b2d43836d7ab4086fce4d9e384fd8242011a982602ec8c5328b151ccb2e12d4c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_b2d43836d7ab4086fce4d9e384fd8242011a982602ec8c5328b151ccb2e12d4c.bin
Size 1.5MB
Sample260922-strb1shc62
SHA256 b2d43836d7ab4086fce4d9e384fd8242011a982602ec8c5328b151ccb2e12d4c
MD5 54974cae2982f1ea9472e450905dd85b
SHA1 1b67242e678544863b2cc4c44e548a763ff043b6
SHA512 582c0e3b1085b8ad423da12930aae9cc3514676123526ff60b6105267e4ae5f85d6ca2651920523cdbb1ddab4e17fda5ffe2bc3580de73156d15ff15b9eb6fc0
SSDEEP 24576:Qv5BF5iDjrkDjrHvp7CVAlE5UOBWgaBdWgaw++T++YcSnlE0WwPks7yOZStsTLwz:QBB3nvp+VAaUOSNfTfYc4PV7JKsTLwk+
TLSH
T1F465337E36778560C14D903895EDB6C981AABAD9DE0D631358106E0E4CB3888FFC2BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  connect.mellat.php
- Size 4KB
- SHA256 3fa018c8590375b7bd9a79e79beb453de38beeecb7e49da97aa8b5cd13c44a56
- MD5 9922fbbc7e3497cd9db25818f554da15
- SHA1 897fed23f2bdbd9b65b27c55d4d4c881889d6649
- SHA512 cfcf7cd0f7f3c6dde3ed956d378824ea03f798eab5bd8012d6bef87f7a6f67f1359c8fea525f7f459a6cd8d9b7d2a8854ef4d42c102b2a094d2be89bb6a8f20e
- SSDEEP 96:1kMtDNhZJ0UNR1xc6PM/bt9at/f9ov8YnKiqNz84plSySi:vtDNzJ02RzIit/f9ov8YnKiqNSvi
- TLSH
  T1AD91A745687A042490E2CAE7BDD1A3053429A34FAB41C649B5CF12B5CF84E9225BBFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  css/fonts/woff2/IRANSansWeb.html
- Size 30KB
- SHA256 224e0a53fcc1456dbe75f0ae0bd200131609055790eaa109222ac0d0b8045a5d
- MD5 c6f46673e2449eb071e2c098c5190c2a
- SHA1 d9ba337d1d40aaeb82e51906ddaa0492239d291a
- SHA512 785bb16b33546d5bb0d9b9c5cadd69c8e4016521541e1cceccf964abf3858cec6a232a42cd386f73bf513b6a549705faa4e6cc1676586f711d0ba8660cee7070
- SSDEEP 768:lF7mr8mz60mCTXpVIAQfwkj3TQMfWoqClQX4A:n7mr8me7sXpV2jDQglq
- TLSH
  T1C3E2F128F9A1C859C46A4BD26CBED642BBC90BC6C70F76E57553CE1E4C3E4C44146ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  css/fonts/woff2/IRANSansWeb_Bold.html
- Size 28KB
- SHA256 ca1fe702b020c3d4a4c2ff5f2571fc85f9166d0d02339fd59765a2d3f55ce180
- MD5 6ec03a37e370c0d7f4f6bbdba0feac23
- SHA1 adfc091b993c4d39a2d771473b918d7fdbb9302b
- SHA512 ae90175205d31e863d6ff2b930e1569f906cfc243591ff64d6ecd87c8398bb41b48c2bba15415977c796908ab5313863ff7c01fed9f8b194c856688096113645
- SSDEEP 768:mRxMclQ5A6Peexzu1TCWSLTopdA86omC5nHJK3ZYE:4+5NP3du1TCwpC8jmC5nQ3ZYE
- TLSH
  T1EED2F1D35A7328CEFCEBA822650F9096640B173F17F7B2649AA47450BDB2DC548C3932
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  css/fonts/woff2/IRANSansWeb_Light.html
- Size 31KB
- SHA256 6aa81aa885f0548103814374c70bf35db500c29f4b1f58703b750f4bead65798
- MD5 414e7148a634bfc82a601e3dacf84e96
- SHA1 34ad3aefa1da8949aca7c08248c9a9606aa90c69
- SHA512 c33e5657c74eab45043640e77e875dbea61b3c0f6e953c22556f64fe4792e1213da63ca39d36cf058c3830300ef7b72e6768cb80e125619525b69cf8713b7378
- SSDEEP 768:U6tsGeLSGeDcvl5sN7uvByzed2X2lpbY00p04EsyfKv+nk:rtsx1Rvl5sxayzedpFY0aH+Kgk
- TLSH
  T110E2E1C54024982CFB66407CA586EDC63B6E304B51DE8AE20DB72F3BAD561FD0E439B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  css/fonts/woff2/IRANSansWeb_Medium.html
- Size 28KB
- SHA256 f0df32a86465d005467a3db05aa101c6c626df4d02830d4da2ac696da8a7af93
