709f37f96fa5d7e60c9e746a4dab7eca2ff680f444a19cd04eee423307bcd9be

Sharing

Copy URL Twitter E-mail

General

Target
santander_code.zip
Size 46.1MB
Sample260816-pl1c6sxeqd
SHA256 709f37f96fa5d7e60c9e746a4dab7eca2ff680f444a19cd04eee423307bcd9be
MD5 228c1ca8a4ee32a8b22c8bbfd1ff8f59
SHA1 8e71d39b031a8c08e9a5e4d58a281eea31a261e7
SHA512 5078444c57728f4a31014a73f55477c7cdf5a579e08e7fa9ef0d316a158f6351754278bda31238e342fa398cb7dc85a35a5c7b7fc01906956bc1783f33b14aba
SSDEEP 786432:lsNKyWLpEgREpwqtQoiGxu9Dia5bWf3mOAj3RvAA5s99e5hYbhxVrB5abjKnO:lJyW1xvo7A9r5beQ501xZjab+nO
TLSH
T1BCB733348FC80A1AD2665378D3A9CD1FC9C5C754E116D83F3E140FA95D98680BE6AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  santander_code/foxtrot/access.php
- Size 2KB
- SHA256 e74c5fb5fc8bf8d0eb55bd34c86d77f6ef7a8cd4891aae903154b48f47091d9f
- MD5 8deb07965edb9799f602763af749c99f
- SHA1 bcbe9eed70d68069a4814b5e882753f7a44aa559
- SHA512 1bff52a7a9872d1e7c47b725ba9b751971fe9949595931943e8bfe491308aa2dbf736bca27d0fd35a50c1b618966418037b9cc597ee12b7b23b57f6a3835de5a
- TLSH
  T110510F1528F28E23409348D4DAA1FA1A7EC1E613D557D8C4B0EC5BA51FE2FC78D4BA68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  santander_code/foxtrot/admin_auth.php
- Size 525B
- SHA256 07f0c71efbb5f5654558a9851b30ef19fbcf4011e763503b3461bbcd548ee1bf
- MD5 d18e4e96d6779f2d653864e68ec2e04a
- SHA1 51293f8a757f6f11c5c1dba05368bfc1c52a3f52
- SHA512 3adaf99b06eeb5333e7ff6d2a512152b2208f670f81aa55d5d8586b5145a69af7adb1ad14efedc4884bf90ca9f676ed235d4d0f1ac0977ccb3206ab9dffde7ed
- TLSH
  T1C3F0ECA574F39620E3D778291B0A845471AAC5035508D900F87FA3C07FA55ACEDB4796
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_444444_256x240.png
- Size 47KB
- SHA256 a86160432480034bf356c60e113dbd6a253ed5cde6d545e54ddc3bdf9274fa73
- MD5 baf532dd711c6ac4ab8004e14f00cf9c
- SHA1 c24508ab9422b267e4d870ac3d0549d8247b8da7
- SHA512 5b3c0ddc3931037cb3218701dfe33de48683f2b9f530d30503f9d6a56797fc3f3698ff000dc5b12f7a2acff61568782253f9a9dd266baa78b016db9146f6554b
- SSDEEP 192:vTnCamW21OfZ26uIDDNrQWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqE:2auIDDNRNwu4NLoNKwqWvcM7zjZ2NBH0
- TLSH
  T1282300E1A181113F809351E6A530EF3AB2D2E764EB679442E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_555555_256x240.png
- Size 47KB
- SHA256 fd5e3d458b862b7ec9f6a4117dbc161d3644ae29ef523dca39481fc0d1d72a2d
- MD5 02300251819949006a1d180d74c2cb01
- SHA1 38071e2e3e06c74fa81f1ddc6dffc0394a399c39
- SHA512 5dcd5c772254bed2a215e9cfd53910ea6e854476c5b6782be33c1509ad226a16b0690dee7fadaeebbee7a5dde0e353d760e9f38f2f115c1c4f470afada70b42f
- SSDEEP 192:vTnCamW21OfZ26uIDDN6QWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqe:2auIDDNsNwu4NLoNKwqWvcMdBl34N/HC
- TLSH
  T1E02311E1A181113F809351E6A530EF3AB2D2E764EB679442E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_777620_256x240.png
- Size 47KB
- SHA256 747d73d7f14cba33e0fc464f8d11e6a9b5d49cc6a863a48f097b2798d322b4ab
- MD5 8a2bbebc3f84734712a075fbae619446
- SHA1 58dc19a511edaa1c762820ba8ee7c98162ca04a2
- SHA512 d197661fff4e50908c76c7f634674eddf3726e1529aee991d9bb0b1f5c9d3a98cf89be9579865fe675d8d9e9b97b3a7d64e19591c0f14384a442b061f1fc3940
