15f0e71dadb4d1e6e0d069c65f690a8bf285f500ddd75d7920a611388b68acaf

Sharing

Copy URL Twitter E-mail

General

Target
403-NEW.zip
Size 5.2MB
Sample261004-apw3lazeka
SHA256 15f0e71dadb4d1e6e0d069c65f690a8bf285f500ddd75d7920a611388b68acaf
MD5 31d16434c0189c3921eb07fb5005d14b
SHA1 2382006adeb49386aa4c8b1592b404dd2d6d4426
SHA512 cd8ece839bd2a7a38d2c680160c8b8945acc4be76901d6e2cdb75d257e72a4a213a610930053755a56f468ecafcd62fd17210b4d6b85c6378028ab73aefae96c
SSDEEP 98304:e0A9LTN9vSEjcQ5Mjdm2fuSh3KCP0ZYcf8wC8wPmLu3u2/J7jGRhrSz61cJf5:WLTN9vSycQOjA2fuSACPQnf8wC8wPwuz
TLSH
T1EF46333DC34E1955CD9E94B8B34F0FC6B2AEF11A3B0DA8B66E051722C60979419FEC94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CR51/Assets/_get/css/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  CR51/Assets/_get/font/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  CR51/Assets/_get/img/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5 behavioral6
- Target
  CR51/Assets/_get/img/logo_official.svg
- Size 4KB
- SHA256 b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
- MD5 0d105318575ea6a4fc653aa8290a3410
- SHA1 b8ef6c644ffdb3983c518014bc4c0ff4317a011b
- SHA512 8797088012937108aca1905e27dc49900ce00d5d51def982454a4c5389f4301a8857734c4178ef311dae6aed47f033e1c9df3d6f6b0b9bef694d9ce278b3d193
- SSDEEP 96:CXQSfsjFfE77sDwFD3udPJwEym6BxGuJCg6vuIp6v8TqUUwvd:WQAsjFfGML6TGu0ScTN
- TLSH
  T178A188DB736DD1C8BDD02ABDE9382BC23BBAF69C9624E244C30E59226147D875234D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  CR51/Assets/_get/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral9
- Target
  CR51/Assets/_get/js/additional-methods.min.js
- Size 22KB
- SHA256 f8d3e2d9178ac88eb284d0a527bf094b36cc9a286aeca8e697ce0bc11eb7d613
- MD5 9997bfbd021c27ac700aa09963e95311
- SHA1 93a7a74fc1b03a1b959d0756915ca4b715d25116
- SHA512 5d9132f1443dae7824c5056e80074eb81443989e4de2f0ae3570a1f0a967899803293bdfef397be5006d6951b594484c15ed9ad83b80db69d9618faab08dbfc4
- SSDEEP 384:Q6trQ7fnSCviS7rQebXNXA3hepZuBaTOKc1c7Ts:W7fShS7rQebXNw3hemBaTOxc7Ts
- TLSH
  T1B5A2954C6F86A1819BA53CE80CEBE14AA4F5EBF4D4490D9994C042C27EF5FC521F2E1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  CR51/Assets/_get/js/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13 behavioral14
- Target
  CR51/Assets/_get/js/jquery-3.3.1.min.js
- Size 105KB
- SHA256 97ecd42dea3bc998c5efd456bc13e2c45c700fba1c581961ca1481676bf08b42
- MD5 d532c905d593a7f16eff99f24f27621e
- SHA1 ea0f0d16f78ec4bbaf7866213a2f012d2793e14c
- SHA512 81d727042f98245db1a8b66cca98ab7898e8f98d774e8b3930273f66f3ece6db3b20d47598ecf88cf14f96553ab676dc3fce663bd34f299c72d71bbb82eb245a
- SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t9fc:5kn6x2xe9NK6nC6jUV
- TLSH
  T198B31ACD72CAB06247AB70B9407F610BF2361859684D8554F169D4EAFC78A4E8237F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  CR51/Assets/_get/js/jquery.mask.min.js
- Size 7KB
- SHA256 1fc9bbce36153eb9ff04a4ddd08f478ce3ab89ec84be0bdec656b4200567136c
- MD5 07d9472e6b812bf021e6bc22d158d7e4
- SHA1 471680ae1f7b30d1433a5d4b39ec6ebe3932448f
- SHA512 8038bc93c767af0e733f7f493e02e2e21cf70e451aa685eb447b6b7a00b20fbce2850c5b4ef667e308e01a54127d96ba7a03b8ed3f7301ec43a187c245a8a3ad
- SSDEEP 192:tQUK2CRYCovkLFGGFA6UxmiZduIBeAevZZ8PZO:tQUKLhFA6Uxm+EoeAexZ8M
- TLSH
  T180F1D791704771B226B374EE046F010AE77AFAB715AE0414D625C4E07E38F8F11A7EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  CR51/Assets/_get/js/jquery.validate.min.js
