532f8822486ab77a72c11bfef0cc3476e412d64f6cbe8b99e05da8793219e94b

Sharing

Copy URL Twitter E-mail

General

Target
mentorshelps.zip
Size 6.4MB
Sample260723-g4krfahb97
SHA256 532f8822486ab77a72c11bfef0cc3476e412d64f6cbe8b99e05da8793219e94b
MD5 391125724383678038e5d632dd414013
SHA1 67b2b6454112db85742b17441dabb108d9e5d771
SHA512 2c266e778fdf083d50917d21bbbe4b6ca3ac7b118971ecfe19f7c7b248e8c01279a072e8e1b0c2ca42e1ab2b81a81936c70bde75fb86d3e43ea60be1a541bea6
SSDEEP 196608:DL62qRSUtZ6J0X5KBlqdZHOEUrQqAMTDastkLS++q:DLTqQR0X52lqKri+k73
TLSH
T10E6633A5F70C0DA2CF6E8778500FD5AF0B99D1192484BC9BDA592F0E0F421C59F72E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  about.php
- Size 4KB
- SHA256 7d1bb636712f4899d19c17222de31e84d7e49c34802a4653f265e3dc66d86d59
- MD5 24c2d798f586e3bd67a0cba14387726f
- SHA1 7e676ba27a685baef276dcccb88f31752fd04f11
- SHA512 b72315c528dcb7cbc391f12c91864f949f85da17e2ff97efada0c56c194de50845c342361f0d7fe87077a080a6bb242fdb05472aa9b71646ebf2ee574913e7e0
- SSDEEP 48:/3dea9ELfViIDnyrT5ZybAUp6ca4OEbjrBMUT5ZVVFLQWUs8s37u1isFu/M:/3dh9Eh7iZaQ8OEbjr3tzPLQr+LuVu/M
- TLSH
  T11581742190F0102F00425092FEA66E2BEFE6E10B995F072471FD0BA44FEBE5BC5B7658
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  class.php
- Size 5KB
- SHA256 5aa659f44e274d6c0d5f8c31988a56bcf7b382bdf990372d07e2b12979c9f73f
- MD5 81610674c74804f4bc34abd084854781
- SHA1 8dda8b200b6ef4f3efef500e15fb62c7d398e058
- SHA512 6c4ecc034a3c0413db60056936fc470b5ff9afe3328160ca1e401b783e3643f05d1c0224155fc8097cddfb89270d786edb3165f99d47a7121697b685cb3acb57
- SSDEEP 96:/3dw9Eh7iutQ8CFbGPpBonwehaSw5GTbTGX6qqrFtFyfM:/3dw9Exn37essKqtr2M
- TLSH
  T119C19526C1F0102B018300A2B95B3D2AFFE9C54B876A465571FD07682FE6E9BC9B7588
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  contact.php
- Size 7KB
- SHA256 6ac4db821f8b3f08399a6c517d00d05e66ccfaf0a8a3755df3de5a641a61c02b
- MD5 6c125ac76b8d6062d4a876df8fca39f9
- SHA1 b1a9c77dfade971e1c4258c2fc44521d0f1b3704
- SHA512 8c9491a9b1072f2a092a585071052c06d86ed42cfe4ca6affea8e82fc0187184d9408fc8e20d26542d1473c4cc8b03d6413cb67f4392141af05d321983c2fd9b
- SSDEEP 96:/3dw9Eh7iutQ8CtJbOlGWznnWK3fT0WlBWlJWlLhM:/3dw9Ex0wokhM
- TLSH
  T1DAF1C93010F0052B5092A4D8BAA4BE1BAED0E947CA5F525671BD0FD81FDBE83D9A764C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  course.php
- Size 5KB
- SHA256 115a9a9a3273ab2b7b00396bd520682eed53e22c63e798845ca79d33c308e6b6
- MD5 571658388188f55e8796d9664a59ee2b
- SHA1 9fba0daa59a09ea856719771f328d59af3e978a0
- SHA512 aa1824fb6e5fa55f2a38ef757b9566f1cb2a884da6e4c349bd6918a023aa65898a81523963f76ba869f06ee640256c1bf55b9edb8f6347184ba2dfb484d605a6
- SSDEEP 96:/3dw9Eh7iutQ8CcbjPpKlCCx6c35UV2rFtFyJM:/3dw9ExbGxp9rsM
- TLSH
  T124B18519D0F0112B018310A2799A3A2AEFE9D10B436B475471BD0A981FF7E9FC977588
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  exam.php
- Size 5KB
- SHA256 a550143d3dce548c174804ddf4171d090ee1b77f57cd3c9d85a946dfd49e5611
- MD5 10743626ab9f3f4078602935f71351e0
- SHA1 cb5f5628ac88e90d796c69d3d9629c4132ba9722
- SHA512 b57397408e385b86e84de9b76aa77ae419b4bb38901c516408e6bcf488c17d5e1d9b7d9faffe759924234620957207cd08cdd569bc1b3316e10eb410261e936d
