4414cb7bdadd4c1075cd724c80e3304b3c05c3a3b690451e3dc6dbd574919881

Sharing

Copy URL Twitter E-mail

General

Target
machform.zip
Size 10.2MB
Sample261003-pksxpsyblh
SHA256 4414cb7bdadd4c1075cd724c80e3304b3c05c3a3b690451e3dc6dbd574919881
MD5 26a3103b201a9e71351e6ac43802dbb0
SHA1 51a79e98cba57fcc7e582652311391236e400615
SHA512 a10f4d4b9b94073a9c8eeec8a1dd39f4554360f31c63e077f2d8ca6874f8e2a9ca715705b30e8af504f9a1a5582acc22794f7863d9dec3a2fe2adcfecb343c4c
SSDEEP 196608:UFLXT+vqPK+N4c2LZOzWP1/+ROYEu7DA4c:qLivqPK+icMZdJ+ROGcv
TLSH
T10DB612BFA45E8A73FC52AD7CFACA4322946445051F1AF093B77C61D9EABB09D31522C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  machform/add_user.php
- Size 18KB
- SHA256 aa093ae8621072979c7553a339b9994d4b4a3b78d52672747b5e8517d90ec942
- MD5 b55299bdbeb8e693b7f06c1f6667a48a
- SHA1 ef3af6f8e6e2f5fd9d9dfc813e07c79c1f336ece
- SHA512 b584a96a318d9075588dce412208e1ac0abfd00ad52dd5e965e9a2255cbe02d9bd5a0ab8c2cbc78d469ca7dbe47e800a31f5aa4fe7be8816e25074cb73953339
- SSDEEP 384:oZGsUt3i2pGeHmCSTg/v0xKs867pn6H6XXxpuuBiIXPZ5pjme7VTiTNP+oNXI6XK:Z9Q8IKs867pnRpmNP+oNXI6XM99gwRdh
- TLSH
  T1E392C6063A8E4EB901B2C9D299F00BC5B65EC57566410CDBF0FAB27E50DCD18673BEA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  machform/add_user_bulk.php
- Size 19KB
- SHA256 cbd334722fc5d699176c92ba360fafc197614b2ae08884a18858fdc540be3858
- MD5 2a452aaf1f866739db022a3d648cb95e
- SHA1 37ae7690b4aa33f06bb977826c679206c44254ab
- SHA512 d4f2a83cc1170d6d1c964a1edd1d44ddb6c41a03d5e91a8820ce3544fa4d1f5df7678578aa1f29059610d3afb5f1b7b6f78b3f063b745c5681063286c37e38f9
- SSDEEP 384:o+G7Ut3i2reHmCSTg/v0xjHJni0efnAHrwXxpuwHPrwcVhpIPe7VKtTJw2ORRqy+:e4QyjHJni0efnJhpyJw2wg5YSRV2FjC
- TLSH
  T13092B6423A4E4EBA01A1D9D694F00BC9EB5ED575614008DBF0BAB67D40DCC5CA73FEA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  machform/approval_settings.php
- Size 40KB
- SHA256 0386da4f0fa1b8faaf5682fdb84dbbc87cdfe627b85cb7cea4a2f952a46edf79
- MD5 f29b8746d1b426e9905940f031ede649
- SHA1 af41254df6f6467a2dc7eb01774dbeedf8043041
- SHA512 ee6dd5babae0e05938e23b7311c1163d35bef168e308cc4f08e1660d9de4bd3977b4cabbf8bee09a6ff7b9c12593942a249ba9b8fa888342eb2b77d977afb492
- SSDEEP 384:4a08xoT1oTs9k9gRTx7SvZVGVt7yYoh0aRy5kpjE2nbc6sSP7peeQQK/aKQOjYWZ:qRk9ecvZVk7ysCgkCPqDq2qYAEJWF
- TLSH
  T1081396237B1D8477409FD4878EF24798F63DC5365F004AAAF87661BA03BAE14792F894
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  machform/css/fonts/Glober_Bold-webfont.svg
- Size 155KB
- SHA256 9b8a7ae92d200d762e93ba27d355d8c31fc61b71e50abd225fb843bd61e9e17b
- MD5 ef2d2938b29cc6ba5b2e5521f761b678
- SHA1 33ba51824e8e84bc420a5308295878e091806b83
- SHA512 ed7a160694fb4715a5efa6cfdbcca0fa649d8b9052f3abffb91d6f4f094fb2d25c59334a2f463e4d9e57b6d0aa70509403026f0f1e5dd72c184a16b3c0a712ce
- SSDEEP 3072:YQlWHueXrUhCZLEg4gNGkUph3PhFeQs4FTxmKyKqvbQg1Y+Btcsr3:V4/EkUph3PhFeQs4FTxmKyKqvbp
- TLSH
  T180F3217DFA9ECAA5C2CD806B7126497172ADE25F06283704ECBCF7F14C042698F995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  machform/css/fonts/Glober_Book-webfont.eot