- MD5 bb6a9fe5edb6791184821d992bffdcf4
- SHA1 675eed1aa8008c971b9748fc722bcd83469b7593
- SHA512 1664a1ca5f8bc0fdf911a4c13c954542f52aaf014079f8a2e4ab95a38e8a448e6d0c27172797cfed4a6fb956485031a1340955456ab28070f88d3aa605d8fdc7
- SSDEEP 768:19NgPW3Skxd3Mq/BvvBqTYrzFcO/jw81afmZ6P:7NgPeSkvMW3BqTYnFdE8gfmZ6P
- TLSH
  T125D2F2F748B378A8E745A05ECBC78615DC44F237F8D5EBA1EE2234AD098754B8234E24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  css/fonts/woff2/IRANSansWeb_UltraLight.html
- Size 29KB
- SHA256 2058fda079f21b54c31022c6f88179cfb8fa290f95f1ffcc84233dfeb75e099f
- MD5 5010d0152420ca7bd3acb1a9d668a57e
- SHA1 b26fd95d7cf4f167223fef4040790db48e35d0ca
- SHA512 4c53f258a9f4b2924ee39787f6d3becf1005b845a3e4b0d9d6dfc7fa929e1140de9ecd671c1f3c97a2ff452af44d09e056da41f089f7ae879aca6a1a77efca90
- SSDEEP 768:MsVzCeaniXSg0HRfBX6eqTkoU7L4aoewLStVRrF+xgfIJs14bfp/O9:MczCeanSSRRfBXR7L46wCj5gGIrjpm9
- TLSH
  T13BD2E1838D2EFF8BE141F4B201222584507A4BD1307DA71A803B3E64C7EE9A61BEB355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  data/confirm.payment.php
- Size 6KB
- SHA256 f896f0af3d07cc620e3002a58760e0184e1b29e4e8960613b15c75f2c48bd805
- MD5 8b7caef6ec4f4e3f0704f0de7cef9785
- SHA1 13dfcd59538912cfc79a9bee1b1aa678dc2a55cc
- SHA512 5c6ee5c374ecf91b66d6849fe5c9e9275b627ac3fe5ce57410e5e4b896e59771890b49f4e4e038dc499e00498ebf9f9663610451dbcf12135f6c9ea49a02c014
- SSDEEP 96:x8cRE+EAGXncMh6Zh6tOX0ePIF9WOdxQ/fY4:x8cRE+EAGXncMh6Zh6tOX0ecWOA
- TLSH
  T12AE1316558E85C731133C1965092771C7AEBBD2BD2869840B3FF49EA5FC3E83D907A24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/connect.mellat.php
- Size 4KB
- SHA256 cbf68c538e945026a89067809e028fe726d166433412bc3883341b10b9eed0d4
- MD5 a60798ab64f94499b10e2dd6eac7a20b
- SHA1 d165ce8f0dd299be8027106ca873cc07f81fc93c
- SHA512 77fb9e8e725d2d65458095cea5cd5a02db7ac6f36e064b0452ea525c3e269b071a3e0b3cd391ed350195c971db6199bc635c32733f5dafccc33132031ece528d
- SSDEEP 96:1tMtDNhZJ08NR1xc6PM/bt9at/f9ov8YnKiqNz84plSySi:ctDNzJ0eRzIit/f9ov8YnKiqNSvi
- TLSH
  T16D91B845A87A442091E2C9E7BDD1A3053429A34FAB81C549B5CF12B4CF84E9225BBFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  data/error.payment.php
- Size 2KB
- SHA256 eee8d0b1e9b70590de797aa8596c7ba5952fe9d720b48778bd75659f784f9773
- MD5 64627535315c1696e4377bffa1fe5cbf
- SHA1 fb5a3c565b8c4033af74d53cee7cd7d94168104e
- SHA512 82db5a88e06f190181b9b08e5122daee3cb803451a0f36cd97725a661dfc686cda4c71237d55bf214a18275e99dcfc5614d0ebc537e86b1cb51adfdbc730d719
- TLSH
  T1C251EBA508E419B70173C1436450335DAAE7EE07E35AD450F0BF479AAFD3D86E903325
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  data/payment.mellat.en.php
- Size 19KB
- SHA256 a0744918a364aa4cdb7869c16d17162a865c392f1c08bee363481240abe5e178
- MD5 2468e2cbaf3f0d232f0cf74d0cdd3aff
- SHA1 7104e46c8a620e581d0c4a02311081c737a9830f
- SHA512 4791a9d7d21fe8e68ef33a723d31a85ba4ec22fdcda57a65ac8d449e8c302e42a1830f1c99d352e426a551d937aef91c32aa06aeec3c4d4eefdfce2245a8f00c
- SSDEEP 384:gq8grdaKJWfsC6Zgsw+GHs0qPsPvX7srKQsRtLwujC+SI3WIPrapofutTKeFI6MD:3RBW1n55K+
- TLSH