- Size 35KB
- SHA256 1327e703fcf1311de11818f1fedcef1ec0ba4f60734962c6955fdffc408d5287
- MD5 1cdeeb8eaca2a1357de0a82bd5e5526f
- SHA1 f0474ee246d33979152b20bfbea49045581792f3
- SHA512 46b7110e8c0a6d6ac5baca79402e934582fcb901e4b976b9a2fb61ae57ca6e03de1b35b2b8fbdf227a72e55d0752fe9a2213ba13d0728f4bf1a9d4d0f879896a
- SSDEEP 768:UjelKP3m5/1/3zrRwRfpM2gHvoOBKfGOiyOkH8DGt6ZkQQJ59/4:UKlKPE/N3HRwRfpM2zPiyOuwGYkQQ4
- TLSH
  T1E0F23F0AB7E1206A99737279DC5FCA05F1B2063B5159A86D38BC90D01FB1D9881F5FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  CR51/Assets/_get/js/kntl-bau.js
- Size 3KB
- SHA256 a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
- MD5 a635a55ddb6339a3d0d01c641f670753
- SHA1 a6dee4a1df6c51b82ce2e67323514e7de4e165d4
- SHA512 2562ca35be37bfe0b984ec288e23678bc97ba7a881764044e65914ea013742a5310a5c12839cb8a501a464791bc67868fe6a02ae149df9329e40562569eba42d
- TLSH
  T1A77175C474E1F15E539B20BB107FA34EF2B85A65596A8510E0A8C4BDBCB0C64867BF2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  CR51/Assets/_get/js/kntl.js
- Size 125KB
- SHA256 e3eb94507e7879d10c5ac827e21f512c7f57fb4300622a0e94426326c2e2f4a7
- MD5 94b623ee68461a65882e67fc56f36da4
- SHA1 2a567df0824abff72431a569aa22038140a0497b
- SHA512 e182119a46a8c155a7963b8a7ee1f0604efa2b01c0fc65368b41e634f12af56fb8d97d7bcafd757124787842ad562935eed94f065baf585a0088ac76f538d701
- SSDEEP 1536:cJ4htld1OPRbWlOgA6FhPOSRJKELguLDLKv2kY8XbUnJ+pxRvbS:DhttDXFhKELguLDLK+rmUJG3v+
- TLSH
  T1CCC309D93852F8616BF301B7109F2803733D1A2F680D4960A212EDD9B5FD45EA16BF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  CR51/Assets/_pale/css/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral25 behavioral26
- Target
  CR51/Assets/_pale/fonts/dcefont.svg
- Size 261KB
- SHA256 6f8c78e74c3dcd22b82010b0222aff9cd574e9ee3d2f2e48ed8cef7fc1ffa15f
- MD5 b8dd3b7bf72285beea86abb437f0c27d
- SHA1 d03a3846d3008438831a19bddebffa5b344e4d1f
- SHA512 8b1f935c9a387d0781f7cf2930488646a57052a3b838804292656cde0a6daaf460d642a7f6f60ccacdb08b4b8f731c27bc5d3c519c0c342c496d5884bffe4eff
- SSDEEP 1536:Rn9E4CKUNzsV+upmCKVicqPA16CzZHyGaSVHzXpr7R/0DLv8OA2P8apDU9Y2G8Vz:7KeA1AS+8VjVUfjRZe
- TLSH
  T10B44C9D9EBB092F8ADC967EFDB245CB8341A50BE3532896CC23D9F5455C390C5B188CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  CR51/Assets/_pale/fonts/index.php
- Size 547B
- SHA256 e10e88587c22b2a1a7c826f88544c4344dd93fc65c9897bc24fa4e1b8fb79d15
- MD5 399671c054cecf7c9cc4c185c0affa37
- SHA1 6e0f6a849aaaaa56492e57b12778ccfc5132d6f7
- SHA512 5093ffd708ea1fc3c9dc1c3158817f9541686f34cb468068e0409bbec93ce2f6c288630ae1ea3a59f36349b3362cdd2ba97cb2fa3f6fcec047fe6285e3770f20
- TLSH
  T148F0C09F00432C1E11B1817078C43026C72B1BA87F265472A98471BF04D6F5CCA977BA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral29 behavioral30
- Target
  CR51/Assets/_pale/fonts/opensans-light.svg
- Size 113KB
- SHA256 02defaa14182ffb27cd02822e02e03b341ee93e7ca3f34eb67ee61ca02fb15f4
- MD5 aba049e25755f0030d3c8a0a754bb71e
- SHA1 e5dda5dca2e71bd6426dec33308cb47babd7359a
- SHA512 51cdaf11312eefde07319434bdf4e892c426a3302331ebe3d05f659332f3da0de5ffc2bd77d395c36fe415929bd0c888e5991517dec411fedb769939ba765f2f
- SSDEEP 1536:PbbGsnmx8rF0B51vuRb1bObSbT1bDNOkG7m9DNn0V/gsUX3Q1lco8Ms/QFN3Lr/y:yAKfV7QBuF6ADn8QN7DoQbW
- TLSH
  T1B2B31336FDCCC66497EC51A8BA0649B0717973A72A553B161CAC6778EC003638FA9CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32