cb298cdc4cebd2c9da018be55dd4d00bb162776f0510d955f0631823efca75b4

Sharing

Copy URL Twitter E-mail

General

Target
accounts.google%20%281%29%20%281%29.zip
Size 7.6MB
Sample260709-pfjs8sa13v
SHA256 cb298cdc4cebd2c9da018be55dd4d00bb162776f0510d955f0631823efca75b4
MD5 97b4d054f39760be44d807edcc88bd86
SHA1 5e90b35c4ca6740f0808b80ec7c42a7a6029c72d
SHA512 23180c7fd2f17a16b10dd5e605ce1e4ae20171553ee49e73c607c71226deeeba074363298c0a0fe7a25ef4fef7a1be2c70bd0c58dac4a39560ef420a5ae90a0e
SSDEEP 196608:guJvEaXw0pUDdW0y6hUb5vjElVv3k+HKS9vvx05diV/ZY:gSvEqwSUpthUlbEE+H5v65diV/O
TLSH
T1D88633F2CB81CA58FEDE8C38E69C4924C6CA360539A7BDBE1F400B91DDA79462773544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Antibot/pro.php
- Size 1KB
- SHA256 65550d9c52c994219b1fea22f53659cf5ea1d2d784b9c3dfc4b607c432750138
- MD5 4448006d0f26bc847a3e3050adf3a15f
- SHA1 893f2b61f90e718615ef163ab2c86d06adee31e6
- SHA512 de894a05240d2272ec643af70614d9fec85f17afd09c0667de53f6fdf3ca934f9856ffca6505d6bd4a74a0ca298498355477b4825f15a67c0aab3816fd0e3ee8
- TLSH
  T1C741BD69F9137AFA06B5D31887A50882E495520B8B07C726B6FD620C2F7C124E5A0DDD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Image/brand-aol.svg
- Size 860B
- SHA256 0aedbfac81b64afe80d901d42d2195b44bea6729a35a722b854c55349af055ef
- MD5 be06ad6fd654269fb7719877451cb478
- SHA1 7d34a9466c8a3c4f880a8891883781c1e43152ba
- SHA512 855446d9fac488beaa4a8b37788805250ad6064db3c31d4a2df663a7b36989f7710f4a19a6c826839e44335f508693c6fa97541c252b34fbd67d7c3ffb270b77
- TLSH
  T1581152D331302B50A98DA1FE5FBFB51224AF802FC2A03015666E62804FCAE55E42A91C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  assets/CheckConnection(1).html
- Size 34KB
- SHA256 27109b2380d8103de9b7cee5fdcf53cc1c1829fb372586a9cbc36fb5d534e58a
- MD5 2584a75eb4dcad04785e159e9b083ccb
- SHA1 03a0273cfccbf8471b4e5dd42246a342dffe980e
- SHA512 94573051930e1041c4afb813de3d8b2a1c6cda0bf9b56fb552af72ea2f64193d399414aaa545e4e36b27bd3f455f53de7ee748ca4f50336373b3202e898a71ae
- SSDEEP 768:ZiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSl:4IUlVN8KYEsvZSJ4H+
- TLSH
  T16CF2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C453BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  assets/CheckConnection(2).html
- Size 34KB
- SHA256 149d0fbf322397c0f1d65c61072b93955cd747904e9cc194e03afa5aecb637cc
- MD5 4b8229537dd39dc6a4a2e1d750899c03
- SHA1 f8319f0a3c503ae58c2b6396bf4a0b648a1dbb6f
- SHA512 a4836bfe87d7d1b2581345afdbd6f5baed95a76874bcc17690d64d826225487846c728b8e81e87781fea7d9c446821996fcebd568ac2e5ba868c1bef60bbf8d2
- SSDEEP 768:BiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSQ:QIUlVN8KYEsvZSJ4HX
- TLSH
  T1BFF2D7C8B7E2742683A3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  assets/CheckConnection(3).html
- Size 34KB
- SHA256 a45e241cef87d6b40134a0d6c3176a88c23b25c9e3b8aee215a07989dbcf1c13
- MD5 44af90253b76632c3fb14d68f1fc4dc0
- SHA1 74fb83233d053a1b73b7693e5a0fc39b1e8188b2
- SHA512 f6283e1dfc346aa064a3f0a7db69e168309a6c0ab4b9b25df1f1eb3752b22a029203158ede4d9466c735452f7a34d3c67cd6fb93f9fac34d1ee62fb3451a3524
