08da919ef4f680bd8a35c278bf904f6ae78febf447109d7c0ae219b4385faeca

Sharing

Copy URL Twitter E-mail

General

Target
certigestion-tunnel-master.zip
Size 199KB
Sample260706-agwf4act6k
SHA256 08da919ef4f680bd8a35c278bf904f6ae78febf447109d7c0ae219b4385faeca
MD5 1b3dfd3a5deb2384b4acab76ff22fb09
SHA1 3ae82a1d048d7dac4f5764b307caee74838d7a56
SHA512 d1537458cba7bcd9ae7a8ba19eda65472649dd004bfef3c5882fc248ea25f4457fd9afb782f575895a95e0717e436097e71fdf58eea2d9774254069e3b75ea54
SSDEEP 6144:+1Uf1LG7386533Bgso2dvtjOHXk9JtJt7nhUc:bGLtFdtEk9JtJtB
TLSH
T11814BF00D3365C75FA727AFB58134E12C9B26CE06189F54F357619A81D8261E3BAB3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  certigestion-tunnel-master/client/index.html
- Size 2KB
- SHA256 e9f6e652de309396ef99b767d599ab0fbb2b99c6767831c60938cc59c0936037
- MD5 f4e7e138623ca9eae3678a0ae66d1bb2
- SHA1 04de8581efce57ab021323cc9b61e4760a95d827
- SHA512 74659b21e11417a3d7f0a7f5358d7087644d9e15cb08cb383d2cd533a568fffa3f7a8ebc769eba79981413032ff92242d50b5d50e21215691629ed108798fcbb
- TLSH
  T15841C063A5A48C6953A281721DC3F444CDB48097D70A3845B6AE60DF9FD2FE083F32A1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  certigestion-tunnel-master/client/src/components/ui/dialog.tsx
- Size 5KB
- SHA256 3ffd83bd2940c1191fde091bc47311aebc2b79d78824965a5c446115e58190aa
- MD5 0148b8f43eaf9165d46342241392857f
- SHA1 3036bbcdeb05c797c67dcb6ff06dd38b3795b3ac
- SHA512 b0fc605e9c656e857827bd1f8a79cb74877036c83c26eca76f5547701d1b24da1a98efb4905547f1da4500781b41fa4b867b325fa9cffc2d89c8137d11e320ee
- SSDEEP 96:RxQqDchDH2wKcOzxVcqPefvpy6eUXDIF70dK0skNGco8mVz0apLhzJCuWyGWV+8r:zRRoqPEvpYUXDcQQAMZ8mrhcYXi/m/
- TLSH
  T1FBC14360B2BE11180E97ADB1776F505FD7EC505FA24E98A4BABD21D01FC51ACE0B63C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  certigestion-tunnel-master/client/src/components/ui/input.tsx
- Size 2KB
- SHA256 0aaad971269e84519fb14928a70777db539b4cacf9f145fecd905ba483a199c6
- MD5 d232fe60b11a798e1633b00b2ea9de4c
- SHA1 025695623646ff739e16d7c8a00f3971245fb5e7
- SHA512 5d24ce9500c6a65fbdba1db3cf0f5ea6533fe9f94b1af7e61ff7f01a94551c44930132e335c3e79dedf066519b16b0300786327de862bb27fd54f89ad100eaf2
- TLSH
  T165515412A0AA22610F57AB6537DB2C8003FD51679D277DA8BA9D43701FDF064A933FC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  certigestion-tunnel-master/client/src/components/ui/sidebar.tsx
- Size 21KB
- SHA256 782ec3ba8a570c9a0f6ec12d7e1c1efdee5e02eb2da7aa46131c734e7f7bbea8
- MD5 d3837b637272212ca38e977fb8f53c60
- SHA1 a64b346bdef620cfa3e1afa88322dccae82a3c81
- SHA512 ac41d74810a07aa118272167618be734d07e4a3d130c6a3e5c75f106309171fe291b96174b287024b4bb5dd72e2656a936f9bf033bad2fb8b0e43136e753e536
- SSDEEP 384:MavpnPN0+FVLP/qYrIA9FzOulLz8ukkJJzX/+OizYouHoiouKQuedz2uyQ:DvhPlPNcIRoe
