09fe604f227da061fcb8674bf28e534f5480368215cee110cddecae8610f1987

Sharing

Copy URL Twitter E-mail

General

Target
Hatice-Tasdemir-Luxury-cPanel-Node.zip
Size 11.1MB
Sample260706-g17rssay4s
SHA256 09fe604f227da061fcb8674bf28e534f5480368215cee110cddecae8610f1987
MD5 360ba3948ff401a99f3d84f6886af282
SHA1 407671e067422be3344dccc25ec1cfd1baa83651
SHA512 99fec78fee403517edd73c896261808e3e064012974a9457312ad9f0c2cdcbefa6ea1a023e8eb35bd5523bf5a9391b5905f254d36a302628c75795334a6e1a6c
SSDEEP 196608:P1g9VOEqUGkwR0MzV5znaBmG2peehDGz9eENsAi0URc:P1g9sNbRdV8BmGLehDihA1c
TLSH
T1F2C633E4852F8C20D43EA5BE62597F37C26C5CB316C8A61B8448825D14637DF3B2F4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  .next\server\app\[slug]\page.js
- Size 23KB
- SHA256 70da96102f794d2d64196b784fcbe98337aceef62de3b96feac152198310e4a7
- MD5 5f278ac71ada3e83a28cffd57b872f80
- SHA1 6fdc2db3567ae838e8e8b2a05f7fe576d23430a2
- SHA512 31935c44738e414abbd969b4660d12d587aac2b686259b0c18d2fd324267e38acc8042b25e6a4dd3d1b7fe88b2e26de575ee46a5d3238f8a5e52133c15b0f701
- SSDEEP 384:kUYTDn2hs7Q9rTDiv1pAtg++CMAJuZ1FOlXuKKggommgqp9q:gTUrt+Wgq2FjKKQ+
- TLSH
  T1ADB22A25B294BBF709678AD8D877890AF0145C71305EA4B07BCADC4B24C8D9DB369F74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  .next\server\app\[slug]\page_client-reference-manifest.js
- Size 16KB
- SHA256 3b214600333b33e5f9931b8bd00d5fa33c800506ad7b51114afc1b56c81ad3e7
- MD5 f2a7e277242660391d9b95ad29fbedd7
- SHA1 721eb0f15e5ad77b3f3ee42125a36ddfb6820d91
- SHA512 34c19fd9f6f422658c1ad54735a12e1cc15e15332316a7d00d1959078fb4125c8de34e808a99ed95501a25855125f06c2c9b05f1dd84871511270c3fc98fc109
- SSDEEP 384:fhituVY2D2bU1QBJuZweNs0lNsL+Ishst:fhituVY2D2bU1QBJuZwey0lyL+tWt
- TLSH
  T1D4723AB64122FE7D6057656B23723B5DA88516FAB8F42D7B171D0CBE2A8174D0B80CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  .next\server\app\_not-found.html
- Size 9KB
- SHA256 da4bbf512e43ff017fbc9c40f8c07ee8292fdcd08a8ba03e30f1407f1b5d0548
- MD5 d233ab6e25909130431b3e2271abde9c
- SHA1 6d04bf6e133e30f68ae1834b629a1d72e52ad185
- SHA512 17a7492023a069e482a40fca43833653cbbb4e4221895c28de2a0390372d5e76d4ea5d205dafa7255a3b629a4d73cc556bbd16552327216015596015ce430dc4
- SSDEEP 192:RhUOX2s+6yDnvL06XD2TjWDYFtXH1VWnYk2WnYWmy1:RCOmTTvLLyTqDYfSnYOnYa1
- TLSH
  T190123F2A6805DE4FDC6F3EAD443EEC3A408DC93F8665CEA8D2CDCE1416825765B96DC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .next\server\app\_not-found\page.js
- Size 23KB
- SHA256 1936d43d07b8d5610e6bf6fadfb648559e7ff139b34d78b046a912c40b5cbf13