- SSDEEP 96:/3dw9Eh7iutQ8CabVPphQg8UV4rqkrrFtdjGoyQM:/3dw9ExPdfpYrRLM
- TLSH
  T116B1662546F0212F1082109679553D67DFFAD10B862A4254B1FD0AA42FFAF4FD9BB08C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  fonts/flaticon/font/Flaticon.svg
- Size 34KB
- SHA256 5fad1ec1fb55bbfb4b96dfc6b43a8c383be3f105c66e2966f0df91ec4d18f2a0
- MD5 48835d172d8cd7ccb31f8dd2a4ca35af
- SHA1 116506ef8f2169bdf2a96f24ec6fa1e3dce66a32
- SHA512 7ca2704945def78bddd8820c0c32102838b72b25c33f4c82e98c848884a52eb26ea7196c69ab590fb13c9a176bb99bf8944658155a6270a529132196acc54dbd
- SSDEEP 384:T5CThaWZ15fNDXcxRkQ6heQRhrQchYCohbQKh2WkJvWNhcWjwYQRIdq+Kore07s+:T9sCspPFah7NT9CF5G1PEC+wgGc8
- TLSH
  T1FEF283E9A3544BF8DBCA9FD18C350E543E6E69F917A17094C77CAD014CB3F094E98A88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  fonts/flaticon/font/flaticon.html
- Size 18KB
- SHA256 818949e8aa668611ac2780badef401c6288270da5f6ca6c0c3c41e8999b2e8f4
- MD5 5e22f33806be4bade1a8233981ec2fa7
- SHA1 22f408e63406a69f5bb564db2b5a4a6719abf98f
- SHA512 1d9485a2363ba2ae461922685f60bc8afefbb3dd7a8b0ec151c112ac2a4f04ddcac3d0afd140414f5146161c73327180ea24e51c1b062904820bdb8ad60374f7
- SSDEEP 192:NmXWsOGS3gJ2BcFf3I+2G3xmKjHnxfYVNFJMfP8PoiPCYPHPAP8PYP/PzPO2RtC+:NK3RxaFm91p2MGO3PR46UcP33aDIHx
- TLSH
  T1478294A952F301A52687C4E437792752BBA0D007C982CEA57FEC9B40DF89D94AED370C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  fonts/flaticon/license/license.pdf
- Size 34KB
- SHA256 7cc25d27268a033ce65c4c538cc71376ca5d50b78cc21b0bf2b425736e4f114a
- MD5 714c6719db990ba57ec0e49076ca4e0b
- SHA1 bb3e9e18b4d87fe1193186521f4f8e3a6c1f9e6e
- SHA512 d0499e3238a362ee32abb07f176be41498c4a4538aec5116dba0dc9f86b656a5d0839b66b797ffa17702a4edc98f463f731bfe636b1e4e180f66a25e4c19d7d3
- SSDEEP 768:8pFKbRWUVcXrxIHFRz/vRv1Q7EirdLSPlXfYp:g0wUOXQhh1WdGPRgp
- TLSH
  T1CCF2ADB5D5AA5C8CF9CA83D1352D3C9D457CB1228BE890A230704A61FFDEF9CA9410ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  includes/footer.php
- Size 7KB
- SHA256 4ad5337ea1044729573dfe154ef03cec72bbc0e37b4b1d840e2b83d0629705ce
- MD5 4e4d0b696aac6fc6aa2ce33f36c3696d
- SHA1 5cb6fff069b794e1bc3c0f9084ce4b273c40d53f
- SHA512 13d454bc8aeb95409a88a7d94ef3605c33845f5febee1fab918d65ba18eff27f1eb16d8fd7191c9424399884d4ce42c35ddf8f9e2f6431ac930a8c4a4e039edf
- SSDEEP 192:yxQ//EYsOBO2l31ddBCdBGxBFGqMzufov:2QkY5tUqMzufC
- TLSH
  T153F1741C69C01A2E013391D91A259F8CFEB54157EB1A861C72EE1BA31FB3DAD4D239E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  index.php
- Size 12KB
- SHA256 270d1db019b571b58c1b40c4fde41e00d3d50deb084a69c8f21294a09a5e9a4c
- MD5 7356df13d96cce7f714e6424fde18e23
- SHA1 295c36e48017e1b73a75d2e27a71e4d6eb8ce3d4
- SHA512 de8a6540214cf27e3ab984e6f53b1eb69985c87eb128d31297c8c3a3f9e9828bfebc92a9ac158b184f1529f0e9acda4c649985445e45f48c66aa6e58e8fe29fd
- SSDEEP 96:/3dp9Eh7wUeZPj+OYKBiNzdPPdrXtgn0hfD2q5zZZgFO+T/Qgq8gDoV4/rNamAKX:/3dp9E/OrcKBgrrlfDN4Ls735NZGM
- TLSH
  T1D4424F2190F12127018340E27A662F26BFD5E507CA6F469472FC57D81FEBE8ACE6365C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  js/bootstrap-datepicker.js
- Size 45KB
