673853b8370c2f5c12514fe32b443c8dcb6625ffea8d67a4408965112ea38217

Sharing

Copy URL Twitter E-mail

General

Target
govpage.zip
Size 2.8MB
Sample260720-pfymdsbz81
SHA256 673853b8370c2f5c12514fe32b443c8dcb6625ffea8d67a4408965112ea38217
MD5 2af450b90e50a1764f08df661cbf5cd4
SHA1 87f40a9854d89f61ac9b89d71db73758b75007a3
SHA512 c0b91407adb3bb89ccea712b11fe31ed3cdd77ce6ce8ea955aa995192a6a328309e9cea6cc0b87a54a182bccd54f480371df01a2a8ed3617247cc2c5fceee051
SSDEEP 49152:hT8REIDYI9NbEpe3i5ViT5JHZA+VFCLa0FuAZLCUa6bVLD1afQ:hgYANbEpyi2TrHZA+oPTaSVd
TLSH
T194D53379A7AF7370C7123B339C642C25D4346206D2578A4F39AE88C9BFD757B0B61688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  images/myGov-cobranded-logo-black.svg
- Size 62KB
- SHA256 954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
- MD5 b53f20300babca4ebb422e59b888be1f
- SHA1 699c5898c6dd9d2b8b949db2e13c8f0b0d29e26b
- SHA512 3c8417a8c6b689a876633c18f00558b89334f5bcaf8fcd0242d4ed3120bdc0eebc1f1981642c7337c3f690fbc7b243fd61f08220bc7c0bc3bcb2b2ac8c9ae5a1
- SSDEEP 768:pOLsHDCJYU28s5MBiVkYR1utxxmLhtzP4GWWT5m/tW0BhRL26WGiGy5ZGrr:pT+Jo8sifYRIaWgKVl29GiGuZU
- TLSH
  T1FC532F7A5308877B45C3CB84DBDA64C9325DD1C3F2FAA0C8DBA3158B5D128BB95BCA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  images/myGov-cobranded-logo-white.svg
- Size 62KB
- SHA256 10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
- MD5 de646b2f77f5fa27d55a01bbb9cf584e
- SHA1 33316eb871adf6e08af7c780eb15872549d08dc3
- SHA512 e9045ed1fc7c7820e37a6ae88fadb685a79a5d162676fa81360081824bb4ef63dae66ae0d62337d81668eb83998b26ee6404faf0fb299c03cc52e505ad027354
- SSDEEP 768:bOLsHDCJYU28s5MBiVkYR1utxxmLhtzP4GWWT5m/tW0BhRL26WGiGy5ZGrr:bT+Jo8sifYRIaWgKVl29GiGuZU
- TLSH
  T19E532F7A5308877B45C3CB84DBDA64C9325DD1C3F2FAA0C8DBA3158B5D128BB95BCA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  log2.php
- Size 13KB
- SHA256 43e75fdda01ea410f9a39438ce2e3765de3fb4fcc1c1aae1aa84bf648ec4a862
- MD5 3c8c7c42c9b1c01c6bc42a656ff48536
- SHA1 bc3a336d8ed48d5fb9f2f5336299a84b9643fd98
- SHA512 91184583ab7ef16c074eb83cff7893ddd353ba94d9302615aff4fc03c5c0bf095ca3080558ae6ec2a7f04f22f0e1954dd875acda0d6398637fe4f7b43ee7b719
- SSDEEP 192:M1tcwPgnrmwBrMRPDeJE6M2vd1x1R+g66nQTqg66IFmmZ:M1tgn5BEDeTXvd1zymZ
- TLSH
  T14E5232141CF95827628BC991BE639B3BEA82C01795455B0F76ADBA881FE1D63CCCF035
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  next.php
- Size 6KB
- SHA256 898d28ab66194b116ba3c6e1b52229b270fe149bf416b3cc22c085f6dbd12394
- MD5 868bb5a3ae1e16aa072ed27b96077bce
- SHA1 a0cc4e0b78e2e88f7776e4aa208afac7ad6fbf44
- SHA512 994b83f62340da16a841fe560e6aaeda47b3a8293a390bf85f740e182028d1f99c3dfcede2126a7091bf437b4a051f8a61ce51a69651187483e9637f0c413e38
- SSDEEP 96:lN6fpPCfSLfQ1CfSiffix2tCfSWJfvCzVcb5bCfS3Woi:cqKUEKI42cKByb5OK3WN
- TLSH
  T1BAD1712C9E624F6F11B7D0ABB26771CFDA6600211984FD52BDEC048D8F8C64B3B8D516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  thank.html
- Size 4KB
- SHA256 578be6eaf21a4725c0e4b8713430c3b1fc9900ffea4f70d1fd03077cd42dee95
- MD5 3c2355bb96a92366a8e4944d9c250e75
- SHA1 c584a884a75567c4a62bceaa72252af0a8ad013c
- SHA512 81bbeeda59b2f3eeb61b172c07ecfefe5d658d040f012f905a389fed86f1bae3667513bd7e4eee2365481b6c952d0a5099f181a778f822ea04cd4c64fb75f711
