cbcb9ff0e0c3b8bf69353e45cdc4876ca738d7e90cd4aee04e43bbb4f0043fda

Sharing

Copy URL Twitter E-mail

General

Target
anubiastudio.nl_gegagaya_hshtf.mel_dw5mxgu5ad_backup.zip
Size 5.2MB
Sample260706-phmb5se13y
SHA256 cbcb9ff0e0c3b8bf69353e45cdc4876ca738d7e90cd4aee04e43bbb4f0043fda
MD5 4a432befa2a2dfe5c51f071c1f0686e4
SHA1 62536f7677146c5058a9c7b3f7b2645df6f24e94
SHA512 9757fa36ff73a363a5ebffa660b54783e015a1186e0247f965e416eb7f85f56dd5fed8d055a19fc3a5764132165e49fec6b32fac2f0051180389ba9c90e9fb9d
SSDEEP 98304:/+fPhSDGah/NQZke9XRVX4Jt6RpX6dknJAVmJKXjjE2q/08s9iKl:/+fPkDTHYRB4CR9nsXcvc8s9L
TLSH
T17E46337019CE1138E1FFEBF6281105D649E8F21279BEC57ADE358594A0FAA70EFD0186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  index.html
- Size 105KB
- SHA256 b18d47c3ce3c9833e2aedd6e15345f7a1dbe09a3362d04a635504b2be40c5afd
- MD5 681a1ae6d2e9076e8f942eed1b28a220
- SHA1 c3e9363d3cad89a4321422238b5de17fab6a6a34
- SHA512 98cc65b2ce58680e28638f4ff3ba661464e2344c1ffd6584dadd64d46c7cba8307d5e6e3ab78b57cc38128262d3841825b3206c583ce0c96620eb150a94c9386
- SSDEEP 1536:iHnAltXAe1apUHREP6avEnwAwTRg//gW9HiZl62gjuMVDcvcZ5Q1UE42RXEy:/kiHRE5pgjrVDcvcZ5QGE42RXEy
- TLSH
  T178B3D6A077A2143A313F576EF097B61C119E9B53E50E62F5F0BE815D84E0F83B5B260A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  wp-content/plugins/creame-whatsapp-me/public/js/joinchat.min_ver-4.5.11.js
- Size 7KB
- SHA256 59fc5a88fa6aad3642d9914c53490174cef0abce3ab397589364018c4acd74e0
- MD5 d722044cc0ba8301aa6e215203f3299f
- SHA1 87ebd8f71d38dccb9c2dcebbb7203dd836257b8b
- SHA512 6639ca9c6078550602f75ab4246d77f5d65c13275d01f10b25399630a57e43ba0ebc06d654b2fe15f46e9436cc46fb1a61d3b5f127b91e33fd0cf77ccfb74658
- SSDEEP 96:RvLljeKku6rT9dTCysInxqxRbb8c1wfA6msbWqrQD7O/U/LFdpsZ0pZjpDLZT75F:HjLPinxUnwfA6CWQf6UxdpzDtDLBj
- TLSH
  T143F151C1B39034AF0B9A613BE29A16FC54AD17989475B9357430D9F0E623ACC1F22E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wp-content/plugins/elementor/assets/js/frontend-modules.min_ver-3.8.1.js
- Size 32KB
- SHA256 5d80f13fd7524318f81eb1301170d4d0fbee242c12403c01f3a06c9f681192c7
- MD5 48b7a16ab38005edf9c9964313ce1cd7
- SHA1 8b8569d937aac61fd792b6c68fca974e3cdd94ab
- SHA512 e71f63f61c89141ee78cf136b17451cdaf82a74725b81d23baa88b4f1c762736d466202df62ab333eecb22d3ee587aacdaba50ad4404e977b6273ec25b2f884d
- SSDEEP 768:FeAjA6wk9C+Qk4cR8+8gNKRWWE1SeiwiIzyVZMts5z083FdfPquQ5RSSOMlt+1Sj:FeAjA6f9C+Qk4cR8+MWWEsenJ83FdQ5z
- TLSH
  T117E2D6863F61F4A307FB8096A02F410BF3565894780DE0D4B75BC9E178B498A6367F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wp-content/plugins/elementor/assets/js/frontend.min_ver-3.8.1.js
