cd9da41b5d946c5d1f613f8b601d37a485581bc1c68b52900995657389293e4c

Sharing

Copy URL Twitter E-mail

General

Target
gg.zip
Size 37.3MB
Sample260706-wvlppsa18z
SHA256 cd9da41b5d946c5d1f613f8b601d37a485581bc1c68b52900995657389293e4c
MD5 e5f6909a5717a19f3fb2171f83641f30
SHA1 1b1bd9c00f6557de992fa20be3cbd76359cd85f9
SHA512 a3bf7ba3658f367503c4358aa029fdfb3b4e9255715b85f1753909f964995edd031523094ccb0e8fe7d4db558dc0a8359ec88941fb9c9f14ece3d9970e9fb248
SSDEEP 786432:CAcy+HIp4ekjXWZs9s0tZrtMYOFIbfbcdMUc4U:CAcN24Bs0tR6YOFIbY6Z
TLSH
T1968712B9833922F9FD4FDAB1C7D942A574564382511038C7BF5C0212DB4A74A2F3B6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  gg/app/Providers/RouteServiceProvider.php
- Size 1KB
- SHA256 c122fdba4c34d94fc15ce5e50e60bf7e860ff1fa75e2a819f6debf35832e86df
- MD5 1dc2faa6da7b2a647f4cdddde1926cf2
- SHA1 33461f7cc9819952811d81780d7cf7177ce48401
- SHA512 1d7e8988ac852020085d1df37efc86fca528ba87159f502b93c7251456ca91b7b907c1aed45834d48c2239900735d911724f464907d426e14777e20fb6239292
- TLSH
  T1E621F16D55D54B718D272ABC7B0FC580E421E60B24195D043AADC3781FC0EAC8D17099
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  gg/artisan
- Size 1KB
- SHA256 8551e0bf6b0b41d1976fdf7234c6efe8bec59f0a086a251d29689fdf6711c1cb
- MD5 87ef0ddeb20bbc628c8c6838a469164e
- SHA1 16a259c0c33ea9dd44ea393747e1c7bac1fbbd51
- SHA512 fd6644a8354954be08a2eceaaf7c5de5a0ea44170138c03b9d552c7209713043038af8801d74ba9f0a543cf5e0ec639aff6f90381e41577cfb3c2f0c313c21da
- TLSH
  T1E23101CB3EC643E09DE3F2D52B0E56A2D76FE93E39C0A1605095090DA3D624C92BF5E1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  gg/database/seeders/DatabaseSeeder.php
- Size 1KB
- SHA256 1f77f1b8be9d7f798937c7cd5fcbb8a26993c9f8602dd3eb427958470124aabb
- MD5 26d7c9461ac428c9b84b607bede796ad
- SHA1 84eadba03cf756f2e405d7b5f7557a7aa7804396
- SHA512 6b905e21ba8044722cbcce3b56048d92c6177dad623fd683b999b4d48169e3ece3eb9f20522c4f7050639feba574de35423ae0df51c0c051cd828e155f195cdf
- TLSH
  T10641AC3812D91F9344464D8C1209D1D4D3DAD083FA97C9C0FBCDA6983F2D7687A6376A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  gg/public/assets/bootstrap/js/bootstrap.min.js
- Size 78KB
- SHA256 7fa35d7cf7e0c873461afd8725972fbdad6e032894650cf7442c03846e991aa1
- MD5 87a2b3bcfb3b68bf1bfcf513781b9144
- SHA1 03c5e6023161817126a5f6bb9856407b27e364e7
- SHA512 e0ac0cf8a44240b2e9892ba41480ec2cb5d0aad671d82f776ef1403638c9170f888c6b2ae52833de1198c6af6814a8a7a7c3ee6df76efde19719659db6069562
- SSDEEP 1536:7mwziELO+TBR2t472RirWyKsVfK5GEfy3YJtCRv/45wZbqbXZTbYWUZ7X:awmza3YCl45wZODZTbYRX
- TLSH
  T1BE73C5593244B4730ADA85B68037430BF3265998B24B812CB57CADDE2A7DCC67277F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  gg/public/assets/css/plugins/POST.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  gg/public/assets/css/plugins/a.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  gg/public/assets/css/plugins/b.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  gg/public/assets/css/plugins/blank.html
