1503ad9ac598735f63a0d23f86a1b485170b8ed3942513928556fe2eaee572df

Sharing

Copy URL Twitter E-mail

General

Target
First%20United%20Bank.zip
Size 5.9MB
Sample261001-w23a2avamd
SHA256 1503ad9ac598735f63a0d23f86a1b485170b8ed3942513928556fe2eaee572df
MD5 c27785d8687c917bdb49dcbad32de28b
SHA1 c7eb65f1ee225ce28a4e564ab79009591cead27a
SHA512 a154b56dd5e0a360d5ddab394cf2440dd92e1eb70ab5143522b37a0bd79a7fbdf3f535ae2265cbb12ac4507be28050b506f2d1b55e24eb4ab9a09672280d09d6
SSDEEP 98304:HvR6ajIVD8pN0nJypNzOFmtA8OpgT7Zqg7m4rjdbcXg3GE7Wo/jfY5LlYwr5un2r:PR6on0wpVTtAFpk4itbcUWoLfY5LKwrT
TLSH
T1945633B7C1185F99C799773AEF3116B9ACCD4004AFA9E639E8C1400D42E70C93E7A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  First United Bank/JS.php
- Size 2KB
- SHA256 286a9b8ec97b32a68bc5b1bc1e79b586831c5d8b295f60f04bad10a76b52e4b5
- MD5 aa6b7d21ed95cf49144a2cd8bd65378d
- SHA1 a83a1c52e28526fd57c56cd5e5bfcb8805bb16f6
- SHA512 108770f0d93069787f1029523fb5733205ba2d105d9476c2d7261d42646506953f9a42118c9a4871449f89ae163bceb933f4b43aa4e02f43f3aca0c3edadd410
- TLSH
  T1A7411DCD4D2C2E4D60F0205C8C4E3298B46F07F9344AA843F9D3E638F89478D8D6A96D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  First United Bank/Settings/underwork/static/img/construction.svg
- Size 14KB
- SHA256 34e11241c18bfef0e2b9533f6c143713b77a28a55123f225375d8a368b60840b
- MD5 f6f3fc94a20339a31ba26813a81da54d
- SHA1 5ebd41043c7ceaad096424e39adb32c86b22a5e4
- SHA512 292bfc298eb4debc4d56f6cf8079acec63be34401430889203c16bc34eed262d530045e644159184f0e9e42b03dc0874bc56cb810fef007d5af81e9b28883b7d
- SSDEEP 192:qKROm6aSRyMFsda51kjTQMlOU7b8CrgQBUgQBSehu:dwyMFsdjWU7DUdk
- TLSH
  T14B62A576471C699AF210C3DDC6C464FF645E9CE7E56643ACC782A21B7E310E7827C928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js
- Size 217KB
- SHA256 a55ade67aedf45a013ca01c5e93fa042d175348ef4d16f64cde022beee9abbd5
- MD5 a9247b1fe21ee409d0b37e74100de687
- SHA1 7038343de806c871e93d1681ab48633b7aa34f58
- SHA512 9a157e19ee19935eab849366487a7b0830f8483997aa3c784d510ce22a2f91030b3da04c10bcbd6f8ecde3724efda5ec9917782b489fb466da364d0d9f45e904
- SSDEEP 6144:p5a6J9BUMJ6nHoBGi5fy0YVg4LvhMEq1U:p5CcY5zaEq1U
- TLSH
  T11324850A7DEA30E2445BF06E87EF9149F235505B5609E9047C9CA7D81FA0F3452AEBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js.map
- Size 392KB
- SHA256 dd4a5daafa1373a336b2e83c5ad161aff9b7b60fb8ccb320a0c823aa99f99f52
- MD5 06ab40ddb02567b23a55c8c62d1f2b37
- SHA1 961f667f3bda43b00083913ac3202a9ccbe21587
- SHA512 4b7849a455ce1e928dd9b124dbcbbccdc1ecaa81d7119cbdc51a4d20f18b6a0e0fbf097ae35241d01a31aeaa1e5403f4dcda70e6920941e1797f9d690b640761
- SSDEEP 6144:UM5PxoMN633YVqsV7qrnWO/W4MAjTNEjTqZZwusZfUviuQ:KPt6l
- TLSH
  T19C843F132C6BE873715BD6BB29CA4297FE2070991E859600788DE644F3C2F39B4EE574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.min.js
- Size 76KB
- SHA256 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
- MD5 a454220fc07088bf1fdd19313b6bfd50
- SHA1 265a733cb7fbc481fd2510a659a85ad55c93c895
- SHA512 4ea980874fec49bc12b9504e0c46a002889421e191a3cbbde5ae35cf29067eae623e43bda227bc20a0a0c7bc80af56df8818d97ae6a98cb80c769f5432909561
- SSDEEP 768:59YDXypxHVIg3Xeh2p0NH04UX+TG9qTXAdQ+fZMQnOwkqUNFJUIU7lW0+YVxiM+A:59YeHqTEZChY223CzWpV0ea7In