- Size 39KB
- SHA256 5ceb0c2088d29cecbe3ee571dc3cf6fec764bbb7c73f0e22c73007149a2ce68d
- MD5 2331d602370faa61829c8aa628996c7d
- SHA1 e097dda010d924637e9c9f906be7653ae2d29343
- SHA512 362e64e3ac713d26406f7aa096be2d63af3459e853dacae7d92b29b24dc1f2285fd9a349f42c5f9b42c619c0226b64b77c414e5ae9cff9776d19209deae953d0
- SSDEEP 768:ZRxiBDvxJMEa/mvGsfVehz8favEAz/c5G/TSebsvZiVH8URPSz5oedXLfPv3x+FZ:ZRxU7xJMEaYfVnIEAz/c5+TSebsRiVHP
- TLSH
  T1700308563192D4AA51DF48E7B0330219F3620DDDB402B55EB6BDACE6A4B1E8333767B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wp-content/plugins/elementor/assets/js/preloaded-modules.min_ver-3.8.1.js
- Size 42KB
- SHA256 689cd339b9de5d18314f13848a05a7ede4548ae9e30673035d1302da6d139ba1
- MD5 ecbb36c3ad3be14e777b453ce278557b
- SHA1 11611ee478e60ecf2cd969c37bc55da1e1dc9ba4
- SHA512 dab66b102e09bab5f7eb8ae46b57c32b0198c54ed9befd201ad67622d16fc3049a0a534035212cc35273e54a5d35d7e5fd691c2352ef1278056df59134fbe27c
- SSDEEP 768:dUOcy4IW+j/kUIwmLJd0D5ORvd8XN+BesyTUXc38POMIfk9mAiXYB53r6Oi1s4jd:d9cy4I5kUIwmLIDcRvd4NIesyQXc382R
- TLSH
  T1D01327653042D4BA01EF0CDF7413815DB35A4BAAF800B62DB1B98CA751B1EC5B77ABB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-content/plugins/elementor/assets/js/webpack.runtime.min_ver-3.8.1.js
- Size 4KB
- SHA256 f6eb858ead7f15dcd18541c5433714e0c0966d81b8d009a2d49e5a181e548fbb
- MD5 562ad59077018eb139d1f46afd69a050
- SHA1 d33c188f7d0f306b8a0ede1e3b67a0edb7be8966
- SHA512 409335fa2c2d68ac3ddee7ea816d040604d66609ff68e6f03fa3d1bb1754bf076d6ac46b2208d3bd3d579a7213adfd6ebf2e234fb6032b412a7ffcbc439c37ba
- SSDEEP 96:B5Nt0jqf9fzFK245f8/lCjNVobVDPkqf8kxwvT8S2:DNCjw9f5KTeON4FPky+gS2
- TLSH
  T147A10ED41B90FC6B35E135C5E11AA735752FC0333D1BB881FA22DCED98E8A9187A9931
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-content/plugins/elementor/assets/lib/dialog/dialog.min_ver-4.9.0.js
- Size 10KB
- SHA256 ac22074c651576ffb2235e02aaf4484792f982f583d48aa06d9b185d972b370c
- MD5 a0536ca874a6087717a8294501608e62
- SHA1 345fc8ec799615d043e57cd86a879425c48f0069
- SHA512 c8956ac0b4cf330b76bee4b0a7167397c1c8a887eac949aee3327ab35f9a934a988fc59e1c574c3e76382dd1702321f935af64d365ec3019ef137176839c0341
- SSDEEP 192:4ASLFBb5B1tkej/q9bPcahsL3SaDY+Nhm4isuSnFqk+n0eH6RxljwNyJJN+fwr6:EXnTj/q9b0auiGYchm5suUqkG6v6UUfb
- TLSH
  T14622A585F084396647FF7024712F230E23371C9CF4412959FC69D8E56AB8A8E42B6FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.svg
- Size 730KB
