602780eefe58c0996ea5bd8efb6d8ec2071926b1bfc6213883f126acb33147c4

Sharing

Copy URL Twitter E-mail

General

Target
home.zip
Size 755KB
Sample260705-al6gvsfv2t
SHA256 602780eefe58c0996ea5bd8efb6d8ec2071926b1bfc6213883f126acb33147c4
MD5 1ba9d08a8acbff8c027c7013cf05722b
SHA1 abd5d820001b829379bebfc8ea57b39b3c6612c7
SHA512 4fa4a57e968971e028cb6e0f24c44b37dd43ffcdee202a93b3b9fe55ffc439501ffdeba6d7bc9d6d1ecffe2da18cd9b1c08dda5e461a19fc095994f42bc29d48
SSDEEP 12288:2xnT7yicC/ThhPc266w4UcFMABqaAWNu3BvQt8gjdNF6pyKb4rYwEd6h1pwxKkr:onT7ymhl6jmZqaNeBvQt8gjdNFrKZtcK
TLSH
T13EF42322AF379B93D02A20B4B03F94946D458252369B777FC8B29BDFBEC53D91811139
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  home/assets/fonts/fontawesome/fonts/fontawesome-webfont.svg
- Size 433KB
- SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
- MD5 912ec66d7572ff821749319396470bde
- SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
- SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156
- SSDEEP 3072:PLac0AVfCwGzG8LY4kh53s0eOnz8WjKAOvX7LYvglcD4ZME8xYWDQqJpFDBl4qjm:hCG7bFv9gSS
- TLSH
  T17594C96CE9910B79CBDD42D5957D0E90132D81EE28783E1846BEA8F05D06B2A0FDFBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  home/assets/js/main.js
- Size 12KB
- SHA256 4af026bd9eb7b6b5f93d31ed6c6032a91ff1f10647f40b2e066be817cedcb699
- MD5 edb4e293a72ec73d318034aa844d495a
- SHA1 cc8c58ec6593b767a0ffffb4c15210c90439d4dc
- SHA512 e5fbb63dae5d39427f08608de6c6284f5061c4b1678bec4d1e3357cfc0e4294d6e758eae3cd0b346a526a1b97a5ec5d8d1aa98c0e207e17afe3a555184660be0
- SSDEEP 384:tsLwCwVeLpihw7qg4owwSmEw7eSPNT7yNiN0wS:RAVi4e
- TLSH
  T168428897EB6C24BB8255A85D4CBCF2C79A2C44338C250CFBF866945DA04CC3552BBBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  home/assets/vendors/YTPlayer/jquery.mb.YTPlayer.min.js
- Size 57KB
- SHA256 4d4a78f520346e032b25fd6d7382a248bd463152ba2a85c20cb22c5bac63e602
- MD5 40e62623ca0004f04f63f22bd0aa7173
- SHA1 0f1a8f795b4c59605ddfd5b5e58a61d019eedc98
- SHA512 4a85f6937d60ed9851c5352337247ab5431461ce98f2b188917f445f670586ea3dd1168ad46125a7d7fd0c03176b4c6d7e770dab09c27cf352353542f2f9a435
- SSDEEP 768:V5T/hwLGfFr/3esYMJmVAaAaz0RQ9c9PgnG5ec:3mKfF73eJVXXSNV4G5Z
- TLSH
  T1AA43B50AD55DF0AE097212E4F076432D72394B22E2E7C269F047F55CE50A66F613FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  home/assets/vendors/flat-surface-shader/fss.min.js
- Size 19KB
- SHA256 7f1e6076433f3cb10ebae7a8686e80eeabf2ebcdbe9c5ccc274d86ae146289fa