- TLSH
  T17273D60A7240B472069FA066907F460FB23B68DAA50B815CF56CD8DD1D7CD99326BF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js
- Size 128KB
- SHA256 a65d5b4abb65aad37f302c96f1751362e2422a8869f7f889112556d77e384813
- MD5 7f827fe484ec04346553202782b0664b
- SHA1 a9465bbb5a0aef24f9b25184e3da3637634635f1
- SHA512 b0bdd14fd41e96eea34eaa16515cc602e9896b26a48743fa59e988fe05dbb10c457f92f426a17832fa9179e7e126a1d2e535c926a53fc1a41d1eaebb9c00f38c
- SSDEEP 1536:5ZMG/5lzsiLOvFUqZGbVLK/vuOhubEq12NQdYz:J59siWFUOvhMEq1rdK
- TLSH
  T12FD3550A3EFA2492445BF43E8BEF9106F774548B5909D9087C5CAAC81F9493453AEBFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js.map
- Size 244KB
- SHA256 47cd4d0360d67bc10f8d9d8e52189e5d882fbd70679bbf2831d7aa3ad484afb7
- MD5 e7d7dc6d44047670c68d91c068969edb
- SHA1 d04cd958eed85b70479a370206f89c083b7fa702
- SHA512 f2a55607807d45502e2c9f6c894a2df3a0c74ecee69f0b98276d285458c3a64ec97d16f8aed7e7a9c7154cb7cab4a1fd4c83b842e15756c8ff291001566d1b47
- SSDEEP 3072:KLrlujv6biV+eJBtBMAjTQIcxkKTqZZyNutW5zfDoBdiuQ:+/W3MAjTNEdTqZZwusZfUviuQ
- TLSH
  T1B23474223D6B9873625FD9FB289A0197FE2474CA1E414554B88CD588F3C2F39B1ED638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.min.js
- Size 56KB
- SHA256 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
- MD5 e1d98d47689e00f8ecbc5d9f61bdb42e
- SHA1 6778fed3cf095a318141a31f455c8f4663885bde
- SHA512 021e615983f30ec5477fd8b611e8c5045ac6d9900f9a9bb8649b56e0c7d282965a727f8cf501c3b7e1ddff02f5b44924d5481bcea7a926be8a9e166314a07ed0
- SSDEEP 768:5NYyDyKAmHVaS3m3Dqp0NwCkXDtdFDLmTV+miDNJcJiQMRqyPiYtB6UvcCg8YGk:5NTKktDLmTF8yJL45XtHjoGk
- TLSH
  T11243C90A725478B205DF9176917F420BB737688AE94AC16CB91D98ED1E7CC893227F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  First United Bank/cod.php
- Size 29KB
- SHA256 4e4d565383e645b6c032f4e8f5fa9a28c1445736f791a65d5b807163bedde530
- MD5 c5d5bf04014ba6f242f525d0db4ae09f
- SHA1 eb33108f5ad886cc49d121b5384f3996a87f61b5
- SHA512 361ac56fdc9237f112fa5def6c9b32ce59e0dc019bd9865394419c0824d92349e8ca5bcf0af20027943cbdb0fc60e646a51985114f44f73048c862895a90d19e
- SSDEEP 384:pHFndqfVQPK+0z/obO04iaYQWGWbXEK5FplTqlHz9ZbN3J1sKk:pHFndqfVQPK3z/ob/D4f43bqvZbX1sKk
- TLSH
  T1C4D2A695AD40001635338B5F7370EF42E738E50FAF629816FFDD02865B98B5895FB960
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  First United Bank/done.php
- Size 29KB
- SHA256 395338e6fadb2f5eea3fe00e886022e4b3a82278e580565a1b183274c3f168c7
- MD5 b23222a3a1391818e2f242f9e921cddd
- SHA1 1853dda18b3251f8268816b4f46888663624d1c2
- SHA512 4eaf613d0710e0e6c32086a905539ff65f06615c2e96bd9791d3da7a59a44af241410e4894669889f31cc443912c5b78aecc71a498029bf4ed7d14534c66d3ee
- SSDEEP 384:pPFndqfVQPK+0z/obO04iaYQWGWbXEK5FplTqlHz9jDJ1sKk:pPFndqfVQPK3z/ob/D4f43bqvx1sKk
- TLSH
  T1E4D2A695AD40001636338B5F7330EF42E778E50FAF629816FFDD02865BA8B5895FB960
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  First United Bank/file/lolo - Shortcut.lnk
- Size 1KB
- SHA256 5713ee15bb253c0dd03f63974f84bfdb9e1d9474126337cc37babb2073c3e9a9
- MD5 fdd3c34d5c7f98982ea95438b229d483
- SHA1 8f678f8367d01cb942753ff894fa4eaa3c1d5748
