757ddd616b64cdc1ed10ad5372e434fba4d4206d091f3a41be170a860943ae0c

Sharing

Copy URL Twitter E-mail

General

Target
machform-4.1.zip
Size 4.4MB
Sample260827-phwwkstgrd
SHA256 757ddd616b64cdc1ed10ad5372e434fba4d4206d091f3a41be170a860943ae0c
MD5 b8843368bf65c9500ad844097d2f53f8
SHA1 da6a1afd55fee839bdbdedbaefc12a240c3eff6f
SHA512 a06feb1ed3f18b3a8c2cb274cbe07e2ded0186ff83309f6afd5fdd0d7b2a2c9b93bd6df7a9cc61805bae7c483abc0c3c4209a8c521fe55d37602a443ffc68180
SSDEEP 98304:8YGjLTYQx5Uww5d6/kXOyRQ7tgMpbFGVmmzLy82wRIUxq:8YGjLPwe/kXBRqhrGVm4ykRe
TLSH
T12D26227AD52B1A73EC53963CF4CE6F02983C42414712B64B773962D5E7BA0E972A23C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  machform/add_user.php
- Size 17KB
- SHA256 a3f5f94d522ba7993f85f0756329f71cccc82b7dbe9f03aacc763c09ffc7ef56
- MD5 7a6c4187f40fd62eb700e056c48008b4
- SHA1 2df8b05a1f0584b04602236f90b4283f94148b2e
- SHA512 32a90600341bcec611e613093e19fa0cac38935b0acb58b87b6c678540972bd4b850b8e1ec2623a8c97afce3fea0f754122813c47878f4e12447f02dd25e06ec
- SSDEEP 384:WZGGUt3i2pGeHmCg/v0xKs8Q7pn6H6XXpuuBIXPc5p0he7VTiTIP+TyXI6XM9DXZ:jHQ8jKs8Q7pnfpkIP+TyXI6XM9VgwRgU
- TLSH
  T14382B706399E4EBA01A2D8D299F007C5A65FC57656410CDBF0FAB17E60DCC1C5B3BEA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  machform/add_user_bulk.php
- Size 17KB
- SHA256 12bc37547f66cac58bafd6a4a86febdfab8b07c55a240c892fba51dd7f651982
- MD5 ee1f359650a1e65d49ced12971d4fdc5
- SHA1 5d6e3e61cc264ef13a7ed3b1b28c52ec9c849fe3
- SHA512 5aa963a461e21d961a336fdaeaa1ac578ed8cdf9f26d645115c0f7dd09fd89129714596b2ff9832e22ced6502e5846c2d1c2a56eee24441e4ad74955ef9c99ad
- SSDEEP 384:W+GZUt3i2reHmCg/v0xjHJVi0efnDHrwXpuwHrwcuhpbbe7VKtTJw2ORRqbrTg78:g+QJjHJVi0efn1hpFJw2/g5Y9I3F+z
- TLSH
  T18882A6423A4E4EBA01E2D9D694F007C9EB5ED935124008DBF0BAB57E90DCC1C973EEA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  machform/css/PIE.htc
- Size 39KB
- SHA256 172eaf95ae8ee7073d7d2d20a11b13eaaf0a355d426f0c839a06296c534db344
- MD5 a219e20e2678b66b24b9067a2e228a8d
- SHA1 a942a10f546102c2e93919992619c28a17d140d6
- SHA512 e43b5a432994b2508434520630282718cf6d2c83dce16f53f24279a199c5588b57216150f33c9ea16309fdb58b54b71562695583ee058ce76946cde244237ba9
- SSDEEP 768:SjRVYqD2v6Bgpcb5J9Ohl9ohgQoieFViNLCZac9Z0A5v:SjRVcyu+b5Dmog1ieFRZp9ZJv
- TLSH
  T19603F81972D2B52B929771B5007F228B773BB4186908493DB035E0E6BD38B18467BFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  machform/css/fonts/Glober_Bold-webfont.svg
- Size 155KB
- SHA256 9b8a7ae92d200d762e93ba27d355d8c31fc61b71e50abd225fb843bd61e9e17b
- MD5 ef2d2938b29cc6ba5b2e5521f761b678
- SHA1 33ba51824e8e84bc420a5308295878e091806b83
- SHA512 ed7a160694fb4715a5efa6cfdbcca0fa649d8b9052f3abffb91d6f4f094fb2d25c59334a2f463e4d9e57b6d0aa70509403026f0f1e5dd72c184a16b3c0a712ce
- SSDEEP 3072:YQlWHueXrUhCZLEg4gNGkUph3PhFeQs4FTxmKyKqvbQg1Y+Btcsr3:V4/EkUph3PhFeQs4FTxmKyKqvbp
- TLSH
  T180F3217DFA9ECAA5C2CD806B7126497172ADE25F06283704ECBCF7F14C042698F995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  machform/css/fonts/Glober_Book-webfont.eot