- SHA256 ae69f62cf7df7c2777acf907e06e7ad0406b727ebb7544949e1ecd7b1a82f6f6
- MD5 6f2305704b66eea2b6a7c5dd0a08293b
- SHA1 023eb42884db66ec3ae2a872faab9e3747d0f2c3
- SHA512 3bae85d4933b46dab8fa6cb094461c426f7dfe1d38ea634b02e5627971335cb6a061ccdf0213f2382b97aa5662d884592a9d29fbe3a7b20c9ffaf0455c708d3f
- SSDEEP 768:VZrwSkKniAzzy44tWEh+jVruaLjgFKVJJPVEx5iisx7F5y3MNrQlMNrq93jDz3or:VZrwQz0VazEzsUz3Hq
- TLSH
  T17E2375C9E74D159B9276206D882E12CABA3DC0779D454C3BBCAC51E82494D2D93BCFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  js/bootstrap.min.js
- Size 58KB
- SHA256 38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
- MD5 6bea60c34c5db6797150610dacdc6bce
- SHA1 544afefd148715da7dd52d368a414703390ca0e0
- SHA512 2394e4bad0290e39d6b97fac98b20f64d870f8b85377c5ab4217422acc421514af845c76926f197c4a4d22117d9ead389ac1e13a413c04c3818f9404d3bca130
- SSDEEP 768:WLlcnSRAIvHVAYIE8Pg76Tjx4vbh3p6viDl0TS6SXH6G7e6Pxh35CCmVla4:WLl4SE0MJS36GPxhAV1
- TLSH
  T1C743A54A7254787206DF747A817B060BB3366C99A40A816CB8699CED2F7CD493277F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  js/google-map.js
- Size 1KB
- SHA256 c5fb7f4e112926030e617a2c8a48d21e9f86a2153a38e634eb9998e36ab16cf2
- MD5 f23d510a5fc4674254ba354895b9aecd
- SHA1 126578d6b5c81d6142bad964e677cfe98c81701f
- SHA512 bf81d8bb7f49637974c53b85bec31be3259820ddf64a0cda1599ff3507e4f4907d3d2b28514743f9a48cfcf7f7d746b815712db135542902c09c8ee9f5778816
- TLSH
  T141415547B9A421539C5B6065274F13C822B0C11F590CEE463D4E837C9F50D78ABEAADC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  js/jquery-3.2.1.min.js
- Size 84KB
- SHA256 39646863a414e0a84920b3a8639c0f3e8c94535e8dc051b42b485a068dc2902f
- MD5 24f2e59beae1680f19632d9c1b89d730
- SHA1 b3a77b35c4809324ab79e64d40c4ee391234e008
- SHA512 62a642394f3ff4facdfa0df228f7bb55c4db2207bc92e479f6729809c8bbb9b3e02297ba79f218d0b69526cdd8e0547739926045bb29669fbdcc277bfb032aa7
- SSDEEP 1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQr:uxc2yjx4j2uX/kcQDU8CuN
- TLSH
  T1AA83E6D9B2C67062977730B950BF410BB17A98DAB44C8C60F158D9D47EB8A8D907BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  js/jquery-migrate-3.0.1.min.js
- Size 11KB
- SHA256 1743b54e611ae08f0ddb89d8d1bc9ae7d78feacbd672c86a5f5bb3c1a582e05e
- MD5 05689c22f0c872e5089f80a5745e31ce
- SHA1 381ef842b4e21e4783d412a90925ea11281c406d
- SHA512 56a4da214dd59521f2973a0cb378560814cc67d9797ef61aca9e32cd16f9a95f4d7b867e9f6d6e1681baef681631c26279d418655d8a9971775644d3b111916e
- SSDEEP 192:esxlfqrbhUlgvxOCy/ZLhZtA8D/cU+qOh7vLQ3aCmZLBVRCd:esxFqdpOnZK8bL+qYE3DmZ0
- TLSH
  T15132209DB6F7257598B7F038A72FDE567172089B2289DE10355C82941F1C838C2B9BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  js/jquery.animateNumber.min.js
- Size 1KB
- SHA256 18201e44a097144b4b4d9fa01b548222bb46918ab5cd98cc5e48fe5d414d26aa
- MD5 c46a5138afcd0ac989037e5bc908bcac
- SHA1 12a8dd3a49fb07fb906739626d9157e73d1789c1
- SHA512 598ecf8b3d93c188e42e5831c3d0ce3707f98b150e0672f71a8f8549da91c612a53aac7d17e79efc9b1a6e55fce1804f2d0cd43c9b19bd5f3cb3c60e2784bf50
- TLSH
  T114213158F36D124B5A222631433F6947E9AA68C4ED92B11DB01074964F3798E22FFD34
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32