208f050d5a19af7ff2a117f0ac49ba5bc79fc0ca756724af511ba455e6fc0d1b

Sharing

Copy URL Twitter E-mail

General

Target
mbox No AM.zip
Size 4.5MB
Sample260705-gz5aaaes7r
SHA256 208f050d5a19af7ff2a117f0ac49ba5bc79fc0ca756724af511ba455e6fc0d1b
MD5 73f3ef203e419a8667e786413d2f0695
SHA1 7de3198a4764f9a5cf8014488631a5af74dec244
SHA512 14044f52c2b5891aaccb0f0033b6dcdcbd6739df136aae0929897bf19fea1120f5cf320d62713de53fa18145c839ad1a8ea95438bf1ae7f93a21ba10d40dab6d
SSDEEP 98304:sOEsGC8SA7Rb5vreYEUEXgWZAmyE6NRGipVPkbeQv8OMI:ssilrvEUB4hvSk0ZPQvmI
TLSH
T1CB2633C2F7809064D1327F3606D0BF18D22FE2824ACB95DFE53A49854AD56C4D8BED79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  mbox/Antibot/pro.php
- Size 1KB
- SHA256 65550d9c52c994219b1fea22f53659cf5ea1d2d784b9c3dfc4b607c432750138
- MD5 4448006d0f26bc847a3e3050adf3a15f
- SHA1 893f2b61f90e718615ef163ab2c86d06adee31e6
- SHA512 de894a05240d2272ec643af70614d9fec85f17afd09c0667de53f6fdf3ca934f9856ffca6505d6bd4a74a0ca298498355477b4825f15a67c0aab3816fd0e3ee8
- TLSH
  T1C741BD69F9137AFA06B5D31887A50882E495520B8B07C726B6FD620C2F7C124E5A0DDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  mbox/assets/CheckConnection(1).html
- Size 34KB
- SHA256 27109b2380d8103de9b7cee5fdcf53cc1c1829fb372586a9cbc36fb5d534e58a
- MD5 2584a75eb4dcad04785e159e9b083ccb
- SHA1 03a0273cfccbf8471b4e5dd42246a342dffe980e
- SHA512 94573051930e1041c4afb813de3d8b2a1c6cda0bf9b56fb552af72ea2f64193d399414aaa545e4e36b27bd3f455f53de7ee748ca4f50336373b3202e898a71ae
- SSDEEP 768:ZiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSl:4IUlVN8KYEsvZSJ4H+
- TLSH
  T16CF2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C453BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  mbox/assets/CheckConnection(2).html
- Size 34KB
- SHA256 149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc
- MD5 4b8229537dd39dc6a4a2e1d750899c03
- SHA1 f8319f0a3c503ae58c2b6396bf4a0b648a1dbb6f
- SHA512 a4836bfe87d7d1b2581345afdbd6f5baed95a76874bcc17690d64d826225487846c728b8e81e87781fea7d9c446821996fcebd568ac2e5ba868c1bef60bbf8d2
- SSDEEP 768:BiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSQ:QIUlVN8KYEsvZSJ4HX
- TLSH
  T1BFF2D7C8B7E2742683A3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  mbox/assets/CheckConnection(3).html
- Size 34KB
- SHA256 a45e241cef87d6b40134a0d6c3176a88c23b25c9e3b8aee215a07989dbcf1c13
- MD5 44af90253b76632c3fb14d68f1fc4dc0
- SHA1 74fb83233d053a1b73b7693e5a0fc39b1e8188b2
- SHA512 f6283e1dfc346aa064a3f0a7db69e168309a6c0ab4b9b25df1f1eb3752b22a029203158ede4d9466c735452f7a34d3c67cd6fb93f9fac34d1ee62fb3451a3524
- SSDEEP 768:miQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSB:jIUlVN8KYEsvZSJ4He
- TLSH
  T131F2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  mbox/assets/CheckConnection.html
- Size 34KB
- SHA256 78508d19c0c6901a79d98f5d52dd19a459dc8d18ac0e4d3c8e3012bb7fde09f7
- MD5 e251080b7d1e2369390fd1b055cdd6dc
- SHA1 a8ee1e025eb26ba94444f89400887ab370e76f76
- SHA512 aaf70955d6cd61b131344b4f23c652dd420f0661cfa677690c05e8bffb84cfc55a5648cd85ff2106ae60cd6ef607ca759d0903c44403dda2c24f05e52e9884aa
- SSDEEP 768:FiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSz:sIUlVN8KYEsvZSJ4H8
- TLSH
  T190F2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C453BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  mbox/assets/bscframe.html
- Size 191B
- SHA256 03dd138a8585253980397cf5fe00607d8c3b34ba04dbffb5d1907d6d16e94ea6
- MD5 c9bbaf12b37090bcd2ae96c1b40690c3
- SHA1 dcd8e3a05de9e637037c80c2b15e9ea73670b466
- SHA512 8639378100a580ce3d89ae6cb82b338c9dcaaa2334fb580de3f158f722f173ba223b4243374b22a963dcd3faacfd942b6f8ffd1d3623065ea75ff65e683aa00f
- TLSH
  T15FC012FF381320176610ABE499D9B51C4D414664B049C945A89030BC5AD971ED863795
