9658a6085725e495b250b9195762824df79a634edc4b7744cbe295d042b35b38

Sharing

Copy URL Twitter E-mail

General

Target
distribusi-telur-rumahweb.zip
Size 164KB
Sample260721-pl98dabm81
SHA256 9658a6085725e495b250b9195762824df79a634edc4b7744cbe295d042b35b38
MD5 814b46049149452d47f6fe8af09b0e73
SHA1 6691e9ed42a8837c41fafa96689d29b587041bfa
SHA512 ac37a02f13473d891cca81c38d631471980617e0c5df6fbccde0e997ae5953f7e0751f19a143345d7f23ae4c337473953f5e9b687c104a41c90e55203713d4c6
SSDEEP 3072:mLN6uX3Qv4j0Ud71l7YXmw5HL33ILsmvg6HVt/5OFjd6Vzom0x05yJQmGmNJQ:AN6cr0yCz9LIf46HVfqezomKxJQNmDQ
TLSH
T1D5F3F1E2C85C4910D4379BBCA122CF1BF49D663145D9BD8B9E19D8F24A8F5868FDF00A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  README.md
- Size 8KB
- SHA256 9dd4ef23f0e333ae9e2a61d15ecbcd745a25aa928d5f7a2976bb4519e19b5c78
- MD5 eb79dc53723b67180925fe86eaf020a6
- SHA1 001eaf88c7bda3568e7098385ea08463c848beb1
- SHA512 0e045773b8aa6d6d75fb46f9b2b2f23a51017161d9ceb10b4130c9ddbc376d21a0ca3deeb03de4f6c87fe5cbd58c992d5be82aa1d135bb6734a1b39d7b3fdb42
- SSDEEP 192:D4NZ56ftBXuqK/iVfCampro/0ZZ6Djigk7CPrU+:DG56fruq8iV8ps/qZAjvzPrB
- TLSH
  T10B024C179E6B90780E7503CAE08680DACC5AD12A3369304BBF1E67743F7B578574C93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  docker-entrypoint.sh
- Size 493B
- SHA256 6875db3fa33331f57c704da679f5c4b9684e65e451a8b04285edb3f20fc86615
- MD5 f15a0e4dd0801525ecac83ec5f39c0d9
- SHA1 8eb3461beb4054f1099855108d0ac2beee5932cd
- SHA512 f73e116d4ecff4633bbf05218f9e98b3c3667318d30c7d323d02a366296748a0bf671f3a9eb197a063c1039129ad66db10c1f347128855b18aab387157817f1f
- TLSH
  T19BF0D4081377B4681F5153D5D501E340795CF30D1335613FDA38BF70C19E9A1B147566
- MD5 SHA1 SHA512 TLSH
Score

