de580a46fcbda51556d9350b998851bd0e31f8c55b82e47ba29855162534d81a

Sharing

Copy URL Twitter E-mail

General

Target
api.zip
Size 629KB
Sample260720-pgw5yshy3m
SHA256 de580a46fcbda51556d9350b998851bd0e31f8c55b82e47ba29855162534d81a
MD5 402d93846036e901897019221f65c4d7
SHA1 0ebc3296fa9a96d25be30c9a457ca3e9d8832f8e
SHA512 d3f6a6266781e71927a566cb04280a03c270336004fdc3d9e6790b3dfd18bcfd6c64360eb550fbe31de58495b563aba39e93a4a6bb514e1290f2b3809779f18c
SSDEEP 12288:rbrrMETxqzp/jvAMiQuwfrpTSjfnPBYyons5OZzEePeIxk46:rbnMx/jv8QuwfJSTpYDn0OZz/PeIR6
TLSH
T1AAD4C0BE861C36DACE8EAB34D3A74B678595507A0F4035563E84426C894FB873F3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution macos

Malware Config

Targets

- Target
  api/m2m/v1/index.php
- Size 152KB
- SHA256 9e585155722b9f3e671b2e4a0331b2d51e250ad96dabb1e06701753b4f188018
- MD5 81932171defb41a61c274798a56deef3
- SHA1 9492471a276ccc8c990ad7188fd29e690eda1e44
- SHA512 1cd521ccbbc6fca8c4fe447e6836a19ec2afa77e106e7c8f0c6deeb6057907bcf5b938627f7785a0aa665c5d181d65ad6699521c0347f0602f387d7219199138
- SSDEEP 1536:KtFtZtVSI/NhCKM6y5z7exDcQv9JYyPBEjGKm3AfG+zGrr:cSENhCl6y5IDcQv9q/6Km3AfG+zGrr
- TLSH
  T1E7E3A82ABC7B82754EE754A81FDE98047A5FC80379006DB2BE1DA5DA1FC0C78DE9560C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  api/vendor/composer/ClassLoader.php
- Size 14KB
- SHA256 7297260aa8563964c9e19f479e845dc5e8e406c8f6b3f422e5381930f5b5c625
- MD5 11d7e3373ad17161015af6db2ee15915
- SHA1 4f8fe678ab89bbc999c386b1273e7d54d46d3687
- SHA512 d1a06be415a8a4f8f1ea0e948796226fc61aeda53a91cbc0ad330846d534f9bf171c02a6d1de89154c28ec70b869018b5b003543c1ebc966320e7fd9f85b409b
- SSDEEP 384:a5RMAJd/E8VVaN5QDnGteoQbuUNN7dJbZ:a5jM6Ayv
- TLSH
  T19352416D18DB15390463A1799BCF6055E21BE0B7B26A5C15FCEE02E06F4036C81A6FBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  api/vendor/composer/autoload_real.php
- Size 2KB
- SHA256 abf89cb4bec3a5569ddc26ccfbfee3feb202472e148ed5a5fed596ce70b6e31f
- MD5 e38a8b8c11d55714042f8ff792add18d
- SHA1 2006bff8c600633f3a3f9b99e621ae9fda32cd66
- SHA512 126738e4e8d540b34d21d6782c81ca3e1cfa3eb56e0b48f857974190b5ae11eaded11b482a0f25cc8575ab3baf2d2adb0fb01caf6f79ba2134e4c7b1ab822352
- TLSH
  T17041CD2519E6D0920103F59C534EB885686E9023AE068AC7FE6C55BCCFD092CCEED6F7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  api/vendor/lcobucci/jwt/src/Signer/Key.php
- Size 1KB
- SHA256 02cb3df88566345ef25eb90827a3df2e744fb788a252b63f021741934a5a3f93
- MD5 bfddc5d7a35f52b372559f272925e43a
- SHA1 819a2907c32bdeb34208654a56d54e7bbd2dffe9
- SHA512 4665bab9429bdbd71f042409bddfdfc85031a09cc4814776ae61fc63edef8d8973a15528c13c24d4ef8617f4aa2bccf92c50b797616bbbf84917826d9eee743b
- TLSH
  T11431BBA82CE24853539764BC038BF046D8A6E20B526DA997BCBC937C5FE572495F1B0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  api/vendor/lcobucci/jwt/src/Token.php
- Size 5KB
- SHA256 81efb0a6a630c19de73da04116f19f29f081db3bfac5768f61808aaab9732282
- MD5 14ad5947c896fcdc8166ca60b376f1e4