- Size 28KB
- SHA256 ff09afaf848a9b1daee6f2334e8a37e01cc0248807ed96bc8acc1b44bf60cbff
- MD5 61b05fc985e9f49429c3d3b4b7d62026
- SHA1 8d5df6a6691d15f9c0a2fbcca9cbc911b99735fc
- SHA512 bddbf295915776f5cb76bdcf9cbb92ccec7221dcc2af1da0f37960fd308ce11612a977d4af94540754fc774a2834f966667a3450a12bdba7d54793c99f2c55d3
- SSDEEP 768:4kJUl5KKnmMnhsQzczvrgV+ZQ1b5BSC/bqopeBmHTQ:9U5mMnRYzDjZuSCGOeBAQ
- TLSH
  T197D2D05AA38878EBCCFF55F6681508D08D85D64B22EE4F786C6190DE79B70D710A331B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  machform/css/fonts/Glober_Book-webfont.svg
- Size 160KB
- SHA256 efb00fecec670e3f3a2318c93ebb2b4a8d202038a10f54fd7d7022b0f6663658
- MD5 7d7db23d666dfe633d2165f3a9af9523
- SHA1 990b4b955534f7dbde002837f71f7c1eba24801f
- SHA512 5a948f67d60281e555ed718d829f157ddf4e013af05c670cdf7e67da09f0eb00f2a9c460b914578124782b4bcf6ccd5306658ec80a885c4476ca2452f8c9b5d4
- SSDEEP 3072:v0aX5gTuR+PRpfykXOXgSf/h7+SkjFfuHRFwYc4s5t35njsoNL2ThRbuLP4n4aUp:pMucKzzkjFfuHRFwYc4s335njsoNL2ls
- TLSH
  T118F3313CFA9ECAA5C29DC4AB71164A71729DE65F0A283604EC7CB7B14C04329CF9D5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  machform/css/fonts/Glober_Heavy-webfont.svg
- Size 152KB
- SHA256 dd775ad1627b080a2b789b2bd084997e99e5bca1ff1af3a1faa56c0e3b37837f
- MD5 07473c457d9d967b81a3b03f80fadb05
- SHA1 b4a399c5177b9d52ea37710b8ed25a2c4958195b
- SHA512 6433ead5134677e743538e073f896cf2d2f5b8df0552fbb90caabbda420a4380c6b2bd17a72be7520b7b80b6296c719a6090d34e8af79963965319fdf4db2ee0
- SSDEEP 3072:n7LSN9Kbq4zrLTfebj9hbI9Utl3ylabp4rDirlK1nO/E+VfrDqN7:/SLqDzrL7Uu9Utl3ylabp4rDirlK1nOu
- TLSH
  T137E3303DFA9ECA54C6CD85AB7116497172ADE29F06293604ECBCF7F14C003298BA95F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  machform/css/fonts/Glober_Regular-webfont.svg
- Size 159KB
- SHA256 73e952a66b5de7675c1bbf75958ecdc252b9072297344dc823af6fad65b4b6be
- MD5 25022681f803d41ea926060004f74b29
- SHA1 f6b96e67c71aaba7bf7db4cd676525d12502f6e7
- SHA512 3155077a12018150a97c85d8b37886c10c15e4be165d492866a44e781b2283a87ef54506e85f01dc09d8d02d721b20d4d5467f7553c4e5e0910b2fe0e08b383a
- SSDEEP 3072:XaU7jqQjXEnhHZhpDeptIS84qKkj7h49KF0R6CpsDJvsmb9qfjiR0mPFoiQUOjYj:7jqQaPbCVkj7h49KF0R6CpsDJvsmb9qQ
- TLSH
  T107F3213CFA9ECAA5C69D80A7711749B1729DE64F0A2C3604ECBDB7F15C04228CF995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  machform/css/fonts/Glober_SemiBold-webfont.svg
- Size 159KB
- SHA256 da047f4b44fa4fc8973abb065d3667429496b3598851b1b72f3786d54eeef9e5
- MD5 27c2a84d50aa28fd6195ca4cdfd62c10
- SHA1 b7655771891cf52d1736773cd8a38757c3e730b9
- SHA512 cfafeac19b84c0b453d47c325a6948df77a9c69558e353049928a40fd9b688b049a0d146a338f26956e8955973b8fe2281aa6a1b6fd3f548d701a9449dc1aacc
- SSDEEP 3072:1nZOYRZuyHNeb/rBwGOk+mikjSfdPlFrdTC5x0TvmsNqUjbdhBZPlsBLUz:JRQyezQkjSfdPlFrdTC5x0TvmsNqUHt
- TLSH
  T12EF3113DFA9ECAA5C29D806B71274971729DE29F062C3604ECBDF7F14C052298F994E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  machform/css/fonts/Glober_xBold-webfont.svg
