b8214d310e345a194d5d6639a9ea678632f1daf7ca46243a6b567880d644b349

Sharing

Copy URL Twitter E-mail

General

Target
abd.zip
Size 145KB
Sample260707-pfhaeaew9j
SHA256 b8214d310e345a194d5d6639a9ea678632f1daf7ca46243a6b567880d644b349
MD5 319529e8ba33c4b9c10bb04d89bbcf63
SHA1 9e3da815f5faf651516aea26da9745cb31a67533
SHA512 927bc6a559d289819a2496266928c144047bd01e009225166f656118ba2d3f47da8b46b1ae64b1d7969dac13e32c70ebefc5dbfe9f0efe8aa8353083687d0a58
SSDEEP 3072:yjqx8x9ky2q3yd6SHrpKaMnU+FcjP4UqZNhW9f6cENYzQC:tx8x9ky3yd6SEa0URjTcPqf6cwhC
TLSH
T1F6E3127342B28DFDFFB335B4BC79A51990584739003B78837D08006BD56A1FCB5A1A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ftx/error.html
- Size 1KB
- SHA256 f17376b0b7ade8c24d17405d6c2d2a8ed5d8aacf1ca16efff18e96bd2fbe0220
- MD5 ee48901d9c8fd41b99ca875d7c6b0df9
- SHA1 c2b548bba5e2a9215b80375f019bebbc02953220
- SHA512 e3bdd12d8924ba9d11cb7d36ab4fc1aa0710fc992e2024f46be2cf9a47fb631af22cf766d43b729600e8b0d29e82ac0764c8b020c0a0af435c8e541000d217c5
- TLSH
  T1F531B19B56E310027923A0A41FB667412B80C027C24FCEA93E9CB348CF955D6ECD378C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  ftx/index.php
- Size 6KB
- SHA256 617cc71d07947c65c9c125d941680a1a0b539d4a89dfe286780b66dcc79dd707
- MD5 77be1a2677660f7d54ef345c665421a5
- SHA1 6f9c37341439c186dc253f107ce6a11f862b52c5
- SHA512 94d3b140ee2bb940b2e7840fd376fcbc79706836eb15d9f130054c2e89baa25001705c09288b6b7b290f11f59e70d0d261b38bdd6befc354a48991519adb0c6e
- SSDEEP 192:f51EHXstivR7t/2kMKAYXiyHhCCQHCq2BFbB4uFlOGJg:gHR92kuylWSFmuFdg
- TLSH
  T139D18626B5B741244B63D898ABEBB195597A522B260CD5007C9D03CC6FC832CD3F67DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ftx/page.html
- Size 9KB
- SHA256 b9b6161e506656b733e2057afcb23f46122cdcf64c9754e870e17364d82a2ae2
- MD5 fb475d9587972dc35be6abc932b7146a
- SHA1 572dd58890de670a3ff90da02c9befa0269a081d
- SHA512 8cf139abb334f6d408475e466b5539ee7f480d00cc191160b7d7b84ca0833dc3026603926887b32558ba29c39de48e6e18c8750a4274d97a590a3119b9ea9717
- SSDEEP 192:g8a+4GE/seNOjxmUfmSNo1n3f0jzBbWlY2E:gf+ZYYd63f0RY2
- TLSH
  T10512C62752C0211A6A73D650EE52DB49FB628047D202D2793DEE1393DFFDA00887BBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  ftx/pdf.html
- Size 3KB
- SHA256 ad58a230bac557bf8eb5746c73c2ddcd2fee032a56cbadf581531bdccb15e083
- MD5 94483c91bc57fbe2757107a403e3b063
- SHA1 c3dbf36a8c42913f6221bb9cb07eedef71a0d95a
- SHA512 247bbe5741c61c55997967f4a5677408ac56c1d9c2759f59fb20598ee3129bc34150ae0c653fbbc1adcfc0094490ce9ea15c4af086b24e517dd8d044559a1133
- TLSH
  T1AA71A67B6E160005A302D0E1BE83A745650B7517BF0BCCB6B4DF9279BF455B892663CC
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8