9ad07001053a5322495ac081ec45bf134a854c4e8f10581ec5ad384b43ffacc2

Sharing

Copy URL Twitter E-mail

General

Target
wedocs.2.1.9.zip
Size 3.8MB
Sample260729-an8d8sda74
SHA256 9ad07001053a5322495ac081ec45bf134a854c4e8f10581ec5ad384b43ffacc2
MD5 a797fc621a6cbe0e6c7b8ba745d21bd0
SHA1 22c9d40aeddb4ba65391f75f0038a84a3639a983
SHA512 35806d63f90a9a16e4cd5b8da59be27db16ba2bf659a42fcf03ac4bd3381a81f067da4157207f40c289e34d6647f3dcf7f489dd48527301a688527afdb6bfb0b
SSDEEP 98304:nYUjMp6WJUJqgSFNeBeDcf0T4r9cbEZFL4J9zT2VU+S:YUjo6WqmFN6eDa0T4hUEfCziG+S
TLSH
T11716336B8D007082DF93AF7DEB4091C1B81295502333759A9C7E8656DF7E8980F37EA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  wedocs/.bablerc.js
- Size 521B
- SHA256 70b8745522dbd869fb8eab2ada7292a3003ff99c5e5c2625ed83bd83b373be34
- MD5 e2a77fe6ff43b8ce64b917471229d3f9
- SHA1 e49de49f43ee939b86b41782b902c4404dcae203
- SHA512 17f4b7e79f94c9c34d926e2fd4ebce422208a652cf04758fb512e6bccc72b9e24bd1a4354888d3fa99ce1b557989087932eb6cd2c4f2178feb75d099bd9d72ae
- TLSH
  T14EF0DF66156EA00E8046522B819E81A3799D13E74C2CFD14BABC833DAF3CA1CDDB4D68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  wedocs/assets/build/5f4138884ca3828fa2ff.svg
- Size 9KB
- SHA256 4b22120383c74edaf3539b9a7afadeeef17d57713392a654a1a8e597ab2020e6
- MD5 909a272871918a13d6c92fcac71b952b
- SHA1 8704bbdcf73406b35c1986a3097a7a13e893ac51
- SHA512 2461baa5b0fad32c047c826488aa46f056825d8b16452e95633a66e1e0b603daef33cbf1ff1796fb4fdcdcaeef24c050d6fe899d464b414e92ed6512f3330a04
- SSDEEP 192:T1hfKvZ4+qSsaxRZo330AKMFoOolols6NfLfvv:T1hfwZ5qp4foHDJ7v
- TLSH
  T1DD22CBFDA77D27B56CA51B84EBBB441C0B1E106DD1B8DFA3C1348AA24593D9831C48EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  wedocs/assets/build/block.js
- Size 24KB
- SHA256 70f82be4947a41c78ede820a2983de2cb38e259b82ce270a286ca6e52924bbaf
- MD5 14b2d5414ce2158ffc1c10e35fa908bd
- SHA1 e2cfbc136de3804153b34a6fe414b81bf7852d3d
- SHA512 1e059d0cc601c9e8b6b44608ca32267f4afb238d7497fc1df252d6d2076050c33b59bfce5abd64e3fdf07e84ea267e4ef20fd47f6abb16812d52d7ece8162226
- SSDEEP 768:gPnh8GCEodnAlAbSF9CHb3M2gtf+Ez1tvt:a3CEMbSDCHbg71
- TLSH
  T1A9B29865B224203ED697860FD9A11998F3546B59A4B206D0B3FCCC3C7B92E8E707EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wedocs/assets/build/blocks/DocsGrid/render.php
- Size 14KB
- SHA256 b7c0488c6c65fdb4a3fa3822a36bdc28db8f2cb037bc72229af0f59e5f62fa54
- MD5 0777dc2e9f9e7d28172f53ad20f07262
- SHA1 e3b466b4d699bee91b6ec7816d51d03809e71e52
- SHA512 bc55228b0c3906cfb2f46d19cf399e0004caf653d7195a87ae9526ee1f9396bd3c308882123333d696bb81c28e547ac7d61c3bb636f588ad28d18193d78388ab
- SSDEEP 384:f7lyfRjTaRyObUVtmF7AyOYY4pCBgRAUf3F86Ah5xQuU8Ii8nre8B9um68XZRz6P:zlyfRjT5ObUVtmFBOYY4pCBoAUf3q6Ap
- TLSH
  T15B525428B5A636723647586B8ADA58D03501D44763439A2CB8FEC2E43F8485C84BBDFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wedocs/assets/build/index.js
- Size 670KB
- SHA256 7d5f78270237124db759953bc0408e49ceab65502c7d31b662d58e061f07b94b
- MD5 bcade5786c97022ce2a547405338bb71
- SHA1 690e3bb376b3423649682e8d4faa99b6191b8d1d
- SHA512 bd14e6054ee0dc0a234e2a23e2a5d79a25f22b2025385f7ed165fa58b781d82d118e31a1648477820ac96499bf6f281d4726caa0e27ed018dced0ed2788d31ef
