0993ac5a896db45b8adbd9b0b5e0ba953c6a924f26e7b97c164ae2bfc2d56dc4

Sharing

Copy URL Twitter E-mail

General

Target
__pycache__-fixed.zip
Size 158KB
Sample260705-gz18maes7p
SHA256 0993ac5a896db45b8adbd9b0b5e0ba953c6a924f26e7b97c164ae2bfc2d56dc4
MD5 b6e823229d448313156942c3b9e7bbfb
SHA1 a82de80e9be55b1af809e7bec0e318d0029208ab
SHA512 344c146da6b8f2d04865e77af096a1a77d3205247f3cef731c1b1a343fa71bf3bc8b97e7de68da5a56bc1f8a2d52eb12bb5dd7b14b8fcf76d98050f841e4ed91
SSDEEP 3072:XReiAGtoZ5OuHKKMb6iPNQl+IcQ0tCvyaJOugzUWiLCiL6MN:B1IOuHxMbvPNQsIc93nugk6MN
TLSH
T1B1F312FAEFC08B89D8169A3D52680817E12E081D7246E32FA0D8D91FC895B8F7F64457
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  README.md
- Size 4KB
- SHA256 4fd67679ae2003554c42b67c5da34ca94022a1bcc123318a8bc7e1b1d967edaa
- MD5 093a3ed5c16950708e2339b1232d2607
- SHA1 1624ed5a90b1b96e5440168aa674711165b6256b
- SHA512 f3a9af309291fd657bd51c5baf2e4df68e6eefd7776779b375742db210f328ffac03507ceb2d1f95d6aded7db4582d1b19f5b974e7cb5fd8ac38566f6c9706e8
- SSDEEP 96:3BqzOc7nTMgofqmGXtMESJe7TcAZxTrKZRaA2QKwhVypL:mOkTMgofqmeMr87vHri2QKwhVyR
- TLSH
  T1DA9165062784766706B35D9BB25A58DB8EB3B03B6F904074B561C63F2A0413BFA621DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  app\api.php
- Size 72KB
- SHA256 986699a3d67014b12e886f279fbe32510657d48efdb318aa1b46b9276d9c71ff
- MD5 952165d8f1db014decedb535571d8b25
- SHA1 0568d77321236b65751b97415b2f2e468735b246
- SHA512 b5a2ccd01a08ed0c34e84f79defb684e1c600c849b705b0ee9a62bb8948e1518a828263aa516a5557c028185f7f71fa32fcd770ce8002dc100801016d0dc2f7c
- SSDEEP 1536:L4YSe07PqLxtYWekgOySUDhkERa0SIeXsQnWSm3VNFZGJkslKc845Hu:xSe07i1tYxOEUiNnGGn
- TLSH
  T16F73C824B8F759201163707DABD7B8903E94D40316C2E951BE2CA2C46F90BBCDB74B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  app\helpers.php
- Size 17KB
- SHA256 f3d2ba9e69715e741ea9a13e06597c059e15c7a57dd010e22cef4d26ada9cd74
- MD5 94978837dbac5a6c7964d1e614082dfb
- SHA1 70a7d9c6cd8fc709f3a95653b05d1d0a4369b903
- SHA512 beadf13d0843484df55a4668a3b95a6efcfd43525ccff20371768e6a2db51f4f2ba4517e97e0adefb3174fca5dae375a722f00fa1c5c71508391bfb8d34d3bf2
- SSDEEP 384:kCvQZv2WIAcAEOWl83GG9JWzoLqwtdXhFILm0/M3e6sTwBY:kCv+HWm3GkwzmdxFMO3NY
- TLSH
  T1CA82A51538F7A51014A3E03E1FCFE418ABA89813156AE9A0FDBD12D85F9493CCAF5F58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  bot.py
- Size 154B
- SHA256 45d22cf5acfc7020a79359b4b4286197b87f083b2679565a44e1bc457a308030
- MD5 6418c3ff1b709d6ed90f1234710f1d7c
- SHA1 5904136a96ebb02872637d7afa373fbf23939d63
- SHA512 cd7c722018b0ff1301228072b353b3cc4aea5e91d9449864c0f56adbc516a5c55a4c7c5f6e0d13aae83836c5a1a93d4784b22d27d8de7397223e9a0d72f0b214
- TLSH
  T1ACC08C02880218C0C8D18308EC89E0A0537069AE36481AA882B82FA61B2223606A2CA8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  bot\bot.py
- Size 15KB
- SHA256 66fcda3738464ae62d6e9b40670c9f56cac9479bceeb13f108994ee40e02235e
- MD5 f4f04a9c667e93c28956638c16c3dc15
- SHA1 e00bf8ba9ad634de00f128c9d106db7cbac660f7
- SHA512 d6eedf9ff32009896e3af8bc7d7c832e8f13d72c4a8a3b40be16a9326844cadab5b6268eef151a2d3ca900fa0211ec2f0978c1b8432b25375b7b80374ada5a08
- SSDEEP 192:bgOCPIf15NYQ9UW6uHHT6ZeTExwd/tdhhC7LHPtUJuLukGliSNJTwtHF1g5A8Dnn:bL32MTrEC/tdP2vJKkkbmFh0iWzPKC
- TLSH
  T199729601CD7B9C22D5CBF1A9B914B8022519E5072D107A71FAFCE26C0F4D97E9AB4B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  public\admin_preview.html
- Size 3KB
- SHA256 44fd2523a635ad370b4e4ddeed2e21e51402fe90249f784941a01e37e90604b3
