c6e28326c9b4b307b68a77ac0a17764a82eb45447e44536efaabf1c9d28875fe

Sharing

Copy URL Twitter E-mail

General

Target
htdocs.rar
Size 40.2MB
Sample260815-dnb8ksdr5s
SHA256 c6e28326c9b4b307b68a77ac0a17764a82eb45447e44536efaabf1c9d28875fe
MD5 1d0e7f97dbe407e6057a8d4ff1760a87
SHA1 04fb0d6b44441535cc77ef6502e1817dc737ae31
SHA512 9ab14fc704d768edb9e87e16334b1b094788d1f10f77a4dda0a37982a8b13ac695f67c45a459596dc14b84f81fef2d0a2da7bcb409bc9db7ab748eb730f3eaa9
SSDEEP 786432:a8V/cIXXAGCRPGj8wofgXXtn8Vh6w8Lf+DXXmJaTRythxupU/KbPTkZx:aqcblPgefk6f0+CymupUibPwZx
TLSH
T1519733C887F540531B0D383BFFF3A5055AEAC3D24685DD41A81C53EB4E4E97A62EA22D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  1/api/logger.php
- Size 7KB
- SHA256 7de7b2ce211e9e01f86fd4942ca959c1bd929ba7cfbc3c17288fd74647787c12
- MD5 3d4898b15654fc17d31432dea882bd8f
- SHA1 138312db118fae9c6fc31c7e3e197e54eda693ef
- SHA512 60dd444f073ce3f34c78afe4a9538677a7d26d6b453ebf6a0573923601d3d85e50d76b71c70b41cf7487bbdb1218375eddead0e66aadc26efd9d9f3a0859dd42
- SSDEEP 192:/LvngUwbZVXMUf/yD9pCTT/yw0Cr/yggCPWD7jONLVGjX5GGyndZQ+8TyamW:/12ZVch2EBTWCHV5
- TLSH
  T18CF1642978DF48A1D56360298BCFC2E025A56813150F59827F9E1594DFE06BE81F8F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  1/api/scrypt_helper.cjs
- Size 834B
- SHA256 5e0440f3e766ac660d80748bd97db5bd4d2763de9a04dea1909498791f2dfeff
- MD5 1467cb8ff5c7ff53c3fbb56fd7e68efa
- SHA1 4c6af2ebcd8e4ced67da7379afeb2786a60d635a
- SHA512 52e90d9c132ffca4fd447063a78156c49df2d81d1e2a8eb6b5cb422e4f14f8757fcb8020c6946f11b198b3d1f68e251e5dfb76179a15c36271dae78426647c69
- TLSH
  T1BA01AB28386AE69703BEA9844066ED7375FD9340FA07A1E04B28630E0E658A85714E2E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  1/assets/img/icon_brazil.svg
- Size 6KB
- SHA256 4c4a2e93b9aa416825eb17b70e7fed85c83ca0a397ae1fabfe4ead70ee24cafc
- MD5 6e1599ba45b8195a07f0da5721894b29
- SHA1 955f5805b890633c2498454586e485a3323b0d6a
- SHA512 935b23d02ebabc40168aa7d5a7867597279753e34b97f6551f7b9dea6349e27d1200f21678617482c9799b72531ad65382f42aa65edad4338203957ff2fd3d8e
- SSDEEP 96:mcNremLsRL1VwWWmldBqMokN1SMMQVSQr1OHcP/DrxQ4wxpW9YSQGdJL3re:xhwxw9mldBhxnwQRO8PpOpJjGbre
- TLSH
  T137D152A6735421B0FB1EC3BB68E8689A3EA371FF3715806D51A95DD0922369A275C8C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  1/assets/img/icon_dental.svg
- Size 7KB
- SHA256 58da5a269218421be67e432429ac622f0f56d435ecd999e346e0df8cdae0cabf
- MD5 4e16bfe6a4bfcea445ff4fd3a3f5ed3f
- SHA1 c5da32727a8191d36c57cfd87a4343050a2d1f9d
- SHA512 3e9354124920a01626df61f6edbedcbb775018df294b641eef242e40549dd3cb10510dda7dd535ef67b3a6f6222bb30d6f968fe9f1e8e19a1c74b46c49a5a39d
- SSDEEP 192:kNXq14rHc0DNNxfv1GDCXjs0hkPSmk/Myv:kpq1eNH1GeTsckqm3yv
- TLSH