- SHA256 e2749cb24a77208abdd9fda35f0d14f091948c44d21f977c8048a3b13e4beccb
- MD5 2f12242375edd68e9013ecfb59c672e9
- SHA1 69a0ff79a9d93a451e9fa90bd79ae7008d2a9da5
- SHA512 93026158ff99705e86c7e637a9278ca355f1a37abec171e4d702e040a2cfa197acf1691e95be32a55819da79c0a9b151153859cab9d295bff0ec4b64fe2c763b
- SSDEEP 3072:BWPxeOclcjMLRgkqGKJT8L9oHKzKZ6S6204HGIZZGstUkpAlxUxJd1TzJ5QhDiK:j1gU6U2dy
- TLSH
  T1B6F41F5CD3A4C2B8FBDA4EE8893A7ED6366B35FF39103254C278A56028727784C4D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  wp-content/plugins/elementor/assets/lib/share-link/share-link.min_ver-3.8.1.js
- Size 2KB
- SHA256 138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
- MD5 020e87460ce58802842e34a3aac97d83
- SHA1 d2eed5f7573c0bd640fb9f125b6bfedf43ebf9b9
- SHA512 d33ba56954bc10e3ccfde8e52815e394446928d046455fae971066d03855e6e56aeed52be628d4d2e4a4199e5f2e3918a332d6bff21c033052dda36ba74e9d81
- TLSH
  T1605102D37A40D91F07937072715B6A68E3130409A9CBD096C2A0FEB21FB49EB723E619
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-content/plugins/elementor/assets/lib/swiper/swiper.min_ver-5.3.6.js
- Size 135KB
- SHA256 b4983a3898c8d2d480e50cb8acd9c70d1ff22cf677da109a4266eaa4179b78e9
- MD5 a8dfc973b038ea8a190e6a2ff604cbde
- SHA1 c54edcec41ef651c05e25b63b0ee7ac2545651ee
- SHA512 0ee1d25376b0ec0174ed2dacccf819e4e3c2554476b232cbbb519ab659ba496cca3b1ee06616b035aaca92b89ca38c520ef18c93e2743c260d9c5c8ccc9f2272
- SSDEEP 1536:Fj2qhgxfeuGMfoqi2ZLjK8ieVlLXCiiSsWRLK7A3dnaKBjY4vHgZsUOUTqiqpBgc:wxoo6desFshaKi+HgZsUOUTqiqM/9EZ
- TLSH
  T1D7D3194EB39061A551E36257535E8241A3B72809780AD0AC35B688E79DBDE4C13BFFFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min_ver-4.0.2.js
- Size 11KB
- SHA256 214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
- MD5 3819c3569da71daec283a75483735f7e
- SHA1 ecd40a5cc6f0b76200c454ca880210dc301cfab8
- SHA512 2710655dff46653daeb3a6e3f6d36f885e51d5b375738ee353aca40c6f66ae1a7dece57039d58747012ed9ea2822191143c06f270123b8cc580f6a41b8e8aef4
- SSDEEP 192:GngaW9ELBD26z861V/CvJiVKIsvfT+6EdpEsBpP9Qwo7Q4a99RfuzqXppc4mmm9t:Ggz9kBD26861V/wsVKIsvTEdpEsnmwoz
- TLSH
  T1994221493E0724222FAF41F9FC1B468A632B013894C584BBB8E4D5DD18F19296F77B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/general.min_ver-5.4.2.js
- Size 7KB
- SHA256 d7b10b7ce6eceb9ee2483874f0f972e419ab10692ed738c1ae3422e48c489775
- MD5 ef711018665b24a570d3605255874523
- SHA1 bdcb5e1cc811c120fd2983444b296254b7618a8b
- SHA512 aac8916978438ffc4b37880451855baa7c05d3064eb16450c0b15a91ae3b5a5f3fd41b26991d71fcb4c7eff130a0a45cf700e762960806ef171685a3aa0143a7
