b244ab1c41f74ea8428d718669872da1c8a01b179d11db640ec3824fcbb26c6c

Sharing

Copy URL Twitter E-mail

General

Target
fleusaMola.zip
Size 46.0MB
Sample260820-xwczmatfre
SHA256 b244ab1c41f74ea8428d718669872da1c8a01b179d11db640ec3824fcbb26c6c
MD5 4b2875f4ad7b43d8aa29b698420dd066
SHA1 8652242a2e247c3853b274c2157d3be51893f078
SHA512 00a6e0fb7be974aa3d3606cd33096b09b79a061e599397acd1adac586f2e1eb397c9d29f10e1b3c39adc4b9204e2579d64a70f068c2d6c4c85fdfbcf518277df
SSDEEP 786432:Bo4IyaosJ5DBC+HetCxXW1u/yh5x/oSTmGEoL7bsxSJrzkfnRcIR1b7a34zvJHQO:B77sX1pHOKXWk/cx/oSSe3TJrsnRcIRt
TLSH
T1D2B7EFFDFE3400E4F249CD708946FDA4CCFEB117F64611ADE9C8E16219297586AE1A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  fleusaMola/404.html
- Size 7KB
- SHA256 e934bf588e538ac654567e85d00189599586ff6189be34588186628a4ce4c203
- MD5 2c79cb2d4d2c0a6db9b53c7bce238f7f
- SHA1 47998527ed30c9b01d6cd22c110bfd71c7103d61
- SHA512 d2cdd5dfcf222e8e1e3ab6beda0cb30c1a6a5bd35472e4fbc0b64b83c5a4a2b4c3d8af4e9b7eef102068db52e078734c16a688257948e02fe53e58798a1a8f5e
- SSDEEP 96:nSUYAJsi48c4AqYZCpQZCygD7Y7kGPamrcmTj6EH/DH1lcAu:nSUY0siBYZCpQZCyUU7kGPRDHJKAu
- TLSH
  T16BE13115D8F4217B42C291CA79F4AB1A7DC3C507E60AA021B2BE07DE2FF7E41594BA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  fleusaMola/PHPMailer/README.md
- Size 16KB
- SHA256 caa05a68aa3f84f704b6cce12f13dbab6b5d2fc5726a0013856fec821296abb4
- MD5 98d334900babfcaded4003375470700b
- SHA1 d6bb18ce52a8cee2299dd9f7d8a97b776b55ed06
- SHA512 9eed3911732316304d26445bb289071062bc0b998e9464de9886ec586dd60d6aa70a82567bf10ecfc5b2f5f4c171e65491bc6c0af21f36024bec00c9f219b48c
- SSDEEP 384:GTK8PgawgsFrtZ1QVGzyTbGC19CgG5Nhib2CfxT4dND:+sFAxbTCgqCpT4DD
- TLSH
  T15B7293ABB31006693F8327ED77692495EFABC35C6E807475706F4124C344827FAB71A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  fleusaMola/PHPMailer/src/PHPMailer.php
- Size 175KB
- SHA256 7c5d39ff984172ab7ed3616b762e7506532ab5a2740c54e41ab54f8e83ba3693
- MD5 9df3b5a2d0253faa98d24d1232b04f74
- SHA1 1a40dc5015e656b8207d9942dd7fa67c22a4ac12
- SHA512 0d2dd77554b765ee62c1a4d2734ccf411022d690cc8c0b2991f37f363463fa4dc6b976def00676a5a4e786e28fcd54a47166863647060d12a09add26a4ac62cf
- SSDEEP 3072:8hrIp2Ymh9DQ0qgw0Kg16bhdRKbVk2WYQflav2u/SFBBTTWd6dVOSPbcDkuwVAUq:WIp2YmbwS16b9S6FzTTg6d7bcDk/AUq
- TLSH
  T1EB04B81878E75CA1121360BDABCFA040D13AA13F1579A952BCDD43B85FC4B3CDAB5AB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  fleusaMola/PHPMailer/src/POP3.php
- Size 11KB
