6c7e7010ec7f48101c6a50e170c01becc75edc20f1601977ee23bb0bd533617e

Sharing

Copy URL Twitter E-mail

General

Target
CRM_V2.1.zip
Size 4.2MB
Sample260705-pfhaeaf16n
SHA256 6c7e7010ec7f48101c6a50e170c01becc75edc20f1601977ee23bb0bd533617e
MD5 47374c439593bdb4b596998a98ddbbd9
SHA1 7f93507e5aba3809b79912838fb52719ad2cffff
SHA512 c1b84f1069d3875beee63c47407c2fd49a217a3418bf529327c9a4865f34c1ed3f0d1dfc62de5c1d9de2f15ade431b3344430701556a69afae9a138811a49890
SSDEEP 98304:QqRM8cn+gtmoKkFruPNkpx/pxW/5quPNkHzMkKqA:bCnzsSGjoYB
TLSH
T1961623B3D5085526CE4B767162CAD90ED6CBE305A800B44E675687043BDEDD03BF2FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app/Console/Commands/CheckLowStock.php
- Size 3KB
- SHA256 df47d451ac16a488b7c988baf9f2b5fd70dd828218dbdac5a9b49fbe6e8cce9f
- MD5 bac4442aa39d107beb551424c133489a
- SHA1 d39295583cbdec13b8cbad3e53defe034a78671d
- SHA512 1b4447fee3efaf3955865f58334460d1df8ddb703c3ad1921fc569a4580deef1c132a10a55c2ef819f1606d14b64e23865234e6320effdc035ee2e47ed93c26e
- TLSH
  T1FC61266968F96EB7274360F13F9B280560FF2043060D69623DDE43895FC4A28FE575D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  app/Console/Commands/CheckScheduledAbsences.php
- Size 4KB
- SHA256 609da0982dc266481296c8cfbf2c27a525b125d6e88477d9ab06520d94b95d34
- MD5 27eecca1b9d4321db61ead79c762ea58
- SHA1 2486eb4518007c3934417adf1941fc409b992508
- SHA512 1c3f3b1ad277c8c70dea856ee84087a97c05694690e93dd9aa3be23cdc6df639d6f7894beec32663c737ae79f4a15d0a94c3b212ec167ddcb46539ab9f129de4
- SSDEEP 96:86xL8wMLH+342qQ4KxgZ8Up+80qSxX2cWXCLYj:bxQjy8k0OWSLYj
- TLSH
  T1F991637F08E213E226E324745F1A13844856C21BEA85A8553EDE03C81FD1BACDEF76B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  app/Filament/Pages/ManageSettings.php
- Size 10KB
- SHA256 ed6835560dcad7423677abe90f397fb34283fee7105297afb5469c54638bbaae
- MD5 b2183abf9cf69747dadb5f6c100a82a8
- SHA1 bd08ffb9d74e9faf0855c56a2070bfe3ced1b65c
- SHA512 2b2849e71f762edca8133efeec419ea7abaf4e9dc9c7d2b9207d38cab06443c6981d0a66c1922173611d52cb289e7705c20a78123f1c2b1956652dbe9868523d
- SSDEEP 192:N0ypjila42j/4HIG9bhR71h1iq9hByvonX:N0yj2a42j/4oMbX
- TLSH
  T18E222C7823E56204478360BDA6EFB501A133A4230C667E26F5DD12093F0CF784BB76EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  app/Jobs/ProcessSiteEvent.php
- Size 12KB
- SHA256 731b58f9ace074027f4b1fb26e55c5346be721fcb8e732c5cc69d9639101fa14
- MD5 d3cde1f6161c5a261f92e6649050212a
- SHA1 d714af683b9a4766bf7ba246bd0a16369ebed879
- SHA512 8b8ba6bb25debd16f3a36aa9ecb3a1f8b49347f677bce5d9da9146e8bb475b47c41c942f780f2bc41017730de39c8e08144219a43d6fd1eea3640613a91f14d3
- SSDEEP 192:OzJLy3pQySS4mummyiDQptEyR78kZyZdsDfbCvXg/VbS6nuv4hWn5y1yhL:OzJLguySS7j2QptEyd9ZyUTBLi4aqAL
- TLSH
  T17D42C82C64EA5751DC8320775F4BE1563A3A5017AA0DA6123CEC07D01F941BCE7BABF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  app/Models/Product.php