- SSDEEP 192:vTnCamW21OfZ26uIDDNzQWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqy:2auIDDNJNwu4NLoNKwqWvcMxRpfQRzHW
- TLSH
  T1BA2301E1A181113F809351E6A530EF3AB2D2E764EB679442E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_777777_256x240.png
- Size 47KB
- SHA256 42a990a7d0a7b3274ad55dd3377e5d6e066aeac01143f45d2cac52a63c087963
- MD5 8893d05d593420c4a949e9c4e9bd6bc4
- SHA1 5fdcdbda9e6d2abf2f67fbce77701032745bda45
- SHA512 080475020549dca359033bdd9e3d3af4035e245a8046f50fad3a4ca0f85ca52064ba0bb1d5b93fc69767906d17338a4d13cafd5ecfd0fd9f52e8c71707682613
- SSDEEP 192:vTnCamW21OfZ26uIDDNjQWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqd:2auIDDNZNwu4NLoNKwqWvcMgYYadhaHN
- TLSH
  T1732312E1A081113F849351E6A530EF3AB2D2E764EB679442E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_cc0000_256x240.png
- Size 47KB
- SHA256 2dcd9d517698d9c2e9ce7864ee6587042a11ca9518e3ee9fbedb3ba1503b5965
- MD5 062a5148677a28d55cec0d24e7c2b4d6
- SHA1 1e17196005fe419b5fcd6d6c38eb1bb26b08ae05
- SHA512 9a8a4725364c0b1a97ee84878d10ceb1a513f56d9568f3f6a128ce88001e1d2c2dedaf6e9d39a3932979be4414c37572cc908f7015a150f96f1aafeaa5b7e6af
- SSDEEP 192:vTnCamW21OfZ26uIDDN4QWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqF:2auIDDNuNwu4NLoNKwqWvcM4wAyVxCHl
- TLSH
  T1BE2311E1A081113F849351E6A530EF3AB2D2E764EB67A441E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  santander_code/foxtrot/assets/css/images/ui-icons_ffffff_256x240.png
- Size 47KB
- SHA256 6fbfc52c8d242a0b0da72e7bb7ba157bb0a8a5d3990897fb80d875a9af974814
- MD5 ba916f551a3b33d9b04155749f8c0fbc
- SHA1 65627669319e70b052eeb4955ca490a88ca3e695
- SHA512 7a5562b855bc56428fc22c766641b3a939d6c764a95ed322a1464f89fb3bb14b20799f92ba0d52574f644f997dbfa6647cd60e207910f4871cee473ffffa2a2e
- SSDEEP 192:vTnCamW21OfZ26uIDDNiQWNwu4NemoNogIgrsxzv5UOtQXKORcrPA+kRqHDqhLqk:2auIDDNENwu4NLoNKwqWvcM7rDduJBH0
- TLSH
  T1642312E1A182113F809351E6A530EF3AB2D2E764EB679441E3F9B7EA43C1DD2FE41254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  santander_code/foxtrot/assets/img/pos/icon-table-black.svg
- Size 1KB
- SHA256 9e4d7eb6fe732a9ea3fc0ae49b15f37f3f98365781d58338d5d1a8898dc0422c
- MD5 16c48792c97453dd405571be712fa0d7
- SHA1 b776c54a5ac6277b9462bd03901c96f2c585b045
- SHA512 347d74f7bc34e49d5646820d46e62de0253e6dbc6a2d2b731b7945156bc9940fd40f0febb849bbb769e257d287db3d5ef431316af9b2b357329891bc96fe0902
- TLSH
  T10131E108025DDBEB1E6C6628DCD04492B6524E4295F4F2E5BEDF0A1BA95D4C40954FCA
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  santander_code/foxtrot/assets/js/app.min.js
- Size 25KB
- SHA256 05aeb73c44291d38de12323e398f18e79cec0c65130b334ec1d22861d03d379e
- MD5 b39191ac0839e65d09d7d36d3d34c2af
- SHA1 575d291742a885f3966c85f806d1f15b33359138
- SHA512 2c7408ac0add1cdfcc7f3dbc93f40880b9c352eaccc3e31a26ac051819bad432a6ae5b45bf73ccb48197fccafbb7e9f98a42fc030390a2c9e97941887019adb6
- SSDEEP 384:3Ej9TYyChymagg2IaDZzOgj00oUcKl9XFzy5aYyWNC:Uj97jujLnBp
- TLSH
  T12FC256A97A065AB300F796EE52C9DAC172712CCEE6462438617CDD481C5885B13A2FFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  santander_code/foxtrot/assets/js/demo/analytics.demo.js
- Size 5KB
- SHA256 c03446634da43bf11ed686e4d8947e86a0c99f02d07d2bb6019cef9e8b886182