  T176E1C9D6E7B4A0B4F9C74FFEEB24ECB8361574FC26B5C5A08379AD485183AC86944C90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  1/assets/img/icon_diploma.svg
- Size 2KB
- SHA256 cd7dc5186d62053765eae82ed386775a3a5cbe30ab697b9e99ff2c3602637ea8
- MD5 651ad1c3ebc838f7cc2bca85f2a09dfa
- SHA1 071001626e27441fd90febd66ce8e94209140b4b
- SHA512 c060930a3cd34ce2c2840bf31cc694e1973adbcee58707aa64a4ae8f0f12e06c2c743524e8bf3d810eff7c940001acc84a9528f8b7d0631dc0447aa736898dae
- TLSH
  T1715100F05E1CA86DC3874DE28F67BA24230EB0B535E592F0ED5D01799017AE1E903C08
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  1/assets/img/icon_headset.svg
- Size 1KB
- SHA256 5a5f6d60fc34a8e5b861bc2c615a9a24ad49c5537421e45e3fe1d72957eac7ac
- MD5 21744ef1324913d7c00f49c5a3d3b468
- SHA1 5edb0a50777112f58c2db518112bcc7fb3684f50
- SHA512 09ab2a7246e8708fd706e5e45123a9ea60da337877aa3deea72b21150016faf1a224a2ec0c69d732522ad38d51f7f2f24037dac2c01aadba1ae0a51f22172843
- TLSH
  T19D2110A9D36C08F8EB0F15B05AF8BA4F583272C071F584B47556E03AEB056E02991FD2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  1/assets/img/icon_heartbeat.svg
- Size 2KB
- SHA256 e9df6bf4a0e1c7848249c612e28d77234c7e32dc6402b42bffc5839a9fe1a4f6
- MD5 9a2de9d778fba9dcd4bd256fb41001ae
- SHA1 c0498012583fd6de350a96024edf63e69752351c
- SHA512 c5167c0723df28474d7af7c4d8031fcf9d72dabf14ef78cf2a8c8b826e493ce89f626021cfd7a8736a6d05a59d744b3eef6ecf14d9bd126687395f253aad7ae6
- TLSH
  T15D5184C4732815ECF7CE82F7646828A0391E75BF7A4442B993D95EE064239A5BB0DCC6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  1/assets/img/icon_pin.svg
- Size 4KB
- SHA256 4a36246c93f7fa02698f85698a519a68648fcc3362b400b638433bf4f9b5569c
- MD5 54b4761dbeba155ff5375bbcc5bc6297
- SHA1 bc0c8f0be83cd7f69a462bd3f605ce19e431039a
- SHA512 a3cce3aced4bdf94cee6c93d01df34d5726a752d48838f1c96dd6a2fb7524fd4627302dd11088956c9668d158917e7620d30da26fc2c983e6f9f6b2284f3a8e6
- SSDEEP 96:EsliEMYA+V1cAVDZvthRxHwg/+PLQGQ/ILzMSTg:rR4gZvthRxHjGvzMSTg
- TLSH
  T1149151CD360C35E0EB0DB3A70498B4206F3B6ED77347426C69E4B6E0E623657AE18895
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  1/assets/img/logo_geap.svg
- Size 3KB
- SHA256 786d12feae5d074fa1614a284f16c819f7ad56848b42f4593e94bbf4132f0632
- MD5 623938b04c6b9b6d2e0efdf2f33d1abc
- SHA1 d490d86ff53c5db52b08b62b034ea28294e22737
- SHA512 517fc557e7785a4dc9f638bd670f60ff030d98731bd769f40d7e2bacbac808a9344b73cc8163d7816063869445b015e7ce1645d06d752c45d0ae864e6f0c4bc4
- TLSH
  T1AA71975F433C27F89D830EA4867A10A235E5549BB124E3DDCAF3A612B14ADF10574C79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  1/assets/img/selo_ans.svg
- Size 1KB
- SHA256 4084270a4ed28b166aa0169824b14057e6f70b845a2ad3c8352bcc59dfde1e1b
- MD5 55f0987c189609c4dbe75aca771f568b
- SHA1 9dd09ccc1fc0cb422a9a1fc577092ff4e4151acd
