024d23b596a0fdeef0edde07c0d87b7d9e91db9d9aae3e1453a5132611876775

Sharing

Copy URL Twitter E-mail

General

Target
presensi-magang.zip
Size 31.8MB
Sample260705-gx2rdaav4v
SHA256 024d23b596a0fdeef0edde07c0d87b7d9e91db9d9aae3e1453a5132611876775
MD5 d0e755c944c38d5e88704565bb46458c
SHA1 fadafbee47f582f109f51fa831161af9c0d73260
SHA512 0f5ee6fe4a4a102aee8e6e67bee6811e62461119a288340e05f18da0575931eaee39da2a333eafde93cfa31332dab97194da85ef0aa63b60e77a653bb7e16f49
SSDEEP 786432:4LKAz9+jNyV5LSIaeM+D/VOpaOrXNZl4hi08lpQvki+wb:42Ah+jNcZMu9OzXd1/8ki+wb
TLSH
T188770233439F78A7DF837FF0DF004A019657A981306095AF16F41169AE9F8886E5E27B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  presensi-magang/app/Http/Controllers/AutomationController.php
- Size 2KB
- SHA256 85bc05bde9e3adcd237b14cd819a7972d8101ade71fa451ab40e3e38935902b4
- MD5 01d772e05eaf903239c92e35412a8a08
- SHA1 1af455223a099ea092d624e0d739d89eb1e7bebd
- SHA512 f2bb1a8db47549ddacee3431453d96b1807a3441add55945aca0f1186f3b70cb08fe9ed150cea72116efee35071bdfc303b02e7dfa82a542765e29c7a6552f37
- TLSH
  T1EA51410966FB2115A2E3E23F9BDBC45238B6900369C9AC607CED47846F8053CCEF7665
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  presensi-magang/app/Http/Controllers/DudiController.php
- Size 2KB
- SHA256 19deffd56db602fcd100fdac33179d5cf726b4d8d3175486bbebb3c5beda30c6
- MD5 9c2e262f90f6d18d447f95d265f9f001
- SHA1 72c64eb84326f6a551c26abfb10f2db8720aee18
- SHA512 4bea66ef458a9ce3eff2934881f34dcd512285f30eb3049dc137d2854dd16b73321be90d7e5d4791994da3cf365395fec97812ff535733036974ab93f6e41dd7
- TLSH
  T18D511F0BA9D355013733BCB9474BEB4078B98523B24A8823BA8C11A43FC626DDE79537
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  presensi-magang/app/Http/Controllers/RFIDController.php
- Size 9KB
- SHA256 1c42aebeeb714622197119e36dc6ae6231c455530999e7a37f63b734a7947332
- MD5 707ffb5bf68f81dcf36c6f3381bd1ca2
- SHA1 88ba9316c6baf462462dc972fd7fbfe9414fd939
- SHA512 a8f66fe7446f3240fc7e11a921fbb680a8311d03a0910889ce04d5e023862eec16a29e680c7a21af960956f9245c3fcf96c6a8e1d29fae62b57c504a277fb98b
- SSDEEP 192:Gq6UAs7Gd6/e70d1e6XP/oCbJ7rCHbt3CjdC2LkMtCZ1XH/oL7X5TiazoEdC2Zk+:Gq6UT7Gd970dUmPfJ7rQh3whadHG7X5P
- TLSH
  T1BD1200463DF311006777A0B95BDED7567A69840362D98E12FFCC23942F80C3ACFA1AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  presensi-magang/app/Http/Controllers/SiswaMagangController.php
- Size 10KB
- SHA256 6780debde2c1974b868fac834eaecd920f90503d33cbac113298e8f35a703f2f
- MD5 0bf3b2896d27b5f9afdd0a050502e3d3
- SHA1 411789b23f0a7f4f358be4cc69847db16ac0c589
- SHA512 2f9a7884aaf3eaff269d91d96ead5dfa367121026ce2fdf2fb4ffd18fa4a55b2dd6664d3824644a7f2d3a0ddc7d217ee58e69629882898c5a13110eaa9d01baa
- SSDEEP 192:GouHIwgQzv0SolRNx2NevwsYnB9nIH9Wj5nhnCODvnh18NrjvXQjhSa8ZNQxAPyY:GouHIwlelRNx2Nevws+Lxh9COD/8N/ZB
- TLSH
  T1E72265A61EEB1210A397F0BDCB8E97111895940396A5592EFFCC53E40FA483DCE70978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  presensi-magang/artisan
- Size 425B