- SHA256 2dc0f740d163df70fba15e39caddf9e63c8b11fe44aebd63b74400d1559677de
- MD5 b00389198581dc0f27104b69e9f49536
- SHA1 cdf1727048fb7d515a20eca042620cb5d2d10cd6
- SHA512 ce717bc4dcd38407cbf817c9e089fac39161968d6910a01571d82935f74c4bfb4169a84628dd61c315a2f3a7d382a16d3823970c21b320298a0cee9527acbd63
- SSDEEP 192:LBxp946G6S61A6P6CGCRelnM6V6r6Jm/4KmwgFykjmnIYoHexAuGVw2rfJNVyjMe:LBfI4YwIjMGGSU
- TLSH
  T1C242742C38E34922135314BCD74B9480F336952B2265EED87CEF43782F11B2ADE70A96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  fleusaMola/PHPMailer/src/SMTP.php
- Size 46KB
- SHA256 90d0b7b89bfe25fe1c0ec9554b8a5a717f273e684dcc271b31c34ec756c5f3cd
- MD5 bba41e680ae42fe6fb01908cc2352e14
- SHA1 a507e5125b7809e872b2858665216dca6686eba0
- SHA512 ee6dae05ab4f6f9f460455948628764e119d94218e9007bfb75a8a5be8a36719d0250c8e0cefc823be22d198ad3b7c53ef6037cd91cd58fd8b125bc6aa4859b1
- SSDEEP 768:6fA3/oeQONxzrqIJjXb94a7/qW085z/VxcrTRYgc4ybMI3WU0:6fejNxzrqsp4aDqW0Q/Vxc/egc4ybMI+
- TLSH
  T1E523B84A34EB1976121320B95F8FF080E33AA52B1229DD85BCAD57795F0473CCEB1EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  fleusaMola/arquivos/BI (1).pdf
- Size 549KB
- SHA256 1e42d4127b36d759685ccfaf48f958e2bd73111ed7817772937a181f1f44bec3
- MD5 90e3e410475362c5dd9c502ffc5ac4f2
- SHA1 9faba81d726cc3218f1981874f95d04cd5b64b33
- SHA512 0edad09d22ae8a937ff233acdb923b5b6807f4c8ce80f8011baef2b10b4bab7d63cd8fd71c9fd08d27f394b72dc87b93224c567dde2e37cbdd65c52add3bad04
- SSDEEP 12288:y+0vfRQMHBuEIw6IA/gxyKEPy3vY2tz1Zr+OpXnjtNYDqi0+x:qhLBuEWIAYgPCvPZyQXnEp0k
- TLSH
  T1CBC42331DB602BF23262E32F1A1A7D6D4651E772E32B81029AD0C52CDF7669900DC67F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  fleusaMola/arquivos/BI Celso Nicols.pdf
- Size 820KB
- SHA256 417cf4f4995adbffae7a2cb7960d40a708b8ffc813c4c687724baa19a3bf3576
- MD5 483b09e3c24d88eee474f08284b2ea4d
- SHA1 9603c24085fcd69dbe7eda6243bddc13961cd879
- SHA512 f051925ed3815c90836ea7cc406df6c0d12634c915265d7c23069d4f1e096dbfc5cc7b0958bff72756af3a5bf15b0e49c55bc324924bd71f669b72de99805902
- SSDEEP 12288:5mAMoKhk8gLFn8UVz5XcyBHF8YjWVBzI4N8pYn37OSN1x9aSHW/WVWl:sAMruHnXt5Xc2HmAWVJf37OSN1TQWsl
- TLSH
  T189052307342DF46BD71329ED19DF77AD14AAA71C674523A1370609F3687EE938D8E880
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  fleusaMola/arquivos/Emola_Receipt_PP240228.0956.U47679.pdf
- Size 87KB
- SHA256 5e687a5174a219f3bc5167306f0ce0995aaa681af69d1a3a75d937c79c2e71fe
- MD5 91309a31510121eb62c09eb4fd46aed0
- SHA1 bd22ab4c4f40340df9a67235ecd8e94b75e8436d
