b29134cb852c36d063e99c44080c124fb4f7d012f833f000c8092bbb8fe78938

Sharing

Copy URL Twitter E-mail

General

Target
oxigeno.zip
Size 29.1MB
Sample260705-wsczsaex3z
SHA256 b29134cb852c36d063e99c44080c124fb4f7d012f833f000c8092bbb8fe78938
MD5 1151e1ed45cba4adec30c8f9c472ca2e
SHA1 0eb58916d285f342185cd5ead35adda0227dbf95
SHA512 c29339c269492336598a7817ba14ef5b6461040552590a27c66dd128a44288be2cbea9340153be2c08559eb36cb906d3d953a1a54d7d5520f5763cbae161facf
SSDEEP 786432:mid6LCkvNnTN8iblagU6GzeCcgXojOASv0A6Of1ASxv:mMEvNCiblM6GuV/ScA1f1ASJ
TLSH
T11B6733A4D7754716E52473F827B076AAD23C86B10DC15253A882007AFFE539FC8D4AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  oxigeno/fonts/fontawesome-webfont.svg
- Size 433KB
- SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
- MD5 912ec66d7572ff821749319396470bde
- SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
- SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156
- SSDEEP 3072:PLac0AVfCwGzG8LY4kh53s0eOnz8WjKAOvX7LYvglcD4ZME8xYWDQqJpFDBl4qjm:hCG7bFv9gSS
- TLSH
  T17594C96CE9910B79CBDD42D5957D0E90132D81EE28783E1846BEA8F05D06B2A0FDFBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  oxigeno/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5
- MD5 89889688147bd7575d6327160d64e760
- SHA1 de51a8494180a6db074af2dee2383f0a363c5b08
- SHA512 c2e77eab327af1469097c31bc0daf820c066b0222059d8ff0ecebca974b62b7535e96f1f356643b2b62763a924d040e4ac9b2097e1de2c22226411fde8723743
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEI:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo08
- TLSH
  T130B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  oxigeno/index.html
- Size 30KB
- SHA256 5d7a46492802258bcd5d3c6749289e947fd61cc92860b7e665e18be5fe75645b
- MD5 51ce9ef426df400e533fffba6f582d24
- SHA1 35fc7653992478e7adaa838bc10bbae73df2dd5d
- SHA512 b1b71777164800b6211428848005836934efcf4ddd8491c8d9ccb7d6c3fc6b6f8ebb3c4c9617a9982cfd981cc5e7da30e4b0ed3592930e65e5b189640f4a4eb8
- SSDEEP 768:AaqsJ0vOib/3OhdV0DTaCXxPon5h5XYxoV7KBHn/dlnD7:5b0vOi7+vmvVBgn7qxu7KBH/7nH
- TLSH
  T18BE2782268C0882301B7C5C95A256B66FFE2A25BC61B9A4073FD2BE74FF3E55DD03544
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  oxigeno/js/bootstrap.min.js
- Size 35KB
- SHA256 d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
- MD5 8c237312864d2e4c4f03544cd4f9b195
- SHA1 253711c6d825de55a8360552573be950da180614
- SHA512 e18a5959736a9ceef67b40daf7964c519c678d680bbda8d2c7679281f5d349a286c99b96ca24e7a8e64ce987d372d74ae12da7255c606ccfe27ac13a35b5a3d2
- SSDEEP 768:b8lBD27UwlNBMl9/qahC2+jS1g8ep0skCXFXflcKGf3Z1RQ:oe78+S1Klvla3ZrQ
- TLSH
  T1F5F29606B23031A107DFB1E5515B020B72396A6EE90690BC78B9DAE53DB9C48717BF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  oxigeno/js/html5shiv.js
- Size 2KB
- SHA256 b3aa003abf3b6aaf1654fe8669472e3c01dba7bb73be4a8b73a3423cfeeb0e39
