d7e132516d2296aa33918c51f6731bbd6f69dfe53c6381cb166851701ae41a00

Sharing

Copy URL Twitter E-mail

General

Target
web.zip
Size 1.7MB
Sample260729-xcy3rasvev
SHA256 d7e132516d2296aa33918c51f6731bbd6f69dfe53c6381cb166851701ae41a00
MD5 4b22e3b473fb5d1d4cdb721446a72e9a
SHA1 217c8071041ce4e784c499e884a64edb24314533
SHA512 a35a442e81f19f9274270cdfb8bc28d87645aaaf8268628534508fe23f401af3d279960fdefedd528e01687f97f9aee2be2d85a43c73e732a9fc7f8b89a7dfbd
SSDEEP 49152:QLZGUHSTDlsGipp5HItG2JTbMAG/+AX21mf:QsUHSlsFI3PMAlv1C
TLSH
T188853365C781FAE4F0826B793848D717BC71C9500EC0F12555AF8989CEE9ADC17CF29A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  web/AntiBOTS/AntiBOT_1.php
- Size 9KB
- SHA256 6cd9cbdb3e27052b188daaaafa78381617ef5c5e387ce6d41ed32019ab4a16c4
- MD5 db251f37ad9d792bbc5f2b6065403223
- SHA1 f34c7f22c418b4828ca73451a8a85b5c5240b850
- SHA512 01a5091abad9b23f1c42a71aea157b7bf090c6e704ebd168aec381c4e85ca83871ce7c1d641dd8c6a5ebd343ff1a030e2c75bf5ae96fdb7596fd378e214b6d0c
- SSDEEP 192:xJmOVKfa1pCcLpDE/Li5eRss8mPZqTirP28jZz+MbhT5X:XLVRPO+QB8moTIPx
- TLSH
  T1F412ADD83D955C5512B1FB779B83E01AFE3A852781890105BEACC1E94F705EC82ACFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  web/AntiBOTS/AntiBOT_12.php
- Size 8KB
- SHA256 ddc8fd6f2d4a73604ff4c415e7a8529ffd7af4de9d42650f171a68f4cece70c9
- MD5 6d04a45884c337f2e612c8d580590466
- SHA1 b6efacd08fe8f68369823ba5891ffc81869441b5
- SHA512 12c9303a8a0a7662f6268998cf4de6ebe2733f53f15f9176ea164f55a2afa1e70b2ac640b88ce153b90ad67b3f5a90a395412a5dd07afa33dd26f39569d378b0
- SSDEEP 192:ayeIR0CMhl4LQsdmIsK12rGezODH+ZS/U9Hn/N:KIFMh+JDQrGezA/U9l
- TLSH
  T18602503BF8C19A207AB4864942F4D95BE5C9A1CEA710560DBA3ED4C43784C3437BFB69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  web/web/Lib/fonts/dcefont.svg
- Size 261KB
- SHA256 6f8c78e74c3dcd22b82010b0222aff9cd574e9ee3d2f2e48ed8cef7fc1ffa15f
- MD5 b8dd3b7bf72285beea86abb437f0c27d
- SHA1 d03a3846d3008438831a19bddebffa5b344e4d1f
- SHA512 8b1f935c9a387d0781f7cf2930488646a57052a3b838804292656cde0a6daaf460d642a7f6f60ccacdb08b4b8f731c27bc5d3c519c0c342c496d5884bffe4eff
- SSDEEP 1536:Rn9E4CKUNzsV+upmCKVicqPA16CzZHyGaSVHzXpr7R/0DLv8OA2P8apDU9Y2G8Vz:7KeA1AS+8VjVUfjRZe
- TLSH
  T10B44C9D9EBB092F8ADC967EFDB245CB8341A50BE3532896CC23D9F5455C390C5B188CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  web/web/Lib/fonts/opensans-bold.svg
- Size 24KB
- SHA256 eef24f3e988c322b2ce93b9e113cf6479ddc988b5973a86c20fc35de8ab34507
- MD5 9a0ff17ccfb8fa22db3b25433a0608f2
- SHA1 e8ae88fe789fa0b5ba2ec7ccc66a66110ba7550f
- SHA512 62cf76b4f785b53225a4f77df614d31ea29372be9d6ee3fb4ae093d0bf81d84ee186ee503a8568ad0683cd0675f733889fd08fae5a25d91781fb3c1da39d7f25
- SSDEEP 384:cQqs3S/a6CAwSLQeov1YorzG5jJkjX3uNLmnevnTS84N+Z63/3nQwF2M45J7PLL+:c4Sv6z1IZSUO312j5FLL+
- TLSH