- SSDEEP 768:miQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSB:jIUlVN8KYEsvZSJ4He
- TLSH
  T131F2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C452BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  assets/CheckConnection.html
- Size 34KB
- SHA256 78508d19c0c6901a79d98f5d52dd19a459dc8d18ac0e4d3c8e3012bb7fde09f7
- MD5 e251080b7d1e2369390fd1b055cdd6dc
- SHA1 a8ee1e025eb26ba94444f89400887ab370e76f76
- SHA512 aaf70955d6cd61b131344b4f23c652dd420f0661cfa677690c05e8bffb84cfc55a5648cd85ff2106ae60cd6ef607ca759d0903c44403dda2c24f05e52e9884aa
- SSDEEP 768:FiQHknt53YUNDiEN8KABE/7jcvcuSfR458rOSz:sIUlVN8KYEsvZSJ4H8
- TLSH
  T190F2D7C8B7E2742683B3B5A1502F000BB17B5C6AE44C98E8F189D5F16EB568C453BF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  assets/bscframe.html
- Size 191B
- SHA256 03dd138a8585253980397cf5fe00607d8c3b34ba04dbffb5d1907d6d16e94ea6
- MD5 c9bbaf12b37090bcd2ae96c1b40690c3
- SHA1 dcd8e3a05de9e637037c80c2b15e9ea73670b466
- SHA512 8639378100a580ce3d89ae6cb82b338c9dcaaa2334fb580de3f158f722f173ba223b4243374b22a963dcd3faacfd942b6f8ffd1d3623065ea75ff65e683aa00f
- TLSH
  T15FC012FF381320176610ABE499D9B51C4D414664B049C945A89030BC5AD971ED863795
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  assets/js/redirect-checker.js
- Size 3KB
- SHA256 e6f9d62b9d20bca248ffacf9c7e7c579893100e8d9d9be8670c3abbfb699db52
- MD5 f88a4c72500082c3bba3ad056374da77
- SHA1 fcb54603e147b57de001c2f4e279b3ce328f4bc0
- SHA512 32a7f77482b88ac16ac0b62a076f58bcd7628fc7f68874ae1cd7ca9170de4e273b943dbdc3515221cab20252f84075380d22c6bd016dfbe492d922e1a590b675
- TLSH
  T18061031633E711212A7760689F0B66577622940B138EDD3CBEDD43E42F47B2085B7AF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  assets/m=_b,_tp
- Size 759KB
- SHA256 06a7f2a1b05de87c858c86e7f4a666c3efa176f85e78c3e932de3058e2c0ad48
- MD5 ffc136bfe9026810515bc63c2619f3c1
- SHA1 8d8a9954e05d1ed1c95c89e54b8110563ed1f13f
- SHA512 487ee6ca7f06f9bd8c1f685cc04c53ac11d9824abd54d109ce9038f7b9898d61059d6029363590d9be845b5f9175d2ed88f657a965a5d1ee99e4f3afd0d1bf52
- SSDEEP 6144:OFarNe+kkqZqyqsfajs7F6FtpK3hpDiS0AXr:OYrO7F620AXr
- TLSH
  T106F43AE9B6E0B1635713A7E0883F141DA12F24B5762C4828F1E6DAD35EF0978057BF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  blocked.php
- Size 1KB
- SHA256 8e7ba6995f730673b121e7dbe01d448a5422c3032222e8f143b0015640dcff3e
- MD5 e2249d8852be9d0f7f15f56e5894fb16
- SHA1 43fa5bc552fc415e1982d5c1f2fc39fd195b566e
- SHA512 2d15af0517bf9ad40494e005d368428a5b9bfedb970b3088ddf2b033783fba0c495d697038fbbeaa9c8ee22f1330b59a4927345d0d33fdeea9153d456b897f60
- TLSH
  T102410F1A56A0040628B2E2B96FF3A308FAD350179307456A3ECDA2878FF5611C5E3FCC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  bootstrap/fonts/fontawesome-webfont.svg
- Size 433KB
- SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
- MD5 912ec66d7572ff821749319396470bde
- SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
- SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156