- SHA256 f91a517c0c5d3a904c3f390933964a5e08ec1fc68146882730daac4aca4ffcec
- MD5 e66bb13691f6184c762c196427d8e685
- SHA1 b8f0fc8820d5de0b4de5710b0184fa998e156089
- SHA512 fa3f43c9125e19995c2e8b17663396fdc20ca4007e1bda34cff35738d65b3b88ae1e31de1118ef116f00a8b2f2f25b940192f98a11f67d63f756b1659becc1de
- TLSH
  T137E0A3FB078C02A1DF9634DE164CD4031C5DC9177CC010A5F415395887C58DA77573E5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  presensi-magang/public/vendor/sweetalert/sweetalert.all.js
- Size 66KB
- SHA256 996d70ae1b8aa760a5d03095affefe193765d7af19ae607a15aca8300952987d
- MD5 6539049f4a9dec00df4cf9654d28c649
- SHA1 49c0871894726ce4965f5023206633b61d51aa42
- SHA512 83a4b20f799e19516c6c706532aede0dd1173efb47f7fc8f292f4735928dd6c07a9c3552cd5c1c980ad3a0a14f6f4108953d7a438e7fbab0ba0e325fd6af2b23
- SSDEEP 768:bUgzbm5DVD95LI59BuNFxa8JQYTd3b8uQzg3BqxUhPGLMcLDxFXJhIVbqzeeM6oW:TOD8bUIfIzRMAqln8yzfujrcYAuq
- TLSH
  T1A8630A625A04F033B6BB05AE64E0E104B9999419FCB34C54F42CC9504FEBD4F26B7BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  presensi-magang/resources/js/app.js
- Size 22B
- SHA256 cf6dab196c721f6911ff99cc4f910897f978599a2d289971a316a5fc33091f94
- MD5 1ccf2b9101110f40ecaab1608a6f91cf
- SHA1 d2e5cf4f96d815b68a4f2a012b54a0d25daa4952
- SHA512 a1df12e9b6252139f1ca40bd94a1c3d9fe3661d6130b36ae1d8664f725bbdb3f7a73426a1da39b870da004430615e3e5137f7d4252f4d1cd70c9c3e09d87221f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  presensi-magang/resources/js/bootstrap.js
- Size 127B
- SHA256 6fd9fc82e68fa915a882f4e227b9faacbe7bfd66cb953c628840e83bda6b72f4
- MD5 78f909acc19aea4717eddca5a87c1ba3
- SHA1 737674b888fd746d93f53ca3b748936d85f14c20
- SHA512 cc8c649f9d05d0b5c4f51a344cc03f85b1df1284036edd9acb6794fa0f493899c1785537c20b2ceecc0589f193094dd92a6d68bff91a98d0fd4ded3a5364bc12
- TLSH
  T1C7B09B3F54D5741E4A7241D1DE117B14615453A41102D5711156D17171D686BF181694
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  presensi-magang/resources/views/admin/dudi/script.blade.php
- Size 4KB
- SHA256 0206e9da17c74f9f0e734d17a771e45de00f5f9d1abb416aa981f171cce88a38
- MD5 3881b7948afee961ed55f491cc536722
- SHA1 bc42c5a161da8846c3b84c22ff5fda966c245c1b
- SHA512 4d3f3a9773f3a37097a58d0763729e5ed5921fc3de49e492e6bc94095879ffb4a841b8ce91082d2d831a986d5f3b63c23230174a855c3bf045b3783053446101
- SSDEEP 96:yMnrnrYvf9VxEZkfy1RxQPvN02SM+zN/Qp9TZzJ:yurnUX9ViZkfy1R2vzxa4p9dzJ
- TLSH
  T18081FC2A363712314DEFA9BF6397676A393090077451CC093A9DC3984FB2F926C33699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  presensi-magang/resources/views/admin/libur/script.blade.php
- Size 832B
- SHA256 459dc7b377b62520d68eeb185d1d3711e8fafa674eeab3f61bd8c7a0eab23da4
- MD5 e1b8051465c8f5db74079234eaa1025d
- SHA1 f5ad08ef99c674c23832310c54c33c26824f6086
- SHA512 b3b9927f6bf02c5d5a6f33c95d7aa9a7d8791525ac6c91ab88381cb59cb71c8e1fbcbb00a64028cda3ccad13473dbcc85df46a4d59c64542a3ee5f674965480a
- TLSH
  T1B80108673E9665710DEF79BB5836A3CD787452063801D0589DDD55904E10BE3FC3BA90