- Size 117KB
- SHA256 2fd5f39b905b7166e9fce5e25b1b08364d8b205c1f80e6d14ebfd66be4430f1f
- MD5 5bbb905b558b1e30e5172cd7a8f009fb
- SHA1 6549d48bd3588aabb526fc5df264c8d39b619823
- SHA512 fce062c0c9a33049708feebf35c4ca6aa268911e82fab8023251982ebf8822845aef740643553731953361329d4331118afe3759d195b738d0d1c4a6d50b03fb
- SSDEEP 3072:869k+DIYy/eNc5EZuU4E40CuI9wKomBWTXj:869k+DIyS5EZuU4E4eV
- TLSH
  T147C3D671BBA0207A2167437DF16BB718616C9533EA0D1AE9F8FDD15886C9FD200B261F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  gg/public/assets/css/plugins/c-2.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  gg/public/assets/css/plugins/c.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  gg/public/assets/css/plugins/d.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  gg/public/assets/css/plugins/fancybox_loading.html
- Size 117KB
- SHA256 2fd5f39b905b7166e9fce5e25b1b08364d8b205c1f80e6d14ebfd66be4430f1f
- MD5 5bbb905b558b1e30e5172cd7a8f009fb
- SHA1 6549d48bd3588aabb526fc5df264c8d39b619823
- SHA512 fce062c0c9a33049708feebf35c4ca6aa268911e82fab8023251982ebf8822845aef740643553731953361329d4331118afe3759d195b738d0d1c4a6d50b03fb
- SSDEEP 3072:869k+DIYy/eNc5EZuU4E40CuI9wKomBWTXj:869k+DIyS5EZuU4E4eV
- TLSH
  T147C3D671BBA0207A2167437DF16BB718616C9533EA0D1AE9F8FDD15886C9FD200B261F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  gg/public/assets/css/plugins/fancybox_sprite.html
- Size 117KB
- SHA256 4a80d5ea2df9cbe254374178212539682d4c40461ac1b4bab74e8e0f72c2c024
- MD5 eca3d714b5a12e5e8846d0a7a5a257a9
- SHA1 430ae370a67fa1b40b8518c38fb2dcc58fa82cc2
- SHA512 46484b68878f136a952798e00ce58cfa9e1f03c12592ba2df5f2aad307403173fcb2a77c07922a9f79c3a8d634c6fe49b266c337fbcdb0f275dddf99775f4163
- SSDEEP 3072:869k+DIYy/eNc5EZuU4E40YuI9wKomBWTXj:869k+DIyS5EZuU4E4sV
- TLSH
  T15FC3D671BBA0207A2167437DF16BB718616C9533EA0D1AE9F8FDD15886C9FD200B261F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  gg/public/assets/css/plugins/schema.org/index.html
- Size 1KB
- SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
- MD5 8150f458ed6fb9b1db4e5cfa57a1a281
- SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
- SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
- TLSH
  T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  gg/public/assets/fonts/fa-brands-400.svg
- Size 692KB
- SHA256 36b51fbe6b87587541b9173cd79c16c6b359ad22a172b922204f9aa87411acd9
- MD5 d72293118cda50ec50c39957d9d836d0
- SHA1 29e6c7e5a4d63d2c9563cd208456cb4f8a357868
- SHA512 a1343d5329d718b50561171698493270eebcc187decb2669a9620187bdb4362c9caff7a56821d62b93b806577e57cf530dfc445b5918fe648cb38b57725ceb99
- SSDEEP 3072:VxoH0RzjIt6Gg3nGz0JTQrHMzT7yfUkLHQ6TzFa2Pxtxqpch1UzXmSDaM+z:4icqmP6U
- TLSH
  T19EE4F05CD3A4C2B8FB9B4EE8893A7ED6366B35FF39103254C278A56028727784C4D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32