- Size 28KB
- SHA256 ff09afaf848a9b1daee6f2334e8a37e01cc0248807ed96bc8acc1b44bf60cbff
- MD5 61b05fc985e9f49429c3d3b4b7d62026
- SHA1 8d5df6a6691d15f9c0a2fbcca9cbc911b99735fc
- SHA512 bddbf295915776f5cb76bdcf9cbb92ccec7221dcc2af1da0f37960fd308ce11612a977d4af94540754fc774a2834f966667a3450a12bdba7d54793c99f2c55d3
- SSDEEP 768:4kJUl5KKnmMnhsQzczvrgV+ZQ1b5BSC/bqopeBmHTQ:9U5mMnRYzDjZuSCGOeBAQ
- TLSH
  T197D2D05AA38878EBCCFF55F6681508D08D85D64B22EE4F786C6190DE79B70D710A331B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  machform/css/fonts/Glober_Book-webfont.svg
- Size 160KB
- SHA256 efb00fecec670e3f3a2318c93ebb2b4a8d202038a10f54fd7d7022b0f6663658
- MD5 7d7db23d666dfe633d2165f3a9af9523
- SHA1 990b4b955534f7dbde002837f71f7c1eba24801f
- SHA512 5a948f67d60281e555ed718d829f157ddf4e013af05c670cdf7e67da09f0eb00f2a9c460b914578124782b4bcf6ccd5306658ec80a885c4476ca2452f8c9b5d4
- SSDEEP 3072:v0aX5gTuR+PRpfykXOXgSf/h7+SkjFfuHRFwYc4s5t35njsoNL2ThRbuLP4n4aUp:pMucKzzkjFfuHRFwYc4s335njsoNL2ls
- TLSH
  T118F3313CFA9ECAA5C29DC4AB71164A71729DE65F0A283604EC7CB7B14C04329CF9D5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  machform/css/fonts/Glober_Heavy-webfont.svg
- Size 152KB
- SHA256 dd775ad1627b080a2b789b2bd084997e99e5bca1ff1af3a1faa56c0e3b37837f
- MD5 07473c457d9d967b81a3b03f80fadb05
- SHA1 b4a399c5177b9d52ea37710b8ed25a2c4958195b
- SHA512 6433ead5134677e743538e073f896cf2d2f5b8df0552fbb90caabbda420a4380c6b2bd17a72be7520b7b80b6296c719a6090d34e8af79963965319fdf4db2ee0
- SSDEEP 3072:n7LSN9Kbq4zrLTfebj9hbI9Utl3ylabp4rDirlK1nO/E+VfrDqN7:/SLqDzrL7Uu9Utl3ylabp4rDirlK1nOu
- TLSH
  T137E3303DFA9ECA54C6CD85AB7116497172ADE29F06293604ECBCF7F14C003298BA95F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  machform/css/fonts/Glober_Regular-webfont.svg
- Size 159KB
- SHA256 73e952a66b5de7675c1bbf75958ecdc252b9072297344dc823af6fad65b4b6be
- MD5 25022681f803d41ea926060004f74b29
- SHA1 f6b96e67c71aaba7bf7db4cd676525d12502f6e7
- SHA512 3155077a12018150a97c85d8b37886c10c15e4be165d492866a44e781b2283a87ef54506e85f01dc09d8d02d721b20d4d5467f7553c4e5e0910b2fe0e08b383a
- SSDEEP 3072:XaU7jqQjXEnhHZhpDeptIS84qKkj7h49KF0R6CpsDJvsmb9qfjiR0mPFoiQUOjYj:7jqQaPbCVkj7h49KF0R6CpsDJvsmb9qQ
- TLSH
  T107F3213CFA9ECAA5C69D80A7711749B1729DE64F0A2C3604ECBDB7F15C04228CF995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  machform/css/fonts/Glober_SemiBold-webfont.svg
- Size 159KB
- SHA256 da047f4b44fa4fc8973abb065d3667429496b3598851b1b72f3786d54eeef9e5
- MD5 27c2a84d50aa28fd6195ca4cdfd62c10
- SHA1 b7655771891cf52d1736773cd8a38757c3e730b9
- SHA512 cfafeac19b84c0b453d47c325a6948df77a9c69558e353049928a40fd9b688b049a0d146a338f26956e8955973b8fe2281aa6a1b6fd3f548d701a9449dc1aacc
- SSDEEP 3072:1nZOYRZuyHNeb/rBwGOk+mikjSfdPlFrdTC5x0TvmsNqUjbdhBZPlsBLUz:JRQyezQkjSfdPlFrdTC5x0TvmsNqUHt
- TLSH
  T12EF3113DFA9ECAA5C29D806B71274971729DE29F062C3604ECBDF7F14C052298F994E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  machform/css/fonts/Glober_xBold-webfont.svg
