2d1ca8f9107c3534e065b94f2ab55c584040a274a037af62b1ce94b5bd157d70

Sharing

Copy URL Twitter E-mail

General

Target
lighttpd-1.4.49-1-win64-ssl.zip
Size 10.3MB
Sample260925-pmw25seb33
SHA256 2d1ca8f9107c3534e065b94f2ab55c584040a274a037af62b1ce94b5bd157d70
MD5 3ea70d40dcee9412f1e42381b11d5582
SHA1 b60a5c08682aeaf5eb943335bac8dfea9b82520b
SHA512 f42be92f6446e6b6f8c0b2e3401bd1f71417e3c60ad68a79a0edb84a3e4924a5225a4e52b708d19bc17c0e7a6f0d6af9402ef523445198a2252fef030d0d4841
SSDEEP 196608:6tkm7Ml04GbgsfMlVesI56lKBG9uxADx3Nkc/khNaTiao6nI99RJhRjRlVa11Ylj:6ksMl0ZgT37I56Q89uu99w7wIJV46jMa
TLSH
T127B633FDECA00B4CD26FA139F0F579A88D6562E943C60402AB7EA1E108E6FF541375D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution upx

Malware Config

Targets

- Target
  lighttpd/NEWS.txt
- Size 101KB
- SHA256 a4ef7de9f2575856624b8f8f754e217ff778597110e1072595e22bbb16df4445
- MD5 790dc6222f6506aea61e276348c65fd3
- SHA1 523ef4bc5ac3fe80d3c5bcb66c9dc33a512c81e4
- SHA512 d864681c766f35bf02ccddd68bf1f8039847987042eb53eb0d01ef994f69191248128d56942929de9b4f5942c4aa7c3146960f79049e098a4d6068b364aa02e3
- SSDEEP 1536:i3H3Of0FUxPQxG3c2fycM3ntKAfrEAHgt80YJ1QE0xw8pM4iVKpxM1CnG37pf:iXo0FUlQMIEAHY8Ywd4hE37F
- TLSH
  T18BA3932E7D2A711256B702C2B2F77463E35F902D2B2D14647CC9910C33615EEA2BB67E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  lighttpd/cygattr-1.dll
- Size 16KB
- SHA256 5fdd89666113e72293571375ae0e5b8729dd084706400d1be35d7f336bb25ec4
- MD5 3bbcfeff34c6c5d8e60e4779e0565f90
- SHA1 f3011440c46183ab3ab68b91edd481c19168b5d7
- SHA512 10324bf6f7bec2bf662df9e8ff84ec316c0ed54f77f67e0ee5e71c25e09f95fd39de3a2a8cd6f5c9b687fb3f7826de0fb389a9f7c4e5b8dfb00f97ccea4ef0c1
- SSDEEP 192:r6fUvKoJ9SRBxqstAJWZWDGyTDIsLbB02Hh4pGcBeB+jja7tYACCCrQcOtYQvPkR:GUyRnoJ7DGyXBvBzHhwGIeAj0G5s350
- TLSH
  T17672FA07AE70D4FCD213907812EDB57A54B0F91651B5FF9D53A4CE525EA0EC03A2EB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  lighttpd/cygbz2-1.dll
- Size 63KB
- SHA256 e2a03ef223dba8885d88c69af0e07a9ccdca460768bb6f8cd47e3dedcb3ad196
- MD5 7df2055a8a935445839fc85ac1c45313
- SHA1 3a7996271676807977fc36b078a7ec586eb3ec25
- SHA512 d33db498923be621ff95d015f1717443ca592b30815e28cd0b982837a67bdf2cc6f3af694a761fec55c7911069e91c75f9b637a7acc57d3eabc34214de2e2eb3
- SSDEEP 768:7RTT3vCfTJSCqHh82k9g8BMbeG499Y6hN0wXZN23AAgTYYYYYYYqYlUQ:p7CfTACqHGd9rOiG4dCwXj80I
- TLSH
  T102532A4AA1C62F69CC47C437A04B1F3EEB72FC1D0B15A6BBB44CF6715B9AB501C58628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  lighttpd/cygcom_err-2.dll
