963f018576e2f1c84a61c8f6e
- SHA512 71ccab821e8f7befd54b15d5e283272bb98f39ea6d9d240040b68ed338f6753baf0f32caea668ed99a9ad201c8fe7100b34bc795b68a6a6bc03d6d288e6700a6
- SSDEEP 384:WemLgF9bqp2Z1iiQUyuaSKBix6DKVDRvnAXcGpotUVjGe2TuVLZwda:WemLgF9syp+cGa6VjGeDd
- TLSH
  T11C72759C2AF7766066B379524B5FA40F36B5C023041ED260741CE7E81FE00B8AB68FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-zlib/src/binding.js
- Size 10KB
- SHA256 dd3fe9de9f5d4573249429996226c6b2760c15c72666b31c09e1bcc615841a74
- MD5 a435bcb4b131cd32e89f6423287a5294
- SHA1 38a39ec60a4ab1925a5ad971a5d4657aeefe4f41
- SHA512 7e791d3975b615d126c7757981bf9cd610fffe3cd6adcdaeb487d8853a1f8175f732a0b5f7477c65a61be9648abd546ca62e74a16fed10077e25a75f76bb509b
- SSDEEP 192:0P1wkCvfkG5wo1SWseojTuQC+vWWCUq2vaLplQVTZSuGYcrBv4BdQPK4:iekCHk01rseojtWiPYpm/yrBv4BdQ5
- TLSH
  T176322F6B22FD0992931535758F5FD0961A30880B491B0BA87DACD3F82FA51381F39EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/browserify-zlib/src/index.js
- Size 17KB
- SHA256 e9640502f3dd0de07af4548f22b077c3c80759254ec16a45ec93bfc436082406
- MD5 b0ed587acbf9e86c4034096ce93c9ffd
- SHA1 32de02cb3b58e575368bdcabb37d8aa9062a86cb
- SHA512 8769f88f2c06d07ccb97f9002209055c0f2f6c2e406159b2221f10f4091319a9675a3ad7d2b931679b3cf8cda2b64f23183e14db97a99b3b7e79c6a1eff5a3e7
- SSDEEP 384:k2mLgZ0n5q/2ZjkGucUqMWcTkjsDKVDRvnAqGp6x+VhGeSMPhbZguC:k2mLg2nw+pVGI0VhG4E
- TLSH
  T14D72869C2AF7776067B379524B5FA50F26B5C013081ED1A0701CA7E92FE04B8AB68FD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-from/index.js
- Size 1KB
- SHA256 789fbb44a10307bd2c0c958ca4bc58063211f0e5dae8dd94ff4a65a86ae70c9a
- MD5 d1c41c4b44a03c3df12a9adcc9f204cd
- SHA1 9c0aa888610acc1e4bb9ccf388d53d42a9590eb9
- SHA512 5db0c44b6f2bc44cefa9c6ba90d1913a8465d293907439d31d9743afaf0874edf2e60a12a3a7bf43d387ad1424402244ca917a9c7354c83fbb1e2f804cfbd55f
- TLSH
  T1BA31BF40BEE190124383723010DF9D0F73F4B479452DAEE0649906205FB5DA49EB69FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-xor/README.md
- Size 1014B
- SHA256 5ac090d1d4c7f56967119d676f078cdad897347a6bc3b2032a92e709d2eb99e3
- MD5 54293fda6f9f680c84e59154f9f81992
- SHA1 e7a9baa50748406e0db0c0db027eb1e8a8316405
- SHA512 5a21b569c2810c25584b9993a69ccc1eb0518330fdc2ebcd345cebb987b69a684a1d904c6ff65539cb3d3c09705813c0fba2c98810e40d13891a275590a7725e
- TLSH
  T1F811E159DF6987760B4775ABC2FACD5FE0EBE5E162C2C80944AF2D3182422C1E2390E4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-xor/index.js
- Size 206B
- SHA256 7fbcb6d7c0577245f3fd84dc41c8ad97a48fe09382919970dcef8cbe6058948f
- MD5 ef007572560bdaa8cb1fa0f839298990
- SHA1 61a52420a18efbc82dba687ba942f0176ca14f8a
- SHA512 b4f7e0eda7feeed4f152f04de2519a305f4baeb2f265c8abc626fb1b48c86cc7da6f1cd36b8532e725cdfe2cb282c5bc305ec0274a4d763f80773a5f251abe1b
- TLSH
  T1A2D022A1AFE052AC1183B012D1DE2C0E78B09412A40CBE12413DE8A00430F20C9AEDCA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-xor/inline.js
- Size 38B
- SHA256 bea50afa3a1d59ba7f82c923ce9f0be0bc5e0b5284fdc960c282d19cef3c483a
- MD5 4a480dd5ff258031bf8aa2caea9b2282
- SHA1 80b38b853f4e9e7d67b7d047bb3f5e7798c263c8
- SHA512 9419b24ace5921b5f787f2e8ccb972920c0d59cc65700678cf14251a5977a60a195607d9c3c9fd9d95203a0c6ae7691fa0dd981dfe740eb75e046195268a7ab8
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-xor/inplace.js
- Size 186B
- SHA256 150010919f09c03465bb526b1dcf2ee06b1b449c09eb577b085368297fa857ee
- MD5 74b5375d89253e1aeed40fdf5d012e3d
- SHA1 2f129f6381cae3b1cd000c49bdf5411ca73a2a41
- SHA512 852f33d67e5003bb663f75e0563cafec92d8e062a7d004813b5b914f97c1f74812d8f8bf3b5ae87c01d99450d0eab801cfd1fc80de46bdddbc2afb6ff968e6a2
- TLSH
  T111C01252A7D0518C5193701495AA5415BCB4A456195CBD15A12C95805670F2086AEDD9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/buffer-xor/test/index.js
- Size 1KB
- SHA256 1cf764d76eb44d8c41e29eaa90d5a9fb3562bf71f46bbc2849bdfe50c1a07b70
- MD5 89cd7189106932b365d60d78c38ba073
- SHA1 4b06b4997acddb5ed49640dc849527a0ad8b79ea
- SHA512 b8b646ecd7f84549cc32a276812db97bc2d99f17cdde96ed814193d61f2b0bdab8e3c0a2170bab8bf5252dba64b19b42d751f8a43585b77bfb21e176fbf48113
- TLSH
  T1A511660CA5E46241350BB0AAC63E5C08707647530448C5C2FE6FAE432FD86ACC923AFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  server-data/resources/[cfx-default]/webpack/node_modules/chokidar/node_modules/to-regex-range/index.js
- Size 6KB
- SHA256 e32199271f92372a2deb70a3a57f7c0f7f558d04152a905eb97104867870c404
- MD5 4a8c07ceb1974121b3e401d0274e1527
- SHA1 b522adef7fd77cfdda9929f8773fc7d635439dcb
- SHA512 24c62be5e3ab862a4ffcf4408cdcd0af9bb369f1ea56c9d37e4f8129068097e98b8c540e7535fced73e958267e82ba398f3692fdfdb2b9e866151717a991c5b2
- SSDEEP 192:Y5cGr9yT1RCNOQhHkVIuNWp7ZNvAHWAI2Vaxb3D2ezVN7CxStj:Y2GpyGqNc3/rj
- TLSH
  T146D1768C6AE330160907F06662ABD459F56496075C7CDAEABACE03903FD1834D6F9FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32