- SSDEEP 12288:TuT/56hp7bdQq/gfp+TZ1dFAtrsvAy1b8:+whFdQq/mQYtUB8
- TLSH
  T139E43C85B650E43DA1DB101B59BF4608F3A95F19F4368884F1FCDC0C7A62E8C663AB67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wedocs/assets/build/store.js
- Size 11KB
- SHA256 48d3bb6bdb55e88a9dcbd89766c2667a46e9e300577e86ca47177116d4b43560
- MD5 5c57e68082fa90d7ab22919ca06f506c
- SHA1 116e709f87109d67cc19ee30bb3976d6617a7e1f
- SHA512 c713a4a2298e14728326650fce1564bcd93dc9eda12b7ab1b5c6cfa3c46f46f408985f768f87b6cead16ec8a619efdadaaa5aecd99ea5fe83f5bf872f03d93e8
- SSDEEP 192:496qQx7MvAMTYhavAMjihmTA/7hfRM6GPvAMfrjBzvAMGZEkvAMczvAM8jDvAMwy:49QF1RzewKl4Swssrk9LZHSC4+LhFU
- TLSH
  T15B32828138C7E20DABED9D65983915607661ADECB01FC4D8EFFC8C7765424C1E13AB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wedocs/assets/fonts/wedocs.svg
- Size 9KB
- SHA256 4b22120383c74edaf3539b9a7afadeeef17d57713392a654a1a8e597ab2020e6
- MD5 909a272871918a13d6c92fcac71b952b
- SHA1 8704bbdcf73406b35c1986a3097a7a13e893ac51
- SHA512 2461baa5b0fad32c047c826488aa46f056825d8b16452e95633a66e1e0b603daef33cbf1ff1796fb4fdcdcaeef24c050d6fe899d464b414e92ed6512f3330a04
- SSDEEP 192:T1hfKvZ4+qSsaxRZo330AKMFoOolols6NfLfvv:T1hfwZ5qp4foHDJ7v
- TLSH
  T1DD22CBFDA77D27B56CA51B84EBBB441C0B1E106DD1B8DFA3C1348AA24593D9831C48EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  wedocs/assets/img/wedocs-logo.svg
- Size 5KB
- SHA256 b64b96cc487f4f3e202ed6a3fd217adec7225c77444abc7a7f0c7a7bbc01213a
- MD5 b565b6bcbfffc6dfdf12d44b236c09ef
- SHA1 ee6e1f9397602efdd664f899bd68848e716fa7c0
- SHA512 10ab95a923937c5f4bf8457865b4379b172ea864e5e7a8119fb6d5e085a7236560c7cb42d5fd9ad9361f838b96b57412a9d09035f6ea108f42ed1201e0f0b711
- SSDEEP 96:3E2Ww52YFgp4WFYVpyvUL9Fe29cp9UV4gE1XoIfc:02Ws2YE1+/CNXoI0
- TLSH
  T1BBC12EA9D9FCC17EC95A826DEB4180741F1C00F3B68082A8F54E5B0E5F115928B4FBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  wedocs/assets/js/admin-script.js
- Size 544B
- SHA256 5d6e2e8861200194844cf8991e5d7e079f6fb4de84c1da6fab09509ee7d06eac
- MD5 d40972226d8410c747667292669502e5
- SHA1 3e2323dff74578ac2cf18812d7bde6871baaf7ba
- SHA512 d44f317151d52f63578c7b9015b0647449722ea9cbdcf4a26106dd4ccff15a4416337cb09d2d447994892ee89fd80f37e9e612d725dc10524eb733b8e6901ab6
- TLSH
  T117F0C93E40F092D34033A8188FBE86853227548BB16BAB043DAE1B449F43A3528B67C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wedocs/assets/js/anchor.min.js
- Size 5KB
- SHA256 a41fdd78773d0867c5a494630b8de2981dbd46c7bcb5a93ee5e5ea9ed3bde1c9
- MD5 4c085574bbb6add4a37144d88709d5da
- SHA1 baaf82b10b40562e92b5a4e6db1c5557eba91fde
- SHA512 699a2d04fcba76a9fcc9568b2704ab909f90c6ec55ebde40e1d82874032f4d4e49c8d8b99a1aebf8b79a0f71924be971d5230528db34b6ee5930912035940fd9
- SSDEEP 96:mh3rljWh4eJS6B91D6L/QT4cvchJc9z2dZ0SVwLI6Kn:mdrFWhw6B99ky4cvchJc9z2dZ0swLRa
- TLSH
  T186B1D77C320A3F7513BB0BC19856164AFD21616F890C1849F56FDBEB3024D84A2EBD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wedocs/assets/js/frontend.js
- Size 15KB
- SHA256 40af03d03a4c5428f8298ed2bbab645e60eba7a06ea49119a38726f850c2ea13
- MD5 bd6a3d725646941727411af99ab6ee56