- Size 12KB
- SHA256 52f35b352629e0dd2dc474908f49bd5727e8169c48fe9877ca993821abfa75af
- MD5 e94fa0dc0426e30982eb5ede91f2c189
- SHA1 119af7e101edc896e4db83545fe0f3530bf4f85c
- SHA512 e1e7b4b97b18014e3774370977d74b4c4047c739737e570663dd0a9473e03cb06ea28bc3a3aca02363a5ad38c5d4d9e4e0b7b21333459a125876a9e534e7f02f
- SSDEEP 192:LcbTVPTjyad4xoSeExjtNlCCC2gBLmOqOhaOSCebwvICL3v/DOQgh2oh2ve/9fLg:W/F0TeKjPsRZdEwvI43v/qDhvhrVLg
- TLSH
  T15E42F86F5AE2F87EC047D27C58EFA23459B5FE024634772E4760D121AF146C8B53DA44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lighttpd/cygcrypt-0.dll
- Size 39KB
- SHA256 8f8806cab7a7af43947062180982a1791ea1babc7d73783c180a0b13d7fd6017
- MD5 00d42b3a3443f1b746c67c88e94e6ae1
- SHA1 e4fa15d2cce48e535d9bb8f92326106b8dd1eaec
- SHA512 cf14fca989f6f45de039219eec91633801a658c39bd46cb514ecf31398c3017c0d2f68b7cf4b813b82943ee6f909201f3c18ec05a3e3284e89edd534a75f0148
- SSDEEP 768:0hUxbqNnXp06oCOlRaRy1ZIoRpsJgLa1ex0dtYYYYYYYYqYEio:0m9cK6fk1ZIofLa0xz
- TLSH
  T12A03F807FF5191FDC42A473452DB4373BBABB83502B2679B0B60D7642DA17A02F29E85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  lighttpd/cygcrypto-1.0.0.dll
- Size 2.2MB
- SHA256 9443e1493f82f9f18fa3d710ecbae0a6937b6524cc17ea9c42326dead8dc6d7e
- MD5 97d2984915313e19397412bf4b8dc1eb
- SHA1 da09e56b6077cfaecd65e527251cb0960cfa0d76
- SHA512 3889bde40f4309e41275d7260c758d944693d74b919132ee53580e02364d10cbbca5d800fb9dd42d6b6a31d254dab81c1a20d1d836b7abcefe1b73af11e8b79a
- SSDEEP 49152:fGtlqGaVwAsOQPFeK8gsX9x8tFiD7h0MzHvs+67HiI17nJVGmh6sIU6i/fEhod:C58gq8tczHvNWhnGmhq+Ehod
- TLSH
  T1C4B57C27F2A234ECCE7BC1F0879BD232A971F86816B0FD6B3554D6301E56D50272EA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  lighttpd/cygdbi-1.dll
- Size 46KB
- SHA256 524fab577169f1c337b3d6fad85283ba58bcfc4b95acb29be3f707bc854aa3cc
- MD5 49cd8788292f09005981826c73b7ed02
- SHA1 f17ff209b858e2c7e00b3ffd2a188fa46c63eae3
- SHA512 6ee9b3ac464c7b8f9599b3e9c99a802c85327930e1ea4961cb26eaa47414678d163c9d54dc8d61d898d03e4eadcb9cb97963d009356777ae68764cc5df42ae06
- SSDEEP 768:00311FgkNT/XHht8iBtvmmDAhmoZ1CQryjjwB:02tTzDAhmoZ1FyjjE
- TLSH
  T1B423D73B5E47547CDA23C1308467F3315630BC24163AAF2D0B54FB376E25AD8A96F86A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  lighttpd/cygev-4.dll
- Size 42KB
- SHA256 3a7d6d871655e7b34207ef50b251e61271a4e45f6f5953300ec5dad78cbffd1a
- MD5 0ae0f4698b2a70e938556aeb4d7f132d