- SHA512 713f671456c3780a12a379121c6a076099ea2866bbf140ec2f38d5504a7a2faa767eb25862a562dcf139b53853a9f1e4af91f2d3cc9b36f2350e71ae9f96f512
- SSDEEP 1536:p0pLBdTrq9BfqmqB+ONmisz3dO4LLFfjavtsuG9YfS1ChDcEQ/jrIoux0h:p0E9BDfiKvLQF1GOfSMhDcEUjrB
- TLSH
  T10293F2A7B664882CF6D1E491A475BB592FEC317534C30861AC3C4A3E4167980E98FEF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  fleusaMola/arquivos/FACTURA JUNHO.pdf
- Size 266KB
- SHA256 1c34c051b385ede7f84fd26f31e439997eadf62816749ce15e0106c404794ea0
- MD5 54bd989eb3fec96f6514c6331913080e
- SHA1 2db3da795527ded8cfe5c82863e5f5763182219c
- SHA512 04113722bc4f3ab109fa4f7228f2f13d960770d08dc5191a15bfea915f38605d59b1d17c26f4abbedde5d92679ab43a734e5c37d1a425f06b3db258f6040a73b
- SSDEEP 6144:YScqZ5V+mNWLfoayzpcD5/996Dfx3YGsS2o415vaHyLKPMPlWY9rDDzY:D5V+Jwagcmfxbsr/1sSL8MPlVc
- TLSH
  T161440207DC18A692D44453F83E13AD6C4B963B9CA8C53AFA95E3BECF3A256714C4D138
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  fleusaMola/arquivos/Factura-3023-2024.pdf
- Size 42KB
- SHA256 4cd7bd120f0c6ec7cf51dd1c5fe9bc3972143a30d4ea45826463ec4d676002d3
- MD5 55439e183353a51d4162870e1875d83a
- SHA1 7f3b19344ba62d98e582ca39f16cdf29bb7627a7
- SHA512 e8eb6730461b30ed22655c6db95ec742cbcc3408fbd6c078811279a361787e6241e0234848ad6c08b7e443515a150d49e57b419067f6658c9a1d9026a8fe2c71
- SSDEEP 768:xd6pcF5j+AF8N/37MPteJn1JTzNmErZpX/CRhBZ3BGuDx688hy2yMBcZvwD/RZv:xJFtF8NvfzQuEBTGwxthamObRZv
- TLSH
  T19313AD80650CDD48C891B4338CEDF28EE11B797744F0A460FBB7DE2708961807DAA6AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  fleusaMola/arquivos/Invoice-8812.pdf
- Size 18KB
- SHA256 3dfbfcbbd1ee2b920d8725220bf2057d420bc62a01ef8bd55581bb6dd895eb24
- MD5 c7635bf8ade6a47b3de3426252f861a5
- SHA1 d1f0306ccf32cdb69589fb9788f5f11622b66be7
- SHA512 3cc883c944c0ca01f11e23268d6bae68a5ce986f97b456ee5f1ac8acae838fb1f93719fc62ad8d7914107b3b31c0b7dc9583c4cac47913fcd4fb2325e76b229b
- SSDEEP 384:6TZ6phBoIy3htC5YwbJNUNiDo672f3KDlYDIlYDIvJoYDIwtp:6TZ6p3oDM2qzs27YUl
- TLSH
  T171821880195CDC44D096F9139D9CF688E13F797290F1F481BBB7DE1BA482561FC8A2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  fleusaMola/arquivos/Nuit1 do cliente julio.pdf
- Size 663KB
- SHA256 7e4df5ae1cd3f1fc965cd650a63db9c6932cf6a8b835adfc18d2ce73ef996c9e
- MD5 6f63de31148409cc797eb26cd7702f9e
- SHA1 dbaf555cd383a8f36ebc3649909fbc8697196afa
- SHA512 65cd8d32ed6be85ec253c599ed66ca775548305bf6ea0c8f8c8b02320b82dffd941424fab5e2238de33a5a075bbe06228bbd87137054f555434ef1787c33c889
