e3500097339abeb9d21836cc4c901746517c9ba3e08ebd6e9e1175acd558af52

Sharing

Copy URL Twitter E-mail

General

Target
bfol.me.zip
Size 6.6MB
Sample260813-wwqeaawckd
SHA256 e3500097339abeb9d21836cc4c901746517c9ba3e08ebd6e9e1175acd558af52
MD5 407db7ad9b0a2b2294783048b0144be7
SHA1 d15067be6c0ade4cfe809354f1acec0081e39dc5
SHA512 be677c743e327894399959bc0901123c06b43d0bbf1c0374aa04be1114ea5175d8d4d66f176100968930cfa4ddd3c68cabf640a8fb8f3a66c1a6dfd42e9c8d0b
SSDEEP 196608:nIG7py2YIW+MIbXdmDDIWh9bqTYLAZNdxjWkj9BWVF:/y2dBM8X4OzdpYn
TLSH
T14A6623B3CB7E0069E58D2576DD0BC148908121958F029C4A7E48FBDFEA566D89F33D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bfol.me/admin/index.php
- Size 11KB
- SHA256 8e460239f101bfa39c814526bab4110ee890a972e4a68f44cdfd3255f94bff35
- MD5 d0acc492bf5dda12377d3d343cfeb86f
- SHA1 76322e4b6bf6be5de313037d0808c34aa7cf3a06
- SHA512 37166f747b36b5a88055879eeb00950bfdf143efbcfdd62b3299eadafb079436229323a59cdd7ea65a53f8433469d5755c62e089c2f0feca73e28cc092bb9e49
- SSDEEP 192:A3IZx+kcVpui36Ul68McJUPbLC7fGqhFMOdRoGEUOg1+KTUPkJiZF:AG0ph36UFUPbLQGqkYVEUOlPkJiZF
- TLSH
  T1DC32A59DF0EBF57B88AAF054AC58A94076AC4A037286795EBC8CC3D04F6CD61C47CB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  bfol.me/admin/plugins.php
- Size 5KB
- SHA256 a356c5dd896eff2a512acc9c191818ec8f14b12812e9c17f1c1ed31ae92daa44
- MD5 1d94ee1244c444bd33df2621f2c74669
- SHA1 d53064f8959f3db58ced3ba7bd278ff94b9b9805
- SHA512 80677d61669b98c0d22a9ce30ea6c107aaec5218b635c405c099fadc18a239390b84ac955f56a02a18e59016d69629f653e87ccc3876783752d696f4f02a08e2
- SSDEEP 96:pqyBiEVpRHpgAQnAvrtE26Ei9mo3jcDscqGt2V8+n2TwX2rbhANvZ0DKolVDrJg:ntVnHInktE26Ei9mIcDscqGt7lANvWf2
- TLSH
  T178C1411AE2DCB63B407BE4B721614ED371DD92D56200E861FEBE05505F30BF8597BA42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  bfol.me/admin/tools.php
- Size 14KB
- SHA256 9c6ee565f918b8bec0363040e0cdd177fefadaf299f8ab1cc75ba55df33ff9ce
- MD5 2749ec2549304cb2dd034c8706ffd98a
- SHA1 0c9f6c9515655cfdaea0676cf71276b0d40a6307
- SHA512 fe6e59fc1a539aeafec07c4d0cbf509596127fd52541dc4fbaf560eefc068178b0f12343ff55cbf9e82b56fb5127d5641affdc4607577d5a3b7a3ec6cff04fa2
- SSDEEP 192:piiPPvsH7z5nlstxD80vv8pgqPU9+76bJ5IOwVSvcg:piiPPvsS/v8D7615IOwVSEg
- TLSH
  T13162C50FC3E9732EA065686B8B9B4D5020D6AC4729147825393E02C81F7CB6F1E7B3B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  bfol.me/core.1499925
- Size 10.4MB
- SHA256 46e799d1aaca74d6bfa30aac1354cd123a325105b281e2804dd5038de4d362d0
- MD5 4bbe72193c5f9f334d6909d71149b1cc
- SHA1 f6f1c3462e93d33823168652ecdc190650979558
- SHA512 e5df185b8ca013964cec7276af2cb3170ca95d26671cbe40aeca823a5441eda4f083b0e5655c65fc755402cadf1ba941f633e155cf00a6189689764d4afb776c
- SSDEEP 49152:jtSuAkKB5WViH1tAHNdFK6vNDaFSAr8lFeNtb/FkdIv:XvKBTH1tAtC6vMFV1v
- TLSH
  T1F3B69F257F67892EC4570535898B63E326E2DF718E46222F63B4B21D0E3735A3ED690C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  bfol.me/images/accept.svg
- Size 1KB
- SHA256 6426e1ef770f7e4ff6e82c54ec5f11f3885adfd9da47e0ba003b0c8993fc8282
- MD5 c5c74dbb463bdfb293e4fec9b8b06d1a
- SHA1 171a3796e0dc6739caa150b95dd016cbecb691a8
- SHA512 3a076d38aa227b6ef81f190d5ea2831626471188f2c527e8dc09ff01c87539f86bd0e0003c7068a751f21d2dc0550e516cc77baa7454abb993484a479984671f
