bfa0afc8e945e872cf3c52c78dfb3ef87ea7fd01ce08f4458488b2d3e9fcf40d

Sharing

Copy URL Twitter E-mail

General

Target
Idkplc.zip
Size 6.4MB
Sample260705-wt9p5sey31
SHA256 bfa0afc8e945e872cf3c52c78dfb3ef87ea7fd01ce08f4458488b2d3e9fcf40d
MD5 2989c70b7a121eb0861800d8a566d4fd
SHA1 1f36175aef914c2897e25c9984411a5e6b41707f
SHA512 73d485d3949b5f8ff83c3b1cb56c5ec5dfcd2ccae178980db0bbc2808889e159e0646645d7c41830fa337998c5a394427dfac420d3db79aec48e98d2560e27b9
SSDEEP 196608:54DK3qfi+Y50g4ek1COLToE/DEZoyyUFdUG:54WaO4ekVxrEWyyUFH
TLSH
T1D16623FA46EA2025F58D6CB6585B8AC6D0CB856764CEF7384A399320D70409F377EF09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  403.html
- Size 668B
- SHA256 59cb88822cd306b25c795a4d813758c1e0f59f72436aeb9817cb6030e0bf3115
- MD5 91beffab0d6adedeb80678ef2147d06f
- SHA1 f8033a36527a76580718fee9cbec739b9cee8b5a
- SHA512 3779eb562cc39f52ef81478774ddfa66733de027de4c2f85a9055db1fd3770a16a1cee1b87eab4648d52ec0e5a70eda8c2448c7040b80970a9064136a71131d1
- TLSH
  T17701994EA27628315325886910033670E273AE16E38BCE31318E23318FE56276FC37B9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  403.shtml
- Size 668B
- SHA256 59cb88822cd306b25c795a4d813758c1e0f59f72436aeb9817cb6030e0bf3115
- MD5 91beffab0d6adedeb80678ef2147d06f
- SHA1 f8033a36527a76580718fee9cbec739b9cee8b5a
- SHA512 3779eb562cc39f52ef81478774ddfa66733de027de4c2f85a9055db1fd3770a16a1cee1b87eab4648d52ec0e5a70eda8c2448c7040b80970a9064136a71131d1
- TLSH
  T17701994EA27628315325886910033670E273AE16E38BCE31318E23318FE56276FC37B9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Barresi/Ir/bots/Samane/Plcman/3pop.php
- Size 12KB
- SHA256 1a358cd6f294b5a7fb6a4f52c775a143b58c3eec6848cacad096cb4bd5881be0
- MD5 d581cd7a4069583ee8df15945e89c263
- SHA1 520f61a3a3237248607fe5939c5887083cd4320d
- SHA512 c16575e7abdbefb6a78e2eaca0937df75e1112dbfd743c958861003cc839aed497cbb0bbc348990ef5e5b1273df69c822d02873493ece5a3885d8814b4ac56f9
- SSDEEP 384:gJiMm8eCFLXq4BcyrF26G1kguuBoQOkF8EhXM:gcMm8eCFLXq4BcyrF2X1kruBoPkF8Eh8
- TLSH
  T1ED42C78296F8023971239075A6D332657B7A5423C14ECF60FAFF9EB85FC49484F1BA19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Barresi/Ir/bots/Samane/Plcman/Policeman.apk
- Size 3.7MB
- SHA256 4e37a0ec3d96ba8f03b53df7718c7f8d93b64f761d9a381d35b9c48d232ed8bf
- MD5 046ef5aa9e1f6d4db9f2336f41be8c46
- SHA1 b799ecf5e5a1e1796d802640c22f8b00a405d182
- SHA512 0d1f5443f9170353428bae5574c5f5fd5975fc5220c26e3306f109dc0a9af7ff188153ef09a708d5b3884a5ed15ef6e8a3a889db9bcd6c3114753bf08712272f
- SSDEEP 98304:SMpKKsF5ntQN3FpZfiYeT8E/Qzvl6NjdUzdp5etHGB/0/orG7CD:vKF5nWN/ZKYM8psNZn8Y4
- TLSH
  T1F6061296FB05003BC4FB443685AA5362527B4C468AD3BB4BB694B21C6C7378C4F6EF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Barresi/Ir/bots/Samane/Plcman/antibot1.php
- Size 6KB
- SHA256 aa152960e34e3b0a4a2423caeea73a5ce0dbf02262ed82d15e958fa4fdec8e45
- MD5 161737ecf18fe5eceb44b035cc7b3811
- SHA1 cc7811266bafdf98977a8e674ef6198e3834c960
- SHA512 a64227c9cacd5b52049a4a38eddf220d69d622e4890e6119f61bef77d28f74d6ed93f93219c51c2d1821da3badb89f2240d38b2219a75e83d64acbf23609cb5d
- SSDEEP 192:ooYHrOco526nKzggCi+mPynlbiL43vLJMg6e:7YHrOP5NXg+maIL43vLJMgp
- TLSH
  T1DDE1947E40A826B789F890D035E1D1B9ECC80399B6A15854FFF1114C70296B8F6E93BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  Barresi/Ir/bots/Samane/Plcman/pop.php