- MD5 61be50b6c98f1196d78f0e0c6fe4ea85
- SHA1 a1d5952cf630efe1e801188725457436e55c1af6
- SHA512 9cce6c9f921e542592c9e808636d93d527754f72356af7daaf9856079352f08df15b136bf89d2beae2f18352648bcb63b1c5a490b1a2ca963f11fdfdbb1f9068
- SSDEEP 384:vO2dQ3KFrFv9GzfMTNsk41ml9t9s+BKBS/QhbnlZ4l76DjnkvhRa:1jkVMl9t9siJ/fVa
- TLSH
  T1939297E8B1D178294703B093A02B468DB23958697C0E845DB1ACC4EB7DF9E48713BFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  home/assets/vendors/jquery.countdown/jquery.countdown.min.js
- Size 4KB
- SHA256 04e23e5924169b1465bd00f55a21ed8ca3abd7e3b94f3df883d6ff70b09c2c4b
- MD5 28892378e7a1868f4f4d964fac71c0ee
- SHA1 ee6d2663f0fc6cf687c9ca14d9c74faf4748f171
- SHA512 95793c93ff71b725a80e41d11384a05265689a1acf63059791834747cdadcaf5ca626b4a18c5b19db174ec6b81a336d6c56058cbd81cb9fc6db21c4c55e82bc2
- SSDEEP 96:jbeRFMSiM3jG6Ghdynv/2bBqz2eJxMxHxqxAxixw3xexIxrxAxW7qD2Ycw9NYQ:HUpxGhdBqztJxMxHxqxAxixw3xexIxrk
- TLSH
  T12391B8CEB3B317D905D452A6009E1216517BE25BE0D6402CF5FCAEC8B9B5D9D302F978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  home/assets/vendors/jquery/jquery.min.js
- Size 84KB
- SHA256 e045199b903617c19709d76cadabf5828b940103ed6eed973f08a7f74df377a6
- MD5 d69e1146ae710abbe6090f6e8b610e07
- SHA1 135cc00556df6b29574afe1cb87c7ba0ede6196b
- SHA512 6ad1bfece63a1724f35d09b33b9392cb04f2d68043700e3a9d339dd313b2314acba314b582acca39b2174de14a77607dd31ba8ef7739914c382c8352f841bc74
- SSDEEP 1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
- TLSH
  T14F83E6D9B2C67062977730B950BF410BB17A98DAB44C8C60F158D9D47EB8A8D907BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  home/assets/vendors/particles.js/particles.js
- Size 42KB
- SHA256 24d60d1165133564992e50a7dba5782ea45676a89d22886d881eaf87a74e48bd
- MD5 d4f8eb4dbaad4a2505069e846cc0deeb
- SHA1 f38b62863b8325b6bcc90b15af85bf5f8c61beb4
- SHA512 e252cbe32c18849315e14c38038eee0d37b0b54eefcbd7289da449b1a8cb4b1c5927158bcb61ccf35e093a6470ae50f0bc8c63cd65f0bdd1594ac34523e16b4f
- SSDEEP 384:TxzjtwGGs5YQWS+ngXFlkjXEFOcQmxm3DO3p3z8CIopbubAi4OUlLqozr+XDhYnT:9t+BDcpz88pbuM+Uo0r+XUd1YTebBCQL
- TLSH
  T1E8131E8D5BFB18632697B1B84FDF8001E73080DB1A8B95A5FC6C0258CF98655D29EFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  home/assets/vendors/quietflow/quietflow.min.js
- Size 6KB
- SHA256 5ffe810e33f20a535197e4ce290707772074ba50a17999dbbc0e7305837d5136
- MD5 0b8cb42c2457e3ebf080618fdee12a18
- SHA1 f51d827bce93a410b52ae4fd04f72c1101a6d158