- SSDEEP 3072:PLac0AVfCwGzG8LY4kh53s0eOnz8WjKAOvX7LYvglcD4ZME8xYWDQqJpFDBl4qjm:hCG7bFv9gSS
- TLSH
  T17594C96CE9910B79CBDD42D5957D0E90132D81EE28783E1846BEA8F05D06B2A0FDFBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  bootstrap/fonts/glyphicons-halflings-regular.svg
- Size 106KB
- SHA256 42f60659d265c1a3c30f9fa42abcbb56bd4a53af4d83d316d6dd7a36903c43e5
- MD5 89889688147bd7575d6327160d64e760
- SHA1 de51a8494180a6db074af2dee2383f0a363c5b08
- SHA512 c2e77eab327af1469097c31bc0daf820c066b0222059d8ff0ecebca974b62b7535e96f1f356643b2b62763a924d040e4ac9b2097e1de2c22226411fde8723743
- SSDEEP 3072:jY+spjSP0yD4zOPqGGUG0kSnouoxvKDHkPooe4Pqo0CjmFIudsqi/CWEI:kRjSP3D4wlG0kSnouoxvKQPooe4Pqo08
- TLSH
  T130B30F1CE9940B709BDDC3A25B75AE54231C418D72303CD04AB9E5E0B99BF694F8E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  bootstrap/js/bootstrap.bundle.js
- Size 223KB
- SHA256 06ed8a1990ade6b474914d22e71f2b431e655045b16b96aeae674318fa4ce646
- MD5 4d5e7e6ccbe7360bc74ee4930ac25477
- SHA1 7cfa62b4df5d4910475dbd5e237dace197e5f282
- SHA512 8aa85692f2ce5d50f3f8bafffd9af210a36f679a6681d2847b9f1687f5707d31b04e4bb430a6ee2e18c9d7350026ef2249b3aa7cb717aebc49eb5fb6ed31e2d9
- SSDEEP 3072:DeOiz6JsHhcZMJ6XsqoBGa5fHWb0YAguWEtI3+s:DE6JsBUMJ6XvoBGa5fy0YAgwtIt
- TLSH
  T1B524730A3DEA34A3456BF02E87EF5149F635505B5209D9107C8CE7982FE4E3452AEBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  bootstrap/js/bootstrap.bundle.js.map
- Size 399KB
- SHA256 4d769aa49a4aa7aa0c71c2c15f3aec6c5a0e5bb1c5b537b6d3527d0c9c960131
- MD5 4d6538c06c82b86375f9f4d09455752b
- SHA1 bc221e5ad61cae5dde479f04029ec03c73189570
- SHA512 8014bbcb087c22f94879695ade882bb59426adf9ff904a1776c7123fc643ea8dbc51b3924bf0047998232e03fa47cabd83fb4b7c47018b07999e15be7fcd14b7
- SSDEEP 6144:hM5axoMN6tHYVqoV7qrmWY+atE+AQE6pQGV4m+8nlhnXgS7oi4:yLRyQ5
- TLSH
  T197942F132C6BD8337157D6BB298A4297FE20709D6E859600788EE244F3C2F39B5EE574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  bootstrap/js/bootstrap.bundle.min.js
- Size 79KB
- SHA256 5edf297381b409d711bc8d27676951a59e151e783412850332519c05243d1e24
- MD5 7fd2f04e75bd7ab1a79d80cdd4c33085
- SHA1 e02a14457b25e6df2568b772feab4387c00a4934
- SHA512 3b2e41aee25d13780ff7e2cc275d640b99c4ae4877a7863419ac13d49adc7b3e114c3c4e0dfdccfca3f7a44b2078e63159e8eacb648f9e3f9032982dbe10dc89
- SSDEEP 768:WVDnVrD5m8HVHZIEzSV7BTxx4mu0spQ1+jmzpvACS+eAuQnQ3O1+dCDWi6OzlTd3:WVbVXIVCHKzpyAWMkG1sn8B0upp
- TLSH
  T1E583D54A7254B47206DFA176807F460FB2376899A50B802CB869D8ED2E7CD893177F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  bootstrap/js/bootstrap.js
- Size 133KB
- SHA256 8bf26ae9373c49b3cc06b9efabfb0e4df1fcd615b97a655ae0ecd93ea85cc2d2
- MD5 6386470cd2491cbacf90825b3a65991c
- SHA1 e70b61e27abce309a4be39bd3d3d4a4e0c4e2271
- SHA512 56d99d3853723a78915081f391f2f81807becae021a16cc9216616ffd7a571dfbbccdbb5d8e2ac7161487bd3d143a541cb8763af0195ccae8c2c3de84e92e945
- SSDEEP 1536:W/Mhzcl7vqOiT+1W8khJyJK/8u2IEZPO+w:weOisWEtI3+w
- TLSH
  T175D3410A3DFA2863556BF43E8BEF4045F634508B5509DA147C5CAAC81FE493453AEBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32