- SSDEEP 48:yUt+OtDwPgUU309Dus74CRpkzvmDeJKuVtHHiG9c39W5G6E3gUqOUvgM:nQmDwPgQbR2vmDeJKuVtHHiZE5EgAM
- TLSH
  T138A1522518F450271052829ABAA37929EEC2D507D686CA54F8EC47DF0FF6EDBCD0362C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  vv/id.php
- Size 14KB
- SHA256 4e6774b254ea6a92c2499bfded72f53fd87b7de85e37df5046e78243331a9315
- MD5 d533844bc74947189c2d70f694b0ac63
- SHA1 a7fd9bafe2cfcacc2c93a765077fa5543f1a865b
- SHA512 f68fb0c865546f7a7f9334234526002d0a52a11d7cc02c148be234171ac22e7b1789e994cc7d3a178d9a1cf444aa186aa3063d755f26fefa85bc3b8572616c14
- SSDEEP 384:TlEZheIOaIYKsSjCIONtJIdjVtayMRuOZ3rhKmdFDC:xgQKR1ZbrdF2
- TLSH
  T10B62B615B6CC6E7B016705E6A0B7DF98259B5E38C7138D44F0FB91A42ED2E41B8134AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  vv/lib/fonts/icons_sans.svg
- Size 67KB
- SHA256 63b54f612af42b08f8b7335da2d8b5822b39fa9cb88879ade7e779128f75cca6
- MD5 4548fb5cddea1438e10fff69c588e370
- SHA1 7c82c395dec233e66f554d8d8d18efb49302b418
- SHA512 c2e53f38dbac3fd118b152703eee1179e67e088caa5339ec3a30e7997dcbf971d49d491df2d91d7e7a8867b822d3064a5e17edc3bf8b4c44d0985788625eb5ff
- SSDEEP 768:TaTJT9MFlonp7uyCtGHiNa+uRkvOh2VsMaGusID8hfBncG3q2EJhViWh4Ka3lXDy:/WUy5R9hnDCcMghVliKa1XDwqIt
- TLSH
  T19C636668F95549BC8EDE02C186FD5ED8423D82AF251A3C2557DCADE00F0BB2A4B5FB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  vv/lib/fonts/p_big_light.svg
- Size 127KB
- SHA256 4cb27823ffdeeb53969fe93aa646d7c874887a37c0fb2080a666b262c8907445
- MD5 3390651ad869cc14f4a05a29f3e43bbc
- SHA1 5f5c7b5a72275a02d91df1a08cb776b4504c6836
- SHA512 e535e6232793f030b2c38cf056ffbf895c95b616dd788b9fd18ed6e906a27daed0f01aac65714ce260d34be1259062b284fa36caa198b3bdfb422746c578ff83
- SSDEEP 1536:TqOiVkBmm/5NVF2J8//f/Qot8v9EY6NKCDiA69Y9pwyNtOdtdj/HTZvOxL1eLvdt:l//n6LDZHn0K
- TLSH
  T197D375BCC809DA944EF7C3E09B65E8F9402E83AF7509356DD58A93E10906E3AED275C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  vv/lib/fonts/p_big_sans.svg
- Size 126KB
- SHA256 260786028529ca9f95f8ed66cdd48e1734d73a849909904135326d7c987ecdea
- MD5 f5964cde2a415cd3ab55b247e0093b90
- SHA1 42f556092c3e3867fbdbd93fc2fe06ffae14b123
- SHA512 66f815aa6868af0d387c83ccab971c3af5977f8d545cc1a5420fa8bf1190ce5974dc34fd63d443b0e1d40c5eb8f1e96fc3c38af959c0e5195a89685c516f76dc
- SSDEEP 1536:JM0x7p+ZAsByOx5G4sKtxa18zj0DWfeYjXcpHJIqxFX+iyWaMC20hFf8wOe211X:m0iGYItaMCmwE
- TLSH
  T160C374BCC805D9914EFB93F0CB9AE5F5402E83BF74187879958FA6E10D01A3AE9275C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  vv/lib/fonts/p_small_light.svg
- Size 122KB
- SHA256 b9efed2db835f2dc748880b3099b040e7e3f030f656cb527ae2aec62946dedfa
- MD5 1a5cc811f6ecd3b2bc93d4cd2a539bc0
- SHA1 6b9de7b1c6ce05aa4c7d7080d973d122cb45a9c8
- SHA512 af6c385efd79d6ab02ffd469d3c508fbd68108038770bc1dc161f469d8a53099f3a9d6fa6c1a5c7b0783f82e45126693786814f09440866718e1b4cc127541f6
- SSDEEP 1536:JALFw646iAYUdGOeCh/8lu0RjoFA9070+7iI+8wEHSNfB3dpsKzFrS3B3onnPg9T:iniAYUkOeCh/wRu
- TLSH
  T15EC385BCCC49D9914EB7C7E0DA56E4F9402E83BF3119352995CAE2E20D11B3AED279C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  vv/lib/fonts/p_small_regular.svg
- Size 122KB