- SHA512 6f7811ddd19736bbd3ecb131af267783ca3ec80fbe57f0f93cd21ff06d677b5060bb8baeae0d35917264bce964d3d5d3eb149edd20b3dae640c98702f8f1cd47
- SSDEEP 96:fu7cG2WFkAZCehjMyjmAjU6fhhNT/soWeWsmikRrrYXmoRsGCokh4vd4qQjza:27cG2WpPzTTcVsmvrVoRs6I4H+a
- TLSH
  T1AAD14418F388097D18D243FD1EDD73C62055707A5D03DCA0A297E075ACBAAAD792ED8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  home/assets/vendors/swiper/swiper.jquery.js
- Size 203KB
- SHA256 4a3d6952c74e73c507b70edd89750566352035b3ed041865b1848249ed8b22d1
- MD5 b61682e9bd518ef836295715c549fd98
- SHA1 79e5cc4367405926a60a54cea9c3cba37efa6ffd
- SHA512 4b08ccb3c6c80406363087f5f5e72e3f3e3043d03687eae9eb4974326c79f6a1c02bbcac4b172a4b19b0f5f0a8c4207efea20fe1773d396be1aaed2ef241ef75
- SSDEEP 1536:9yiTJC+mKENi4q3c8tjosiIyf4J6d1BYSjsCvGcrSah8B76gAg+0dY:bdCXYFJ6d1BYSjszcrW4g/7Y
- TLSH
  T1A314100E54B321A695E3313F5B9E904526B7C003A519DE547CDC4A09AFE8B380BF9BF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  home/assets/vendors/vegas/vegas.min.js
- Size 9KB
- SHA256 067045eb318eae352748a71bdf886811a79f97b21b036ad82eb98aa673e61f4b
- MD5 7755bd0029216b4c51146ccbe8978e7c
- SHA1 5752b2c5c89f226b6e489832e18086a3730ce49b
- SHA512 346b53be9c17fe4992927e6f28a667db19e849835be85c669f105fbaff016acd984616ab692ba67495c21fec50366dd2497df0734539163dafa7f2104264ac6e
- SSDEEP 192:VGsTXXwzaX5BXK3gletr+YMC9wqBxFIGxKL8xsktddyKq5:Vq3uyaYJwcxFDxK0sktdsKs
- TLSH
  T1BB128686F291A54901DF51B2817EF20A5B72A1447D23E12C7DF9DACBDC24ECC6123AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  home/assets/vendors/waterpipe/waterpipe.js
- Size 19KB
- SHA256 8cd51dde55f3aba1bfbfd09d346cdf58ce6198e2d01d43c22f63829a2634aac4
- MD5 b180df6205cdf39a15b60f607b89f428
- SHA1 7aa6400cadfbbd218aeeed42fa2542f86ea3b7c7
- SHA512 9b8db0c02b3ffeacd3ec988c67fece4a765d9d16f32e0917b86b0c587376681610649e0f21d16172e27abe08502cbfa7ce2ba449c105a3498aa5960d0485a892
- SSDEEP 384:HSMXvDLOX+nDKDGUSL3OfBzjg6j2Lwg6aQpxFOfwLbWzSUB:yineZSDKeQpxFOSzq
- TLSH
  T13E92631A9BE71566E41620BAAF5F1288A233841B1906EE2D7C5CD3C58F054701EFEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  home/index-bouncing-ball.html
- Size 5KB
- SHA256 09561fdd82898ebf3a9156e079fd5ccf2885f4b0d7e9660207b18bd2ab81a76b
- MD5 c8dac2b4e1f8af0eb55f52527f8c8214
- SHA1 f37e9d1dafaee6eaacb6addda356bcc4e1102a78
- SHA512 de209740f2611502119fa02ebb8aeb60d113f539cf545e758c20f332c5a46ef1e8740a5759811a1959b9c00e79d1b5677feb0050a6800ec80cd216fc967d8630
- SSDEEP 96:ZuenAhGFxVaztBZzaDBZzTG4BZzNBKOdHrwqfoYE1c+1D2O4tOTU+:XnAhMVAKDzdUOdHrwqQPW+T4tOTU+
