3128b0b857b8b852c4076d9557eb47e9bb57c054799ff89bf349b2f55947967a

Sharing

Copy URL Twitter E-mail

General

Target
api-tw.zip
Size 906KB
Sample260705-ws36zaav8l
SHA256 3128b0b857b8b852c4076d9557eb47e9bb57c054799ff89bf349b2f55947967a
MD5 97a2792fc22d1d7804de7b3e697920a7
SHA1 276717f2034c9fb40eaa219adeab084c8f037630
SHA512 4b942f5783ece1c2da27d20355a53a71ed0f82e9414b4e349492f42426373ab2e8eb2f7cf1491aacde6e0391c4a5a15554f5624d1755c6672714b46d5b6e0a83
SSDEEP 24576:Ngc7GvYBbjTisRtD5hWOv9JCimqssPri+IFEkCez:NgjYBbxHhR/jTiVpz
TLSH
T11915CF34D104146ACEBE423CCCC73350EBAC797EAF6924B53BAE81D11A8750935B9B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  api-tw/api/balance/index.php
- Size 4KB
- SHA256 c8a0993bc74af2bdf77a4680c471a2f59763fef464bf92de0769d133cbef9164
- MD5 efdd51354ae34326a8357c736bd9e173
- SHA1 66ab3011284cf06784b10c9c157029a1e700f7fa
- SHA512 f606a1b8d5cd8a540562683aaaed0a773da5d964248e128dbacc3186e193eae456dd4dc762ac4b2b59cd3329ae307a49f8d481046d8d09b5fe57a6606fe98469
- SSDEEP 96:s2sulxLnrXUMgBjdDA9Bvyy9Ei2m3iQMG/IAOzPIAmy798imR938:s2subXUhpO+
- TLSH
  T17B91D833E3E128FBE661483502B5B9E675527E9D80DEA270CA7798E8061CB3CD336124
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  api-tw/api/confirm/deposit.php
- Size 3KB
- SHA256 9a614752a644db5497e0073dec59d2aa178876f4c6836137ed49ddf8f70df6ff
- MD5 f51ec7a3baf9f0ed5b882378e39c55b0
- SHA1 7c607486f2840e4da377308a0264ac07330923ea
- SHA512 969370d421164ef3938e277c27f73565555af1374fd6bfc7b072d3015575db776f2112b721ed994f9bdf700e2015d23b8299b298aa14bfa9dd438fccfc1bfd6c
- TLSH
  T12781C832D3D534FAD2A4442881D6B59736813EDC42DC663089BA9CED965CF7CC736618
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  api-tw/api/confirm/withdraw.php
- Size 3KB
- SHA256 586f265af4c69f40fd90b0402f7a567fe5dd82398715d17523b5f8e91a57deed
- MD5 9e698650a4ec7405ad576393094093a7
- SHA1 aa8993f8c62adfc07451561ecaeae64c83c2468e
- SHA512 1376f04055fc55181ac336f8e5fdc9c6e6751e125ab44f5535f9a860d4a9e18ae6d719ac237a21adb2150df0fb39d56d63e91ecbbafb70a09e1c171823105370
- TLSH
  T120819532D3E528F5D2E1942C42A6746772D17DFC82EA5651C6BB9CEE9628F6CC332010
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  api-tw/api/system/config.php
- Size 2KB
- SHA256 49258cd2a05d5f318911385cc078fec868f91f453178043ac1ce957696c2bb74
- MD5 ef4b0f66966f5b6f5e1dcb6c19f916ef
- SHA1 84efb5c6154b39863de518574f4b4b02123f652f
- SHA512 506f7310ce526e1f9ed17de42dee3751da15253a51d7bec2ce38afd98cea37098af3ea40d8f3aba4d06b3819b025f126b6ae193dd2688ef859851633a1881862
- TLSH
  T10C41203574D3962A07534069CA8BC514F17F8523036CCC91BC6F83A9AF81D54DDEE9DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  api-tw/api/transfer/deposit.php
- Size 4KB
- SHA256 7996f7b3da06f4d8c0c855cc3dce80b99e91f48da375b3bc73248efac818e424
- MD5 fa4b4b7bb7c400b7c7e388ff8f29201f
- SHA1 338c76148e55e10fd375100a57733fc33d3a545b
- SHA512 58e5d3060eac938ffda3b5a58280b2488e5a05c85526a443bfe9c2212d1dc29b2b17021900d144c75b6688fde2c5ae182881b4a7194ac6dbf7e3fa8d7ab0682f
- SSDEEP 96:s2sucELnrXGMgBjdDA9Bvyy9Ei2m3iQMG/CgZrSNyQAOzPIAmy798imR93x:s2su/XGhpOYG
