b6cf75ff6a0bf2aa9535a393a3eda3869f7e55f332ff82cc6c7ce6add309562d

Sharing

Copy URL Twitter E-mail

General

Target
subrion_cms_4.2.1.zip
Size 11.2MB
Sample260705-gxledsd14l
SHA256 b6cf75ff6a0bf2aa9535a393a3eda3869f7e55f332ff82cc6c7ce6add309562d
MD5 8333e748ccd7d23451a4b215e63b532b
SHA1 c9ade9c8c83c35e1cf389747f42c99f4c32ac312
SHA512 415b2163734c15fcd40437c8c6c4a77615d19db54541ecefc74b0a88f354f41e3f1480f8def8731eaa6a4cd3dd67d39d730b8245a262c0c05c36198d54461350
SSDEEP 196608:jlxcn4+l+DdeLnO9U5M/IC/sQqbaIBuD/zXMQvYKvT4bjyC3KpH56P64xv/yjR:jM4y5O25MQMsQeFe/ourA687x8R
TLSH
T100C61212FA2F1852C567073EA406B201D5AE91807B63F1DF76B846C468FB1DABB73319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://www.googleapis.com/auth/plus.login%20https://www.googleapis.com/auth/plus.profile.emails.read%20https://www.google.com/m8/feeds/

