5712edc2459518baf542725d7ed28a8575854877cc747428a967acca77722765

Sharing

Copy URL Twitter E-mail

General

Target
Meritrust CU.zip
Size 36KB
Sample261001-ppvxvsxwft
SHA256 5712edc2459518baf542725d7ed28a8575854877cc747428a967acca77722765
MD5 5625badd163c993c269ff3d94c069494
SHA1 d76bad98039fd76c70c1dfff8ec69493d4a3527c
SHA512 3a8dbd7b05c9a03b15c58cbacb11d7dd86d851f7e60b206a1dc23781f26e9be376e46b179605840f7b06270a471fa84ed8716afb4024e6b3fdc14bfa8499ec7a
SSDEEP 768:Ui91hEb5baUt1LE9DmKV5h/WW4sHSHFCYZvQ9ROC0f6YWNf:vREl9tRE9vzh/WXsHSHJZLkNf
TLSH
T180F2E031BB9A9049E1E04E748466E44F5C2641057178DE3FAB79A830DECB06AEE67373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  Meritrust CU/cod.php
- Size 4KB
- SHA256 fa1478233e2a237f6c648e001cafa67860e91f2523bf6cb6112be0ba1b2482ee
- MD5 3853ce1d06480e2fdf57b02d0711cae2
- SHA1 ac6805bfcd0289503894f79516c06e8ac28d9cc1
- SHA512 0a561f4c00808a5321607c192ec8866e63e4da6cf705218accee91fc9d5dd713d49d7e214a5d0f75e99f7fd5f143b3e1ea5e70ad4e9c4a0e3695db2f8f26abdf
- SSDEEP 48:tYS8DUpUGJvco8Wax86b04ym1QMFuZL5/MY7b6yONeH2O7e7E4bOakl0xYgvc8ZP:WSf/DaxoVMUPR7b6yVHVqGao0mgU7S5
- TLSH
  T16591312732861405B673D5B8AF13D746EA658803C24152793CEC126BEFFE75195B378C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Meritrust CU/done.php
- Size 4KB
- SHA256 a199d0db18680b483518261c47461bcc862364211a0d89e344f1fefb70940092
- MD5 7f51861627e2626b3d11e53611d73b06
- SHA1 eabb5ebcc78267dfb89991bf1c0984d6c034ee60
- SHA512 7bbb05648503572448a9dfb2711b77d2acd993eff3a5344e100cde32cbabe926266c7e01d7c31fd02ac34b08898bc30fc32e3734972625454e70990752f7e9bc
- SSDEEP 96:ASfNmB0T725OY698XVA/pIqaLHVqGFSAo0dLL2z9ES/:A0muucdUVguHV8A112N/
- TLSH
  T17AA1202AA64618067633D6F86F22170AEBC24413C34252793EDC639B5FFA355D663BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  Meritrust CU/login.php
- Size 11KB
- SHA256 c24372cb0a96a5e3484e784d58e69477fde66f940c267158d5ea5c62fa192d14
- MD5 79be6a4eb29cd26665956b7572db9542
- SHA1 c1fd76fab722741930d75b423029b397dff470bf
- SHA512 3cc93e5990e4a38964a01436ca0239bf8006d957f085edfb43d56827adc9facb3d2ed5086619515cedc74ba9ff53fdfeb961890c8a82f582f6872e64c8a206ee
- SSDEEP 192:mfXEA+MU89vRyjTnDK4MxF1udREG92DwUfLcyek/+:mR+GF/GtUjcyB/+
- TLSH
  T1294251A692471412A933D3A4AF63070DFB568023C30682583FEC63966F76B479963FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Meritrust CU/login2.php
- Size 11KB
- SHA256 2589c83f942407150ea3d21ba8c1aa1f946c806a367973ae908c251864326220
- MD5 4003ee7bf1fd8e825f7a9a4ade3701a0
- SHA1 6e14b79ae5d4a189d001698e46bba1a30e7b51dc
- SHA512 fca4ed71a30d8d4f27d91e0e79717d3aabb8cb5442268820dee9e0cc03a885250842956ae2a9a179daae98c6fc6cd6469b985fd832e2fb496fa008bb7195d074
- SSDEEP 192:mfXEA+MU89vRyjTnDK4Mxl1xdREG92DwUfLcyek/+:mR+GlEGtUjcyB/+
- TLSH
  T1E84261A6924714026933D3A4AF63030DFB568023C30682583FEC63966F75B479963FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8