- SHA1 fac4448ffd7b377f9f20c810fee5eed52f4ce9d8
- SHA512 d4b438b68aedeaf880697e77b2c6f479acccde2da6a49f6059358364d8b5ae0d8124fa7708f36e63e478aa65520078af8b74d05986d2307741b9eb11d57e5885
- SSDEEP 768:Opt2kmjNc923TVQE1J84IYUNM7ydw2+i0VzVEcv9/oooooooo1Ys02l:OpMkmj+923T2E1KEUNLdui0fJ/Ysvl
- TLSH
  T142132B9D7372887CC9C7C57486BEE733B610B52110643B7D8611CB302D29AE46E3B6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  lighttpd/cygfam-0.dll
- Size 30KB
- SHA256 afdd73e066429554adeb485d1c1c1599601bff9d6821c6c7b7f4c7f0541eca44
- MD5 f11b752cfdeaca00647228e400bfadfd
- SHA1 10fa749ad995e69e0cc64576e2dede5e24d351fe
- SHA512 5f7963dddb215e10ca77403d13d87839fb6ff5f8cb4b2af0e2cbbaec62273312340ccd2afdb99c3c577efa4c8c060b93e7dc512a698b3e4120088fc84c277a30
- SSDEEP 768:hs30gWDATGpG919Wu3Rngbdw8TkCihkQzVl5A:H4Gk19Wu3Rngba8uZA
- TLSH
  T1C1D2E86F639311ACD9079134C679A733F930F4311231BABA8B50CD785E399A6A37B784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  lighttpd/cyggcc_s-seh-1.dll
- Size 69KB
- SHA256 03a9068866fcdc673e3e40c38f97706a75b646b6bf3b5964e040c401f415cdf9
- MD5 2f4943fa5d0badac77358d5bfc21f40c
- SHA1 c2058ae0cacd2694d628d6f5737cb23d607751ec
- SHA512 588fb6062018ba42769ba5b03896cc48d000f778d804c9c71b5ab8a58d0f4ebfabb610ef40add0fa35ee13c03335de63832d1ba85af40454603979037bed418f
- SSDEEP 1536:sYfdJlM+3Bwb0Y6cHDzXu3bA0cKJWBxK7iwXN2M0x9:ddTx3B8KcHXiJJWW7iwXN2Ms9
- TLSH
  T1F8631B93B2D3B8ACC116807043D7DB359527FCB406709AB762E4F97816B27843E5A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  lighttpd/cyggdbm-4.dll
- Size 39KB
- SHA256 08e57e3b91925f37e3a1d9fd53bb919f1c99597b6ebbe1ff740766a118278501
- MD5 44530cd27ae1141f76b52f69710c99ea
- SHA1 317af0a988c1c9212d39fbc77af24673faf01584
- SHA512 cc783336e982f7de3dcac4c428de5d3c19cadb10eece1e18726a85be5863c9d372e86de474bc45f834be035b96cf1fcec59fe2815abd43d8a5b6bfccd088985b
- SSDEEP 768:4RNHuYZymMUenpi0jLDVfhtLAtCqINKXPQ4gYYYYYYYYYYYYYYYYYYYYYYYYYYYU:4RNHRZyweU0jnVfZwXHcd
- TLSH
  T19E031A1BB69360ECC56BC07802ABAB31B831BC2315317A6F4360F7761E75DA5276E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  lighttpd/cyggeoip-1.dll
- Size 186KB
- SHA256 32ee2a492605b8851cf9e9d61bccb95d94514d1494e2d93a1eb711001a7f9acc
- MD5 a29a10d12f799c2492ea09cf59cf4de2
- SHA1 13f65a54a263c7eaf5f7307867b12a87573abe08
- SHA512 3578852abbabd9a00f33c71bd8f721d1d2c5bb496191bfb077a6584a3d927852820fe42b96b260cc9e4ad1daa71ec9411471b2003964d916fafd36ffb265035c