- MD5 262bb88879efaaf75c74154fe0308952
- SHA1 2123253519c0bee8a5735958281a73296a66003b
- SHA512 d3915b572fce20ce95c1d5a0bb75f424bf3d6f71e726a77afb50e85c457603d60241cb4698227dd3cf071b7133fe444cf2f0e6728913058731173fbbc9ccaac8
- TLSH
  T1F44155893163205A879B20AF523EE30BF6F47266E9694051E49DCC7DED70DD0827FE16
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  oxigeno/js/jquery.countTo.js
- Size 2KB
- SHA256 ee4a99978f49792845630da2169bf98164f013c7c88502d1928bd4c2c9628fab
- MD5 c7d3381598a48a6823bfe779beb3960e
- SHA1 9560b54cc652a9a8171ac2f23f1a0316d44481c1
- SHA512 660fb9a3778a2beebea2a9ebdab716927d00a5bb41101d032355b7390d1e03a86f39a7f6d943594fdd22ef86e734e4aea44118369e3d4c294553337123b5f933
- TLSH
  T138515245FB4E209D8A6630BDDA0D528D0B2DA13504ABA075FD7E21880BD4C6EE309BFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  oxigeno/js/jquery.inview.min.js
- Size 1KB
- SHA256 423e09ae1666148e2718bd7aacfb05d17888e0554eb51fc343ef4317ef7d3b62
- MD5 4edba1c65592e5e64d420fe20104eb79
- SHA1 a0e2be2157e43e2dae20e43d08af042151dd75d3
- SHA512 d02491ef9bfac2839800067fd258adabdd6e36ab53de020f59b4fd82950cf922c32ae0771ccdee813a668c66a35e5f5183a8edd506d6efd89dbb44ea73a9ca72
- TLSH
  T13D21E0297301302ED0DF64E3B1AE1D091863A237D302A8D5953AD8D9167C47835AFA9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  oxigeno/js/jquery.js
- Size 94KB
- SHA256 b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
- MD5 8fc25e27d42774aeae6edbc0a18b72aa
- SHA1 b66ed708717bf0b4a005a4d0113af8843ef3b8ff
- SHA512 87d90a665c15d71ac872bd8bc003d9863964c7ec7ada6370b902b93c0bbd7770fe25730d946c7c6a465baa95efa74bc0e78af3f83aea615af35060cc8702a6c1
- SSDEEP 1536:EPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jqkODZ2D5N9Rag0MOIdSZAgtgoX5Yn:bIO/e2D5c4LgtImLja98HrK
- TLSH
  T1CC93E8D9B6D2706297B730A851BF510BB17698EAB80C4C60F058D8E47EB4E8D507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  oxigeno/js/lightbox.min.js
- Size 7KB
- SHA256 6c8abd074d9c4f8b738945503c713ca0f39eefd42421b7902cc3b6ac83d954c2
- MD5 dd614a6e54383b733dbe5e20ba7859a5
- SHA1 128273a9c66a32d7d59a6f290deb6cc4a2b2ee5a
- SHA512 94c79515a63600c49846391e05d9f424e872679acbdffff0a21130a6e1348991ce9b326500e58c51aca170995fa26207caa76f10d7056720a031b19d0f9dce7d
- SSDEEP 96:tov6PTK8IGftdKcaevYgzozT9piR0CJKTYm0mt0ey8/IwCR04BLNKZG:+v6PTddKJevYgczJcyYPSSBqG
- TLSH
  T1BDF15305FB202039EA6E40D7311B5B26133A6636BE07DA6D743CC6E959F0D44597BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  oxigeno/js/main.js
- Size 4KB
- SHA256 2a913f67f18184d2e685601241df32d64bc0253226375f75efc5c63015419a45
- MD5 95a3fd7365cc0cfb77ad031003288c83
- SHA1 0f9b8d828de858c994acc18d28b1ac9bf8dcca2f
- SHA512 e12b0d79b9fa146bf75080663ad391b3cc16252663a917c7b1467fb8d3605644fef33d7f1362d175553524f4b59159ec5bf5a6bd575e0a4e5d1845f4ccaa61b6