- TLSH
  T18DA28752B1F124AC044744B1BBEFA038595CD8DBDB49A841B7BD61C81F8A35FE8F29D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  certigestion-tunnel-master/client/src/components/ui/textarea.tsx
- Size 2KB
- SHA256 ffbad961ec02f9ca23f4157daa1a4139960c4477a245c216a793b4692dec142c
- MD5 1c69b4138bea5bc6bb631a632add7562
- SHA1 760389ea29a39487498fb5c8f24bbe9f70c9913e
- SHA512 4fa1131d6caf044e5dd74098d6eccce12e4d7dfd24cfffdb1fa25c4ed4c49fd5c52b91acf7a1771d3f364e6dac39795a0d7342c618468d289c69c83a25710289
- TLSH
  T125511112B0AA12510F57AB9537DB2C8003FD12639D1BB998FA9C43701FDB054A933FC4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  certigestion-tunnel-master/client/src/hooks/useComposition.ts
- Size 2KB
- SHA256 674c515075a2f318d4ec2291313ba552488de0b2c1aac7f36f3d71c4e34d434e
- MD5 16bbb7a4775b78704034802eb6d8ea5b
- SHA1 b7fe71474187163c7fcdf4b36080ef0cb63f519e
- SHA512 1b3f0ff76aa64ff48a46459e90cfdc2a4e13a8f2d3298221e048200456b787f1a4be0f6a617c3a6e1dbf8bddd9a2985aa8f383194e90896009ce5723c8cabf94
- TLSH
  T19941CF45E57B202687C373D52B934B7933F811832A4BEAE4767E16709FD36986053BC8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  certigestion-tunnel-master/client/src/hooks/usePersistFn.ts
- Size 471B
- SHA256 60cc14f39a3f8b212d7baf4beeaf35f81e09a7c78e4154bcca3477e010879511
- MD5 693f129cc13fa61de95d481e6f7939c2
- SHA1 6c755cbc162dcadf5729e7526271a1c7f76b6935
- SHA512 a91468715e3c90461c87016620d5f8597d59206ceb9f46a9047ce52030b9899fe1e1140dfafe68fac38a04e02869fd7ee8fdfdf4f0717692df40b2a5a083de20
- TLSH
  T1DFF05C8095FD21B3CAE36865081B5FBE6BE37601380AD328B57E13B0AAD041CD5679FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  certigestion-tunnel-master/patches/[email protected]
- Size 918B
- SHA256 4e16e6ff3fde7d6c1024d3e0c8605dc9eb6afb690d0d49958c2f449091813072
- MD5 e526e8618a810cffac619d38d1e615a3
- SHA1 c90df7912625a432218cfd76a320c0019944fd50
- SHA512 5c2c213ce1ef5ec97983ca4ab0b34649563d67c68edc6c80527cf5eb6c878a065411fe93a8c5050af83cc57d7ea446fc41dec02a28b59dbd36d35c2a7132c0d1
- TLSH
  T17A119C7450F9123108BF13DE1F67A84C72AB587EF2908451374E9504AF964EA41CBBC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  certigestion-tunnel-master/vite.config.ts
- Size 5KB
- SHA256 334aa6992b105e2f9005f723c53e8f8b2b3f386c3f14e27c45ae9f160426e170
- MD5 a60f1045b4263fb9bf7ed08fc9046ede
- SHA1 9a2712df9d67a1bc007411b56cf4eacfc699fb98
- SHA512 6c7e1d491320307aeaad5da274c6c4c5d8f7db9923dd39243ae860b04a0c4eab33a976119463960b72cd03fdc117315eef8f2926453a0654dc9fe630c2635af3
- SSDEEP 96:aiLuaEfqlPpZ6QAuKw3BD+74IO0D68mKCr1MDn+cvnLizRvzw5Zv0z:DKylhJ+74I3D689CrkHvOzRvz4Zsz
- TLSH
  T1C7C1631318B61A254572A2084B4B956673B5D15BBD0DFBA0F5ED83180F8E728A3B1FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18