e823a729191cda216e3183a7d03086bd7296b73d5274dd86a53cd68e460bd1d3

Sharing

Copy URL Twitter E-mail

General

Target
hahali.zip
Size 1.8MB
Sample260804-pf69jaah54
SHA256 e823a729191cda216e3183a7d03086bd7296b73d5274dd86a53cd68e460bd1d3
MD5 8a5b2d97f2872e53d0b5d968a95295a9
SHA1 eecb6b2b165a4fb570fa3c1b566f190b22a19ec4
SHA512 79548c948965500067c151313272e7ba4c71638955da3101458ccad1938c5c83b11887f816cb11891246b704b47571799e9c8e8b588092734a79f04167395df5
SSDEEP 24576:9Oy4104MH76AlS9Mbj+cx6i8gtSOxBHYnLPwD4Ys+dNdfo+OMd7vqZcU:9O3104MH7rz9Ja84Ys+loxMd7NU
TLSH
T1EA9519B0E7617292CD9E84FAC21DC65F399A879F010B5A4C1DA181E85ECD1DC773AE8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  hahali/ajax.php
- Size 735B
- SHA256 39f87155280b91fd882fbc3d333e189368ccfc8774648490ead33f1c2e9b05b3
- MD5 fe6e7496d1560305687ec5c4d1cc77d1
- SHA1 93d8dd9aaf8e4d3b5d87fe4e5432c1e088898726
- SHA512 de01baa241b6629e8e8f86457d7bd33c95e59b19f8a6929b4c333ea13eff458cab18902d4ecf8104beca7ac31aeff70b11fdf3d6cfdd1c3e35f2071e25bf8637
- TLSH
  T131012B9A7C2742524937B1745A178814FE2259278394E60D7E8D86490FB2994E4E3D9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  hahali/approve.php
- Size 54KB
- SHA256 8e089249fe1f96b30a742df615608ce7345e013dc4cdafe151eb6864b59629de
- MD5 991ce00f12f1192b7509fc2a626577f3
- SHA1 5707abc4cfff02c78861c759698a5b758590a081
- SHA512 37e67d7d1374901b974753cc88dae2b0eec94168275cd6d3c3c96deabbfd4e1cc61f134f0e848dbc36376772ee456c2112328e138082879ff13961500e01a8b7
- SSDEEP 384:Mbs6xdFiEMNnL9IfB+scZELz+fkyTmqPVIhq1jq+2zvq5qsFsHJ218LLmSunw:ynxdFi6vsFsHJ2vw
- TLSH
  T12A435235A1052004A2739F4D7BD33F4AEB5942238302C1797BED2A586FF69698693FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  hahali/assets/images/actions-icons/carousel-arrow-left.svg
- Size 748B
- SHA256 437c451ac5a5b6024a6cb8c33881bb523eb4afedee657739b435baa0d8ea02b4
- MD5 04b511313848156b865cad408c6b48d7
- SHA1 1f7bd57c12813c994d208c1d71e56eb6782a8974
- SHA512 e62f61a8bb802c60f63ec6253b69eb0d817aab54931fa6f303fbfee0e21f29b80ba10b38ecd5704005d74b369ebf7437c740cb490de2cf6e11488a157c6c2f7a
- TLSH
  T11D0195FC82E9B0D59511E339F29BE4EAB0AA24D773468F4A815C4954AE8414F55084FA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  hahali/assets/images/actions-icons/carousel-arrow-right.svg
- Size 766B
- SHA256 c90f777c483cf41ecb8aa6f9799e7a0d3466e5005152a32c88a14d40ef141700
- MD5 c5e070b9b3d57932bb86610202ee9576
- SHA1 261cfb10c42e607e8e3641aef5530f5433d41e25
- SHA512 1223b4f061afce7cc6007a3a1d3589f6f8d51e429f26e2aafa9b98e37d9c0a23bf06c6a31669264e9e50d774f9ee8e61b2e36ff3c93de836c9e0991d38119b7b
- TLSH
  T13501BDD813FAA1D4864ADB3295E8B890337324DB3304CD6B77E559514F914AF7188867
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  hahali/assets/images/logo.6801710d.svg
- Size 2KB
- SHA256 726e44dca23a4116b4a66e997c5bcc6c42db6f74b88651a7863ac1a4e689b0a8
- MD5 50adca60b69e4c66c0439df21d6b00bb
- SHA1 75c892c5cccd8bac656e26b39a60f16512b9d825
- SHA512 8afdca6ada4f3b9eb0817f1c5ca50053cb5fa2679741a7c75aa288cdcf6487e95b4b97d6d7867a1a465e0dc66adacb1906c9e0cd799a7baa68b39466f90341ae