- Size 12KB
- SHA256 6fb91dfa94892b938fd2a23ee8c704fee9442c7be69408756a266981d04fc897
- MD5 f736239ab1dc24c49f2ac72b0d5f33e0
- SHA1 b52b75c4c0cf3213efd2dbcb453afa4577307252
- SHA512 b37f03a800a21c265fd08dfa6ab167877249e48878220e5fa9759d42cd1c6a70b44b3b00cdc7ac2e58a09ce8ab7fb661edc4c5b3d4052b7b36a3760339e7cc95
- SSDEEP 384:gJiMm8eCFLXq4BcyrF26G1kguoBoQOk49EhXM:gcMm8eCFLXq4BcyrF2X1kroBoPk49Eh8
- TLSH
  T12342B78296F8023971339075A6D332657B7A5423C14ECF60BAFF9EB85FC45484F1BA19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  Barresi/Ir/bots/Samane/antibot1.php
- Size 7KB
- SHA256 41a36b94b7aa657a409e0a4ce3ac18c3e25e56934c09f6d4fdcd38cf79cda30c
- MD5 6875b1a51f35541b4c266971709b299d
- SHA1 501b01363f9c738f02025e9ae181d57eb43192f7
- SHA512 491fa95e25cdcffa899109852d252ac0b0cc12b5807eaae53ffa873172a84910804150bf3a605bccdda491b3d80faa9d02bffdc8115c81db540ac377e387c5bb
- SSDEEP 192:ooYHrOco526nnSzggCi+mPynlbiL43vLJMg6e:7YHrOP5Nfg+maIL43vLJMgp
- TLSH
  T108F1A43E40E826F788F590D035E191B9ECC80399B6A15894FFF1154C70296B8F6E93BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  Yekparche/orod/403.html
- Size 668B
- SHA256 59cb88822cd306b25c795a4d813758c1e0f59f72436aeb9817cb6030e0bf3115
- MD5 91beffab0d6adedeb80678ef2147d06f
- SHA1 f8033a36527a76580718fee9cbec739b9cee8b5a
- SHA512 3779eb562cc39f52ef81478774ddfa66733de027de4c2f85a9055db1fd3770a16a1cee1b87eab4648d52ec0e5a70eda8c2448c7040b80970a9064136a71131d1
- TLSH
  T17701994EA27628315325886910033670E273AE16E38BCE31318E23318FE56276FC37B9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral14 behavioral15
- Target
  Yekparche/orod/Addr.php
- Size 5KB
- SHA256 168fbede1611b949604d85fa660aa6f465e5f55445ab8e575b6a4e5834977926
- MD5 6e9b1c753a8362def6ef96d7b22c2b19
- SHA1 23083ff41f84cc93433ee182dc5d71957d871bea
- SHA512 475a78a6f1e6b4c8889b3aec0f8df86b7c39a0725d578100750bcb8bda6ec4b3fed354f19fe3dc05222733d8b0312754559dbdf34352af29c36fe4a66851d6c2
- SSDEEP 96:/ozZGLLiGQAaPI+lkgo3+MK7laVbOYv7vmF:+cCI+lkgohGeqYDw
- TLSH
  T114C194E999431046E513C6BC5B8BAA046379C017EA46D84FBBDD63DCCF846DC80B37A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  Yekparche/orod/Theme/js/app.js
- Size 2KB
- SHA256 a5a25613d0c2d94b02571d30877b49a58b0606653f41e34fded8e29e1d47dd25
- MD5 95c713a2a098155b7c47d7168b7bf56c
- SHA1 f4692619f43e430885eeb3147b8461345f178d05
- SHA512 4cb976451319076149cf5ba199097f8b6e6b907637414a98593409e2018898a3e8fd0e9c4d00d95abbedd88b52f3183c37f4d643eef5c9f3f4b90fe487978fb1
- TLSH
  T1F6512329EDF41DB3105AF03508BE5247F530895B4D1A3D3ABA4C829C5F0EA2D61BE7E9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  Yekparche/orod/Theme/js/jquery-3.js
- Size 87KB
- SHA256 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
- MD5 12b69d0ae6c6f0c42942ae6da2896e84
- SHA1 d2cc8d43ce1c854b1172e42b1209502ad563db83
- SHA512 a55f55d56899ab440ef0cae17b28d5cc8f5b9766d1e9bc1a8ac6b89376924b476c1ab0c325497eb5d44af41f4ebf8eea236d87a36902244b8a3eca54994b8711
- SSDEEP 1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakV:AYh8eip3huuf6IidlrvakdtQ47GKl
- TLSH
  T1E893F9DDB2C6702257A720BA007F510BF236199D6C4D8450F265D8E9BCB8A4E827BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Yekparche/orod/Theme/js/particles.js