- TLSH
  T1C0B1831A4C4E6E7745060DC9B130F328A4EF5E35D22DCCAAF1F7492E7ED1E889C0A921
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  home/index-fss.html
- Size 5KB
- SHA256 955d75bb20ab3105c5087623f3670e149994c53e4e3c1f80687129fc7568ac1a
- MD5 d59b34b41ea1df6b89a2aeba412faa35
- SHA1 e91ddcbeb36dd10dddeb7b0f0447249666dad60a
- SHA512 1efca1f96c2adb66acaa09b08ef0d23ae3d63a5ed3b74b6ca4b632cbdebe5c3d2bea5f8836bc9aa1e30452e30a7a0a0b9d672c7a4a80610e726fb477c71edf13
- SSDEEP 96:ouenAhGFtTVaztBZzaDBZzTG4BZzNBKOdHrwqfoYND1lD1D2O4tOhU+:CnAhUVAKDzdUOdHrwqQGD/DT4tOhU+
- TLSH
  T16DB1811A4C4E6E3745160CC8E170F368A4EF4E35D228DCAAF1F7492E7AD1E889C1A961
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  home/index-particles.html
- Size 5KB
- SHA256 513762242e2fffce594d15d78fa82c7967b7c668eb76a50eaefd6d13414edfff
- MD5 c0df1e91a8e9abbc833f49b3f7111f32
- SHA1 aede628e9c2476a463e73a1e407f1084b82f6117
- SHA512 fab6daadeef046a6d36e8f1b8d99cbb232fbbaac3772fd16efca01f58f49cf609b568a627b7239137d3c4e6be10cbc7ccd23408c78b3e9c5b5921ec65ec12d2b
- SSDEEP 96:NuenAhGFUVaztBZzaDBZzTG4BZzNBKOdHrwqfoYcO1c1DWF4tOhU+:bnAhZVAKDzdUOdHrwqQQCwF4tOhU+
- TLSH
  T1AEB1941A4C4E6E3745060CC8F170F768A4EF5E35D229C8EAF1F7492E7AD1E889C0A921
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  home/index-slider.html
- Size 5KB
- SHA256 3c4f27d6720b0d8b48ed028cb119167372107e539f1b0dcdab7a2adbc5b9e88b
- MD5 0b4137dc704ffbf555aa744609f868ac
- SHA1 6acac4d23036b06052d57b209e5f91fc5291cd08
- SHA512 4db4a4e53d1a8e1e25736df1d0fcbf2d4748c0fa9dc0142eb12dba136da7b8e40b744593b67ca6c005ea911d1c6b16bc84b110f57334e694d6725cb2c7c30bc5
- SSDEEP 96:UuenAhGFdVaztBZzaDBZzTG4BZzNBKOdHrwqfoYi11c1Du4tOfU+:+nAhGVAKDzdUOdHrwqQhCU4tOfU+
- TLSH
  T1BBB1631A4C4E6E3745160CC9B130F358A4EF5E35D21DCCEAF1F7492EBAD1E889D0A961
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  home/index-smoky.html
- Size 5KB
- SHA256 b5a10c20af816a0c5b9bbf1af7d5ca6b54915ff68f07075c6d179b8aa709ed72
- MD5 07bb6491d50e9c8a49b4ff001024f37d
- SHA1 f6499159eb0458270301d1962392deb6d4ea76eb
- SHA512 7fb9c8b77e1335355c8f232bc16f02189b002d4720d86459b9703787b6fd6a8979ddb4e621be32f85f7a390b9c676fd1e73810ce8c744b848b7e4e931350f825
- SSDEEP 96:guenAhGFdVaztBZzaDBZzTG4BZzNBKOdHrwqfoYE+1V1Ddx4tO7ZU+:6nAhGVAKDzdUOdHrwqQf+z94tO7ZU+
- TLSH
  T1D6B1731A4C0E6E7742060DC9E130F358A4EF5E35D62DD89BF1F7492E7AE1F889C0A921
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32