- TLSH
  T13A4164C91760C4E47963CB5DEF267581363698FFF27A4781A129CB20AA8BCD97806800
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  hahali/card.php
- Size 51KB
- SHA256 7e67b9a9fd45e33185aceb6f555439c35174915faec6944754f1762b0e6c99e1
- MD5 c75b0a756009aed978175f1fd0a6fcbe
- SHA1 c211066412913e01f9f1578c02293a8ac41959a6
- SHA512 8544da0dbad5aff40f6f462fa5118421172eee9c6937f3f491b60c253790cd69debb221eccc0a18ab848eef782a0186a1764d1e05dd4b158fff8cc2af15b54d5
- SSDEEP 384:Mbs6xdFiEMNnL9IfB+scZELz+fkyTmqPVIhq1jqF2zbL6pxzKlqSunw:ynxdFiIeyw
- TLSH
  T1AC333135A1052004A2739F4D7BD32F4AEB594223C301C1797BED2A586FF696896D2FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  hahali/control.php
- Size 6KB
- SHA256 eb74d19e8b839d529bd777251d81ec4876d3998cc7d1078b68d330fd21c9b0de
- MD5 ce94babee1ec7ef96a1ccbef5c13b6e8
- SHA1 80ad1b1c93b24ee3eec3e82a7848aee3af367fff
- SHA512 fd0aefcdcdded6d1306ca4923a7381c93214562c4828d6291f4f6c55711dfbcb310086f823832fd099d458b77fbe5d96d02253005e4cf5e1a272575da3489945
- SSDEEP 48:vlEGCEmP3LzVq9XC+NIVtChDSbUwjCqnBnSlgVwDlpnIAfEEt7Es6KHtHEbQHu7I:vuGCEgLzsC+N+CuZ+qcg+Dbbc0xEz0pj
- TLSH
  T173C1713168C19E066233E8969C16AA49FD91C207D75F3A0475EC37B76FF6C444473789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  hahali/detect.php
- Size 70KB
- SHA256 0bd14dc2525969d5d014ade1c25e2571bcce7a51c71afeeeb781bda638838d27
- MD5 440a4353652f2e06128b350226eac912
- SHA1 fef5ab7d302b3271f580feb3e44e68c8989629c0
- SHA512 ffb9149c2aef9164f15b3b8e4309deb003bef9d12aeb4bec381b6cc8614c4d5db15140a2bdabb67e723921328427b7e1651b26f57c45bc77db649a0b22ced7ee
- SSDEEP 1536:rf9+hj1Ot0Mz1u3LAIPyUgczWxmXUYod9QaUyu4t+w3YeqEx7fZTtKvbQbtJkr3:rV+hj1Ot0sIPyUgczWxmXUYod9QaUyu7
- TLSH
  T1746364896DAD7972603293E65B0BA068F77D6137446A514DBCED82702F7032C923DFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  hahali/functions.php
- Size 1KB
- SHA256 e2d609048f246e02ca672e1e28885ffa14c468101afbad5951ce8734aef99b20
- MD5 8ca479530745e6a863e946e9aa7a61c6
- SHA1 27e82360b1184788780460fbe7241a635b32bd3a
- SHA512 9586e6f6105ab710a11e9f1a28e78e9c3baead6ec5c4c6c1c72fccf1da2986a71b88610ea8cce0fa5debdfeb3eb049381fd9dc066616872cc232a32c2cf4b67c
- TLSH
  T16531CD85B89B6A740973EB2C9B499518FBBAA113058651017C6D41C80F7711CC7F9FFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  hahali/js/bootstrap.min.js
- Size 60KB
- SHA256 2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9
- MD5 cabc5d07dec4c381f521bbcd41c009db
- SHA1 ca329d086682a4d75b5528d326a66a6d3fffab13
- SHA512 66f6e36c99f2b57f526b4dff01c6cffe787d2bde6d6abe11d080314d2da08760a18889de7ebd6bec4a675429694d650437b55aaef12c1f7aaebe463587474016
- SSDEEP 768:+hkw5E0MWirtTVU4t8GMqm7MT8VbdPyqzgqqqLWpeki3iMFpnkIID0Jhp6zvsv1z:+Z2TTktMqTiaDkIxIzcn
- TLSH
  T1EF538249B254787206DF747A817B460BB73A2899A046813CB97AD8DD1F7CC893173FB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  hahali/js/chunk-22DMWHJU.js
- Size 59KB
- SHA256 631d6a094d422cc1d936c560d6a3dc19fcf71da66db148322eec6f40bb477c96
- MD5 53c1dba0e1ad35499f3b211cb12bc3a5
- SHA1 64bffd8b60502a0dcbda491b2cc73abd7ab81bcb