Targets

- Target
  admin/actions.php
- Size 6KB
- SHA256 716b9c8e2eed4c5e05c7a406f47ebcbac1188383249fc36e8eaa1619ab0b88f6
- MD5 c8786ddb30ba69f8f1dcbf926e4e5f93
- SHA1 08c0de97665714a2828fc01c1845618ce284fd2c
- SHA512 f8fca358d9ca90ffec22271297cf2a342acbfaee41f641534f6b36a4ef492c6905c495ae823f3b9ff340a6fe55691f3fd710724e20d4289816e32d06a0fb8138
- SSDEEP 192:oWE/VlLLo1HARUaoc7CIb40cy2cpTsTxxJ:olhRUC4XcpS
- TLSH
  T15AD155E63C669C225313A07EB7CBC4C6AB4558436C585912FE0C75978F8C174BBE5BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  admin/blocks.php
- Size 11KB
- SHA256 fd391e0e5fd431e72b0ec89e9c8d6ac21f4b8ae9411f375ac1524fa0d6c55293
- MD5 49310a7a531a4fa123486b5b53618032
- SHA1 c23c9866fdcf601d8dc050d7b6d89e2acd18c2a9
- SHA512 d239db1ee2e68fe5a5412388f50db22bb7105f7b2126c8bd270d472bef301950efd1f79ba35a593f5e1bc137b78f9fec5104df1ecc842d1858d8bcc0cb4b81f6
- SSDEEP 192:otvLIo6VyxLYiUBb2DSx53dxVbQNje9QLTBCF1DaKR8sm1cgJ0hG7xvDMENrtX:otvLI2UBb2SDutNTmHH7G1MEZtX
- TLSH
  T14E42546B247A1E78E093F1796B9BC1C1A626543338C17945BA8CF3811F8D27DD7A0BB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  admin/database.php
- Size 19KB
- SHA256 33e906c608e0830c97ec9f211cb2119072d990293e9066f362fc14754a39e7d7
- MD5 1b76bc2864cc6f90f345cad7ccc27e04
- SHA1 328575ff38aa53a330293fa5671dcfc2f6747383
- SHA512 19b43a06e70866748e3cbd300ffbfc7a063ad61b89fb56bd2bcc9649e299181dc58ba3bf671cd67e172e7f4c8d7bc4ae08e5d15d5590fa5bfd1e76117192b00f
- SSDEEP 192:ooGbYECcbmy9UfCBlB+6hqce5HIz6h+xSITKQjPhobC/6pDvNwCgHg03lkK1RluT:ooGkaH3hWLhQ/Mi7qLlFs7NcCnnsHmI
- TLSH
  T14992868A64E91D71D173E8B82BDF80C12B35D4172452CE02BDDDB2CA5FC862CD6A5BB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  admin/fieldgroups.php
- Size 9KB
- SHA256 720472a4d8c80f54b77f7614d1396cc01acb71409d8ef6e64097598b5ef859fb
- MD5 faea5a9d461d69f861f6fbe30405d395
- SHA1 c2dc37b71617d21ef273cb59a19ac945aac158fb
- SHA512 a3dcb200852cf0a1e273fec737cd013c933ac9dc4bc6e5f0947bd3a39ba87f03184a7fbb388c356bf76a9eb5d3c18a4510c5d71df087268e3e8d892b8c5bb64f
- SSDEEP 192:oexsI8bh3Wv2xM3d9z2eihCCWq00r5meDea3LlTCFuBMK:oexsIWmDX0i04eXhM09
- TLSH
  T14012984538B66D3DE097B1BA4BC7C0C69A2B542398C53C097ACDF3821F4C6BAD671DA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  admin/fields.php
- Size 36KB
- SHA256 0c145f83b987235e87a97f813b55ced05e1fe256c4f576b54436b5604999451a
- MD5 b087c5d457c2e72b9f1c3a0788a812b7
- SHA1 3df1f4b3f8db3bd3776c5b668d445f74344a7e7e
- SHA512 817eaf3b3747a988028bb1cfa436764f93156b96a69eac28c104d70a6cba1ed6e00ffb57df343d3450b6598e631a30a881bf0607fce73b13c425c27d931b529f
- SSDEEP 768:ofI2MOBOwbNN/wR6ryYFuB0BIKllJURkR7R9E1iR7RxpIc302WzQpmRQaRF2CQB2:21GOyoNxNA1VpbJ3prb8gmgj3
- TLSH
  T19903415634B62D72E023F2BA57DBC0005B56643399C67956FF8EA3831F4441EEBE4AB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  admin/index.php
- Size 14KB
- SHA256 bb5d1a8721f63b194822d1bd33b199a0660c2cb72f1a320d396bddb0dbd46856
- MD5 6d31edef6d970999b028cc8ac7cdcc99
- SHA1 f97d668d4f4f6235bca8c75f1406454322e0e707
- SHA512 11148edb6cb11de9b021592fab62963163273c611da07661b2e8d7d79b91e50a957f633372ab36c84b92ae3d5f767a4f7d92972c47dab3e0923ab6613689fe50
- SSDEEP 384:ok0ARuGpcTXYgFzFQ0UySQKIRNrXEJdokBJOlSvttDdL:oNtpOvDx
- TLSH
  T17B62629A38AB0D32C127F07E6F9FA0C14B229053A548DD153D4C72CA4FDC5A9CBA5B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  admin/invoices.php
- Size 6KB
- SHA256 bc96c0ea127827c6dfc99c0c329704d82e2c612a47cc1c7085d028b58d39928f
- MD5 64117470d1ac44931d2678604dd9a635
- SHA1 314acfbb4760d991ce796329e7158d5dd7a0e50e
- SHA512 9db65822ff74830e84453ee76f34a2a158ad1d1d20c712874a976ac56dba26c1cb0f5925a72e1cf0cec9568ed95c72337217ba1740c7ff3d1ba6300d50a85840
- SSDEEP 192:o51yfIomfjhALWS4xkNl1kgSZmgjwSLeLFIlS:o51yfIcDr4gG+1B1
- TLSH
  T15ED1639E29366F65E093E1BE5F9BC0C0913A5033368574043D4EF38A0F9C47ADA65EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  admin/languages.php
- Size 23KB
- SHA256 86114a421819bfa998d9f678fc77d532bceb70f42248ebf077a722d2e53d4c7a
- MD5 7b3397eddc59ba66b0b4790229a708d8
- SHA1 1ed540f369f93528b06625f72f1bf64cbfa66de8
- SHA512 34c21af02e62a1f9c6eb99621f2106e82d30a935bdd9cb100f89f0bb188c75cb5aa0c47e25ca3060afdb214a9d835c883404a6da59a1f314d62c7973aca18761
- SSDEEP 384:oGIrepcNP64c+7gLVU0IdANYT124T/R6/j4TAaxyd:oGIreqC4fg0C4TAzd
- TLSH