- TLSH
  T159A1D833D3E228F7E2A1483542A675A2B691BD9D81DE6270C6766CEC461CB3CC735224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  api-tw/api/transfer/withdraw.php
- Size 4KB
- SHA256 10b7d5f56e81e05fd699e5a68d205ab1872fd294ea11ecec022a7e2914f53867
- MD5 b503b35033e374b20fa9f69f43db1103
- SHA1 31d08fcc00257b6a2c0ce9e17a55c794a7241a99
- SHA512 d0d1f8acb6be9f52842debd3e09b7523a72a3b313ca7faff4c10723765da8dac9979d34cdf3111edc8a9101699f5307b26ec9d3ea7a6da4f9fb63111723bc22d
- SSDEEP 96:s2suv2LnrXPMgBjdDA9Bvyy9Ei2m3iQMG/d6ji5nbnL99MzqZr9EiYCzc9:s2sueXPhpOSW5bjUD9
- TLSH
  T18EA1E833F3E534F3E291C82A41A576A671927DDE82DDA23186739DE94B7CF788231114
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  api-tw/config.php
- Size 2KB
- SHA256 eb1dd01d65b86428906a5196e064dd8fb21e5a613d105ce431a51c3619a3ea1b
- MD5 6f52d373f163b82a91ae89731688044d
- SHA1 39cad01e789b6d44c6287e27a95fdf2e8e8dd18f
- SHA512 e2f880e51e672688f19f7456b59cc6ffa74885a5fd4f2949d62ee69e2087f81027d99f3d4f4515fbb7cae68ff890964e211ad7012278702a914abb5b62532ede
- TLSH
  T17751245A7482996307A380B89F27C144F16F95077319C9A1B66FC3B42F40A25CEFE4EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  api-tw/css/OwlCarousel2/Gruntfile.js
- Size 6KB
- SHA256 6f858c3b8941f605c0a2c5673a7bd9a88422d2c6d81305834aa9449702b03874
- MD5 15742b22425a578c854646592c42721d
- SHA1 629024e33a688a15c2ed2faa6cd352877d415659
- SHA512 db664329726ba316274c4905887a89e2550a19b322cc5d5136c24f9520f1df36aaf7b5f98742d34408351a860117fe62e122aeceea6be06eee7d3c99bdd2146d
- SSDEEP 192:0ikNG9N2HeaF2e5UeYDvKQA/K3vv95+LecPhWO83VVci7tu:0EfyeK2e6eAf14Kk0k
- TLSH
  T131E1BEC9C31CA15F69C061DEFC4C34C1A52C8E31E823667BF8BC76A876DC5498026A79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  api-tw/css/OwlCarousel2/README.md
- Size 3KB
- SHA256 87f1fbfb563b30399584fb4fbf965fb029dffa5f988ee4f55c368a2024e6981c
- MD5 048d6839b0a5cc6c2d35faa4476210b0
- SHA1 287f460bbc32d82b3e2ecdc2d0ab927eafc6c15e
- SHA512 965f60e76f30b35b24019ded7809c1bab7097a823b8847cb2d1e65b0a04ef258f37f57ae3fc9a4704d3f18dc5dbca2bca7dc08d9a5c9f51058324963aa2d568f
- TLSH
  T1A181702F754456230D6367A1F5B77187BB2DB6092250F07860FF022C1769A99427FA9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  api-tw/css/OwlCarousel2/dist/README.md
- Size 3KB
- SHA256 87f1fbfb563b30399584fb4fbf965fb029dffa5f988ee4f55c368a2024e6981c
- MD5 048d6839b0a5cc6c2d35faa4476210b0
- SHA1 287f460bbc32d82b3e2ecdc2d0ab927eafc6c15e
- SHA512 965f60e76f30b35b24019ded7809c1bab7097a823b8847cb2d1e65b0a04ef258f37f57ae3fc9a4704d3f18dc5dbca2bca7dc08d9a5c9f51058324963aa2d568f
- TLSH
  T1A181702F754456230D6367A1F5B77187BB2DB6092250F07860FF022C1769A99427FA9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  api-tw/css/OwlCarousel2/dist/owl.carousel.js
- Size 87KB
- SHA256 db9d6cf3c1c4b047c62f646e7d9991c06a212931c362bf53f9a2406b30f09466
- MD5 ccdf893e7d8b26933af0c336bcc3943e
- SHA1 ac575ba3377f95ef22bad865ec35b0b3dcb0dfe0
- SHA512 818db99c2eb775d1342dc2cf871509185c5ad86a08c80e452f29b8509a870c43078e9f11113e999ff487a35b25b6ddd6b95b6a7f2c4408fdfcfdd69473f59510