- SHA1 859545fa2e1d3af5c95bb44e66f8714de99973f0
- SHA512 2aa29dfcf85709b1b0ed1820853fdcf680d8933d961e9ae03d7caaf775a4030eb013daef9b8b364dc6bf2acbcbd89f3763378cc1788e1abf93c9ecea623fbd29
- SSDEEP 96:JzvfA13Dau3qCxZjHHcJawbxkMSDJggOFAmrmwL/qvahl9Kcy44Y/F:JzvY13Wu3qCxdHHUZbxXS1ggOFAmrmw1
- TLSH
  T18FC100CC2CE7B935411364B9838FC1C0E95AA61B255C48427D7E9BB82F54B28DFB3A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  api/vendor/lcobucci/jwt/test/functional/ecdsa/private.key
- Size 226B
- SHA256 aa232260d047facef294ceaec5fa528abb9a8ce32463f3156115528c378a8a02
- MD5 e5c1f6a0289d35e2755cf279d8dcacc5
- SHA1 51df5b00e9d0cee6036ffabed51d5a25d6e719d7
- SHA512 55c6004d6acdae531191c7a6410b8516c7c76422cf7fe78ad1f765a83667612f63b7580be06499c2abc8f0c5c4d27c9aadef339847cbc08808e5786ea5d1f935
- TLSH
  T174D097814FC51A824062CC4144A322395FB2D2901F3713F28109C002AA01A0DA06CA9C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  api/vendor/lcobucci/jwt/test/functional/ecdsa/private2.key
- Size 302B
- SHA256 cfb916c82dca7ccafa57498c7c1fc3a3a80aef5d606636e1b3eafe119c959c34
- MD5 d8e2e4461152666cd0d081d2f1e5c6d5
- SHA1 8e4cb114a768e34b888b7186afcb1db18955d9c6
- SHA512 5d68cbb4e1e55a087f39081b4d9d67bd2691b7659aaa4d0c731aa8a1c9211720a16098d071aaf556cb9cc1af58425856fdb2056bb095a57da7bcd494699c405f
- TLSH
  T1B4E0C2D67FA15BD5A033CD451C92273BC3A2E277AA0823B284C96061AA69E4A619C428
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  api/vendor/lcobucci/jwt/test/functional/ecdsa/public1.key
- Size 177B
- SHA256 7dbf83226ea09d46aa9c976775d32e1799d526d33a9c47f826b947b4ac615127
- MD5 a0e0d5cada887f474b05be6c05459f55
- SHA1 f7f42c5eb381d96d9fe2ae7874d2ce22a06f7439
- SHA512 8dfe6d8a676aa4bcfc25a0bca4479196edf0126681b3cf96f2b6c4b597611369fbd2915ed3f9a3dfda6873e4f24aaa8c71f9426966ed934e465e93ea4079934a
- TLSH
  T1F1C0C02C8F021FC20041C40C4FD743D18E20B2E3A77721F381066007F000324710C735
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  api/vendor/lcobucci/jwt/test/functional/ecdsa/public2.key
- Size 177B
- SHA256 2690820530f4ea5beb89407905d5b850ea368a6e2f06047888495e7370b31b50
- MD5 1765fa273efbf724247d909a3d42ebfe
- SHA1 94f507ce7d367294744158756074053f23059f49
- SHA512 c108c2cc628d4ed8f06cd8632f2aeadb4ab2176b1f65be93a08385e0a64c15d733091bd842839ef60e10f470340c1e96a628720de526cc530e519593869c4efb
- TLSH
  T148C080FB2F42D6908411D48D4EDB07D3E114F5D7D557517D00101D0DF203750621C937
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  api/vendor/lcobucci/jwt/test/functional/ecdsa/public3.key
- Size 178B
- SHA256 76b3bd2cf4577f49f06aae102241a3b86e03efc6c6c64f90d3aca86869fed867
- MD5 2e6386405894b3e832478003965f0aaf
- SHA1 f4c6d33baf98c1ea059d51bdd28aafcd25b9f53c
- SHA512 7e2020d8088c51ee482421d0288a38f8cbea0f600f1af1ec78e3de1b3cd78cf9b1278ffc7fb5fd808a6fbbccafe7e5f214391b51c3daf4704151323d414327c2
- TLSH
  T105C08CBEAE224BC68062C4840EC2839BC326F3B7E12323B805D2206DE5B9311721C831