- Size 22KB
- SHA256 faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6
- MD5 00debcf6cf0789a19cee2278011afcd4
- SHA1 8017f8b1869077db728573f1ca4684a00af69462
- SHA512 29e7f9b1cee07d369c47b4d929e95cad1b35e62a5fefeb7e9fb661ea628d25b996fbf4517425bd9f07cb9f8617d2cda73ba2afe58d8286a8086a4682e8f5b4f4
- SSDEEP 384:NkfJtGvWjT6uYvqhCz8wSEHESxtVAFPQcYpeib+9rOEKXWd/:NC7T6uYvn8wRxwyryVOEKXW5
- TLSH
  T161A2934D23F73E77378AB2E09BE9D122C774A4D1399B04B0F93C667DA52549201EE7A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Yekparche/orod/Theme/js/script.js
- Size 736B
- SHA256 0e0ceec33081b70245ccdb221a4efb1fa42a495948920e075589bc7004975b82
- MD5 d1fa0bc0720a07738d421347e5e3a95b
- SHA1 44eabd17fd9f21bf57438e9059e645cc531bacee
- SHA512 ef71b7892edfa17e95fa2caef13f9a6a49bd929fed97619d431c517fb2289c45f1f2eaaaf1eba177a076d679307920ba3fa9af88108bc6f9e715839706f0a5a1
- TLSH
  T1B10147CCB8E3A82055B471FA0D7FD0027E3A6521504E9A47B484046DFFD2B6CAF6BD25
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  Yekparche/orod/antibot1.php
- Size 7KB
- SHA256 41a36b94b7aa657a409e0a4ce3ac18c3e25e56934c09f6d4fdcd38cf79cda30c
- MD5 6875b1a51f35541b4c266971709b299d
- SHA1 501b01363f9c738f02025e9ae181d57eb43192f7
- SHA512 491fa95e25cdcffa899109852d252ac0b0cc12b5807eaae53ffa873172a84910804150bf3a605bccdda491b3d80faa9d02bffdc8115c81db540ac377e387c5bb
- SSDEEP 192:ooYHrOco526nnSzggCi+mPynlbiL43vLJMg6e:7YHrOP5Nfg+maIL43vLJMgp
- TLSH
  T108F1A43E40E826F788F590D035E191B9ECC80399B6A15894FFF1154C70296B8F6E93BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Yekparche/orod/css/jquery.min.js
- Size 93KB
- SHA256 aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
- MD5 f03e5a3bf534f4a738bc350631fd05bd
- SHA1 37b1db88b57438f1072a8ebc7559c909c9d3a682
- SHA512 8eeeaefb86cf5f9d09426814f7b60e1805e644cac3f5ab382c4d393dd0b7ab272c1909a31a57e6d38d5acf207555f097a64a6dd62f60a97093e97bb184126d2a
- SSDEEP 1536:OP10iSi65U/dXXeyhzeBuG+HYE0WEeLDFoNqLTW8+S5VRZIVI6xSb8xh2ZbQnRmm:R+41ZqLTW8xRrqSb8qGH77da98Hr3
- TLSH
  T11793D8D9B7D67162977730B850BF510BB13A98EAB80C4CA0F0A4D8E47D74A89507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Yekparche/orod/css/sweetalert.min.js
- Size 39KB
- SHA256 2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
- MD5 f3b8ce97ff6ce324da6232da353adf40
- SHA1 2a3daabc70232c6350ab48d32605dc4a6ac1f1fa
- SHA512 000d41ce9e50d0ad4a6a728a9af37fe1ddc844a565bfd3d883014fbe6df69cf3ba412f321f51ceecb6e0075a6088ec4fb5f7a0e73127d9b6bae0c51ca89c7a08
- SSDEEP 384:/BLa4qL1li0jldLUuuRzdNU/CfFqLyX9ye1hAbj/i5Yy/kyyeu8pgUqaF2XSSHEj:ZLahUvdNU/CNqWX9ye1hWz8+B3c2Bkj
- TLSH
  T196031A96758470A643E398F191EF020EF2359523B84798D5B361E8E88FF4E8D50A7F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  Yekparche/orod/download.php
- Size 3KB
- SHA256 f1549ce9841f0e7a30e6e95a4a337f9e5fc684829962d1d9fbfdd41d960bae30
- MD5 3731546e1bf2d7393857301bf18b235a
- SHA1 56a87c1b651bea934ad72ba3d92f980c097c2729
- SHA512 0a863aeccc5dd03ab62a1ce8ab196a0a87855b8f89ca593bf6b90db8a8ddac72e9d778d08449b27a95568b1299db739cd1891bea8b83e887fb2303e5bfa20786
- TLSH
  T16E8130A0650F0A7A561A9941C0F23964C6EEED33D2119852F5FC231B3FE2D45E18FA2E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32