2c68d041add19401b71da651b415bd7e9e4a9efcc413a9e5058f94c323633382

Sharing

Copy URL Twitter E-mail

General

Target
khatabook.zip
Size 85KB
Sample260722-g7thrazepd
SHA256 2c68d041add19401b71da651b415bd7e9e4a9efcc413a9e5058f94c323633382
MD5 4423c2141e5affbdc4b11ed897834b63
SHA1 15235c4ab82fcb3eb2c11af432a81e13fcbe100c
SHA512 e0b56a88a825d16a247ca90cd69052763e6e659885010d5b3f713c3e1cbf55d947dae7e81f694e714ba6080aace59501dbbf62efce9ff2eabf8c8448c6fa0337
SSDEEP 1536:nKT3Eafe+MPVzY1pq2+bgv+iKCtTs3vbEnZPFJEHOqV90TupAC4wCx+:nKDEaXMBvGKCtwvQnZfnupt4wCx+
TLSH
T1A983D068D758270CCA8FBCF1A54F83496193F78A845A743A2925F0257A4A14E3F357CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  khatabook/api/api.php
- Size 5KB
- SHA256 2a7fbc52178306eedfb75a6a9cf8c463ebf21a38e2b9ba177fb9d52c11f0793c
- MD5 e1a9e5201cb42f429426b3dd761b9a7a
- SHA1 093bc848bc158cc482600b83de2b48fdb8e1292d
- SHA512 f8d44343a73f4de1ef8f92a7680cc64e976f723e22a7f177de0a2d47c4688e2b3d02e3964e281ff088bcaced4f2762540e3407a5d4ffb75410d67160d1a034bd
- SSDEEP 96:QPoshL1ntTyNs4gkeln+6lT5CUITbl+zyFU2imPkrXvn:QQs7n14gkY3l13zy62bPkrP
- TLSH
  T119C194199A6719A006F780293C5D9C22BB0BC1067F414131BEAED6DC3FD9DBED72D684
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  khatabook/assets/js/app.js
- Size 4KB
- SHA256 1d86dead4f99b9f46cb7746c962838f3b3731fca2ff600a6cf5c3d62b58e8eb8
- MD5 fb83c3f25c670fb7106e31303edd943c
- SHA1 8a935948ca59b855e490841fa0d83f0f90824c97
- SHA512 001dd6908dd4b9ce469a8c850ba3ca598a5f5cd8b0ed0e45b0c1936f00588e00fc9cf54f7366686dab56a66849c4f96983176837d53c53d3a2d65d20ef84a011
- SSDEEP 96:iE6hQgTpyjl4Zw3lRWT3laplDrigsUxLPsvf7f+boCr+w8OS2z:ibhQcpyj+Sr6ApNssLPsvf7fQoG+w8OR
- TLSH
  T155A13E1ABDFA24B3057BF3BB639F5A98E93510474406CE163E6C87840FA0B35265DED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  khatabook/config/database.php
- Size 1KB
- SHA256 676df0d9855b94a569f150ad6b7572a3dcec4a059880235ac38d17aa094098cf
- MD5 a073ef8e2421958d389e1084453697de
- SHA1 aad96ababff67503c88026abb264ed0cba7e7541
- SHA512 9277248e5aa330dff1a38bbe5b918e11dac92ed0b368c66d553e92496a37618b7d40e3a088d001928969f56ebc971bc48dbefab5fdb0a627cd15e626d56c9bd0
- TLSH
  T1EF31111316E1D334266B306B6E8FD0843271F2271A157695786ED24A5FC05789BB2E8B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  khatabook/includes/SimplePdf.php
- Size 4KB
- SHA256 2e672974ddecb56670406f61b0d760869d8dabe3b6f2e4dd997ad57578aee3cd
- MD5 c436f102ad6511dd639d61c5ca39d76e
- SHA1 4ff884715b6948d94498c43ae31e918e64718e4c
- SHA512 e535e6335636a71c57ab1736a2336f80f6a412fe2e9ce0254fd02637c747f72932095243a9a10630b01671db91d4cb32a1ea602c6557718db428bfe0ee3d8982
- SSDEEP 96:X2MPzgT2ZSdBzOcUpMDscayPMRUNm/092AEupf0:mGzgTWSdUfpGM8q092Upf0
- TLSH
  T15CA1961834E75D191D63E078B3AFD92A996A2117205CEA80B99D83CC4FD053CC971FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  khatabook/includes/SmtpMailer.php
- Size 5KB
- SHA256 d9b851ed9f6e68206e22cb0a32b124c938d1224e586492b03bb91a72fcfc00fa
- MD5 ef874d1c5ac193d46a675149dcaa0a6c
- SHA1 3eefa13198643106769bdea9f774eaf571cf3d46
- SHA512 b8a1e5f7468f693aaad1489887c013db811b109d4bba80fd045829764dc42bdb2bacef81a7194a17ffc61f0d53067afc39c0fd19ce97aa09283745f5bc29c6c5
- SSDEEP 96:WElV5fwY5y/ed0sYC0r7DZRyIEueQ9QUl7hwC6HBN3y92Rw071gkI:N8FsraqIEu9ae7GfHXy0rbI
- TLSH
  T198B1011820AB0C90352350F8AB8BEB042C6C712B5769B99AFEEC81C65FC531DD970E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  khatabook/includes/admin_header.php
- Size 3KB
- SHA256 039993ae0b5ac5e82a7d8fbb453d857ad742c0acce0207136d0d8b19c0c4006a
- MD5 f663240630466900fea13538d88c3684
- SHA1 de455fcc82390fb80eec8b177ee3166e6d4c1af9
- SHA512 0b6c01ce6ccb5d3b0982e7588c0ad11c1397269fa49b9a7d161ba8715bccc33d9c7a2e8dbd6199d2990ba6d7a3e72d0d8c313cc7a7fb0711fd077e86edd0631f
- TLSH
  T1E96132A2C4F6376F022244DA55695B133CD1842BF68A2954B5FE16FC0FF5D412C17C6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  khatabook/includes/header.php
- Size 3KB
- SHA256 54b2a33103caceeffb514e5baa631c5359f18c4be85c4fdea77c9bf2db2a7ca3
- MD5 63c8fcf20eb832ebb5743a660298a475
- SHA1 8186ff8999aa03d007ea0553e50f2447cb19a94a
- SHA512 2b5d519a40b2cb37363db5b50e848c1066be17f35bdaf6d55e8fab41617394f4616ad51b9fa43046dcfd2518e748da6d0f8d685e1de1f4ba3701467f97181d70
- TLSH
  T1FD6141A280F6366F022294CF656987237CD2442BD68A2964B5EE13FC0FE9D413827C69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14