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  api/vendor/lcobucci/jwt/test/functional/rsa/encrypted-private.key
- Size 1KB
- SHA256 1b580c41cf0ed2b980d598db81ef098349d02ba2c9315041d1eeac8b62f7ca22
- MD5 b016c5d9837d980e6ca1e9879735576f
- SHA1 6695fb50412c6c82a7867ab5b0ba827fc70f68b6
- SHA512 7840afe6a50c92c8f8400ae18e5d28aa8954d142ec064e2a9f141be3a422e82fb071161d5c7a47300d754a3e16d59ba69b39289fa42d46e2f4ed58752aeaefa1
- TLSH
  T16631E9BD3DAA4F64A39C8387B4530836C5BBE4D139B12BE4A82092160F755DFF156D8C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16
- Target
  api/vendor/lcobucci/jwt/test/functional/rsa/encrypted-public.key
- Size 450B
- SHA256 0e3a27a8c2a868e94467470522b5d3cad09042cfc46fec83a669a48721d5bfa7
- MD5 8fb4ba79e0e65ff399f51036a2c41f05
- SHA1 e4745e5901ad67098d91a8e632226ce5ce4aaf63
- SHA512 85cf4f2df5a7904427d87a5c20e8617de00a3e1465785acc446d5bb4d8fd38796f41701e82464d5cea8604396622ef3dae313768de3b5c736d1bb813e75465f4
- TLSH
  T174F023320EC59DDDC53EE8250D37D322A63D16F372B1600420EC62731092E98D39F619
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  api/vendor/lcobucci/jwt/test/functional/rsa/private.key
- Size 1KB
- SHA256 5c2b3400321998a2e69f2318fa5fc743bf9d4b1b94aa243426ec7457733e7885
- MD5 32e01cab9b531ab062565e060ca75e18
- SHA1 e018f0d1ed58b13dbad92de09d3b66d26900af5f
- SHA512 6cde372389cafee5e3ccd0affe3d637d486899ec01ea8c3d5acf0c955af74ce20bb55e44150ad329dacf13a651715ac14590524de237da99be4a618ffc9379eb
- TLSH
  T10B311D69EB84B7C63055FB7DDD13C29612789162D79F809321705182972EC23B375D94
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  api/vendor/lcobucci/jwt/test/functional/rsa/public.key
- Size 450B
- SHA256 fcef2aa209dbca8d5edd67df97bc1745d74a3ce5722775a834bed3d4a3bef2e8
- MD5 daf256255dbd8ad5697d08bf3a42f070
- SHA1 d728ee1d194c7583cc37434b26e53f2b044a53f0
- SHA512 303fc080b76d7626a327ed5b4fcc578227f367f2be68fd7428df09510b3e9eb0565032084200ad645e68f9a9afec76099e9c0a0a108b770c72b3bae28f88dd7b
- TLSH
  T1D4F0DCA21F610888C8E4A95ADC0B8283893CB9AF5724E0C98344F08AA840029EECCC35
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19
- Target
  api/vendor/lcobucci/jwt/test/unit/BuilderTest.php
- Size 19KB
- SHA256 e4a1ce65752a499534b1eaad592db4da6567c5aad20f0c84c27ae92ddc5f9975
- MD5 71afc2342d4793e1890e9a51a1b65458
- SHA1 d92d72f732e2bb64ff9e208df379d6d72637601e
- SHA512 417497df784433e6391d266e45268ca4426c237f9390b2905c3a1529edf3e77a1413f47d109082e8cd7f4979b0e49e3c8b0c0a73ce380b98ff33f81abad6f2f4
- SSDEEP 384:Jzft+T+M++lLl0le1z1I1iwPw0wGX/XAX2sPsEsSyHy0ySy3GeCtU1xHP:Jzftcvl9S49+cUT5PwmUrZyVjy3GeCtG
- TLSH
  T10F927ABC60EA4DB2956304B867AF8F84C467722B149AD8823DEFC3756F13314B76261D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral20 behavioral21
- Target
  api/vendor/lcobucci/jwt/test/unit/Claim/FactoryTest.php
- Size 4KB
- SHA256 35a18b1a0e34e28156dd21754f86804f590cf0f0f33266f25b99ce90269f402b
- MD5 a2ecaf8c83c7ea53a594e46d6576e0af
- SHA1 7653c1d548f20fe5cf2ae5d1219d3fe8b1739ab1