- SHA512 8af0860ccce1b01850be469e8fbae44ebaee4e12020bfac566235e65c42d578e4ae99ba13d3a4308d8cddbc940e124252da3fbc3f7e1d5c0b11ff3ffc2802027
- TLSH
  T14841DD5B47049BFFED574A58C7A020A672D1D8DFE030E2D8AAAB3811D60CDC4755C2E9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  1/assets/js/main.js
- Size 5KB
- SHA256 f7cf6c95274a69eccd76ea4e0590fce18e44f45583b130ec565ce204d43dc079
- MD5 8718265156ae03b565c48de235f25c82
- SHA1 b99d569b7393dbacefc5e02a31ff5851aab9db16
- SHA512 77e8854d40296c6b18d2d7e7df1c854aa1748b9744fca85b2fc694785f7e3cf10db2cfed35f66faf06c670729f90a046acacbdcb094bdc9c7416d96b55eb7c39
- SSDEEP 96:X8f9lRHNjv4deHuiOg+FNZEwgSX3mSXE0/:XC9LtjgdeHuiL+FNZvXXU0/
- TLSH
  T197C1EF9AB5E715B25EB338BA7BDF92D0676481039840CE547C1C47500F90FA02BBAFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  1/banco.php
- Size 13KB
- SHA256 afa10d0fddd938c9e493f823540832ea8b565eab714af897c4e02d8a08d27fef
- MD5 a26f20b3e9b2232ac5678c58555786ab
- SHA1 82fda24eca5e41c41d96c9bc33178a2fbdc4aa08
- SHA512 d53aa45137de7717877614408e428e2bb6f50d873c1bbc832878742e58c9bc399dbf83973e683a469525d7d104b82cbf18d6f9681207904445288c68ac54726e
- SSDEEP 96:MHLGhs9uFGN1JqO/jI6jOSZSZS97LhNvy6zgyT5keOhIJ4OeQjHSzd8cXnNSvEC4:wGhs9gGvJnxIIZLPyMTpSzl3NBKjSCFe
- TLSH
  T19652822111F6043791438096ABD65B2A3E95C103FB0E55087A9C27A88FDAEC7FCB367C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  1/bb/bb-pass.js
- Size 2KB
- SHA256 c8eb8ec30a27b509cea252473419aa2a172fb7f8725e059d2cbc52828e3c0327
- MD5 a2f491b1406c48760d36737ee388bcc7
- SHA1 dee95a84a260c6c4eb55cecf6d2597e92ff0788f
- SHA512 5573237656e1f61ba6cf0ebd806a23be18430416714116c3dc3337c5e440edd294d6a1023a6657009284183e775adf9d637fe2d9996c4d315e6f16dda5d656a3
- TLSH
  T12841ED2B79E394B26AAB7A3B17DF9249353144075A4ACB003D4CDA115FB0C601AB6FD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  1/bb/splash.php
- Size 1KB
- SHA256 c7a05d14e2235f100392f3b87e90b0b9f0f8a109ea4042d78bb3b93af83291f2
- MD5 a5047031c8a7be507604dc66a35611f5
- SHA1 d1f8c12bc64dd12633256916500a6d3f8362ed73
- SHA512 74cf465aabc7a5cf46ff2920e3412187d56fe31dcb72aaf0fb4201896b11f204aab6f791d812714e0042e5959efb6370d3553209bcc49d66502f4103c7ccf7c4
- TLSH
  T199211E8601E1804EA222E2884C45FA681EA1942AEB486500FEAD721E5F94AC98877C7E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  1/bradesco/processar.php
- Size 1KB
- SHA256 829acc2e8756c0ac879daa51f10d601181e87a6b15a89fafb9feba314c67e7f7
- MD5 aa0d9ae6d0878b06c66e3a8a94a89736
- SHA1 428a4e4a57f2d3243bc50d5887c3d86b008e029e
- SHA512 75a7b2ba7905a1fc916fef83171e2b6a9fa9fd68994a4e263c9ebb31dfad74616cabceec910648233c3ec9115f8ad092a874096596c7fd9a6edc0500fe3887c5
- TLSH
  T1D63144D24982407BD223D38A2921E6AD193AD64FE744100076FF233C0FD0EF68C27959
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32