- Size 152KB
- SHA256 58465b41b17a355e01019d152c77202b00774e9a9d93086b00bbcd7d9c409638
- MD5 b21ad10a4502a8c717a228d0e6f2803e
- SHA1 50984ac337f08c34c4990ce2b3fca06c9fd7f2ac
- SHA512 6d310146a11eebf9f990a34fc5bcc984b2745596c7e6d894d006cde4c5e1d6eb5af2bd9100efca1cca94be14dc1c7ca90436405fad46e49dd9a2f9d871ec0d88
- SSDEEP 3072:W40RneBxpQPDWdUr++VTlxJC2Haqto1o11Q8OUh9UMTCzh/eQF4r0Yxst1rQEsC9:cRuVk9UMTCzh/eQF4r0Yxst1rQO
- TLSH
  T159E3317DFA9ECA94C2DD806B7113897172ADE29B06193B05ECBCF7F14C043298B995E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  machform/css/fonts/machform.svg
- Size 94KB
- SHA256 035c4ebf5288e36d1ed7a5ed52fbdf6fdcc079291e030afa569de44142cb0a2f
- MD5 702511d602e255e793d71f2aa393d447
- SHA1 460dcb275d4993ea42c628e5b100a2a9f1885747
- SHA512 62069e77aee193e0d8bcda37b779f6d2293254dcb657dbe62d8c84bd28f868a742ea83ea0071f7dd87007f9e21e576c2325ad2b98e529843e566afe3e3ce8ea1
- SSDEEP 1536:H7xXToNrZMlEGHLTC/0cI76/YQ1aa/4wImz2vuU/FY/TQHz+:H7FToNlMlEGrTC/0cIOBAt5//FY/sK
- TLSH
  T1989384CAF730FAB8D8C7CB79C7286EAC3C5B05FD3572652882B95A7411A3908468C5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  machform/css/index.html
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  machform/data/index.html
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  machform/delete_live_field.php
- Size 21KB
- SHA256 919e460c8c850b4069f7e5c93f1d300e45c15533b72d21d0b59b70c2537ec28e
- MD5 d9465a9734d5409cd8b88c76ac85b990
- SHA1 96628a582526a34995fffdd0f33801df06989114
- SHA512 bebc7360467fb0a929b88946f7bab06e93e1e25d0373a5f43ce66e6a6e5c1952b78cbc1984d7a11a02143cc40caa68d55a724115862c77ac4aaf18ee0a34ea41
- SSDEEP 384:z6FfaivN4nyROqiTCV8CLN5WmZIMHt/HYyt6zjt/jDpy8181Apy818Vvb66+wcFg:8Dqnaw/bzJDp/pVFx62buNW3d3UFvpPv
- TLSH
  T172A22112376E062694BE945BE57704EAEF3CC67131C11BCEB07E26C60378D2536DAA6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  machform/download.php
- Size 8KB
- SHA256 868df8744e80fbf3ae08999ff5a7059ffe6e1dbd741b1c499d246627292a2a46
- MD5 a1b183a0ddeb851b210ada6865ac89da
- SHA1 c4264c9d24f02f0aa775853a02e887adc508b8b3
- SHA512 118c3374f22c9e88d57e0e36514af6e4ee530b3cd6cc9cbaa2cd69a359943baefc3b8a61a35fa2e52e8e1502f4dcf698ebf22ef7be42072227a7abc3037051bb
- SSDEEP 96:v3i29g11oKzgDjWa2S3gtvGCOOnU4bmxQwhyk9ixMvH7:v31y11oKcDqa2Swtv7OOnUAmxneM/7
- TLSH
  T10402ABC4EB4F1C920A73B06C478B90E4262A111690846DA57C8DF1BDAF8C1DAD5FBBDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  machform/duplicate_form.php
- Size 26KB
- SHA256 64e926843fc75d603379ecc316474c1226cb0f8f0dec2bff9bc4e5ec95e082c8
- MD5 303f17d838d44f33bd80a30c6cb6b1c7
- SHA1 cf76611db91ae02fea7a339570e9a41d37337bd1
- SHA512 83cf46991a70f00f415dfd8b4fafcd67c8758f84ebc1b09f69dd0795a790b35a1c913f64ea95c795e825f354f4d3a0c347f117c1908fd3c1ae785f187c270f7b
- SSDEEP 384:Ehj6N4xNBRiVhfVtP/qgyp0s+nXRfvBkkfvBtYfvqao03FnSRfvf9VRvlJbfvOtj:jyp3+XBaoaFSD3mVryDrrZTuDCw
- TLSH
  T1F3C278163B0D5B10C277B294F9FA90C69E2DC176368006F9B43E62D90272C9FDDE999C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32