- MD5 775c347cbe6b6157f5da99701f613184
- SHA1 f49a773871c9cb66dab6d228271492748bb2eeeb
- SHA512 ce855899fbce9d68f4a1c6e5cd90669e8da069d1e569cad334aa19160391e7bda443e7d329e58a73f69324b71c5e9182ad652d6968e453e217f0a1d024c766ef
- TLSH
  T11E618B5298E21537922A83CE6279D71974D2601EF9161804F3FD47BDCBEAD427813C56
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  public\assets\admin.js
- Size 41KB
- SHA256 5e67fbfe627b1efa1e4245152b0b69a4c0ada88e8e9ec23834c30786c89c6724
- MD5 828d18304779a9ca76ca739fcefeeff2
- SHA1 c7d42e523115b09108d076f7f0033ad9063500e7
- SHA512 5999a6b8496cf9d5baf4bf55b00b56cabeb48828d5a5bae2488ecb86db8e3a16360dc4a5f3e97f27468d2b77f18819e3d524c8a4620b8a6a215c155f4b8fe0fd
- SSDEEP 768:nHl4U2rB9yPAwiYFT9iRl+nv4+Ej+iAx4ONaDwiBM+YbLWLUdcLwDEf:nHePd9y1iYFTw+nv4+Ej+iAx4OwDwiBx
- TLSH
  T174130BC974BA2134443F71B896EB980A3DFD8517B882ED50767C48840FAB468E9F7D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  public\assets\app.js
- Size 52KB
- SHA256 727aff0f3b77f1d71883a0b8d8c72e496e99aebb1d36f687c709087d58cd1612
- MD5 a68aaf0f8ad7fbe1cbfb3480c8c57611
- SHA1 9a3b3b592c30b584deef558944011338bafa68d4
- SHA512 29bb25045da20d4ac99ba9206d6d96ae43faf21f54014c85c376b155b1ec0f152109d34f54b5d606cf1849a77074a30be71295c3a8f421a624825a7a5cc393bc
- SSDEEP 1536:6CD/xqZ0/zAcCtaM9RIIvrD/54ImMEIIPao0ee:6YCtaM9vD
- TLSH
  T1D533F95571BA10764033B2B672AF9F893FD9A003F586C95077FC8E881FC1A20A577A9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  public\index.php
- Size 3KB
- SHA256 e94a1bf56aa2103cc57b90e991b1a67bce0894a75a7f0f8cacdafa0a8d173666
- MD5 e01a01d5fc52ece1b9d7159d8d265203
- SHA1 be2de9a23169fffbfa446bc93b1c31ded1569667
- SHA512 19d8ba638884fc65323dc0397c755d80abd2ff15c440e1b8ecee8a16c7de87b5137f09cb188332a8316fd15c96e730263b6311ff2435d149d4bba9c6f97dcad2
- TLSH
  T1E281578089F3938604FBDBFD5BDAC80C9176507B79639913BE0C14099FC91F42BB4665
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  public\miniapp_preview.html
- Size 3KB
- SHA256 9045a9a99605684cf32b8fdc5c5465555f390fb9f78ef25e5d09dd652b7670b6
- MD5 20c05a73d30853716433bb8a5dfe1de5
- SHA1 c4065ae927979b4bb64d9346841fa81705a005bf
- SHA512 70df742a12e3d893760c2c4e9b550b4065513458b24e0c9870522a720fef99400cb392bba55c4efdcda7f5d0a3311dc79d392cf3df9e7fe021638556f70bd77f
- TLSH
  T1486102A150A62B77431B86C43512DB0AB9D1F20BEA4D18447BFC1BEC4FC7C95A81B517
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  views\admin\_layout.php
- Size 8KB
- SHA256 0cd6874efdcde7896facc4bf93382f7826ff551348a61797b1543c552b2fbfef
- MD5 c2f996b290fcbc258f0da458183271e5
- SHA1 3babdd819c5276ca2d8b6e25aa92df875d01831b
- SHA512 ee253b03b379a4989c9dc4cc84a6df99e9f99dc29d1e985cfbb9381cda631cee745fbd867c59f8f0d33ea90b800117d0d511b6d9f8c80fb7a6788bed0be4a434
- SSDEEP 192:p8SQb6S+OCmhQr+mJk/IxAZyYhxe0PBnQevnmCr/FDhoHLzGfCRmu/YHJu82Zpf1:aXMmhQr+Gk/IxAZ3hxemBnQeus/ZhoHF
- TLSH
  T1B7029832D8F66B1351729168A9999944FCC6B403BDC060A37BFC32C58F45ABDDD66828
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  views\admin_gate.php
- Size 3KB
- SHA256 578261d915c5b145fa3d464b835e784642fae797ebe333843593582179589c56
- MD5 7bf1355aa87a996c7306c8099f3e0e04
- SHA1 9f62a1700b11084ff82aa1b813d62f712fa41180
- SHA512 0578848ba01a4bacd3e99c3e51fa1d3c5d978f41038b0bb054326f53b26af930c8fc5d187fa6b9274d2a64b5e5c3608b8da6a7e73d555ff2edd8f118f2a62c91
- TLSH
  T14561951705B24A351177E24E7786F3883971004BF786E851BAAC5A486FC6FB5C8772C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24