- Size 964B
- SHA256 3eccae04fbc16c65c792d681f46e5b46d3119816c566580d28010a6203c373f6
- MD5 02c5c391600244368bbad8db6e499738
- SHA1 999fb52bddc4bebbe79045a70577f008029c2fb7
- SHA512 a69bda4d70124d5b8d0e62c53ec45b37135b95de5dae5466370eab77c5f2d728d341cf73f2690da0dbb1653c76c6699609e91d9b506a89ae09be9377ae963492
- TLSH
  T1E511CEA825D669242693A0F4076FF44760E97013C5CBCD017CAE42809F9512C8A61AFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  app/Models/SystemSetting.php
- Size 2KB
- SHA256 e89bac26a16f679f3e37acf4cba3aa6eea512a5184d72a33c0386ebeeccdf1c0
- MD5 86e3032b1f2858fa74a8cc20e71636bc
- SHA1 1738ed720f1e41a65503e76b88bd10b54bca8af7
- SHA512 a9690cd236d4b57adf3e72573f48cfa86a695015815695f15e67dd904ddadd0224e48deb5b67c215d735f00f621c265ea8b5df56382e460a19dc368030bad5d2
- TLSH
  T1DC41D0391EA7D242688284B7D67D9103886614070C853DF3B9EC67190FCEB6EA675DF2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  app/Providers/AppServiceProvider.php
- Size 1KB
- SHA256 a996d6ca5128f83c85fe24814c4457f6ae0540c1997f70e961dd49eb019fa5d5
- MD5 072fb101db0c432306069df936f3cf3a
- SHA1 cc966bdb3df9719a5097b699fdea41f9b30e22e4
- SHA512 0181aa48cbefb4057a24edc3b10a893a8b3c52d337a3724f783e78ea75a04f26b467ac2f755616f07f651253b2ed4e4a9f00bff9a3c4665439406c18378f101a
- TLSH
  T12631481844A944AA2483177ABE6FD710266045531C3AB9323FEDA312DFC5CBC7E724E5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  app/Providers/Filament/AdminPanelProvider.php
- Size 3KB
- SHA256 86a4ab16ac565080963ece82307dd6ff975b8de3a835cf5f13f02a68d3d36e64
- MD5 d9549b3a18d104ec45b7289b27de3da3
- SHA1 779ffd02249cc3abf5b08b3198727eefcb9d5bb8
- SHA512 52c3edc30e77cd58d1832c5421143276dd22fbb025a476ab9aa90a2038268d927f89830f8e16a34f8bc6ebe599f92811383da4982a984ffcb49930b1c619daa2
- TLSH
  T1DB61A744619C47B5C71F27B865AF9B086420E067FD696D917BFF13802FD89A434B838B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  app/Providers/Filament/MonitorPanelProvider.php
- Size 2KB
- SHA256 d3a871db2bdb8a64c6b9a3e6a0c06cd405537f44270ab75e5d0006fad9d95308
- MD5 e579f2194b0aba22ae9cfc9c2f1ac41b
- SHA1 079d1b0c5f631e959c95714b7ea221500ed3a660
- SHA512 47f40a13e930d288834119305edf76afe4da6edc21d537f4bb29cf93374cc1d67171bc4957ef0c33371dcc0530f1e83e7b14aecd50ba226a8dde1fc25969a8fa
- TLSH
  T156512F10769843B6CB0F33B9557D9A186550F0A3ECA46E617BFE53902FC986528F83E3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  app/Services/AutoReorderService.php
- Size 4KB
- SHA256 3a8b8228f1ef6ce6d4354fc38b9ab00d4ef6d86b6ef0a1cd96837e8ef83b354b
- MD5 830a103d79e54906071371b9d3e2e883
- SHA1 fcf3bb6ac62be44ee345bb7064e33c75493049be
- SHA512 001cdff98e868eaf88bef48963d450ab6cd73f3c1eddb76f2f2c8e465c711516eca1f88418488a38cde17b28330b501cc42442cababb3b0b5a03423a487977bc