- SSDEEP 12288:893vFKymKqoBprRKJwgm6MlNnZ7PyFv7TjsZzBlkwhjWZ4g:kcysoRWwgm6MlNnZ765XjgBHjWZ4g
- TLSH
  T1B6E411CB4EDD04B38DD60270E849608A8FFC4E6DAEF517961272487FAD8445E32F8979
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  fleusaMola/arquivos/contracto_Jonas Dinis Chambela.pdf.pdf
- Size 150KB
- SHA256 c881b6fedd6913ac3a6c5a9078a9503fd51f6417dfcf09e8a8a832de822125b2
- MD5 0d44364604015e12c3fc211005639226
- SHA1 3b2eca74a74132dd2f80367a04d7691f2f854f0f
- SHA512 2aadb0b50a146aacab5ef6c697e3082cd5a0e9fb9864fb7504f8dadd910244877f8605da11ae2c826aecdc40b210c5b662f7cc3a0bbc8509e6ae398012b5befe
- SSDEEP 1536:GAEyPwzyPwbPBRONPK0Ve8Iv0QTRNkUm2GzjzpsB/pypdCEeAiqWrxQz0SJOIrZX:iLzLzBMNPKpDcwkUkc/6N01gDr+aWy
- TLSH
  T14FE35E365F9A5A45C9CD166B8390E83261B25FE463261A83FF7D2B1AB3BDC00487417F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  fleusaMola/arquivos/prestacao de servicos - SIGE IPPC.docx
- Size 18KB
- SHA256 a920811ca072505d9c547c80aeca398597cbc685061f36843b438b40b5b45815
- MD5 79432492d7544988d9add834ce1e1280
- SHA1 0b8992f149dc5ba87bcbcf61d9b5ccc7ab731fb2
- SHA512 db28a9494dcf804181795cb91758a4d28b35ae60977045f7c183cd24c6897b893261cfdd7fb25194be8a4c2f283ec9fc16a42fc6c1502c7eee625dd86df91d2f
- SSDEEP 384:/DcvMPkXm33dVh9mGs8EKsh0u13D+2on6Em+HTgGqY2LV95g:J9Vhk0huhREm+HTgnpLJg
- TLSH
  T134829D7AD184B82CC5E68B7CC48D48F1A71C0547920ABE5619F6B7DEC6844AF833A9D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  fleusaMola/arquivos/report.pdf.pdf
- Size 130KB
- SHA256 6330f0a35a70bb9ac0a185ebc91eb8b737f1a17c3ad696a6c95fc4959b2c2241
- MD5 4ef9524aff4749f7874f4b88a0dfc8d6
- SHA1 33ad8943933c55620abb1ecc2603be9474a9c4dd
- SHA512 9f7471b08209483bb7c053c296b7ea04c6c155c89508bfafa7eb5299ada08c4a55385f15ad0372fa7549609f331975f7a8fd4d663bba1e1e7fe324403aad6436
- SSDEEP 1536:SVEyPwzyPwbPBRONPK0Ve8Iv0QTRNkUm2GzjzpsB/pypdCEeAiqWrxQz0SJOIrZ3:RLzLzBMNPKpDcwkUkc/6N01gDr+aW+
- TLSH
  T125D34B325F6A6E85CDCD246B4260EC72A2F22FE4136616C7FF7C761AA77CC00586416B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  fleusaMola/auth.php
- Size 609B
- SHA256 f849dd8e2bee969b06785622be6e74344971ff22c775735ec02165c4374b86ec
- MD5 c26d42ef9085d1c65ae62fe8d6537766
- SHA1 327416c2311f17eda3de6760423ea568a938a1dd
- SHA512 d763bc4bbc20e93dd8392a34330d26b83c258b6b1903675a5ab2d7ffa580d870cab644e6f943b41378b4d477609812df62330b5c24d867ff35ea6f1bf1d85e31
- TLSH
  T1D9F0846A18DB1C1904B2D5441A60678DE8A68503C707931432CCDB93AF77E98CC4BA8C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32