  T1A6B2637DE5414EF49FDD82F0AFAA6C98452D939E64363DA40C69E1F00C0E3690D9EACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  web/web/Lib/fonts/opensans-extrabold.svg
- Size 25KB
- SHA256 3f2ea7e4c7b7b1bfabdcb36905dca07cfeeed3caddb20eed417aa2583dbb925d
- MD5 05fa5acb415ab23f26aad6074912d024
- SHA1 d31a424e9fb90cd40412a75b9a38f56b9022675c
- SHA512 d7a9e8c96478a19826c326a067f0df601b5d9d3fda5e08f3abd89870b3772de04a21ec49a18f8329adf48ac85f849d37148e75ea837393499047cc0cfbfa965f
- SSDEEP 768:c7UYQlr+acApxcpZybvsjnZdkh69n3vXA9z:cUYQlCaDgnjkWvQ9z
- TLSH
  T13DC2517DE6400EF59FDD82F49BAAAD68542D93AE60323CA45D19E1F04C0B3690C5EDCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  web/web/Lib/fonts/opensans-light.svg
- Size 113KB
- SHA256 02defaa14182ffb27cd02822e02e03b341ee93e7ca3f34eb67ee61ca02fb15f4
- MD5 aba049e25755f0030d3c8a0a754bb71e
- SHA1 e5dda5dca2e71bd6426dec33308cb47babd7359a
- SHA512 51cdaf11312eefde07319434bdf4e892c426a3302331ebe3d05f659332f3da0de5ffc2bd77d395c36fe415929bd0c888e5991517dec411fedb769939ba765f2f
- SSDEEP 1536:PbbGsnmx8rF0B51vuRb1bObSbT1bDNOkG7m9DNn0V/gsUX3Q1lco8Ms/QFN3Lr/y:yAKfV7QBuF6ADn8QN7DoQbW
- TLSH
  T1B2B31336FDCCC66497EC51A8BA0649B0717973A72A553B161CAC6778EC003638FA9CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  web/web/Lib/fonts/opensans-regular.svg
- Size 115KB
- SHA256 82f991ee859b117d067c179a9a875194a547f4ce390615b3d60957c3ce03c5bd
- MD5 d73851514472d0c1153c48fb263be504
- SHA1 c25642667516d35cd2eb602cdc7eadb3ffc62a25
- SHA512 bada5b647b404c370e9c2f35d25dc253ac12e440ecdc314cdbe74b4313efb77fd5a2711ca4727707ce658c3608a39716a296e513918b6c28a4f4fa00122afebd
- SSDEEP 1536:ZWM+8TW5KC2/gsUX3Q1lco8Ms/QFN3Lr/L0WPdJW:s+TW5KC0F6ADn8QN7DoQbW
- TLSH
  T1D7B35336FDCCC6649BDD41A8B60649B0717933A72A553B121CAC6778EC013A78FA9CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  web/web/Lib/fonts/opensans-semibold.svg
- Size 114KB
- SHA256 d8d8bb28ff35604be926b9fded67367c65b2fe9685c635082f9b2f5d9cf45b95
- MD5 cc3e491b223ac819c3792679bc4c772c
- SHA1 5f7e52194b62d2a43c1dc290c572674c786d112f
- SHA512 bdbac6964a2a76e29e99463fa9dee1832b05fe2bf00f0b69662f9d17990353f336fa9c2dada43bb5a2c6aed4d85165a9a21ef05c8c770645127e6a7a88669766
- SSDEEP 1536:n7YP+qzbluDiS5KA/gsUX3Q1lco8Ms/QFN3Lr/L0WPdJW:n7Yhw+gbF6ADn8QN7DoQbW
- TLSH
  T188B34536FDCCC66497DC45A8B60685B0717973A72A513B162CAC6778EC013A38FA9CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  web/web/Lib/fonts/videoplayer.svg
- Size 9KB
- SHA256 2c092a48e32bebf6383ae20e15881a5e8a942531a2fc6ffeff1aaa513822a850
- MD5 f70d6c39c3a551f0b3071624a5904bec
- SHA1 62d1c1ebc45da8f6fc5458f8ea54b935cec80d98
- SHA512 74755ef30f66bb76ece681b3373be17705495ac62455cdb572c649d942f674ad0358102400b655dee377156af6310eee201f84b65d5b84d731ff1f475195ecd9
- SSDEEP 192:TkKeUedGeBOd3gBuQhnfpnqfBdTjDf7fsvou1XO1aC13lcNvK5:Tk/l1LhfxqfBdTjPqXs7Gi5