- SHA512 f2b4a3e1f749073fe3974b1c4984c3c2b4a0f2c6175e0e3975deed705c2f1921578fc2659873403ffceabb7dfc7ef1e45508a32dbbd9bf8150b1030587052578
- SSDEEP 96:JzaICHMoilHgCH4NaGHgCH4NaYHgCH4NGbAHgCH4NJSHgCH4NJgHgCH4NJGHgCHV:JzosBACxGACxYACbAACOSACOgACOGAC1
- TLSH
  T1DBA18ACC16FF497AC0231BA5AA07C44DD017764B22AC4C86BDAFC371CF26395B396819
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  api/vendor/nikic/fast-route/src/Dispatcher/CharCountBased.php
- Size 777B
- SHA256 86c36c2ba07fb5385057e888d5030ec953755efc1aa3805a6e27facbc1dbe510
- MD5 aa4eec8e3557ba0e3b34f12291e54879
- SHA1 e1446b24882b559601a2c6520bd2b66adcb7cb67
- SHA512 a96826f2a7b248dac4deb285cf59cd28f5b9f0b6acf726f8564af4f6f16c6641c3c63888bca53ab17b04a83398deb423d9220629d02cb5f50c47a87161bac5e3
- TLSH
  T16501FE3869DB0C81B287A4BC0BDFC8507DCE641321CCA402FF9CC6889F1841DFB22A49
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  api/vendor/nikic/fast-route/src/Dispatcher/GroupCountBased.php
- Size 762B
- SHA256 9fdb3ceb489751443763176716a659362cf9b84bc45f558d3f704e5594d49087
- MD5 d094f38cb944465ccec325ba8ed155b7
- SHA1 1d1359ea4e4b50d3fd06f9cc72195ffaa832d289
- SHA512 095a59681ce7273b5cb4edd21ce179d2e238b18643d7ab61e16793a7558c6180be3454b25d215c967dcb3a6497d9770ea3a0bda544722fa945cb4fd8d4961192
- TLSH
  T106019E3869DB0C817187A5BC078EC8557DDD641320CD9442BF9CC6889F1841DFB21A59
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  api/vendor/nikic/fast-route/src/Dispatcher/GroupPosBased.php
- Size 823B
- SHA256 05e6e48dfe2da2bf068b40c074bd3199edf8b52cc38531ecfd64f054f2d85bac
- MD5 2abb8ca07d82396c1e0eba9de4b76d63
- SHA1 cb02f3376fd95a95ca5f4e90de1ac4b403b9bed2
- SHA512 9d7a8da4f6eeff3320abca5e7cca770d2b0d88c700354c762c58e172e4eb764994ce0d8a45b50a1b1985092929919f90ad39d10d76148cd3fc00bcfe6043732c
- TLSH
  T15B01C03868DF0C81718765AC0B8FC4A57DDE542321C99441BF5CD7486F2C12DB721A49
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  api/vendor/nikic/fast-route/src/Dispatcher/MarkBased.php
- Size 757B
- SHA256 81611dbdce6a4b69b95197d2b30c34339a4dff3b2c7e50c47e98e58ff5f0337a
- MD5 c5587d4ab227c844bf2590b6d1531692
- SHA1 909bd2b453631c997f9e9e1f019b09fde7649e74
- SHA512 1af1a23f9632ec6c500a49c700f2084721b4624814649463c571c8e4a5e43994714134637f0e52ee512e0ad394a2dda05b4b61c4417edcb2f2322f26c930d3d3
- TLSH
  T11E019E3868EB0C916187A17C078EC8547DDE941710CDE452BF6CC6886F1C12DE761A55
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  api/vendor/nikic/fast-route/src/Dispatcher/RegexBasedAbstract.php
- Size 2KB
- SHA256 29906bf63174244a578b7ad798681c21eb924f4f70bce93a98f491c4f9219f79
- MD5 0dfa6d8cc3cc9d7ad643726c2966e44d
- SHA1 5c224ba52abde60ec21a0002fa41e0bcf546f617
- SHA512 fb1a322460713499b155058ae6491906edb0dedcef1e1ddda36ab78d129da107fbe67c903a6c93aa5dd4436b862a0e4d68b05af1fad789b67f866c859a719fb2
- TLSH
  T14151CBAD2DE78C4358AFB37C07CED824B51D9937006D1D82BEAC87546F485386FACA52
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32