- SSDEEP 3072:XgAhaEGd9gt1yQFgSAEEz4K06ZJAzR7eqFFmMhgeoDvAgg/JA:Na2Ab06ZJAz/F2d4gWJA
- TLSH
  T19A14F82E165924FAE896C978FCC0DB3D9477BCB040726DAB6B847150CF02A94FA57D23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lighttpd/cyggssapi_krb5-2.dll
- Size 274KB
- SHA256 ce88d92486d428c7b40849bbb061bcd3ccbe9210a7532a8085df5d1b59c7d1c9
- MD5 6d389930b0830c0bd1bfd26b0d4669c5
- SHA1 30fc2d03e4b1c06631914bd371ba8796e628bd0f
- SHA512 522836e0d73e621721c721d605afc712579fac26f939757f2f639aa3b4f401d21cc8e044ce3402bfaac0e8a798f7081ee0dafe32257bf1da1ab0c1141b6c7779
- SSDEEP 6144:1F6pY8fhhOTKvhxdND6WiygCRMCBwlZcute:rkpOTgd6WZ5qZcue
- TLSH
  T136541A13E26364EDC99BC274579BA3B37930B8659234BF275710CB252FA0E10B63DB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  lighttpd/cygiconv-2.dll
- Size 1009KB
- SHA256 571374320863e4502583108d7073d1c0315b19b26cbdee8eb65c6208e75465f3
- MD5 58a26253238035759510d554060684c2
- SHA1 9d4cd08fffa63a296bab4fb8b8f286d6bbd6d3d8
- SHA512 d2fa9cc6f8333ee02a06690d8d64b0aadaa3672a4aa64b6039180e34e3f1db06d79cc86959b195af941d21b686643d02c4c1bfcd9f7e39e78bac916fd133c0e9
- SSDEEP 24576:6PmqBAUZLYhwPKUT1bbTEpGavkg3NyeuQ6l9fHOfx:6PXBAUZLYGiUTypGaXBuQQ9ux
- TLSH
  T17925CF91F3D2CB27F667C1708D7A9B7BE526EC225F06443736A0B7AD5D32BA014C8612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  lighttpd/cygintl-8.dll
- Size 41KB
- SHA256 5a7185030a21bc26127dd6b07b5f807937d0b7f345aa33a50a5691594609bb44
- MD5 2417915d37002f516fd50ca4da5e7154
- SHA1 b264f1ff40ff08e29eb55ba697009a003857b586
- SHA512 b0ef59f3cc1779f5461ad235eaf5577e3ec4c07dc2b874e7a1919f9067ab91b52d916ccb47228002b7755e39bd9cf255ef1790a559ce991eb5b47a9052ed7e5f
- SSDEEP 768:hSQIqyZJPeyCFWUk/n4+aYb/VxAQpWmqTt0BcB24AYYYYYYYYYYYYYYYYYYYYYYW:hSQRyZoXy1aCVxAQpWmqKc2ytS2bVb
- TLSH
  T18413F85B6297A09DC013857895EA67319733FC222570A76E03A0F2701F90EDB6F3DA96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  lighttpd/cygk5crypto-3.dll
- Size 191KB
- SHA256 104c51ec1e261dee6d172d90f822ad0b55c75b10dca30079af6c14ecf158e202
- MD5 4aa8c2e5089264f4e2e9c834ea21b020
- SHA1 b655851a9b24d70cb2b92eef92c61faf01b33345
- SHA512 d607427a4bf1657e37dcebc550fd93c770f90c8dc68a2b1fa5db8a4ae68c32c998f7f005162edb852c9edf98102cb71f1e9df72b82bbffa105c0b6be307495c1
- SSDEEP 3072:q5Y1eKdX87aUDjbtqoP8LcZkzlzTBhpg7T8/oiMqqD9Xp0uJ:qoeKdXAa8goP8wazlJ07gohqqD8uJ
- TLSH
  T181145A56EA6298D9D9BFC67043EB8332F430782412A4FF7B2364D5756E43AA13B1D708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32