- SSDEEP 96:wnXf6Q0/Dd/3/D4Xfw4gLuTbiSNpt3EKcD53R9OAKNerK7vo8VXHHeaLbMSKMLw4:4v6TbN3SLFNjilC5erKjo8RH+o9MuAa
- TLSH
  T158F1B8C8365676F095B37026987F7615B139EA34782CD840531AD4E06CBAECE90B7B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min_ver-1.7.8.js
- Size 754B
- SHA256 c30dab20b677f2b13f42a4a04385a3c6d380fa023a4a1c32f45f2996e152bfba
- MD5 afb55c29bdbcfc262d9fa56743572cad
- SHA1 d4b6cb9df2b1b5477cd968fb05cf5faa1d13d6bf
- SHA512 458d91d1274af1448e950803384da02c7896521ef7dc47ac7735a8a37226b5292eba33def05f72f3ad435e2ecf2afdf5d79a6b7b91d145a2de3074b0c80997d3
- TLSH
  T1AB016D38B83BBEDA1C6F522414AF07CFB251C4B2A2055C51432095B81E75ECA630BF88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wp-content/themes/astra/assets/fonts/astra.svg
- Size 7KB
- SHA256 3fa6bbe7c11c627e423fdc7ff52fbaad3acf976ca6f61ecd0755aaeb911fc6e4
- MD5 418f1832babfeb3713d55521c5c790e0
- SHA1 7e2e5a9f65264ec2181b9a10aca33f7b35f8ad92
- SHA512 1bc269595443fbd8e1dad5f23daa547643c88549396ffd642b485fcb1f2e95b3ed74e0f79924341a50c5f806e4392a7f2fc1522fb05e724964032535e7a7fd28
- SSDEEP 96:cnsdr/NyfmUY1r0D/1eCS47zW+w3Mex7pmh+8FBwMKWUwrsLwLjRA7pv3m3sqb4p:csdr/kmU1DYCS4Sp7Qg8zHh2Wo9Io
- TLSH
  T105F1BA9DF32E3BB0BD4A07A0EB7E9D5D021D421DE06AEEA7E93447614DA3D0835544CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wp-content/themes/astra/assets/js/minified/style.min_ver-3.9.4.js
- Size 10KB
- SHA256 c4073c72b720b3645c4e7e2e57b81b450cc658b65908013057a0bc9d158cf457
- MD5 90108aa84abd32de121c6eb75d002d85
- SHA1 17608a3c4b1ec53dd8201e42e5a577416eb8ed56
- SHA512 504fd72f03e89a5a6fb4b15bc59a1df0719c8de3713606ee579db15858eae2dc01a4cd3e32b3a97288b655ebbd31be214c5a2aeec95d6748748f6968c1d76cd7
- SSDEEP 192:9BYy4hgGuzp247ysgGysyyKOFzFd0kpyGeiCqhoLwUqDmD9PyRRShA0H56bR8cBe:bYxeGuzA47ysgGysyyKONFd0kpyGeiCr
- TLSH
  T15D2284963240127614FF1AE6B8DFAAC5327264AFEE080440A579DD1E18B0FD351F5EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wp-includes/js/jquery/jquery-migrate.min_ver-3.3.2.js
- Size 10KB
- SHA256 d42490c6288f50ed2c60dad5c0e8c916f4f59ada49752918eb985ff6b361ed7a
- MD5 7510cd2a721bbc1395363e90a834e7b3
- SHA1 fab5e7783b4736101db71a15f706100bdc04e347
- SHA512 7a2c4c6c7c5b5f28e6b60a9b0900b535c21e544fcdc03cc49fc3764d074b7b9e1c7fa90c7c902e4891fe9b230d01a279df06c1d9f49959a403a3b7bc13062c19
- SSDEEP 192:JrprDNvD66fPP/+I6OP1fQP0OIr96DB6MHXcwr1RV:JrprxG6fPP3P1fQMOIsDsMMI
- TLSH
  T1A032C59D71A6B4624EB735B8B03F939F71B605D9250D8940D26CC9F6782C84EC22BF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32