- SHA1 54e243b5e4169cd2e997530c10f3ffd4d76025f7
- SHA512 3954047cb3b60d182858ee0fce4ad369302ecb76add044caeaf6151f480061b54544007dff46a74c09651eebb4cecd2a626b3b40c1ef66d8721d60a7b6f80d50
- SSDEEP 384:Hv5R1SRqY58buJlMou26cd7h4Kh9PyFEQA3ioNWZt0U:wcYq+l/V7h4Kh9P9h3ioNWj
- TLSH
  T1C572611A62F9013705B365B27FDB7A443863A483B505860D3DBE4B442F92C2981D7FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wedocs/includes/API/API.php
- Size 27KB
- SHA256 6d9723f3ffc59e25903e5ba2f7d48897e200456894db32a52b85a862aa3f11e3
- MD5 a6e8e36a8b14f7e3968ad288ad56c418
- SHA1 648ee858a612eed917e32f7fcfa2f955eaaa3d0e
- SHA512 dc7dc5a21dd6d8f74435d55dbb95b99413a10438af198d1c6d7801305e96440390a8839a20fa3dd6d088a02ec49186c1d7f90892943ebd573a7e015b8752eb7d
- SSDEEP 384:PPvse9oxXZXTlOKsjfyQj3s37zWxjBwOjV1ZuT/FApaIPhtYAPJ95j:fseyxXZXrsjfyQjU7KxjBLMapmu
- TLSH
  T14CD2936938EF81201973F43ADF6BFAA0A459800735066A11BC6D63EC1FC476DCD72B69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wedocs/includes/Admin/Admin.php
- Size 3KB
- SHA256 1080d592685f3beea2468cd18c53e0ff4190f388cbfee589536f55f13b05cc1b
- MD5 253e095fffb86cdfa7860f714751c3b6
- SHA1 3eea2ab26adef4498daf198aec727b230a83ca55
- SHA512 32fcba5a25b03ac509a65bc2872225b96030b06d0f7bc978118b7de84582e2e606e2de41cdd1fc21bd4e306121a8548408e45af47e4a0481c88791a4fcd72bc0
- TLSH
  T125710269B8E71D3584536C79974BE068B437525B702B9C50786E06F0AF43F28CAA3E4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wedocs/includes/Admin/Migrate.php
- Size 13KB
- SHA256 e6a13d603d5a0af8d40953426a71341f7a263b73039bfb79aed52ff5efc3c0a5
- MD5 c83cf2b966c4e6b7a0902f4797cba0ce
- SHA1 25f696765498ee53f16fef2062421bbe3417004f
- SHA512 56d916883c6da68ebab190c8b127859f818a01d08ed0511c03bea71f1345174ed37131e99853e004258ee9fdcf89e95fd447447823e393ec787eb59f3130d604
- SSDEEP 192:Q6j696j3rqtkaZqQkH2HKCjSpOC2cveBXC5YvSkNT0qE82RxSadm5aTwBPZUiE:fSZqpDCNbtFZSPlb
- TLSH
  T1D0523668B4E5D11010E3BA39C792F582E82EC507A7275950393ED99C5F49B70C92FF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wedocs/includes/Appsero/Insights.php
- Size 43KB
- SHA256 2b6853e6dbd33711b0fd69c9517ec425609e2ad19121734670d9eb3aea2ff508
- MD5 00d03953cce1954406d00facd91787c6
- SHA1 63f78ec2a7822b1aca75567ff438372198f6d244
- SHA512 6847f5d6070cabfd92098e2020e4c00a85d4212e41067d8a4b6a67ab7773fa7525ec126fa2b4a805384de9b92238f558b5156ecdb19094709b807f407b37bf6c
- SSDEEP 768:tO+jTu819W6u2Bi8ZDPcVyOqsLSkLSFfh:k819W6li8lPeqLkLST
- TLSH
  T14B1376DE35EB4936502323F99B97C0A0B16FA617430EDE01BE6D96E41F4076CCB71AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wedocs/includes/functions.php
- Size 17KB
- SHA256 adb0264cda30d4e500fc41cf710a46461cdc95da10dfb1a9f3be6a0dad55b175
- MD5 547cc6ba83bfee7cb19e3dc2bf43af45
- SHA1 42c20c5fd7fa876c2c01ad0f14c76721504755d3
- SHA512 a6b4397032536aada85702f629d36deb073821905d8c2408201d0481b7c13210bf39d4d620754d699878e104ea47d5177fdb716e60e240c448c4fc537bcb1483
- SSDEEP 384:t2k0Eq3ZPxwiqiGynAkqp/oCkuGItcY4Z8BeQBfswZzU6sd:t2k0jtxwiqiLnRDDuGItcvZ8Be3w15k
- TLSH
  T1FF82600130F3A2611563787CEED5A084B8784257762BA9457CAE16C8AFC5E38C6B7F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32