9^/10

antivm discovery execution ransomware
- Renames multiple (1830) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  next.config.js
- Size 281B
- SHA256 cc55f86819d01f8be9ec4979813177216af30b7679902061af7db2076021fc7e
- MD5 1cc8a694545fbeed7195cd6e44984951
- SHA1 334c5c5ad354aafaef838fcec86861900e2b3015
- SHA512 9c7385acf9fd934a581f62d30983bf2add94e1c7870392a01d2f5084910418903f0c1dc59137e285bfcd887804c7c13da357de89382660d79bfb485e512ad6e5
- TLSH
  T143D02B1361BDA13729349981F3E13462AE581350325AF3A82EDEAA5CA4CD52AA0215D6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  postcss.config.js
- Size 89B
- SHA256 b78f5d0a0a449ecf58b6b6252e26cd2216c7aa41235e2d6d01a26b9a065cd439
- MD5 9a248c780e4c76f85b0f492f63a3d417
- SHA1 fec8f2681a35a4ded2a5e60bc3db58372aadd918
- SHA512 a678d715ed1d629a2fddd50e2705c188bc0f0e255997a05df4647bb1d453a15211e3078f18a1a23f4ddff0dc5898a132f9c72893aca55416202368b8f9d5d0e3
- TLSH
  T144B0120200FC34D3417001107FD84610A0C1877208084082327049184F179270070D84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  public\sw.js
- Size 1KB
- SHA256 63f780c642d1678042c441ff4751126526eed3a8c4831c56e45265e1c015c2de
- MD5 594847a8eed0a86c07e90802376d7813
- SHA1 b60cdb19ab3924d4ffefa95cb25062dfa1c3bfa7
- SHA512 37e06776ffc78ad9cd5aa8f4586b9e1de15879890d53d7a0a053b37486a00665019a6bc3083eb2f97682b9fcaa9662592b2e4fd10be80d8dff655f32d06bdaa2
- TLSH
  T18421D29A6B2D0037543163A0EF05E20EAE1A62A363C645B5B97C2BD98FD75A80079CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  server.js
- Size 824B
- SHA256 efc6895fd5f3fc477033e38eac6b07c2e758dd9968c846a48d76344590cc057a
- MD5 73c0878eb5f2c87789a6f41f4041e040
- SHA1 7c67aa61c2b6d2c8037ea4b229be794afe23a47c
- SHA512 4f020f5c946499e82218c750564888211e628b40a93be8ecfee4863d6a3f149c24438398b7959f469752305c2aa34705180b0d246eb5ed050788e3dbbd1b59c3
- TLSH
  T1C601234772D520E8AE6807DAC0610113F31AA231318081FD623CD3F265C233546487E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  src\app\admin\branches\page.tsx
- Size 4KB
- SHA256 6686179c959521faeb08d56c173e7637ed49ba271142f97575dfce99f867b8da
- MD5 be4c705fa67e3fb0d748c39cdfdae12f
- SHA1 f11850e111e7fad8fe2f77f5ba9d773b817ec114
- SHA512 efaed207615f643905b8ea9cdbd10ae4f155e462dfc2c91c4bcfa43b6b1242f942d27387b523db462c47c8d0d5cb9c8f21bb6f8213b4cb48f1b368684d1c9ed1
- SSDEEP 96:t3abgyKK1HQ5gbhV7bf9eNPA387ldQoOcPpqY3:tOKKI27bVoYUQoO8pqY3
- TLSH
  T10FA1D26531903DD949B3C6729EAD8019E86141EBAE9FD5A0BBFC72830FB34104DEB9C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  src\app\admin\flagged-adjustments\page.tsx
- Size 5KB
- SHA256 125ba77f5fc23478653ae7c02897ce6b17d964c068fdd78028481853c7557fba
- MD5 e1c56bbbb5b83fea6d290b13f602c4f7
- SHA1 8b9eb6c48e6ac13600b97c09b613f11dfac3412a
- SHA512 03a1363cc442c8b046e84aa310607169fef9a29044e9542f490756723bd0851ed0df8ffaf00ab3bd2619aaa1e22ba9de4c5a789578e65f6b950347db2180c126
- SSDEEP 96:t3abgLXvzCQwuN4Tm/TflWu8/iCmAL0Dl0Yy:tfKuN4T0RpAYy
- TLSH
  T141B1EB6130F06E6E4973C036CE3D8520ED649167DB47A9A4F6BD77A70F72850989B409
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  src\app\admin\pusat\harga\page.tsx
- Size 10KB
- SHA256 fa061341fce7aeeed36414b9f3e4da39cd9c5da2952061869e913e83fb379bdb
- MD5 d64339e7092570c9fde7def2a4181227
- SHA1 007a76de0c5c3b33dafa8cb13584f1e239260143
- SHA512 f5203d2b30958a0308f469b095b774bf18084f326acfb4244a081540d73b1a7261fa51cbfe92294c735a6d10786ff3ba87916952686a9303220cf3538e13a0ea
- SSDEEP 192:t2IRK181W2Yndzu3wP78as7DN383E+tXrKTmKpCikl:t2QKSWxph4L+tXOYl