- SSDEEP 1536:owLoreUC7AuLMjvNlP8GNMBJ6IcIhKJQIOybQOoiYM9OJ0QQKOv:oUMNlPBqJTuOGQOotEhKOv
- TLSH
  T1BF9393C5F36C261B422631785EAE23CE723D402AD911186F7CA8E9DC29D546C436EFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  api-tw/css/OwlCarousel2/dist/owl.carousel.min.js
- Size 43KB
- SHA256 a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d
- MD5 f416f9031fef25ae25ba9756e3eb6978
- SHA1 e2a600e433df72b4cfde93d7880e3114917a3cbe
- SHA512 6cfb3b01eea956f84e4a221cc940a547bfead8e02c462a2fc38bc0917fb325bc374a101e7aa7b3ab9d11208708511abb39adb4ad6da7daaf9fc9704d714f65af
- SSDEEP 768:UCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSGc7UuHjRUQuFBt33:PITMFC4dbMVRSGcgRDV
- TLSH
  T1E7137346B3202D2A869B61A0663F160BB23A241CE414547D7D79E6DE6D7DC8C213FFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  api-tw/css/OwlCarousel2/docs/assets/js/app.js
- Size 646B
- SHA256 c638863ac4eabbb641f874c8a519ce0ce8813159e2d3ef0faa3b6771752e6eb5
- MD5 adea774b31f20be8a68bc3a742bcfd45
- SHA1 20a1b70b2566fe2fc7ac44b8f84daf550b62b517
- SHA512 67f73491b62bf2ae63632639a71114942c793f11ac6126146d44b89abda0b70beef2d2fbffcfcc21992f088fd3cf1fca90422dc8ce3042a22eef59e6ac51dad4
- TLSH
  T184F0DD22F73E75B713BB3105086E24CA3E3E28D97845E861FDA0842828D0147A369C0B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  api-tw/css/OwlCarousel2/docs/assets/js/foundation.min.js
- Size 88KB
- SHA256 990c59e13ed8f4f6fbb59b8fa94abed4fbcdf09616933ebf3058990c3d63e3d1
- MD5 15220b40d8b7698c61d43e4dab2b139e
- SHA1 f926568b0bc0503c0b015751cd28a7b284e469f2
- SHA512 9e1c6f43e7edd9ef68932144497c9922267f9d4e0aec12ed58983424b0ebf52afecaa383ed16ad855d1bce68ba8bda7440477d8780702c6328d4e8edf7523ff4
- SSDEEP 1536:99MeJo+aCWsQC0ZNDHbejgiMVGQvzoURBBygAUlEV90nMG6Hi+myGunTbwJkNAZK:9E35qUx6y4GvDyR8pu
- TLSH
  T1D593FA06F2A1306A01FB75B5412F020121335869AA55A83CBD7DCAE9DAB4DDC2177FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  api-tw/css/OwlCarousel2/docs/assets/owlcarousel/README.md
- Size 3KB
- SHA256 87f1fbfb563b30399584fb4fbf965fb029dffa5f988ee4f55c368a2024e6981c
- MD5 048d6839b0a5cc6c2d35faa4476210b0
- SHA1 287f460bbc32d82b3e2ecdc2d0ab927eafc6c15e
- SHA512 965f60e76f30b35b24019ded7809c1bab7097a823b8847cb2d1e65b0a04ef258f37f57ae3fc9a4704d3f18dc5dbca2bca7dc08d9a5c9f51058324963aa2d568f
- TLSH
  T1A181702F754456230D6367A1F5B77187BB2DB6092250F07860FF022C1769A99427FA9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  api-tw/css/OwlCarousel2/docs/assets/owlcarousel/owl.carousel.js
- Size 87KB
- SHA256 db9d6cf3c1c4b047c62f646e7d9991c06a212931c362bf53f9a2406b30f09466
- MD5 ccdf893e7d8b26933af0c336bcc3943e
- SHA1 ac575ba3377f95ef22bad865ec35b0b3dcb0dfe0
- SHA512 818db99c2eb775d1342dc2cf871509185c5ad86a08c80e452f29b8509a870c43078e9f11113e999ff487a35b25b6ddd6b95b6a7f2c4408fdfcfdd69473f59510
- SSDEEP 1536:owLoreUC7AuLMjvNlP8GNMBJ6IcIhKJQIOybQOoiYM9OJ0QQKOv:oUMNlPBqJTuOGQOotEhKOv
- TLSH
  T1BF9393C5F36C261B422631785EAE23CE723D402AD911186F7CA8E9DC29D546C436EFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32