b0e3d2437db75ec453e76d28ac7ac9f4a7d22a132abbfac2712e5fef12fddb1e

Sharing

Copy URL Twitter E-mail

General

Target
smtpapp.zip
Size 179KB
Sample260708-akazkahs9n
SHA256 b0e3d2437db75ec453e76d28ac7ac9f4a7d22a132abbfac2712e5fef12fddb1e
MD5 18425a6845b29662ca90f3b29a36eb19
SHA1 20e3980d136fee86177483aa60ba05be847b5617
SHA512 8e5368613a7bfec23a0fe97a2dc61140c6fd31bdd7deacb3cfb2efb0c1cbd57e9481805f2c6a64e9439ed9e116ff94fc45b84c8405c11f9350fe9c7f3d809a56
SSDEEP 3072:ZqXnU3btLNRu2+6bJTJy6CFKRvNn9tcZDeDGwP5PJtIPQ/5evEzny9qOKfKPTgaM:sIZ7+2TJ7CSkZKDjPJtI4kMe9qOKfKr0
TLSH
T14604AE7FC549239CEBC9CD3D77BBEA328941C6524C2534B2476043E28D4B98F79B6294
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  smtpapp/config.php
- Size 732B
- SHA256 c3d9e5e247be3de8c0abf49aaf5b1d664c9ea59e2dd47eb48c6d7e86d56684fb
- MD5 3de3c7915b1c602b5323574cdc51834e
- SHA1 e5aae8d1ab0c3656786fb76c021901be6afa6b8b
- SHA512 e1c55abe13e503801b600816fc1ec01dc49846405540cf4f2333dd46637965959777b6fcdeeb57178a570b03f2ddd80ab7578386252472521fcb2b978cad7344
- TLSH
  T1130110BF6251C26902B218D20C12D2A0F470F42B1B20A5223C7EF38E1F75974765368A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  smtpapp/process_send.php
- Size 2KB
- SHA256 6af0d1ea47c3ccda5122535d8615a691b445f4d70eb7c3cb735a4bf27ebfb789
- MD5 75f6baeab4824e61b241922f2b89a1da
- SHA1 dc3f71b244f93334b541cb162a723d3aedc3b57d
- SHA512 11f88aace463f2dd974b5b424c4e0bdb985b9204270468679cef568557ff1f8c80f4e9bd6888c4bc1984628210fb70983f1c49fc42ba8e898e6ae2c473f6243a
- TLSH
  T1C251D951345A6B60EE38F2B5BBB06440FEEB61073C11A950B4DE52805F31E4BFF541DA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  smtpapp/vendor/composer/ClassLoader.php
- Size 15KB
- SHA256 d4b2313e562edf942838ec316d983c1a3459ca67da3e5658e861200b0b3693c2
- MD5 c02be6d96671f88d28aad3ffa134c8ae
- SHA1 7f146de662b0599355b3b049a161e23cbdbbdaeb
- SHA512 f73af132ef1159370f4da75d1477541c8fd55e82d64e1a29b199e8963597b3558853edd48f703118bb139680e80bbae5cd601580c9f62355f3e749214b40e162
- SSDEEP 384:bRMAJd+yMxhA6b9JmKj7YyiznGgewQbuUNN7dJUu8:bjxMHAS91Ex
- TLSH
  T18D721F6929EB042A085361BD978F9051E05FF13B622D4D65FDEE06F06F0072CC5B6BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  smtpapp/vendor/phpmailer/phpmailer/README.md
- Size 16KB
- SHA256 5a00934a50f21e97c61f4201df2f321be80ca65ed2a5e674c167768b93cfa10a
- MD5 61632fe69500cd300f96a3e6cb4ad3cd
- SHA1 32f3f6c557aec172a9f1298b24bf03cbe2b144a7
- SHA512 8dea0d99e77cb8de5e107800dbf60b723afea94b7bd4bedbbe456899515205a77b28b0a23456b8cfa1bca282d35577970627c3ee2b70f675b615079f98f2d7b0
- SSDEEP 384:wTSjhvawgsF52HcRF1QyGzyTbvC1UCgGTkbhib2CfxTrdND:EsF0cvxbdCgDfCpTrDD
- TLSH
  T1797293ABB310166A3F832BED7B652495EFABC31C6E807474706F4124C344867FAB71A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  smtpapp/vendor/phpmailer/phpmailer/src/PHPMailer.php
- Size 191KB
- SHA256 45599a196ae7944ee2dcd4f3d3da0ac4243513d346b2d77bbd15dbd0c37f7064
- MD5 b7e61d0662fe1f5d614b9f801e6be3fc
- SHA1 9b6652df1bf72befb08682b030b0ec239bae8893
- SHA512 0466865628c4bab868e5322a8c4ef77c828eb7a0baade73d883b8945cc147900d537f7269c96abf80dc6b61a562163b80a5615e970c984cd2baca1c3f5deea7d
- SSDEEP 3072:thPJj2Y3HwR9DQ01OgiDd1F/RmRp3S5nbmsjhlAKlq/g/Io+iQvjQ6dC5lUGcDk7:XJj2Y3w0g41Lww4Y/r+iQbQ6d5GcDkb/
- TLSH
  T1B014C81878E75C91165360B9ABCFA040D13AA13F1578A892BCDD43B85FC4B3CDEB5AB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  smtpapp/vendor/phpmailer/phpmailer/src/POP3.php
- Size 12KB
- SHA256 f23c66c56efa2d5aee5ec828917b7fc071b600b94c3b59655aaad8d8554cd866
- MD5 7435806d304c8e8601571a84240c096d
- SHA1 6360f8b3695a77db25696106dbbadd4757eeb0b8
- SHA512 fac6f5e4ac8099b10ee764357ba942c8e089f8c5af4d98e896cc1ec28d62df5cffe7ffc681b006c6b92b4a1ea12158e3d70c64b98bd988fee91249f4cb3753cf
- SSDEEP 192:LSxp7h6G6S61A6P6CGCRelnM6V6r6Jm/4Kmwgzyk9mnIYoHexAriGVw2rfJNVyjG:LSfX40wIjsGGPA
- TLSH
  T14C42732D38E34922135314BCD74B9480F336952B2325ADD47CEF53786F51B2ADE70A96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  smtpapp/vendor/phpmailer/phpmailer/src/SMTP.php
- Size 52KB
- SHA256 522bcf0d07be7e7e00114711db5c9ce2b4d59ac041c5ec36eaadd979d5fa7046
- MD5 873a6202fd7db49da169515c5625f3ce
- SHA1 802f86518c55e45062f450f2f4243916bfc174b6
- SHA512 b5e13d110ab215a2def89d6c2df3707da86e0401f5af9ca54ca5ea33064bfc236926c142df6ff793ef97b3f1c619e9c1d6f80241fdfb97c0269d02e1f89e101c
- SSDEEP 1536:DoHHMZxzhdwXLF4aD7Wp+kQ/Vxczm8c4ybII3WU0:0HHMG/Vd8c4ybM
- TLSH
  T1BA33C94A34E71976122320B95F8FF044E33AA52B12299D85BCEE57785F4073CCBB1EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14