- MD5 2f68545f3f0ea9507c1ed4e76396758a
- SHA1 8edfb7a0576d100739fb63b920e7f455a6697809
- SHA512 564139a07863109b8bc21005b025502dd42a667ec368c02352350dbd30abf389f6ec706916e1db0ae7f5b8314045e798efad4579d0be04f546d13c2cd641cc90
- SSDEEP 96:TscslrbuS3lRk8Pq4RFMMP4w/D/SS/r/w/T/tP/M/KR/e/j1h4kfn6iK:pw0tk1nn6J
- TLSH
  T197C1AB9EF4A8081FA23B8AEE3271DBCA46533160A8D76B1D7EF794741D517082C76E07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  santander_code/foxtrot/assets/js/demo/calendar.demo.js
- Size 2KB
- SHA256 49b9584b6d6cb917f1d7a7ab0fe72d412f66b75f08e893fcf6179beaf81f3519
- MD5 310de547ee6f19c4f8b04fe3c578b4d4
- SHA1 fab7bfb1c0e5c889b2bceaef09adb4b202f1e935
- SHA512 97431250b9a0510959b994fd45631442f796a9813435abb88f64035c71bfca1522dce4b6e6a2a00c5870c9bd827e2ef7f74676f670e810d4893fcc7e10a8c43a
- TLSH
  T14D518C6B84A2057F4B3F136C80E7EF6111A2A0EA18CC6F15F981BB7048C1972B539DD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  santander_code/foxtrot/assets/js/demo/chart-apex.demo.js
- Size 16KB
- SHA256 2dde4f215390986803ad5e3bf5b6550533ed451850565419abc810457530a3b7
- MD5 131d1bb5e529760107b96f5364f78701
- SHA1 9987ee67ad537b22423ed76e5b9962dbc748392c
- SHA512 62523558155089bc771478c5722eaa163088216ce679d8b2696b899daeadd6fb4eb39b44ad55c0a5fdbec8a575961ad0b54339db9f1f7686eac518415942d5f7
- SSDEEP 384:QaPXAuizybU94BHvOESOksv4xwi5EePOwC6WXFBcIylV53BLGhi7TF5TbQKCN:QaY04os+B6WXMHhGKQFN
- TLSH
  T1D47286B5D0B149EBFD3B08CD6252BA068462FD2D5CC38EB3F68E66344C84910A66EF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  santander_code/foxtrot/assets/js/demo/chart-js.demo.js
- Size 3KB
- SHA256 7e1f75edc7b4d4427114f04c04d07efdad9a02f959b4671bba85b8ce04d31a5d
- MD5 cb557bf99acebb4f2b849122ee2e94b7
- SHA1 80f33f2629881e9def592064fa420620a181c9bd
- SHA512 2d2accc608d370b1ab1ecd65061514181d13cccc80127e9cbf60cf440a9b7eb2329d08cc040606dd107516e04576bd14c1d101311f2dc2b659bd2244d898e8e1
- TLSH
  T1EC819EFFF0E15916A63716EFB073C64606637080E8DB5B29EAAB98740C717496536F03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  santander_code/foxtrot/assets/js/demo/dashboard.demo.js
- Size 8KB
- SHA256 059aac80d032ef630fd4750042eb5b00b8d3541d6da9046a0ba2eb1d998143c3
- MD5 74af23a9263f36ae4423e1fc1f2f77bb
- SHA1 8a70cd24e5d454959f56ebd0f0c3769e6c01e497
- SHA512 2b3abe89efb10b2d2d529891484bcc0806d2075fea8514395018036c87e162f7e5871a7c1f481225c493760389fd9c64aa715c5020bdca2c43370ab42da65468
- SSDEEP 192:19+zVL/8qyFX+NKa8hFh2wWEquxpi+C3aBaNaoqwXm:19+zZ8q4uNKahZWpiX3i4aoqwXm
- TLSH
  T18B021095F4E20E5945EB86ADAA9BDB0536F33F83E1609ED2F5016C23C461A077239F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  santander_code/foxtrot/assets/js/demo/email-compose.demo.js
- Size 909B
- SHA256 434fc8ad85b45f70d5293cbc13cf6e6dedde86a3fc953ab00316351bf1353266
- MD5 3b163af5cd1b50b778b9c68b2d959564
- SHA1 094334a3eb17f62b2367de58a4ac5d3d27f810e8
- SHA512 9dfefdf1c950137bca4008f5c2fc579065f4e4bfc458c99e35645064aa0ac4229db6ec18fe17a54fd764db460f85d350c6d5be53b84ff15ddb4d95b14062db23
- TLSH
  T1CD1112581F3D13A596416089392ADE8907683B003F80E0FEC9AD958F5617F0E69E538E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32