- SHA512 953841206ad1a9c8f11ba712faea54dc20be5edbf2b28b315d20e70a17cef592f0498b6941728a30d5512272e4ec98f1534047decace54c5b8fbe9ec27e7492c
- SSDEEP 768:RHHMYjGixPMWYUNtZnwKJOCiPbisYUEBeNc1UbRNEgtegjzpi78JsyqQtnl:RszWYIw0OhbuBhUbtDjzNdFl
- TLSH
  T1F953A5CE3186B112976602B404AF480BF23D6C65684E4D1CF61CE9DD7939C7A52BBFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  hahali/js/chunk-23H6V7CN.js
- Size 763B
- SHA256 fed0fe574ece95f40cdbce4f205740c036f36b54fe685886a9acb666ca322452
- MD5 4ed8da785204ca90f101f5f2b46e6efe
- SHA1 a293ca005f1fd8bab775fef64c3bcaec6c801881
- SHA512 ccd531f35b2906c45fe855a2a7b0c7567fe16efecd32a0d4e9a7ba9b177c22992eed3a7d3e7ca828689a2852ff1a1b1ce0a6ec42e13691daeae24f92a208681b
- TLSH
  T1DC012576C012B2BCC7694EB5903390D0C1271CB4127E01ECB69C7AA15C56EC202FDF35
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  hahali/js/chunk-2MY2ILMX.js
- Size 10KB
- SHA256 448a25f0ca131a80228104350b63a30097180f21719f2a2efc2ebd2472e92871
- MD5 8caa17d947cc293541974a35c4705a6a
- SHA1 1fd53ed97ecbc3c1c15cc731813e8290e700f84c
- SHA512 f7f903fc966bcdbfdb8f119c51f9bf2fbc3cbe1162b23676fde5b549094d7e3ddb879de1306494b91b5e6c2254e95c1d92d83f7d47557b814fef3338f0b32f83
- SSDEEP 192:jfu6lS4VP8esMXb9y5UpkKkag4HiOAjV+x4AsXvj5OudXBGl9P6V3/6nJKJcIHEm:j21G0UpK/AJddKrKRMh
- TLSH
  T15B3252D832F6E52041954112AA754141F23EDCC4943AAC1CBBA724E7FCD4C2EA76FB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  hahali/js/chunk-2PPFUFFT.js
- Size 4KB
- SHA256 0a11cb68a8d0400fed48aa71d82d33861c15268c9be2f977e865c089ae876d16
- MD5 0c8a50f5b937d521ca905781240cf621
- SHA1 3e369591746c5ccefe654c29a87c54c5e6f87894
- SHA512 dee2cdf6e1a7f85b459228215868dfa16bb3ae70c781a5fcb9b991e9dbbb4a2f540b8806347132c65f948a415a65edf04620c560d2ba54b0dc1f279c5fd2940c
- SSDEEP 96:+1eaqbOuY86DXQ0yapVBa5BYWen307wZHbENa/Bs1FHLeY56k8vms:4dRpZyapTwaWen30E1bENa/Bs3HLeKly
- TLSH
  T15D9110C522AE152567D6D4A4463C0E03703074843E1A432CFEA9FAEEEA2DC5D75B397A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  hahali/js/chunk-2VVPTE3Q.js
- Size 23KB
- SHA256 d88dc9c2b92b25b33b92607d8c3543505ab99ceaaa934c47d47a439048ef8e79
- MD5 954e5ada6b0388856e657299b0c2fee5
- SHA1 6dfa8215cdf7183a441eddad0817795474cce406
- SHA512 daadd4a76eb683f4b458623eac9c55da9b6b51a17cccbf3d2cb3eff6845315c99697b9fc39952b0fbee323bd7cfb686442ef7e1cc9f0a68caaad2bfbda74d554
- SSDEEP 384:uR2DElfpbRlU50fwRwJ100Tg1ctcSYMj6US7sPemhLQgm2lgvdVQLpKoVRuZnyc6:+bg6we2GgcYMjTQLF1+TZgE
- TLSH
  T120B20885B393AD7B07A685D8D0950982B35D1545702D843CFD385AFB68E0C82AAB7FFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  hahali/js/chunk-3ZLDTC6G.js
- Size 539B
- SHA256 ab9e8db0c0e9009766daaa49c5a70076f3de85d398b43bc35ba3131c19f9e83f
- MD5 760d10ec8f5cf913b30765a40bfc34a0
- SHA1 88f13a1d03ace8192f12f8f9b42333a1a9a99c60
- SHA512 d64863710c4107fa76d92f683d69752ad4be86e5e71a4cdb551e32e35dcd1099348bb0942be1694bdd2c93dfdcf417143cf79699b8540ca16e16ecdc887fa1ec
- TLSH
  T10EF04C8BE2A9717C4761C47511354297913D19A0235D44FCF3A959A1BD108C5027D724
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32