32b59195285d6b4a76a47c815f315bbd66f64ca76afc47964b20934441733ae5

Sharing

Copy URL Twitter E-mail

General

Target
a.zip
Size 10.1MB
Sample260724-petxtaga37
SHA256 32b59195285d6b4a76a47c815f315bbd66f64ca76afc47964b20934441733ae5
MD5 e9fc95d90a6da7fb16c2a0c78f5115d6
SHA1 f7cb6c5f656f1ed85311b9d79206940b3f3a0921
SHA512 e349f744bf62e19adbc02ee551a813289e1e99ec84389e0955d7377ff8b187ea87abc2368e84f5bcacf913400b0173a53b8b1e7cbf05849edb17e4446ac5791f
SSDEEP 196608:tn0x6qHRmOCCauTOK9x+SpQfn0x6q5hmOCCauTOK9x+SJQ1:t0xFHRBaIJ9x+Sg0xF5hBaIJ9x+SI
TLSH
T1D5B6335980FC666EF8971F3C9702B71240AFFCA15028EF89FB4655E8CEE78D61483295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  de/config/config.js
- Size 285B
- SHA256 c07ef4ba4b0df6ddbe62e0f7960d12ff4b8959bd3fa8f1bdad5e7c44ea13e16c
- MD5 c0d3e31b0ed4b98567487b4a9be316f5
- SHA1 2010ed0d6273bbac3272db21d930bda309f2f6ff
- SHA512 a6b76cdac79d8202a828bef852906a0eb4a38d667d2e66d23aa3f308d5b44d2a67fe92afa7882544dcaf5a005b7a67b7d9cc434c64205985d9821e134f16cedd
- TLSH
  T16DD072361580B381188C01AA96290117EE40E028AA0CE036C24B9BB22C81A30A032992
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  de/img/mfkNbEskGSwj.svg
- Size 1KB
- SHA256 088d1bf639f9a9e3f2ca38cf1ea4c88002c79d6f3e4706868aa3d9f27208109f
- MD5 bab631a2479c23c7727cf637c7e005e4
- SHA1 8314d7bb128be21c1b40ce9de4c76b524b651bcf
- SHA512 f9cc6d7447d4ab817cbb5e516eb4f28982a1f30fc727f8551eab06ebb772b269b0e0afe95b28bb56a3d9ef31d59a0b3e491963fe6a2480f7b1ee5dcb0119a2fa
- TLSH
  T1A941B4D84AB002FDCC58E9FE0B68312C696651E5F409449DF7E39E2EAD9844C8C4A2F2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  de/index.html
- Size 31KB
- SHA256 82eb2cbd6d9d58df8d8fbf14465ead406af72ec3d2a3897ad8268d3816347492
- MD5 356084a979299dc8023710d30fda9cfb
- SHA1 3d09ec91fe13c822ef9db6d44a9de4b2770483b8
- SHA512 cc30bb78aec71811be0412b3810915d74df2c2d145571f16912db262d30a0ce579f614dda88b0f4bbc06fb2a6e4c6bf26594d2d067fc66034d38a742aec279a4
- SSDEEP 384:dxrZp9nXWEVg+++cZtVU8S4FfIG28UmPILKem2Io7egoWNUNALVL1:dxVfXWESpt2EPILL0o77osN
- TLSH
  T18EE2967440E9A65E4173C2A49A115FDAFFC691ABE34A828475ED2B977FF3C80CC07094
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5 behavioral6
- Target
  de/js/app.js
- Size 42KB
- SHA256 a67afe88e779c11e4eef3236cfb55e45501ee8ff54cfd004a2e0b6d03bbc6ab1
- MD5 4d0be3ba16208e7ad80972cf0c4e3cf1
- SHA1 e79de03f71332dfaf03a6de542d4e4b72798920f
- SHA512 ad5420e22635bf77e94e8be6616185ade68a7cb7564e3de1218aa8cdb54f906cccf84dbcfa5cccca7c1999848bf57519eff676058cd2c818e4059c6d0610cafd
- SSDEEP 768:wHKc6+q6JqVjNQWb0IlQtjI++GcrRxMpakBQx+qRwhoXkWp8fia8NWKAn5ePOBku:+J+QT9SXWQIiiiXHaQZiFTaD/jjx4ES
- TLSH
  T13013424173C5B8860387977E772FB1E5E82E1CD87188088AF104FCA4F5ADA1AEDD5A71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  de/js/bip39.min.js
- Size 359KB
- SHA256 b45762b71c7d828553fe62e019e428dfedffcdd79cc0dca78ce43e1d698618ab
- MD5 e160ed103e7cdf24de916a3f37339d33
- SHA1 11e0b895f29dd317bb3e3c80df355dbc59069b55