  T134B2639F78EA9D21E123A0747BCB8489AF2D50132445BD46BF8DB7C14FC9A38D6907A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  admin/menus.php
- Size 14KB
- SHA256 66f2f77bbf96e562c8bd6a86557889d6f1a8742fa99ce30d7ad935b0c2a9eeee
- MD5 94ec7f00c8914a23fdf6a2805b10afa4
- SHA1 6cf9934a76a98489c7f57f4569809234432a2e82
- SHA512 c8789ed52cb427f5d3a2292469bfa11f08cf0625fe6f956c207a77e1b58b31947f39abaa5fd3c38cbefdde126facf8ad41688f877d85a21a444ea974b953e68b
- SSDEEP 192:ouCWhLIoC4TSWnXbpVhXfo06yyoy8Rs7Dew8OSxlz3dx3urKG8RFdSsdimaexNnx:ouDhLIubseR7D3uFyImau2k
- TLSH
  T1C162641A64BE5D34E093716967EB84C19A29801338C9BD517E4DB3816FCD238DBE1AE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  admin/pages.php
- Size 21KB
- SHA256 67a4e4ad03f26eda5f1efec0936ce4bdfa4b2079aa33a2eaa7e22feabd09958d
- MD5 c9a2fda02e6fdf14aaedc7d0e9e6ab05
- SHA1 a657f4f319da535d5b5f34400430b7ca071a5e7c
- SHA512 6799824cfcd7d8bd114aba866e7bf22ea3ba732e08c64ead114396a0afd1fc188d70783820a1181410151df1782b7ef2d2ea9618ae947c287a3db54df130f7af
- SSDEEP 384:on7uLIab1FbF1gclrHVLxFM2X2Y75bDPYElmslWX50ge:onAIaJlLfVLLM2X2gfYGI0J
- TLSH
  T181A2755738BB4D70D067F1BD7BEBC042AA7EA023258479417D8CB3C45F885A9EBA0660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  admin/permissions.php
- Size 10KB
- SHA256 eb2307ba3f4f1c4c03fddfcb0d42b1d7c65fae366abf26809af0b6994acb6d88
- MD5 b9dd706b71e377b6c0dc166395046495
- SHA1 77185f40e3c065d040c4d646d4e40c2f54a62b3c
- SHA512 d9a128fa2edbac7dc8521dc41387cae192d8ba3461b4f75dd5d5ca88dae62030f9918652c71ab21f05c09f6a97b63c4d9d52d44fd84f6ab78d0489a3587d7b7a
- SSDEEP 192:oYIgtg1a5AZ0OHEmAZ0fzkSJyvM5Q2siu/ryymKzCP/P1axf8uz/sVCoxNlQ8u8:oYIGk0X0f443siu+ymECfsCPy+
- TLSH
  T158327416B9B76E7050C310BDAB6B89C19E34410378E5E9347E5E72821F9C2FC9B71BA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  admin/phrases.php
- Size 6KB
- SHA256 2298048455c37406918b1380d3d459a06d3504c7cd7bfa8cae6b90aa9cb7cced
- MD5 820fe9fb6796007bace4c39655ee5e61
- SHA1 a2d6b16dc6cecd5407d6aa89bc4038ce88c0c157
- SHA512 63b659a50537d5634de914b2dc94f6b54e864c0fe52b716e313941816c24b80523d58515745fc347a0e2a6703029561cd2061087cef60141c98861f2e6536b5c
- SSDEEP 96:5uXcoIozKkSIlLEa/NVsEsCVp28FYLcF7/r+wvyEJgAXV:o9IozKkSIVp8CzfFYLc9r+wvyuXV
- TLSH
  T12AD1239D38B56E3A919BE2BB77CFD4C9A51D003324457C413B4DF7C00F5D9399AA0998
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  admin/plans.php
- Size 12KB
- SHA256 4c47b0b12ccb5655be93a20ccd8ad235ae485a422fb1618763e2736997cf3e5d
- MD5 36825804af56719a4c6b1a8f4b245b12
- SHA1 4e4f7ed85a7afddf3977cbf9fe22e0147e91cc4c
- SHA512 9b68e36a16e510bc4e2fb566b89f9981dc4d1fee018548690a823c88495e7cf9360ed8f6b46d11ef5fb91966253008bd286480e554fc67de4d4ff65fbb8955eb
- SSDEEP 192:o/Io+xp4HcWSmuMVy9BYYGCiGCCKYUrf4ccbstbGMJ6XCuwU/SgmrfA:o/I9UcW9MLUrwZbmDoXCuwUfmDA
- TLSH
  T1D242545E28721E65D093F1BE4B97C0C65B3924237582B502BE5EB3820F5C25EDBB1EB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  admin/scheduled-tasks.php
- Size 3KB
- SHA256 fcf4c480c848bdf59474d0a236e0e5ff93e11b1c266da6dae3001d6d0af856eb
- MD5 a12815c15e9d26a3bc740b40228b06dd
- SHA1 e976c510e5c5648f1fcec46b7b996406b1491604
- SHA512 24b55a746a858502046560ebc05de6145a993b432a0080c267ce06496540beb686471eb33f4a53dd3f3de3397630d1a4d0105391939921cc520ceb972c457106
- TLSH
  T1EC61759F6AA29E32804391FA3F8B40DED366106336156414388EF3DD0F4C9B985B1DE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  admin/subscriptions.php
- Size 2KB
- SHA256 8d7448559879ad9475f82045cc3344f92fefcdad7ad739854a3c21042fd050d9
- MD5 00f7d5323e88bfda2d877d2241f2abb4
- SHA1 e6032ede2a0b1023622b38cb60047afe2c7bdd97
- SHA512 d4c25c69a7ad40a8b9263e3d5b92d6270f0a9de654bc72b9f9978e34d890ec6d9e82f7eeedb0fc0041dd74451b212f76977fb9b12a955cb28d26cf2347973694
- TLSH
  T13A51863E1919AEA5488760742BCBC2DED6365413395990483D8DF35D4F8CEF8CA63D74
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  admin/templates/default/Gulpfile.js
- Size 2KB
- SHA256 a6362a7e3f6670ab648736c95e0cb42c75a4739353ee113a7ed1ae35bc046478
- MD5 e6964c21a24526011a9b6cb90c8c4994
- SHA1 31cd2a6b6221e69d64c30a88c02873e180a59b21
- SHA512 83500216e7c274faf4fca4cf44debcd47d81e39409bc8bae3ab9f336c53f51429ee3c6cf542f9c568e5beb0d4ef38d310993de11df78c04b82c2c8870ab0111d
- TLSH
  T1F451148E5DF62C2A4223F6526D0B0081F85340978705B904BDCC56D52F9C97AB9BFB6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32