- MD5 4d181647dbf54a2ccf6fc65995019bbf
- SHA1 be78f8e0e111d420c5ad70cd7fc88a2c28856804
- SHA512 be9f2d92890d2fc4c3f3a47875051f2a075bf6ec750d59e941dfce2d5f8d2a9f60f49035699c6b62a64b60b90abc0a18a96abe311fd2b738c1bfdd8c16afc09c
- SSDEEP 384:kGpYAqtRYTDT2hsEQ9rTDiv1pAtg++CMAJuZ1FOlXuKKgYdsq:XpYAqt6TgGt+Wgq2FjKKgYdd
- TLSH
  T12AB22B6962113A6F1D3619ECF4A7CD0BE0095D70A14B89B17BC9FC1B24CAD6C733AB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  .next\server\app\_not-found\page_client-reference-manifest.js
- Size 16KB
- SHA256 f2337e0c23b8b114831b189a29fdd3410f76fcfa55e389c905821896afbc6926
- MD5 ade15b15fbdba597bde9ee6369b7115e
- SHA1 2083d5e6191e923291f776b15fce430adedf1b27
- SHA512 f5f7ed07ef38781a01e264d0a35936f1fc2afff2a6226288c68e9cd06812a3f5284e3aa25f9c742bfd2135df8ebd21663cdbc676aac0b9a9df03c07becbb278b
- SSDEEP 192:dzhiAwdwVY2D2bU1QBJuZweNs2lNsNklI3sv7sfq167n:NhituVY2D2bU1QBJuZweNFlNq+IGq
- TLSH
  T1C6724BB74122FE7D6057256B22723B5DA88516F9B8F42E7B671D0CBE268174D0B80CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  .next\server\app\api\admin-login\route.js
- Size 35KB
- SHA256 4a9db95b86c0dd270e720fd725bc0abb8df957475b8467ca5540edf27532cfd1
- MD5 22379ba66d346a9e43e648c6e39ddc33
- SHA1 934efeff4568c0f078573fa899f615f95f2f0d22
- SHA512 79aa5aa135e4d3c1ce5b499f84ce97b6ce477a29caa485b4c23d9099047b587d691f77d7bebbfc285e58095268a2b7fdafc6255545037c2e26b7654aa1ef8003
- SSDEEP 768:KTf5TW6ARXUUmdD1Vuo0T0SmuKzQxD8kOiHXc0khj4CmUA3jmiNb5:KTf5TAR5BQLzQxIkOi3c0khj4CmTjNN
- TLSH
  T120F25C136316F952098303BEB62748EAF03BDE22D40D5494F7D9BD99A0ECC8476F9768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  .next\server\app\api\admin-login\route_client-reference-manifest.js
- Size 16KB
- SHA256 897854c2eb08d31423c3c31d4f348163afe9143e6e6b31e7ec177905c8720f13
- MD5 7d5245bfd4e88c988955d92f62eb1bd6
- SHA1 8c05df15933cecfe33b72a1fcffe469efabc4537
- SHA512 ae540d279b95523e2584120cfba52cd19976d011ec094214ca53eaf6486aa12e7ca4485bf0a96f72b1424ae6aacbc82c0206867329d71291c5a12ed58a6e89db
- SSDEEP 192:OVzhiAwdwVY2D2bU1QBJuZweNs2lNsNklI3sv7sfq1+7n:OlhituVY2D2bU1QBJuZweNFlNq+IGO
- TLSH
  T1FE724BB74122FE7D6057656B22723B5DA88516F9B8F42E7B271D0CBE268174D0B80CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  .next\server\app\api\orders\route.js
- Size 10KB
- SHA256 21dcbc3e5bea174083a1929e99b5036dbee9832d7564a1788113eafaac279ce5
- MD5 1ca0e7ba20a1f58765253c5c3979b99a
- SHA1 3f18c74d1c60e8325d4056565e6e840e674d748c
