7ec33a15d16c8c5f5777408003dae215e811504bf93357ae9f0733fee9b6d184

Sharing

Copy URL Twitter E-mail

General

Target
map-logger.zip
Size 49.2MB
Sample260707-pezhasew7j
SHA256 7ec33a15d16c8c5f5777408003dae215e811504bf93357ae9f0733fee9b6d184
MD5 a30c5a942d7bea5bae1b789f8c0dfbb7
SHA1 08c5a31aa9f45529c40fcbd68982aba10a37f8a3
SHA512 6c224521f1b13db6dda0b4142996a0c2cfc911492c4df51a346ed75570577f699ed7656acd5255dcac3cbcdcd236fab240889d95239da099a92f1545557d58f3
SSDEEP 1572864:3JDJ3ewB7zECQrOCXv20yhHfZVxzO10LKLJHmjG:HfRQrOOv20yhHBqvJGjG
TLSH
T13AB73358F2491922C10BAEBA31AF4197E5205F188420FCBFBFA544563DA3EB09753F79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  application/cache/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  application/config/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  application/controllers/config/role.php
- Size 7KB
- SHA256 762c949296621ff0d02ef6715d56da3bb05d3383151e8bdfcf7ef8e40ca8d4fb
- MD5 786d05d48d59b1eea60fc6d34e07dfc9
- SHA1 eeea80c69e48bb9a54e1dfbcc6ffc6c0ad7eea12
- SHA512 b5ed264c73fc7670df7f84816aa0acbfc458f277153dfe14569219de633eef75a117229d4406388f6c1a2d84629413341a900959ef4828b479a0faa006460811
- SSDEEP 96:g2wkReAG+Ko19SjzmPgQhKUkrHl/SOTxWpqsTxWpjay:TwOfSK3qxWpqgxWpGy
- TLSH
  T194F1249739C9DE74A13723AE87669B48FD22512711024B01FDFDA59E1FB053C88C7A68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  application/controllers/export.php
- Size 811B
- SHA256 72617963867723057b1155361e81cc7c0134a6207c330dcd0b709b20b973d403
- MD5 e895372b5f221ba33d1d5a60dfc23f9e
- SHA1 c75e33d0bbe19eeb92992bacda6b7a8902932be2
- SHA512 85f9dcdae9b50febed61ceceeb7053a84109badd3a345822cd341152caed5cfc165d83ea4f8dcacef80cb2ce69e78d165dacfd9e39aa6ecb469d2bcba999c768
- TLSH
  T11A01100AB85AAA61B3B20B7CDB6B6500EA59B1139501414375EC03C52F31398D7ADECD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  application/controllers/home.php
- Size 7KB
- SHA256 23c5230f3f6b17d4dbf252aa8338b8b47cca56a5bab4da89114b41ec4f594f37
- MD5 ab911f9d05b42551848f56cde2edc2ea
- SHA1 7199fc2aa3dd5eedd46ec615326bc19c781cdd56
- SHA512 f0ebdabdc6671c46ea050505668ccf93a6a754ba619a0928d4f2b0c4b1b09755dc8ec6bacd6ea491956d01426ddd8094380b3c413f9aa00f080485f09cc97201
- SSDEEP 192:TwzmcL3WaH4OWaHfn2HhSSIE75ESDgSpdthHrC:E6cL3WaH4OWaHf2HhSSF75ESDgSrHG
- TLSH
  T1B1F1511ABE1EC4A5D033226AEB369A4CFD15B123215086427DFC16C42F71AB9EE57D3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  application/controllers/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  application/controllers/scheduler/logger.php
- Size 4KB
- SHA256 6337765193322c5f92f732be3a2f478b96affc9b3748c9a0ae6d68dd1d4858c0
- MD5 1791fe0eef3895909be79ed2251bd766
- SHA1 428765996488f4c44fd419716ce566afc6bd8209
- SHA512 d7cefd3e22fbbcbd086e6c3243ed3c85f50826018e5ed5d66adc9d53f90bbf0b2e73486a905a6d8330b2fee6ef955c1a13d557cd3243bf9c3363f59580e20a92