- SHA512 7b41f0fd11b9393077e5b8eddd5480a0a391625cef2d8d39b0fc97d59bda4908bd228fa337ed2b1b041dc9ada58bcd8121fbe17c9cd679c2a24ff3f3978a0852
- SSDEEP 6144:zgu6BSn5NwCkUzi0uCwCwL1NU2HZrGftyWYcAyZI:zgukSnvXkf0uCwJnHRGftyWYcg
- TLSH
  T1AC74B5061E580E3983ED22F010FB2DC511798D0A899C38BFB95CE5D65D29FC6E0D6BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  de/js/jquery.min.js
- Size 83KB
- SHA256 8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
- MD5 6fc159d00dc3cea4153c038739683f93
- SHA1 5d7e5bbfa540f0e53bd599e4305e1a4e815b5dd1
- SHA512 a574742476d89bdf841a26fac51ff0fae62cfeed95f38a1f3eb0699202d8c8abe165826d514bca4b2d69822f2d25901a72c3f081fd646e1238cf082ef0e28ea8
- SSDEEP 1536:kYE1JVoiB9JqZdXXe2pD3PgoIK6alrUnzZ6a4msO7R6xfWBP4TCddWHs3ghna98o:P4KZ+sOsOV6x6pwhna98HrU
- TLSH
  T11683D6D9B2D6705297B734B850BF410BB17A98DAB44C8C60F098D4E47EB4A8E507BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  de/jspack/585b051251.js
- Size 11KB
- SHA256 a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a
- MD5 55d343a40c7166a79fd314f13cbb2e93
- SHA1 96904a849c32ca220e0aaa2ae3e81cf2b5cdf764
- SHA512 518ac396e7f82899cab4a6e3cb68116f2b599d680d015a1a8024926bc39e9a5d3ed68935b2150da33ad41a9103e4cfd5031a7e89036901c972eee257546bb1c5
- SSDEEP 192:GO3pHufQPTACpF4Pvhzz6E/ra/sb4nZIPWfz3JBGvh3e1Q5l8h6LDeFTjC0:GdRCchzzYfnqejah3e1Q5l8h6vb0
- TLSH
  T1D732C2997694F1B646AB7160C03F620BF276352A3006D020E25DD9E4AC7DD6E9233F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  de/jspack/bootstrap.min.js
- Size 47KB
- SHA256 e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
- MD5 14d449eb8876fa55e1ef3c2cc52b0c17
- SHA1 a9545831803b1359cfeed47e3b4d6bae68e40e99
- SHA512 00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22
- SSDEEP 768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
- TLSH
  T17523C84A7254B4A202DFA476913F450BB73B389AA60BC16CB95994ED1D7CD8C3227F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  de/jspack/jquery-3.1.1.min.js
- Size 84KB
- SHA256 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
- MD5 e071abda8fe61194711cfc2ab99fe104
- SHA1 f647a6d37dc4ca055ced3cf64bbc1f490070acba
- SHA512 53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
- SSDEEP 1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
- TLSH
  T13183D5D9B2C670529B7730B850BF450BB17A98DAB44C8D60F058C5D57EB8A8E507BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  de/jspack/jquery-3.2.1.min.js
- Size 84KB
- SHA256 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
- MD5 c9f5aeeca3ad37bf2aa006139b935f0a
- SHA1 1055018c28ab41087ef9ccefe411606893dabea2
- SHA512 dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58
- SSDEEP 1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
- TLSH
  T14483E6D9B2C67062977730B950BF410BB17A98DAB44C8C60F158D9D47EB8A8D907BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  de/jspack/jquery-3.2.1.slim.min.js
- Size 67KB
- SHA256 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
- MD5 5f48fc77cac90c4778fa24ec9c57f37d