  T1A0924061B08C59370073468B10B66B46F5AFC972CB521019BBFC2AB33BE7D53991B61E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  data/verifyphone/img/ipg-decline.svg
- Size 834B
- SHA256 1fdfd54a0972f82f6a3b1598b4508bd642a1d37d563ead9e9e730f1edc29ccb3
- MD5 f03271b21383e7b5e46a330edeb2c4c8
- SHA1 8ebaffad96d40e96944ced1f675dbe030bd4a549
- SHA512 fa2447075ef66b22971816ed43125568e902510a28fc93f4990b5086b9a8e271756e474c702f0b464f486c96680dd91764dd0bb5031c66bc79b8dbe74e292afe
- TLSH
  T142018EA560FD4828E5030641D7C80E48572DF35783474A5E73DC34A18F70556B9CE35B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  data/verifyphone/img/ipg_sms.svg
- Size 2KB
- SHA256 60cfa122fc2ef0d3a16def27419770746cbdec414998fd2b42e04cb2d28f2fb4
- MD5 3b73fb7ac62e1f4110a5ccf708fe6933
- SHA1 cad0c7a8322c582a4dbb404dfc4f3c4793da7db2
- SHA512 8d63405318ab6cb41f109ede031951a42207c2d9ed24bbcafc9da69c0d5e29d73ed110378256f3ceeecd25b1ddd83c79a3161858309c56070d0a8b4d194b571e
- TLSH
  T157518EF623FE8A80A453E39277C595A04B22B1FB328315B8B3DC71A01F455BB3D02B65
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  data/verifyphone/img/papasi.svg
- Size 1KB
- SHA256 c6de2a54114f2d97ec8dc56069ffc3d6bdce5256a64467f7bc10ff94b17df5cd
- MD5 56797b5d38de6631eef1c958bb97b0f2
- SHA1 74c4a2cf221ee0afa523fdfbdc493e12f8f087d4
- SHA512 00718c7795b94ed2df6dce5c509f02aefa71d29eca76fc619dc3523c267f0e4502106bc74b09c8bb6dc22a4aa1d913f683593d0d8f48914c6dab6446d4540854
- TLSH
  T1143146050545B9FFA821C7FDA2B405E775E6A8DBE130729459F73437A32D8E006513D5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  data/verifyphone/js/bmp.js
- Size 17KB
- SHA256 a5bc6db64dcc5b4bb7ec80ba035d053928b53e4d9ed8a1134c9569de4e45b21f
- MD5 5c756bd8ada8e240700af57cfd03457c
- SHA1 611f992af7f6de7da0fdaab6a916a9f93cc991dd
- SHA512 2a8cafe25afb2bc94cd5cc5c84d9749925294052ffe4d39ecfd04278b112dc7dfdb0c2eed8297c93ce5238e57e37c1daad2575c24d04806ed1c25046ecf442cf
- SSDEEP 384:hnllSfWrAoH3Ka081R1uiaWoyp6kllyocqw7KaV:hnLXrAoaa0wXaWoyp6aYotDaV
- TLSH
  T106820955B1903AB147FF16FD30E72386B5B08D82D5009520D2BCE4D12DAAED9867BF8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  data/verifyphone/js/inputhistory.js
- Size 1KB
- SHA256 3c77768b1150a25e88b68648b24bbd57468ceee6a296c43d555e39d774763081
- MD5 e1a59fb2f5f6f919144eb2f8fb5efd70
- SHA1 a3ba42df27b372b5759295e385c67c2d3f130b37
- SHA512 93472e52245d8757dfe2d2252e0ee69d288fd846ba4b4c34eed8deb6a117fddfbc828651311b515084fcbb917d5ae62ccb891346844d219ab77064a631656c1f
- TLSH
  T10C219ADEF36D92720EF331350C295889592DD9B628468F573CE25ACC2D74A39C326DB0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  data/verifyphone/js/jquery.min.js
- Size 75KB
- SHA256 f800b399e5c7a5254fc66bb407117fe38dbde0528780e68c9f7c87d299f8486a
- MD5 e4958bd2e32d9fcd6115a585ed17a9cc
- SHA1 97be02d1785b7bb4f41ae116a6a9bef74cb018d6
- SHA512 c6a447c20f0f834250fa79dee66072dd21ab1838a1a6caf9518b8c8087158f548c7d22ab44936fbbbb458ad68aef4c43a52b010485694dc4c65e79b1eff436c7
- SSDEEP 1536:hwAJNZ2ma5WPwY8Ck2qrNW47dipA9RifxVUmYYmNDhgjUkzYiH5A4+9X:hht2bCXi/NDhQYs5A4+9X
- TLSH
  T1FE730BD9B2C2727383E731B864AF520AF13668AA648C4894F06CD8E4BD74E45447BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32