- SHA512 064f0fc067097a31d47b622faa77cfaedb511e902e918c49daa0c626d8aaa7f5db9ebadc3881d9e8d6892680e79a05935e6ce62d82af524f90790c24ff66fcd4
- TLSH
  T19631320603E246D6F7FB02F91EBB65C18331BC108E69828DD4C9408C6CA2B34D0E5B33
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  First United Bank/login.php
- Size 29KB
- SHA256 0b7fd3f379276569c48b413cfcf84f4a5b9789641cfaff69de6241274f96495f
- MD5 7a4520092ef45eb6d375c791be27d244
- SHA1 1c4523164eee92f0866cc9a3e36c53e5c2a7887b
- SHA512 e50a8bcaaf810e6552e78c3c52366fcbbc1307b430b368d7ffe3d0f59aa1947d9ed986ce5264ece2f7d96bdbd08d91f20a97658e3d6169396a4f924bf15a578f
- SSDEEP 768:ELgndqfV7A3oyQDp/1zeFTFmHNFiFJFnFG8dFwKdXFyM1/Ih:+eNkt079U8dPXFye/c
- TLSH
  T185D294E66E5000163A2F8B9F7061EF426738F50FAD22D816BFDD02949F88BC595FB914
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  First United Bank/login2.php
- Size 29KB
- SHA256 287288c8f00f855026b18e5a7ac646ed4d40c190fc7efa3a3a10f5fa77b66fa4
- MD5 9bc8a67b4ff1df66decb1b6a122b6f8c
- SHA1 8558bdbe0437351756ef4952835d85830d08451c
- SHA512 646571feab971fc4323efe33ed3a2dc3a1452f133bd550ad577b5b58edda8c2e437e9b78e518bf7c8255307abf493968fa7c11d9ef7254e48c0df56d3d807daa
- SSDEEP 384:pHFndqfVQPK+0z/obO04iaYQWGWbXEK5FplTqlHHV9ZW5W7J1sKk:pHFndqfVQPK3z/ob/D4f43bqhZW61sKk
- TLSH
  T18BD2A7A5AD40001635338B5F7370EF42E738E50FAF229816FFDD02865BA8B5995FB960
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  First United Bank/processing/done_files/13.884592655f8e03c201b2.chunk.js.download
- Size 62KB
- SHA256 eb2a9aba22bfbb8d136886a5132fb6a792c27788e24e1b634252ecc5648e1680
- MD5 4829f49ab033fa8b25fb85fbaffe4544
- SHA1 08ce0a04ba4c3d07bcae95fc5e565334ffea6f16
- SHA512 faf758513724215db4d6848a3de7148a959f2a5cf2f1aea3d08bb13ae7c7e1269201db4457d695ba26f16182c9c0099722d08a3b9a717f4dbae91786f850a98b
- SSDEEP 1536:zqA03eVNANA5Ap8ApMCzuHiyy/uSurP4Wx4I:zD03esbp9uHiyy/6
- TLSH
  T1CE530ACFB149B438429329B5D13F3206B6332539644E40A8F54AD1D978BADAF8227FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  First United Bank/processing/done_files/AppMeasurement.min.js.download
- Size 32KB
- SHA256 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
- MD5 d860c16ac938f7d839f0ec158d02d0f0
- SHA1 8710f81ed151233677f7e32b229cb35293dd6840
- SHA512 31832074a21601bbede57d360d753f69a244f9d3cfbb066d1d36688af8f1cd34783bace431f103a2fc668833faf064c5a69b2bf85948c1505f719a952f4aba03
- SSDEEP 768:GOMjWPr+mBE10/Y12DqSEKClrlkxDgVsG4aFrcemyFN0:GO5Pr+eea82WuduT5N0
- TLSH
  T162E22CC535EAB46E165271F43D6F180EB139CF5A8C8884B8E081C9A16874EC651AFFF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  First United Bank/processing/done_files/RC59736ece5d774b119d38fc68ef2eb150-source.min.js.download
- Size 10KB
- SHA256 39ae1bc342ab3e5bcc2addce2eaf8b0f3be7f72150062e9a84247e16ae0e2634
- MD5 26f9989f3f46e84c6a3418b55f50d0d7
- SHA1 46eb0b5510db60f722d4bbff60888a7920579d60
- SHA512 7908eea2e88afb43a598b724630ba8d1af86837136ad86e6dbc43af7cde0f40accc7831a3bfd9f951b10c51ff3447f4492e849675bc7b4099d599ac80b80691e
- SSDEEP 192:/Bs4TClAD5gqrbD4Ac3pc1UoL7zq26hSz612BXc9VaVcV0Vd/yc0qP/uh:/K4TClASqrbDFc3pc1UoL7zq2wSzu2BG
- TLSH
  T1AF22120F717A8261879DB42C63AAEB30C9FDA2D451601978F532DCDCA302DE76AE714C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32