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  mbox/assets/js/redirect-checker.js
- Size 3KB
- SHA256 e6f9d62b9d20bca248ffacf9c7e7c579893100e8d9d9be8670c3abbfb699db52
- MD5 f88a4c72500082c3bba3ad056374da77
- SHA1 fcb54603e147b57de001c2f4e279b3ce328f4bc0
- SHA512 32a7f77482b88ac16ac0b62a076f58bcd7628fc7f68874ae1cd7ca9170de4e273b943dbdc3515221cab20252f84075380d22c6bd016dfbe492d922e1a590b675
- TLSH
  T18061031633E711212A7760689F0B66577622940B138EDD3CBEDD43E42F47B2085B7AF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  mbox/assets/m=_b,_tp
- Size 759KB
- SHA256 06a7f2a1b05de87c858c86e7f4a666c3efa176f85e78c3e932de3058e2c0ad48
- MD5 ffc136bfe9026810515bc63c2619f3c1
- SHA1 8d8a9954e05d1ed1c95c89e54b8110563ed1f13f
- SHA512 487ee6ca7f06f9bd8c1f685cc04c53ac11d9824abd54d109ce9038f7b9898d61059d6029363590d9be845b5f9175d2ed88f657a965a5d1ee99e4f3afd0d1bf52
- SSDEEP 6144:OFarNe+kkqZqyqsfajs7F6FtpK3hpDiS0AXr:OYrO7F620AXr
- TLSH
  T106F43AE9B6E0B1635713A7E0883F141DA12F24B5762C4828F1E6DAD35EF0978057BF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  mbox/blocked.php
- Size 1KB
- SHA256 8e7ba6995f730673b121e7dbe01d448a5422c3032222e8f143b0015640dcff3e
- MD5 e2249d8852be9d0f7f15f56e5894fb16
- SHA1 43fa5bc552fc415e1982d5c1f2fc39fd195b566e
- SHA512 2d15af0517bf9ad40494e005d368428a5b9bfedb970b3088ddf2b033783fba0c495d697038fbbeaa9c8ee22f1330b59a4927345d0d33fdeea9153d456b897f60
- TLSH
  T102410F1A56A0040628B2E2B96FF3A308FAD350179307456A3ECDA2878FF5611C5E3FCC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  mbox/check_telegram_updates.php
- Size 12KB
- SHA256 7180d0e33a00cd8932d6d8356416aed9b5a26a10b0c888610eb420e245166918
- MD5 795c3def8d00c00c0c45f18dd4ef87b5
- SHA1 d8bd37f28d3049d93d36a809313a01033a685451
- SHA512 32529983f06fa6c9188349e99c981883fadea6073e597c23b1ccd3684f8c85e60cddea7547198e6770acee9a3d07f5e78d27be54b3e3335d4712e6a9d1f33ee2
- SSDEEP 192:XkyHVc1VC2PsCu79ycAfLFCcAfLm/kcAfLZcwwz5BAC7Am1OiCuawJn:5GVXAwsKkNgUYOiAwV
- TLSH
  T13752771238EB6925587E901E23ABB3912516D0073ACCD82DFE0D93D44FD627CD2E61AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  mbox/images/sharepoint-portals.svg
- Size 66KB
- SHA256 543637ae1cbb45ed2347b53dd13d5edcf973382b63e063e76cf4343ce91c20a5
- MD5 250ecd1251e08c952d624476ff1c39db
- SHA1 367f882bc5fdb29a928b9b3fcffda3e16f74e664
- SHA512 73cf5b406a87b25db519f9d1dd27a0bd2ee5ab53af43dbd495129d30b72ae99cb785edac616291ef835c2b1fc10719f848e7ae75cb84c946d8f618f52d1f1e6e
- SSDEEP 768:13Cx6wLe8O8KjIpBaRRivkF7ikfqzCGhrd1vmmjcGFncv/b2PsVgnnXyQCctrQr/:pb8KHFukfqB1vgz2iYniqtrQrqfrU5D
- TLSH
  T16363BC22230DB7AFAA49469A9A3504D570DBDCD7D130B1C0B7BB3437E94E8D16C6C3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  mbox/loading.php
- Size 4KB
- SHA256 2d7e8d0a03fbcde975f4d4871c9584d2f6eb8e34a2d02c82d89e1dd1aa43d8fa
- MD5 d442bc8ee43c65c52ead7b7b80a4249b
- SHA1 6ed5dc2cb973d16560c7462e21a73db30c301e77
- SHA512 fe24e45068c4eb27bab57a44c9237b1b89caa070c5696afb385f1b16ef73ee38ff6f93df0dffd29bac92df80eb30e357d349c93bfeaf70852c2f6be8fdd11c68
- SSDEEP 48:jt5bDUCplM3Al3qV4GDXnVv2cld7iAvCvWDhTD4lmQAvzXUs1fsMbP8nrfwXRdQf:jt5Hd9zQHWOCeWmQOLUs1fsgP8nrMXm
- TLSH
  T11191331A7484601A2177A26C9B634604FA57C517439FC62C7FED23465FF2B0886E3FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  mbox/success.php
- Size 2.9MB
- SHA256 cd55d01a2cf216ed58d3bcb3ebfc2ea799d7dcd5fe55b2959148270998b2e785
- MD5 bb4938277231e1a8a777bebdaf10a3e5
- SHA1 cec29956b15eda7c62ca84d057e9caf57bfec4c0
- SHA512 25c688e5f23560960490c66ef907be4f2ca8879abdf2ee534b850a59dde9a74209fb98609a24a3646726b9bc849b95d2713307b32ae371250b084dcc375ffc3c
- SSDEEP 24576:gCW1IjTtKQ1OJCacDBVX5j7dUVnL/9ZxMe4V:KQHOJCacDBVX5j7dUVnz9TMlV
- TLSH
  T18CE54BCEB271313BE523E5F4859B5549F2AE4890F51A0D78BCB0EA834FB595902B3B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26