- TLSH
  T17A31BF89F1A758D6922C86502DE6A916C31AB0A3C2980D5ABDAC4470EF444C3F37E7DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral8 behavioral9
- Target
  bfol.me/images/asc.svg
- Size 1KB
- SHA256 edb15e837fa421629ee44640ace4235ba2cb6cd71e898bd0091a91b5c0ab2fc9
- MD5 6d7568ebd564e0b07878392fac409d19
- SHA1 7697383e103814d797261c44ef08a829371d382e
- SHA512 2699fcc04139491e675b82df022a5058b9135b337309c0cd11c4ebddcfa7e6d062378c8e8032222d161844c064803d049b78117ac6ed6c86ff4e7dd80ac47b70
- TLSH
  T1FE31CD95F1A748C6922CC6512DE6A916C31E70A386980D5ABDAC4470EF484C3B37E7DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral11
- Target
  bfol.me/images/bg.svg
- Size 1KB
- SHA256 6c601394389c1bb7d0d71a6f7c3b2fc21dccca61b47431f3e8f4085a588dc7f0
- MD5 bc251c363ad18bccda787481b8b4d94b
- SHA1 02f4af9294f8a90aef66149e8ffc75a6f27add61
- SHA512 4a19bfda695aa53746f11c139e0cd166ff677c2463d3048f5ae89379b0e67aa9a50aa9772d8fddbf5d89d150800c026eea99e966d092817c62ac52470c97f615
- TLSH
  T1ED31C096F6A758C6922C86502EE5A512C31EB0B387980D5ABDEC4470EF444C3B37B3DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral12 behavioral13
- Target
  bfol.me/images/cancel.svg
- Size 1KB
- SHA256 dd7e7c4082e7503d06b2497145e03b8b9e2d20779dc4e90d58158e731113217e
- MD5 56f00c3c244d6d25d9b824a34f768041
- SHA1 a4db2b3827389e2653ecb501f7df226fe2932727
- SHA512 6508c0363f8e16fc022fea32a46130d11a380517521f1b9a492361d5a7bfcb148118a51205d16422df81b2d7da37076d6b7bef17400580cd065e213995fadcd0
- TLSH
  T1C931F29AF56658C9922C83502DE5A516C31FB0B782890C6A7EEC04B0DF494C2F77F7DA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral14 behavioral15
- Target
  bfol.me/images/chart_bar.svg
- Size 1KB
- SHA256 4dc264b6c73da2bd14f8deec1d2bfd54b6b9314197d726504c1e75c8604d63e2
- MD5 4c5ed3f50c956a6d205abc2b6651bc5a
- SHA1 9c867180084dea14edb7e20cc4e568101b52908e
- SHA512 52634237c7cb2efe9a1f2528cef3ac388843f9c98acc20147a18e348b5a6718ac4c0a9223288590ca86ca66e7556bde19a080bbae8ab4e34e799e178af36aadd
- TLSH
  T14C31E085F1A358C6922C86513DE5B916C31970E3C3D80D5ABEAC5860EF444C2B37E3DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral16 behavioral17
- Target
  bfol.me/images/chart_bar_add.svg
- Size 2KB
- SHA256 62c149df4ac53c832319225e9e909102f443ff8280f8df820578f6b0b9f93bc4
- MD5 f7245bc70cd59deab11e83b5d3204ddd
- SHA1 8742f97bcfb15cc62b039fc4a52dcc16734fb833
- SHA512 b6259579554a429434b681203be9b21b1a1d2887c9db21c73e35c26e06b956d8116ab0da14ab49ebf7af35df3e1bcceafe0d7bc8ecbbc454aadc66a29325ec7e
- TLSH
  T164514585F2A648C6812C85A03ED6BA1642197093439A0D5BBEDC4835DFC50C777BF7DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral18 behavioral19
- Target
  bfol.me/images/copy.svg
- Size 6KB
- SHA256 7ba104446c553f02b241964c7582823741a578fad9eb149afa784254eed22377
- MD5 9e49653312297fce6cae7a651a191eea
- SHA1 b13e565e9050fdd645973096a93be7ad3cf2a562
- SHA512 6bd52fa684ac710aac6172c7fa5de31cf9dadb761dcc0d034b62add54cc55892062ed49c369756a8aabbd9c74c92bc99bfa90b2da05f49638d15a6ba84bc09fd
- SSDEEP 96:VkoIanLXDzJYfLuEwmB3OaXnxHTYJ1CkYB8L9I32Q93a:Vk6GRB3OMxH+Mk5yz9K
- TLSH