- SHA256 bb9c58f0a67b344fea294c8314b8e9a3bfad93c92a6c6f927b656311c5bd42e3
- MD5 345b22864617e24360fcfd49641504a2
- SHA1 fbd99f0b821462c804fd232241702e5117dadb2a
- SHA512 ddb1dc643dee381ab24750c08089f520a92f2be3ad086e5d15e1157afb8e079205953305dadf614f3ecb8aa7706b9d2bf67e3706ef2ca88f186734918cc7483f
- SSDEEP 1536:h1AiCYDtWpwtqMuSeEVS9p6jsAE57r/jhgBjXWfjbsgC/tg/bIbIbUbz67VE0lZ+:dK7Vn004
- TLSH
  T183C375ACC84AD9904EF7D6E0D795E4F9002EC7AF652D342995CBB2F10911B3AED2B5C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  vv/lib/js/jquery-3.3.1.min.js
- Size 86KB
- SHA256 b0331451a37833bbaf54b51fe12fe973653b8ab3c2e002872dbe624ee96cc2aa
- MD5 1b26f7612f4f5406b3c372b0a11ddbfe
- SHA1 51f4f269b279cc980321de7378108f4bcfb5fa42
- SHA512 6f612ad531e40625a15f32f8ff1ef2817bfa4f4e4851754fa33d584054fa01b24d1bb833311ebe8f7806ce9a848a166b0c122347701146183a89b773f6056cd9
- SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t/:5kn6x2xe9NK6nC6l
- TLSH
  T1478319DE72C6B06247AB71BA007F550BF236589D684D4410F129E4E9BC74A8E823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  vv/lib/js/jquery.ccvalid.js
- Size 7KB
- SHA256 ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b
- MD5 2f24b339e94eb18fdfd5cd5a60e82546
- SHA1 2abf52df7041eac55e0f59bf867053d4cb29891a
- SHA512 2f7d845049efd0b09eb757f4dd37396d1d46670cc4abaf6739e5c87955c5cdf959579199797466f6397a4da71bcc82d77d9a82ec80fdf96d7104d43b88db3478
- SSDEEP 192:ApEqFsy5wEq/DSUx0oTYpOiaZfsmvNNiV0UV9QRVjiwSyRabjsafHEaoJ:J0WNkpO
- TLSH
  T127E1DC9CBAF331945913BABA0BFF5503A4788447510CE946BE1C63605F90B7C52F9BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vv/lib/js/jquery.mask.min.js
- Size 7KB
- SHA256 bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
- MD5 acb54232967a36f1df1d0c0623a89d65
- SHA1 6bc0ce0a4a1dd27ddb307b80a1247af996eb23bf
- SHA512 8035921865b34dcd260f53f43700d4b19b12ad2c8bb02f0cbf4235e09b431495eed8f828de2939524d7e06ac68b1b109536803503e96e430a99fb976f4087d02
- SSDEEP 192:E3KIpiAIexCKjpf0sb4mtZGPiE0KiReKevZd8OA:E3hLjf1f0i4OZGP63eKexd8R
- TLSH
  T158F1D8D57286B1A252B330E9017F120BE777BBA156DD0818E62994D06F74F8E1053F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  vv/lib/js/jquery.min.js
- Size 84KB
- SHA256 d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
- MD5 a46fb81762396b7bf2020774a2fb4d9e
- SHA1 fb5edd7a663dc8dda7ec10815a7cd82a30fc98a7
- SHA512 40759595b05808dd911075918bdcc32fb91362019bdfca24827043b8e54116e6ebe7362050ec72182b66481f1dc8d4ec4c8942c984fd597659313d71ad60dc33
- SSDEEP 1536:aLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6tv:+kn6x2xe9NK6nC6N
- TLSH
  T1378319DD72C6B06247AB71BA00BF550BF2361999684D4410F129E4EABC74B4E823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vv/lib/js/xsecx.js
- Size 268B
- SHA256 12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
- MD5 550817b2acb4cdd6f3204540c1ec5589
- SHA1 46631bb315d384550c88d9f07315d971cd22b11b
- SHA512 fb24c0bb0bd3d8c44006b585ba1d58f39ce808eb60c8f9009af1a282aff1fe39ff1cd76847d78ff4c0eb6791a97e5428be0face2aa3760234162cc533060eaa4
- TLSH
  T142D02E08B47C8381207BA03D02BB8E00EF3A326B72010B40FC853CA83F3420DB222B80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32