- SSDEEP 96:F3jPE3SF0xKAuNe48jgadmzatno+YGux2LMv8bjIv:dY/jVjldm2tno+zMv8a
- TLSH
  T122A1741570ADB91A84EBB16D813FD700AF3CE163C50795A568BD4CEC1DD0BBCA362D98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  oxigeno/js/mousescroll.js
- Size 9KB
- SHA256 f90d927787467e1035c72bc75628bdcf51c6a61640f446da512f50d2619beac2
- MD5 674f46eb4a4e06e82ee29894603a5238
- SHA1 ca972c3e9c8faad973385dbb7b29dacb412a04fe
- SHA512 7ec8d6d6702378c6849330591c05e13788a0139a5bfa8c2324680f61b28999325c32d795cb36659bd086762147a6fdc84dd372210c4b44c677679e66212f45bb
- SSDEEP 192:4dPSt7iOlcrqQG7A2GN24Qla2H2ulS292tlp2Y2ll0cqG7LOKiWXbTBRCEB/A7PN:4deuOhoJalauDlSqYlp5Ql0VyLOMbTBo
- TLSH
  T19C12B6D7B349B122C3EB31ADC24D33D4B7388119711D786A2C6BCE6D74828B983D795A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  oxigeno/js/respond.min.js
- Size 3KB
- SHA256 1d733c7b92cb33ecdecfe740c315e0fde44f46b6f3cb3700ded9520aeee1e38e
- MD5 48626676a875709c0d5e7bae93cb02c2
- SHA1 142a9caa4c384b905702bd5f62f8e6ec617e1e36
- SHA512 a133ec6ca8b11553f9e940bd30faddeeb2465bd5cc9b48f3431670140c1f4d1d74b2362729e1e907e50d6a2411ea58b2027996ff0ee3e5f7a420526f8efda5d4
- TLSH
  T13C81D9A83229315CA3B76079667F812DF8775C9375255880D91588E83C68EDD00BFEEB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  oxigeno/js/smoothscroll.js
- Size 6KB
- SHA256 ec0ce2360f8fc0ec941cb30b7630042028323d6598baded68a57fce4b2167f6b
- MD5 0b2a7551b434ae23f257bd184714dc19
- SHA1 54f770124535b4a77c0eafb0289d6f9ec3d6fe03
- SHA512 06d55507174633d2055f98f9102dfe981903899e453fdd78acad17ab67606805ea637b502003672667d79fb06287b556fbcf418d0fac44862250183da8f115fd
- SSDEEP 192:cAPS2IfwMe/hQV51iJirZiZhagJdFdV2UghP3pPVlAA/ie/1pPRvdG2C:cOSD06tCVJElNA2C
- TLSH
  T1ACD1E365A9E32472A21B743A021FA2083A620403128EEFA7796CC5787F54F7055F7FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  oxigeno/js/wow.min.js
- Size 4KB
- SHA256 bf5756b42791ad1d693196b5b2e57e93a387d45dee7ba02322a001c451b8df05
- MD5 1d974e35932504e7bc160cef807ea041
- SHA1 289bb4e924c418a7c229ae90c4ed6ec9f07866e8
- SHA512 ef5083270b57e712ca65d3ab8bef54c6e9f49c4c3ca7e4156dbd3356baaa610bd1ee84bdb821b6fc7ab97eb7f6abcdac565e184eebe1364f5fc1a816e5248614
- SSDEEP 96:xGqKtAZw5D9jEOVEE1VlebgJAW42IJDaDle:EGO55YOVEEblekJAWNIkDU
- TLSH
  T174A143C9BB467032C79792F1863F4205B33A15BDA009447CB6B984E57D34D299236F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  oxigeno/portfolio-single.html
- Size 1KB
- SHA256 459851d328125e6f02c3d3373a242f7ce0f5fceeb2f8659133305b19b156d1d4
- MD5 1337186b715bf3456c3e93ea400f34b9
- SHA1 77603f8e0a10a46ed6b371e670929b28d411bcbc
- SHA512 f5440633600c0cacd5e6c763a8e110a0281418092e58bf6f8c2f3ef50fd80a5496d4dc24f143195a285e85dc3048ccace295030c0a3c326daf85e6c357cc7952
- TLSH
  T17511D326821E5E3B375371F76179758AA0DF7A20C733D656F7F7C20B8581C02A422213
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30