- SHA512 979b98219bb0c45821ac92b645bf63c63959d0832e96a0ec9985cf91b75256bc62ec67558dbe7c9e2b18a90cc1f49ac3f15e888b6092648506560af6f2833340
- SSDEEP 192:kntaaw2/762QyVsVLLANKlJx/UcvrjvsUijXA2EK5C6Ildt3Ga5Iltq:kAOzQyVQLANKxUKjzijXA85C6IldpGcV
- TLSH
  T1CF2219B4E26A79915F7822F8D5558946B0408C75510A45F2BF9EFC0B209CCECA3BDFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  .next\server\app\api\orders\route_client-reference-manifest.js
- Size 16KB
- SHA256 d38f03e5fccf769c24850f35e23547db42798303b1f2ff3ccac735e7621bfc2f
- MD5 bca22991ba19e4ed460ec42466479a2e
- SHA1 74804b5d912d2e9e73e1e078c5f45a50f3d84d4d
- SHA512 d402f3bfec5c5ad6b4fb8f4329833ff10318b7d6099a25d7976dc1f3137cec106b794231ee14d18d077dae34a17c7d9cde1d58e7ac1ab31755da64003909d599
- SSDEEP 192:wzhiAwdwVY2D2bU1QBJuZweNs2lNsNklI3sv7sfq1w7n:KhituVY2D2bU1QBJuZweNFlNq+IG0
- TLSH
  T1F6724BB74122FE7D6057656B22723B5DA88516F9B8F42D7B171D0CBE268174D0B80CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  .next\server\app\blog.html
- Size 24KB
- SHA256 7e74e1a5b1ec99d1ce4479815786b263ea1c3646b3ed5412b6cac4d2e55f51a9
- MD5 db0a3b12baacb72e76997a8da2942f27
- SHA1 40b8ee3ddb092dd31751d9fbf26ce43a6c4ae9ed
- SHA512 b23bffa07e984da3886a93ac205a5029df03d9082d851d1e12975b2c7fe440daecc34915fbd378480ce0c0295ce7b4089ab483d7efa0439dd9f76c6b3ad06916
- SSDEEP 768:RCORFDa2FvQptjkYV/ShhRfsFMZ99BmMio/:DxFb7P
- TLSH
  T18AB26339A909CD1EEC2F6E88853DAD39218F81BB5649DEB8C1ACCE344542579FB53DC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  .next\server\app\blog\page.js
- Size 16KB
- SHA256 3c2c956f7ea3cec12591520461f7c8af9fe90de4b4e505eb4eaef22912f02f98
- MD5 84e2a2ee8e2fe27850eee853ff7bef5d
- SHA1 1e9e1f7695a9046887a859b8f8d3b2b153013fba
- SHA512 1280f9ee78b6913ead1b4c1dea3057ac4b0724a86a0e898508853797ed845673dea2cfc087492c870ce0b6d36dc10940c2183abfbfe3a7c255cfc89fbfc225da
- SSDEEP 384:kpYTDm2hs9Q9rTDiv1pAtg++CMAJuZ1FOlXuKKaq:jTzFt+Wgq2FjKK7
- TLSH
  T1AD721A25D6563A3B1D7696E8E4B3CE16E4445D60704A89B2BBCAEC0B10CCD9CB32DB74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  .next\server\app\blog\page_client-reference-manifest.js
- Size 16KB
- SHA256 4e5cf64cbed05868650ee8ef52a207852168848bb19f39c4b6add0482f13c369
- MD5 64ae738a08feeb79ea7197967d77b808
- SHA1 b5f1e666c4f90b71c1d0ddcf10b209622415cf3d
- SHA512 86b42cb34bc03b39504d1d36fbf57a86af4aa091f83c2b56a2d7e8e9df402c1a3d9f4615c78137404ebf9a633835109b4dde85e6bb17641142618fdadad71953
- SSDEEP 384:khituVY2D2bU1QBJuZweN80lN8L+I8h8M:khituVY2D2bU1QBJuZwea0laL+pOM
- TLSH