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  presensi-magang/resources/views/admin/pembimbing-magang/index.blade.php
- Size 15KB
- SHA256 99194a546ce53e50e8ec5e6041ef8cc438767a1409a016cdcf576acf592f9061
- MD5 745d2cc85a39bca430b1c3dff2a27165
- SHA1 e0adbcea551e0c8542638775d4157d6c63a20b81
- SHA512 cc056579240144fcc75f31208e72100fc1d9338600cdf36880bd6c09588fbf80cb41a697cec32fbad1531dabc18c0ac7fd2a21fefa966438dd69a31c79f13021
- SSDEEP 96:gk8G0isqbre/HkVqKkL/IYg2RmdHwl19P/TaUWiNHb3H9PJFmNzIVUcA9PoJioNM:g40iqLDR99GUv1H9C2pA9ATfKbAah
- TLSH
  T11F62FEB474F817B342DFA1D56A699F0B6D91C503C72B1644F7AC0BC80FD2C529A2322D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  presensi-magang/resources/views/admin/pembimbing-sekolah/index.blade.php
- Size 15KB
- SHA256 cb0dba69c391d0daf43e3f417729ef4adf3f44ebd1908ad6a111e9f52048ade9
- MD5 b867a28916c09add101b87a860a6edc8
- SHA1 c2d9325771a201ca77ef6720db2c98faf2c48b4f
- SHA512 3c05e6f68dcada8f036d88f4f56d643d6b931cb00c54bb3476a1f454790d12d502692231a0be1e6891767ed58807957a93e78389178267b1e969e6eec5607664
- SSDEEP 96:gA8wPOis+b7e/HkVqKkL/IuZg2RmdvpwlD9P/SaUW4NHb179PJnMGkNzIVUWA9PL:gOOiwLDHn97Uj379s21A9ALfKbAah
- TLSH
  T1B372DCB424F816B342DFE1D56A699F0B6E91C503C72B5244F7AD0BD80FD2C529A23369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  presensi-magang/resources/views/admin/rekap/script.blade.php
- Size 2KB
- SHA256 a75cb20aefb38b2cd5e1e08a41ad09f1322b3c59f8babc0e31b2db50e23be81b
- MD5 914613f2a0d206bbfdb8995eaed560ee
- SHA1 3b5e492dc36944c781868efa4fabd3dbc5769200
- SHA512 e8ac98bd2650be03f5931b2097c0bcaf93d5e67afd0feba9ad5956ced88256657f1020e87253de57ca0adadbb8c0e3a9420a469e0c9e975aaf8fcc8f4b247467
- TLSH
  T15B418EAF3B6715700EDB70FE81A393C63E2151036E039469BF9C55154F20FA2B87B960
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  presensi-magang/resources/views/admin/rfid/masuk.blade.php
- Size 11KB
- SHA256 cb56c425df95304d5a3a45cabcd7e2fc2bac0731f50d2e1174f37a02791af3c9
- MD5 de42451ffcbbd2623af9f30251a37858
- SHA1 ae0aa1cefb072461e667de1ccc74e000864f0b1f
- SHA512 6f175dbf5f7c2a21d52fc4cc9b6d3ee64c78ef8c73bd2ca394e7b1d7d7e958fb6baedf7206f5423b571f724946656a683b5634cf3344697c7abd06d3ef36ef90
- SSDEEP 192:grzO5ySIHChj/90ozVc+ZusWRAiAIEviLiC:grzO5ySSChj/tRgsW1EviD
- TLSH
  T18F3251B528F6107242A3D5F96F82AB037FD19003C91B9901BABC0B940FAAF52DCD3759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  presensi-magang/resources/views/admin/rfid/pulang.blade.php
- Size 12KB
- SHA256 6ece37d06bea8c9be0b1325bcba789562525244e342e71ccb1aafa6121c9b9a7
- MD5 dbffea5cf3d7fe831bd0b682912c9ce7
- SHA1 9a4b258a874d7275ce09f964cc308b1d7a56555a
- SHA512 2948b471f72b13530c31a1dfd5187cf6e530fc8e75aa6ad16d6a60749a197839ce72dde5cb41935156579d0db4e34ba708166e5137566f1e9776ec1979c41622
- SSDEEP 192:g8/5bELF2Chj/90ozVc+fusWRAiAIEviLiC:g8/5YLcChj/tRWsW1EviD
- TLSH
  T1C64243B424F5103246A3D4F96F82AA037FE19013C61B990577BC4B940FAAF52DDE3769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32