- TLSH
  T1F52230B170F02D898873C6368A6E814AFCB1419BDB5BD650B7BC76C30F734148A9B999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  src\app\admin\pusat\pembelian\page.tsx
- Size 10KB
- SHA256 4d26f23458e903a8466eb45bd8a3ca654a01101f9f9e3f153510b9cae22f229d
- MD5 2373e5505f396ba3208ca83d1ef03004
- SHA1 eb90b3489009ea966cc93fee90835e0a9a9883c1
- SHA512 60f6b8867eda7840f7ec630b13acfab2f22497eda76d2637c811b805b5cbae634f498ff479548da7077db5004caa75eac2d88ef4d10466a24800895f1d2da45f
- SSDEEP 96:83mCNnDQbgPKKvwlL0c0sybPTRBke0kni2JLU2RTy0h9+x0DbnrUzcE65kpydoBL:82IkKoWRXF0kiWRy0hsaCBBxCsDPL7V
- TLSH
  T180326361B0F02E6B0973C176CF7D8524EE954127DB4392A8BABCB2530F32844CE6BD59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  src\app\admin\users\page.tsx
- Size 10KB
- SHA256 7fa6a6a96704be9d022374b5a324ae840d7390fa37cce9e0c6f13d73c18165dd
- MD5 5dead8d1877876d0cb3f71f55b8ac445
- SHA1 a7a6ad982fe9f255625c0cff1834b04ba79deddf
- SHA512 c4900c7659158648c2121cb21c4e85fd788258c0c8280ee38caa1f0020e557600caae74a2cf9f0a75a199e304c1fb6c950811a2ff3c38a7697d48c81374fbf53
- SSDEEP 192:t6hK0E+So3aK6nToOGNxFFqQSOJLzNqjmyk2:t6hK05GofT5JvNg
- TLSH
  T10822412131D02CD544B3C5B28A688029FDA942D7AE8A9255FFFC77831FB38148DEB995
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  src\app\api\messages\unread\route.ts
- Size 1KB
- SHA256 87123a2773c5ada6367c2e5201f335060e01901f468e23dfc3779a575a568bdc
- MD5 52daa07e73fabb7787de6f45bc38598b
- SHA1 e7276c58f18a0dcd0545462fe9a74ea8d10923f3
- SHA512 be333962c7b8d053b2113d015dcc0d260a9aa007915803b9e9441f87adb53ad71635df4836c70a3aa6b9c1b12b4b97c2422302d9bbdbc057f8d12723220065c4
- TLSH
  T16921414541FA38576C3311E36D92E229D07DA51BF18062457F7CD7207FBD09482A9FE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  src\app\api\users\[id]\route.ts
- Size 3KB
- SHA256 b2b63bca639dd06adb95148b3a4114c0732762d0b01cbf92b4907b520bbf3646
- MD5 469d75a251edae9bce1a8cfc0096b6ee
- SHA1 e11f49751cbca461d4a77e5b043450cf6fedf8c7
- SHA512 fc42f8d1c14985e814be81749b4bd11b45d9a23388186b610411267690e6ddd49e4a9ed64821dfed6ee7d9dc2413e5ab8e4acfc5be322f5fe5df281835be78f4
- TLSH
  T18561504BD2E77A714B7592D09455B110DD24830B385006B2FF7C83593F3B942CAA2D2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  src\app\branch\page.tsx
- Size 48KB
- SHA256 9e74d2036e08f63cfe9b6c9557fa50ffdfb090c01063592ca6f262b6b0550f20
- MD5 e54cfde8e294b482c177cec884a940ce
- SHA1 3434fde898444d78b960158b836ead352a384ca3
- SHA512 0e67d5440ecf0d215ba644d3f986d9afcfff3106f872b1d27363492aadfaf0996832598d15e29d9515abed2af63f0e15e8bfe742993416b398958275039cd96f
- SSDEEP 768:p5CDCTaQ0+ZPaeqLoS8w3v8MLeNyZ6l148A:p5ly+hS8wC8
- TLSH
  T1A823C97170F02DBA4973C6328E2D4519FDA5825BDA4BA5A5F7BC73930FB24048D9F888
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  src\app\courier\page.tsx
- Size 7KB
- SHA256 9ec9e8d73f19ab29ef4e48a935beb651490f675f405f993b6d2bca641e0a8cf1
- MD5 50912f65d5c0e68495f6947eee564540
- SHA1 fb8f0b4a7dd55bff19ad1acdfcf717e240b9c385
- SHA512 aea42998a01e27d8068edb2ec54cfb6003a3f9ede3147c79a4a0ab883672c126e2b513c0c1c68a036ba2eb767c0c98cea6cd8bb8f7ee3e5e3b342309968eb020
- SSDEEP 96:J3aKeg0JCHRaV5iQqbAIFFTNG6AF6N+7BSdyTLsw57mJKqfkJlZk:J8CxYpqhmr6NY7sw57mJ3kJvk
- TLSH
  T15EF1547130E01C86487381B1CF6ED116FE32415B9A1AA5A5FBBC37C24F77814A86BED9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Renames multiple (1830) files with added filename extension

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32