General
- Target CE-SMS.zip
- Size 4.6MB
- Sample260707-w3xryact3w
- SHA256 3eb7f3598db2c0059d6f5ec47f5cedaa8e4fa6dc4d3366591775dc14ae3420ea
Malware Config
Targets
-
- Target CE SMS userguide.doc
- Size 1.4MB
- SHA256 54cd30b6e0c21bb7095cd881e4310fd898bbc81f19ea68e89d687d61cf8f38ca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cesms/ajax.js
- Size 563B
- SHA256 0c6c38ca5254cea9814d35a4ad39e53fd496eba222d485efd2b97b81cb455d89
Score3/10 -
- Target cesms/connection.xls
- Size 49KB
- SHA256 fa305ce83593782d1ddc0265dd19453c089337bcd1a75ff64f89965f5c778161
Score1/10 -
- Target cesms/excel_reader2.php
- Size 58KB
- SHA256 3e3f0145e32161e2457eb8388324044f32a5e8057a5b206f66b9e5eca4eef1ac
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cesms/gammu-config
- Size 11KB
- SHA256 944179fa6d52c4e8a369d6c20e4603483e51e9ad8506daceb856da2a40311e30
Score3/10 -
- Target cesms/gammu-smsd-inject.exe
- Size 61KB
- SHA256 d15dcd35e7f96b6c32532d6366b8bcb94d9f23ed8c806a616d640674c8d86b83
Score3/10 -
- Target cesms/gammu-smsd-monitor.exe
- Size 32KB
- SHA256 cbc52b70a9b5673759482ce1d9cc1577975b26f9556444ee2b34a2072da19a60
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cesms/gammu-smsd.exe
- Size 41KB
- SHA256 7704b140dd7af14b01e2cd636aa782c82885bedf9186cb911bee0d8aa5245e0c
Score3/10 -
- Target cesms/gammu.exe
- Size 383KB
- SHA256 e5cd4e9499d771a9d0f6125a2bb7f0a0b3a579b044f66d7b466cf01830fbfe17
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cesms/jadmaker
- Size 1KB
- SHA256 abd64616e571e2d5a069ad74d94d2154e8a3483517c7ea4d96e4c77443e361e4
Score1/10 -
- Target cesms/jquery.cluetip.js
- Size 23KB
- SHA256 97e7a51d3087b465f173249b5cd19f3e26ec3275074a0cb8d6843597e74773cd
Score3/10 -
- Target cesms/jquery.min.js
- Size 76KB
- SHA256 1ff28fc98efaef51f4bbc9c7297d0098891e4270a858accdae4e658373589251
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cesms/jquery.ui.datetimepicker.js
- Size 113KB
- SHA256 4823bace4fa0494162244f058d1d8d9e9d4214846ce7072dadc93a2fce2bd338
Score3/10 -
- Target cesms/jquery.ui.datetimepicker.min.js
- Size 70KB
- SHA256 52e0fd0b444c9292e8916918436bbe92a9a010c5ecbc075908ddfaa413161633
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.