- SHA1 9e89d1515bc4c371b86f4cb1002fd8e377c1829f
- SHA512 cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269
- SSDEEP 1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
- TLSH
  T1B663D5D9B2C67062DB7730B950BF410BF07A98DAB44C8C60E198D8D47D78A99817BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  de/jspack/jquery.min.js
- Size 83KB
- SHA256 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
- MD5 2f6b11a7e914718e0290410e85366fe9
- SHA1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c
- SHA512 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
- SSDEEP 1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
- TLSH
  T11E83C6D9B2D6706297B734B850BF410BB17A98DAB44C8C60F059D4E47EB4A8E507BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  de/jspack/popper.min.js
- Size 18KB
- SHA256 a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
- MD5 70d3fda195602fe8b75e0097eed74dde
- SHA1 c3b977aa4b8dfb69d651e07015031d385ded964b
- SHA512 51affb5a8cfd2f93b473007f6987b19a0a1a0fb970ddd59ef45bd77a355d82abbbd60468837a09823496411e797f05b1f962ae93c725ed4c00d514ba40269d14
- SSDEEP 384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
- TLSH
  T11C82A3CC3291B06643A79167A06F960FB2339979614E9410F199F2D87C70EF9913FC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  de/restore/index.html
- Size 9KB
- SHA256 4a4c577d88065a19c2a983bd89a11bde8efdf426583b47dcab4223b26d06bdb8
- MD5 16e41e7b49584b66b357a84fb6a13d21
- SHA1 797de4c37cbe5a389b968db44490c880ee834800
- SHA512 ab382dc7480e3aa187d6f1742961c34cc9467de0cf414223387197ed7bef0ee096013ec6bca97c25e193d3ef987f2d92e7149bfae5d1773414a5d8c1a23c8676
- SSDEEP 192:mVdVf/xxrZp9nDNWaL5LhDCMxqTe0tkLVEYIdsTW9P:YxrZp9n5WaL5LzxPLVL49
- TLSH
  T12D22292145F965AE013291AD9905EBDDFFD781BF9B0B922034EC276B7FA2C50C81319C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  de/restore/js/app.js
- Size 42KB
- SHA256 a67afe88e779c11e4eef3236cfb55e45501ee8ff54cfd004a2e0b6d03bbc6ab1
- MD5 4d0be3ba16208e7ad80972cf0c4e3cf1
- SHA1 e79de03f71332dfaf03a6de542d4e4b72798920f
- SHA512 ad5420e22635bf77e94e8be6616185ade68a7cb7564e3de1218aa8cdb54f906cccf84dbcfa5cccca7c1999848bf57519eff676058cd2c818e4059c6d0610cafd
- SSDEEP 768:wHKc6+q6JqVjNQWb0IlQtjI++GcrRxMpakBQx+qRwhoXkWp8fia8NWKAn5ePOBku:+J+QT9SXWQIiiiXHaQZiFTaD/jjx4ES
- TLSH
  T13013424173C5B8860387977E772FB1E5E82E1CD87188088AF104FCA4F5ADA1AEDD5A71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  de/restore/js/bip39.min.js
- Size 359KB
- SHA256 b45762b71c7d828553fe62e019e428dfedffcdd79cc0dca78ce43e1d698618ab
- MD5 e160ed103e7cdf24de916a3f37339d33
- SHA1 11e0b895f29dd317bb3e3c80df355dbc59069b55
- SHA512 7b41f0fd11b9393077e5b8eddd5480a0a391625cef2d8d39b0fc97d59bda4908bd228fa337ed2b1b041dc9ada58bcd8121fbe17c9cd679c2a24ff3f3978a0852
- SSDEEP 6144:zgu6BSn5NwCkUzi0uCwCwL1NU2HZrGftyWYcAyZI:zgukSnvXkf0uCwJnHRGftyWYcg
- TLSH
  T1AC74B5061E580E3983ED22F010FB2DC511798D0A899C38BFB95CE5D65D29FC6E0D6BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32