- SSDEEP 96:89eq4s8QCIYyMGSBvOCwoK+Pzw+CZ/duOYVx5CEepUB+C:weq38Q/KGSxOCwoldChdkr5CEepxC
- TLSH
  T1FDA1A02A75BA16612292A47A177FFC1394D81093DCCBA9E0378F93C84FC652854F9ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  app/Services/MpesaService.php
- Size 9KB
- SHA256 e2afce5651f2950d901c6e27cd87f2c6fb0781833dacaa93e56531b3176ce464
- MD5 5365a306aca83b6177ebad24205b7bc6
- SHA1 73ba450195412d133a1f75513082da6a0c58dd69
- SHA512 fd5d21c12ca6698b2ca215f899c37311891c1c6fe219479d7822144b08c04ffd78497ba1f7a30c95273d0742810ae2b85bbae652582b66756d896abd056b2f45
- SSDEEP 192:SUWsmipC9sO3yugN+ZTQkqy3yElMDwH6KyWC+iMBc/0KJDiIAyz:Sd4tr2vqRwH6KyWVTcL
- TLSH
  T1A31282007C9B04222A63907F2B8BD9206108D1036E89E867BFED23651FEA77DF4F2175
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  app/Services/SmsService.php
- Size 1KB
- SHA256 0b78b91f16d4198721525f5eb92ae273c3a9e1d44b9b3b69ffe2c796bc85cf7f
- MD5 ce73200c29f7717769e9ad04d3f1b84a
- SHA1 4a33daa582a5f7afd375e47b6a983091ccac6223
- SHA512 be7d9508de882f0fea1144f1aed5eb729690814e461590aff5540a8fd0152c360cfee901209af87cbe44f65c79f4406c5476f073b0dbea6a914b9d2d737cba2e
- TLSH
  T10821CB9914EB6D72958790B53BCBD581B195C5031D8DED0AB8EC0384BFC4BAC98316BA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  app/Services/WhatsAppService.php
- Size 2KB
- SHA256 28d1e8bd4866a69b9e44319ec347e095cf558ac3825148bdf39467dafdbc5769
- MD5 d688fcf5672e7d55c58e0218181715a0
- SHA1 472e3461fababd81bec2c392f73f65b6436bef60
- SHA512 8dff89d747514957d22b9284c244390fb0872cff249fda2c262d6f523879c88bcb9fc3a4c1157fca66948be16ec8b3dd687290ba1a8e93dab0ac350e1507d85c
- TLSH
  T1EE511F9444F7AB211B53203EB74BE4026810421B8DCDFD17FAEC13A26FD126CB675BA1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  artisan
- Size 425B
- SHA256 f91a517c0c5d3a904c3f390933964a5e08ec1fc68146882730daac4aca4ffcec
- MD5 e66bb13691f6184c762c196427d8e685
- SHA1 b8f0fc8820d5de0b4de5710b0184fa998e156089
- SHA512 fa3f43c9125e19995c2e8b17663396fdc20ca4007e1bda34cff35738d65b3b88ae1e31de1118ef116f00a8b2f2f25b940192f98a11f67d63f756b1659becc1de
- TLSH
  T137E0A3FB078C02A1DF9634DE164CD4031C5DC9177CC010A5F415395887C58DA77573E5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  debug_root.html
- Size 47KB
- SHA256 fea8d4374c0913e95bcd0bbabe52e0132ddedb5e892d648027e29968495bf164
- MD5 176226edc9959a50707bcff634085d2a
- SHA1 bfe8fd19515bbd3e3dd31817e7719c0a45936315
- SHA512 17cba3c523c277d3810d5d33d67584b1aee129d75326f5377ca10a8a4ab97aa0d5df50f93cd40c7f0f7a8472853fb09098b5a0c8d493fc35315bada1ac3f28ea
- SSDEEP 768:ZGmCoFkmyUkiD9QZ1uOhERn93emZUKd4mI9EumOkOmTbA0e:ZGjoum2iD9Qy7RRUa83
- TLSH
  T17D237238E2F515BD204F5276F6211FA2AB6FCB03E68BA7E9B1ADD1601F97C508D03194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32