- TLSH
  T1E812A6C8F7B1A5F49DC9EB9E6B280EBC38A508FE75B3D629C2149DB4108BD044B544DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  web/web/Lib/img/logo.svg
- Size 1KB
- SHA256 d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
- MD5 b55b042f907bc7108f5dca2103a8476b
- SHA1 9fcdcc86bfe1f3c7d4f774775670fbd08fe7556c
- SHA512 45aa66abb6c075a1b3f5c76c1273ea21e7855b99031d46bfbcd7b8882f58e9f5612b556e218b41c902ada7fe0f77ed9f3849e8e675bbdddb21ae5397624b2c7c
- TLSH
  T1EA21A485531AAFD49D9801686D383481B5DAAC9CF170F6F4FD877415E06D0C9D4D4DA2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  web/web/Lib/img/wordmark-white.svg
- Size 1KB
- SHA256 d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
- MD5 b55b042f907bc7108f5dca2103a8476b
- SHA1 9fcdcc86bfe1f3c7d4f774775670fbd08fe7556c
- SHA512 45aa66abb6c075a1b3f5c76c1273ea21e7855b99031d46bfbcd7b8882f58e9f5612b556e218b41c902ada7fe0f77ed9f3849e8e675bbdddb21ae5397624b2c7c
- TLSH
  T1EA21A485531AAFD49D9801686D383481B5DAAC9CF170F6F4FD877415E06D0C9D4D4DA2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  web/web/Lib/js/OReoo.js
- Size 42KB
- SHA256 86d5d1c51c152410212d38c5aab2c3b63ccef51667a19a224359fcc23590eb16
- MD5 0ff00a109703c3b13d1c8c5a6014a7a8
- SHA1 4c65103a0079fe524d7370bb00dbfdd256034c7c
- SHA512 4563fd098f9013ea49d7186fdada36ebbf26802e959ce34275bab4bc237bc3123794d17f0664609c31b475bc11f3f8b8b0f84e747cb63abb65ae66a32f03552c
- SSDEEP 384:80NuIr26gMP+2CXRHNHGMj/wf43EMglDxlnn339Jql/iQ2n2T0x7riSxrSAcSh/7:80AIvgMP+2UVfA6w7OSxmAcSh/QTC
- TLSH
  T1B7135849B8CD6D5B235F523E2F1A2269CE6A7D10A5F44549A0D8B0608ADFF33E0739F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  web/web/Lib/js/jquery.min.js
- Size 155KB
- SHA256 6e1297448cf350be58ab05a6c413fa4d4b97440a0a3ab97fb03c09ff49af5ad4
- MD5 50f1aacb05fc40763064d74404c5bcb2
- SHA1 b3c28cab2fc387c630cf23704dde2f1b5013747c
- SHA512 b0e2811c79acba8cec1136f5c1b00ab6409dadbd386caa664b0c5a8fdc1f9bfc8b30efcf8d8b02cd7c6c004b7ab6f454442d5d2f755cdba2c8c0be2b6706a9d4
- SSDEEP 3072:w3kqLo3/YhzDDsJ9SqhJYUqADaCwhjA3rs14aKp/jpy:tJ9SqhJYDADhaSjpy
- TLSH
  T1B6F3648AB7F620359613F03D8EBFD805B176445B2A9CDC55780C91B42F548388AFAFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  web/web/Lib/js/jquery.validate.min.js
- Size 33KB
- SHA256 b8302f6aead75ca339781930167f4e1ad42f50cf7e17b654c93159037fc9fd20
- MD5 9ea64390e300ed1a23e2b62b7cd5cb20
- SHA1 7df056209ee2091fc674aa9f59a1063c072e9e32
- SHA512 cb26e090f8484b8133f45fa1a51d2e163efef52644a06ae30adb7640db6933f83462d69c20cc3eb310dab4956e6a76236684a8f082bd68a9e140e69ed052fc64
- SSDEEP 768:uyaKPHI+V/1/3zrRwRPpDggHNOwY1wGOiyOLHTDQt6LkQQG9/I:uyaKPo+V/N3HRwRPpDguPiyOLXQ+kQxI
- TLSH
  T103F24E0AB7E1206A9973B2B8E86FCA05F1B2063B5155AC6D38BC90D01F71C9485F5FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28