- Size 152KB
- SHA256 58465b41b17a355e01019d152c77202b00774e9a9d93086b00bbcd7d9c409638
- MD5 b21ad10a4502a8c717a228d0e6f2803e
- SHA1 50984ac337f08c34c4990ce2b3fca06c9fd7f2ac
- SHA512 6d310146a11eebf9f990a34fc5bcc984b2745596c7e6d894d006cde4c5e1d6eb5af2bd9100efca1cca94be14dc1c7ca90436405fad46e49dd9a2f9d871ec0d88
- SSDEEP 3072:W40RneBxpQPDWdUr++VTlxJC2Haqto1o11Q8OUh9UMTCzh/eQF4r0Yxst1rQEsC9:cRuVk9UMTCzh/eQF4r0Yxst1rQO
- TLSH
  T159E3317DFA9ECA94C2DD806B7113897172ADE29B06193B05ECBCF7F14C043298B995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  machform/css/fonts/machform.svg
- Size 32KB
- SHA256 da6fe319aa89e5c36368471db6447c1f71b12a0fa01c0ad23b9614bbb86b39e7
- MD5 e9b5e16307578fd2917d06b374418552
- SHA1 2f72260085f3df8338b6d7aa22dc843854b6177c
- SHA512 c26c59ca2c8ef5e9d638bbc98566787736332eef6ef53c7651cae95205905294cf81ca42f6ef86d28b609acd7a821445c19befaa2360784e88779eaf4a155dae
- SSDEEP 768:Th5MubKA4VwYRvjloje3n3bFi8c8uKeEGdtK3uwqYVLak:thoCYloj21DeEGPQuwqYV2k
- TLSH
  T1F6E2E7C4FF34E5B8DAC98BD6DB381DFC297995D925620834A73963A4168330EC68E4CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  machform/css/index.html
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  machform/data/index.html
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  machform/delete_live_field.php
- Size 20KB
- SHA256 20f538538d69adaec149ceed1351cdd91311b98d6a8021f74e60effd5e485a78
- MD5 31d302001eabf5281012edaf3512f746
- SHA1 be1aab0b32489c839b9d58aaaade03df3acf584e
- SHA512 a89f59eeeef7a263af1ee0cdba6f924f9eef51b1e15c1c2b10781115ee7c6f83c9e2575633e5b77758551f5bb8ef114b26e02c702135009c8b1e573f6ea60444
- SSDEEP 384:l6pivN4nyROqiTCV8CLN5WmZIMHt/HYyt6zjt/jDpy8181Apy818IdJ6+wcFywhW:Rqnaw/bzJDp/ptFx62buNW3d3bFHpPh8
- TLSH
  T18E9210123A6E062694BE945BE57704EAEF2CC67131C11BCEB07F36C50378D2536DAA6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  machform/download.php
- Size 7KB
- SHA256 fca8d72c1297a156ff54c1ce8e67dddcca4f62425e73e61f24466e11f9476970
- MD5 eb8633c0d5dfe0de3dcee1705b96a07f
- SHA1 af3f56481910408c42ade964febc4c6138b47524
- SHA512 cf1a48e16eb1dbdb40146598e1e9fe45448ad08330a932a67c1670e1e5ae20dce818ab0abe69e3887d911a3e9ec1e7a96a52cd48d83dd1ceedde5f10cf28192a
- SSDEEP 96:mg3G9gLyAwvWYLgtvGCOOnU4bmpuwhCSVuz:l3GyLvweYctv7OOnUAmpHuz
- TLSH
  T105F148C4EB1F1C920A73B078478B90D52626111690846D997C8DF2BD9F8C1DAD5FBBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  machform/duplicate_form.php
- Size 18KB
- SHA256 c22f62ad34206cd083ea69f659cf606cf1ae9ec56871654a514aa8c16f2ef15f
- MD5 a0841eb7fcb6ba6d8afbeb7da99eec59
- SHA1 c322de5677e1e7e3130081b02956eb85aeaab64e
- SHA512 cc96d0d5ede8993fc870d64387e99511079af45bdbdf172f2a7671620e410fcbaecb19ad55dc051f621fdfb76ef50afc7e68dae6981f1307314f1048aae11496
- SSDEEP 384:Yhj6N4xNBRiVhfV/qgyp0s+nXRfvBkkfvBtYfvqao03FnSRfvf9VRvlJbfvOtQDc:Nyp3+XBaoaFShdmVryDrrZZnCd
- TLSH
  T1B58288023B1D5B50C277B294F9FAA0CA9E2DC0753A8006F9B43E62D90276C9FDDE559C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32