  T146724AB74122FE7D6057656B22723B5DA88516FAB8F42D7B271D0CBE268174D0B80CE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  .next\server\app\dashboard\blog\page.js
- Size 40KB
- SHA256 4fb525b8abff834da58321fc5cf2a25f6ced5a5a55c9ad77794a9980e7a14287
- MD5 1b48ea98db192eb55eddcbdd3187d149
- SHA1 7df35b56d0bd624b416492b83871f40d16d4dd41
- SHA512 aa3de93f82c564da166df08b72e1eb9ff7c5dacbff011b1a5a6cdad86db50141d74e62da070cd8d40d6509c79e6f32d347d6482aea79be5d09acd4ec35dbd44d
- SSDEEP 768:N1TC0t+Wgq2FjKKNYdkaCKWBR4leO7Y3vNVKkghZfOvQia965s:N1TVt+zF+ubBRPO7vtT65s
- TLSH
  T16D13092990693ABF3C3625FCE176C60EE15E1520701744A1BB86EC5F248DAD9732BFD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  .next\server\app\dashboard\blog\page_client-reference-manifest.js
- Size 21KB
- SHA256 eee0c04de57eced73ebd82273069f09d4fc54af7880c6ef098ca32868ff0f6d8
- MD5 d46a7b3742040855f82b9fe7fa1863a0
- SHA1 672e8dba417f58cd21729b97066ce9f0c8ea9bb8
- SHA512 9d9ce99f4a1a3a7a37b3cd114411d5514167c314387e0d1e00b8d174ac8205f1b78f28e124f62fb60acae72ae6fad191dfe6c47900dc3e46b72e2131386d9df8
- SSDEEP 384:fhituVY2D2bU1QBJuZweN8dlN8i+IGDIWIJIJIi8k8I8n8P8qhf:fhituVY2D2bU1QBJuZweil5+B
- TLSH
  T17AA2E1774122FE2D6467696717732B2EE8855AFAB4F01DAB631D0C7E268170E0784CB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  .next\server\app\dashboard\categories\page.js
- Size 24KB
- SHA256 78c2711918ca07143c8f12d6e3b40b7aadc4b1232522829cdc8ffd98185944f3
- MD5 8732167701a154d876d41f89557e6e17
- SHA1 f5a820a7928877b365d61916b05cd925e981cad4
- SHA512 4e889a9bde0b57b2c32f876d4ba8270f1b2ed40580d63bcc4e78e910f2f83800e515885c730298ef3c1aa8f66e65e54713ee731814040557d363b0468880139c
- SSDEEP 384:kKkl6JWbtk9P4Y2JugYTDQ2hs2Q9rTDiv1pAtg++CMAJuZ1FOlXuKK0LIh6q:E0JWbvurTpkt+Wgq2FjKKEmb
- TLSH
  T106B2EA25915D3ABB2D2565ECE5B7CE0EB14A5930710688F17FCAEC0B148CD98732BBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  .next\server\app\dashboard\categories\page_client-reference-manifest.js
- Size 20KB
- SHA256 f6a98aa3aeb3a0b74561c10afc7b89132d69f45260ea9457ab793f4713fbf58a
- MD5 16f5695fd5250a75ebc5b425732ad3a9
- SHA1 f398f042f01bcf45f9b5c924dbb876b0abacf9b3
- SHA512 a31ce66d843372cbfe4f758deffad0c4a22b6fe50585292db119be172d16e92c8e6be6f96bafefd704e3219676fce0029083a5ebb0b259beea14678ab936ddf3
- SSDEEP 384:fhituVY2D2bU1QBJuZweN8llN8K+IGDIWIJIJID8g8v8yh/:fhituVY2D2bU1QBJuZweylp+7
- TLSH
  T18D92AD774122FE2D6467696713732B5EE8851AFAB4F02DAB635D0C7E268170E0784CB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32