  T1C9D1E892F36940C4316E0AA0BCB739527208A4D753159847F69E4C34EFD79E173AAB8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral20 behavioral21
- Target
  bfol.me/images/delete.svg
- Size 1KB
- SHA256 8e4878f9c1bcc3cc4b8932c7d1501ce066fffe91ec3a55883ca2ba90e05d89fe
- MD5 810c702b83d4074c9ecaf9780a099d08
- SHA1 ba27d83fcf808500b4ff38bdcaa51990caeb7816
- SHA512 8c3f89fdff3d54d35b757531d3015ba5986cbaa00a3b43d25a475795af1eea4cdb8653077f128b4d33853aaea507208f06b6a3c888b1add15ad598d7ed00e238
- TLSH
  T15A41AB45F1A244DA922C82657CE6A509C21960538588497A79DC1C60FFC54D2B37B3DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral22 behavioral23
- Target
  bfol.me/images/desc.svg
- Size 1KB
- SHA256 baf55c58a1cdd952ec7aa8b944803918b3cf071c21a168efcc45fd37bdc1ebc3
- MD5 71826a4b58b2a5033dd98830b9a8f4cf
- SHA1 a4ae19111e60d1029fe070969cc901193ee9d2d6
- SHA512 55dfc26c6ba715052085c20aeb5fa43607ad765d7876006fced0ba453d563b88f66b57e1c5b3e39ebe22b90869ef681b37b5782b8fb653b9fd34286ef6b4de3a
- TLSH
  T1DC31AE96F1A748C6922CC2512DE5A516C31970E386980D5ABEAC5470EF444C3B37F7DD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral24 behavioral25
- Target
  bfol.me/images/error.svg
- Size 1KB
- SHA256 8e60653c1add32984a73a7922df38ff85bf8c390828133683f6a20ed66707301
- MD5 62f74cc4b01f3d61a8b83799304d9cff
- SHA1 c67de05ac192bae806a0cd8d9685fe9f1b2b7a9f
- SHA512 cc18e30c03b25299fc20a70dc9e8121bd962caad539297448c9bc0a8ce066168302e1bf9b21fc068c213e95f0c87cee9a0326b030c181ddef736861b9aacac87
- TLSH
  T16F31CD85F1A658C6822CC6612DE5A916C31A70E382980D6ABDAC1860EF444C2F77F7D9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral26 behavioral27
- Target
  bfol.me/images/facebook.svg
- Size 2KB
- SHA256 4df65c61b00ac5673220c1e970a1041a9aae62976548d3b9c9b0aded48678ad8
- MD5 dda396ee80580649feb65195106ea1ee
- SHA1 a71dc44077c16bd6adcc6be63d091f1459293dad
- SHA512 2acbc38fd4af9572c60180b8c0d52385a46e26ef81c03f400f6ee751d9745b1702eb923bb7cb6da00f94cb5dee695a10ec78800d2f940c2b55567231153451d4
- TLSH
  T1E841B9CDF56D08C9512CD9503FE2A606831A78A5838D0DB779F880B4FE502C2FBA97C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral28 behavioral29
- Target
  bfol.me/images/favicon.svg
- Size 6KB
- SHA256 da81854b677df36c965d6d49e6d3a9fcc5016ece5a0f42781b9a2855bb1f8058
- MD5 a4c05ab7236d050bca68906e68f98ac1
- SHA1 df213cf73e426ae0bbcb85d61fdccd7de5f38b01
- SHA512 4fc10cb831f78d187e1c0a0ad25bf388b05ccd49a46539f85eb7b38678d6947d865948014ff41be43c912df8506ce5646d867b21a91806453e73e3ce25b75ff2
- SSDEEP 96:VkoIanLDRX79+yhYfLJoMLHV3XDwLBB0PTbBTr3EDcRv8+H9H1v8Cbma:Vk8IyuVHkLmTbeQTr
- TLSH
  T15ED18141A39D90FC626F4A245CE774021B1E68B33311290A7DCD6870DF591E6E62BECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral30 behavioral31
- Target
  bfol.me/images/filter.svg
- Size 1KB
- SHA256 58caba346a3257daa7c87fb0132dce8abb4578843f098a378277e12b88525f43
- MD5 2ec00e70dfbc9ac5e03409b844233c41
- SHA1 4f47f365cb6b933d93c9f6ce5ae332c8684e45a9
- SHA512 c1832b69261e5cc3a52dd312cd4b2797d642e3e14cef77a7c2ef943c89a35855dedcf2e9d93920af10545a2e16f8c97632e65c5a81f60f1b2887984e20ab598f
- TLSH
  T1DE411049F1A648C9921C86606DF6A612C71DB0A382A80D6A7DEC1470EF450C3F37FBD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32