- SSDEEP 48:hrCtWH7HFH0XgDs1FOeewgYKgMNeYKgM4CWhEv:A4blH0CsheY1fY1bCWhEv
- TLSH
  T16F9168691A8E4E705176766A8B1384C8E1529E2361820706FFFDB04C0FB1128A5FEFB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  application/core/MY_Controller.php
- Size 40KB
- SHA256 b3b3651bcc6d08bcc461047d62eccd79c3c4895270bd249a57498e686defb507
- MD5 677ee2a533d9919e6456fac6e46dca42
- SHA1 757e1464782013b682b94e1e1a0ca8193211a6bc
- SHA512 ab9572a1e64ebfee0e867644382d6caf08865f8c01fcba5412bdce0c72beb8a06c3ea289036002c05951bc263a6432afaa123ce18ffe97e0b6dcf01e969e839c
- SSDEEP 384:4UacAm7Bd0Q1QS3IcdD2C3vm/59PPiQdXOdjZSZiqm38qh5i6XkOq0a4qJFeLE4z:XacAm7s3/fHiQd+wM4c1Poq6fs
- TLSH
  T13813124775108C40A8322EBC4FA7F518EF256523A531E39ABEDC96D80FB1C26CD58D6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  application/core/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  application/errors/error_404.php
- Size 1KB
- SHA256 e49da0ee58d7cb39db5a67e098aedf88cbb189c9af268c36a93ae0545f4f0cf8
- MD5 47c7d0a2b51203bd45a6dad2b44830bb
- SHA1 d28581248f7971f978a335547bccb104e1bf500e
- SHA512 20d810c81669caf19b6601e9cfd1a249b468cab6a6c182762e0aed9b7026a44c9ef1bdc2ffda3fa42eb999694f68544a8ca1b25a6cb03e7230e84c623c8a443b
- TLSH
  T19621CA2ED292190BB29B0AB9F3F1D7536F064053E80A4B3579AAE123D2494787C262CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  application/errors/error_db.php
- Size 1KB
- SHA256 cf28dbb5def60b4e04afa47b4a7fec42acf47d2511cc100e69270fa3fc55c499
- MD5 2382c989d8b140bce3c63ee1eb3e626b
- SHA1 fedd72321c9d95facb85ec0a0655aa5690144401
- SHA512 4a70377a6a6743293c1c8b9beac42b6849b1723d2e3c97562ca41046dc61691759bd81b7c49e136f744d0d8f729a1635364bd63b5bc9b26198ec26fb8084409d
- TLSH
  T110219D2ED292190BB29B0AB9F6F1D7536F064452D8094B3579A6E123D2494787C262CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  application/errors/error_general.php
- Size 1KB
- SHA256 a551b9e1ebff7bfdac80832c46c4a01306cf66c64027f8f54815ed986b3c5489
- MD5 2a265e46af28c3bbb2419c000de4275d
- SHA1 fbfdec37d0a53c7c08267a84dedb3f88fd7b608e
- SHA512 b35d312075316619207d1a901197e1ad479f4c3cc9f2e5adf608a44341e8e0452f978be286c6382e505fc2750fcbbcce9b80c3cbd05c60d11795abed93b5e8d7
- TLSH
  T1B221AC2FD292190BB29B0AB9F7F1D7536F064453D80A4B3579AAE123D2494787C263CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  application/errors/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  application/helpers/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  application/hooks/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  application/index.html
- Size 123B
- SHA256 c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
- MD5 6b37309700ffdd85eed2431b5dfd3bb1
- SHA1 2eaf914fe507a09f321684b8add29b94cee50db3
- SHA512 79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
- TLSH
  T194B09277634D2C49A3F327B41AC567A06283628045532B2A5B498227361241EDAC348D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32