6986af189dc8425a4b861d350ec28509196870bb5187604a9dde89575c38c56a

Sharing

Copy URL Twitter E-mail

General

Target
fakemobywatel.rar
Size 948KB
Sample261011-wfmnfseb85
SHA256 6986af189dc8425a4b861d350ec28509196870bb5187604a9dde89575c38c56a
MD5 4cd3e7f3b8bcd65349d181a41ea3b15a
SHA1 5eb4b4a2d1878e4d0e7f785547c2b1573935df6a
SHA512 2ff28b6d1bc7e7be494094a21f621d1663772f338bd3447f598dc803904662cab0c27079b4b66be02f021d5dd310b76809672c01aaf00e9db48d870e844d28ff
SSDEEP 24576:PebVk1VPZmB1VPZmyvVyFh8FDT1VPZmY5wNzJVqx+Fy:0Ar2rxtnFD5rnGNzJVRQ
TLSH
T1D62523CBB35617F9A7659DD254F720A0ED8728B73009F98DB81C75400E842FA5FE362A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  fakemobywatel/assets/arrow.svg
- Size 240B
- SHA256 8f38ca601fb1ea58e6edad718e074a41fdf65c3c67d5e2135addc4d5283349a9
- MD5 fcecc743ade61d58611222cc2fd189ab
- SHA1 d94c663fc93c69810db6ab5d875cefa0bb01781a
- SHA512 289faf2a90c6ac991c4200554fd98a71e366447729699cd54d575f683436c1595ddbea2ce5806b38cdfd56baf2b0d36baea778ddd355a38d25aa08508c26ee80
- TLSH
  T1A0D0A77F5B885F57424656545DD8E0C1C173E0B854C840B4B39407617445AF3DD1E5B4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  fakemobywatel/assets/bar.js
- Size 3KB
- SHA256 05c3a0727185a9dfc0025b1d4be31d8013f3f6d6cf8fd40fe370251db9d5be34
- MD5 5327b7620416981f18d32420019fb400
- SHA1 2c02a530d8053be1edf81cb0cc9556c33b8fb6b0
- SHA512 97c7d50ef6564699225bf30448710f3e2a5ae6d8616c98efb2c16048cbf68bd88fcfbaf993d52996aa1d88f9356e6c9f04753da2e841fb039f051034e2967715
- TLSH
  T106613F641CB22C750033CC2B57EF6689F277A4277809E816391DC6402F81B5B527EEEE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  fakemobywatel/assets/card.js
- Size 4KB
- SHA256 0724a19cda8fd2f8dcf61a53d1c4c5e252834c69366fcd39767c17d444c1cf66
- MD5 396d3651e1252b15050d11c43a4a7bae
- SHA1 3c432235566e10bdf8ba56ee175a034723f1d65f
- SHA512 0919fff2a05cd145f27d3aa81e0249b2ce21a291d4d2b527fec28a1e4d4351f481761b2886f7c07e89fbbe592f9e1174e593874613946e501901471ed2ae4cf5
- SSDEEP 96:TAXI956kEEcXMxcXg0BZBbP2fXZ14lYST8k/fdz6OUhWiT5A:TA4956kB8Mxc5rD6I9YkHdz6N19A
- TLSH
  T1E2A1630AE5761779A6F717D2A05F82AC7DB0904A29C8C51034ACC4803FA4D997BFF5ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  fakemobywatel/assets/copy.svg
- Size 1KB
- SHA256 e91fc834cb94bb099d059899a9374bdd7bf0e439653cecc9acc03dbb46d7b0a4
- MD5 1e1c250b104588fc3937f677c123ffb4
- SHA1 7c531556196ff11d473606db5f58dcf0aa876e33
- SHA512 a1ecc5af6c98bb3de2624cf19ba2e84d0da25b6c3360d3205c838c54b7d2624e5db9359fa78ca4e7c13952aca5df56b0ecea8c27103ae24f52186735324c613c
- TLSH
  T1AC2180F1558905248D02C798EADC94B13CAD6CDDA2163254746183B1FDB43FE99B6FC8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  fakemobywatel/assets/discord.svg
- Size 1KB
- SHA256 fba26dab934059d8facf7782866fd1406a2ed92394b404b051d4768f78425ad9
- MD5 147f41c95f6ad7574168c3d3a462c455
- SHA1 63061ed6d3cb0a9bfc21d5ff38094f2b6ee2dc98
- SHA512 fb7ac9912d1e7da7286613bc82e7750b6f9812498dbb95f61d7774359e048b88d5e8e7474aea78b4b6451609ea1ea4afb2f67d81ab244e81bc433e29c7f675cf
- TLSH
  T1F0416788539EC6FD8F4953B7A8E000961A9E74CF0850B16ED6CD1BBF112627052059F9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  fakemobywatel/assets/hero.js
- Size 2KB
- SHA256 6079737ae2549c2642a3b30bff29747e6b7dc360bbc402d4638e5b1a63696435
- MD5 d83a3a0d02cd4439414d94ec5650f384
- SHA1 a385de69302b9ef3a981d280a16185dff867d3ea
- SHA512 9e58201c74c54a032984fbfb251df63e7fc574739d614f96582150ea10096e2aadaaf8cd925f2772ad2a837af2416391411410f36c77d63936b5011ca500f476
- TLSH
  T16541AE2D70F73132507764FAABCF62C5B62920473084D9593EBC86052FD1C698BE2AED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  fakemobywatel/assets/home.js
- Size 1KB
- SHA256 f9251a4aaf5367ef09664f10ff32c2aa9fc3b12f289e3cb322a7552080dc798f
- MD5 9b009972b85f12b08b0d2808ce69d71c
- SHA1 ccb70655589d7a386833406ada06674547065ca8
- SHA512 3cc7291a92d8c5ba69e1de4de7aac6616d0213bc154c7cf0a9bb74dada1f7ba7675807616e7c95db776e08eb92c1dfdc9fab5a1fa1428313fe882959c9f98807
- TLSH
  T1FE116A1DFF743436A06D830E4A4FA79A3E4623836709BDA0E534E9116EC19F840F224D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  fakemobywatel/assets/id.js
- Size 2KB
- SHA256 075ace63c4d61f07d47da90f120f93247a3d5c8910d0ecb6909e1a71de310e91
- MD5 031f96f999db7f4527568012a9c27530
- SHA1 0baf0b8e3b1f75cdbf71021918d2f6c5e6a12eac
- SHA512 791f7607eaeceb5a6a0a49c648cb1dc766c4dcb645a0328e350f011f5007a32b67118c2ff192262e6ab73caf47c393602cd99d6a42c4f82237e0713bc0fe0b86
- TLSH
  T19B410E0C5779043862B32174B7CE428A3AB00657700CE964787CA7050F80EA493FAEF6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  fakemobywatel/assets/images/mc.svg
- Size 21KB
- SHA256 5937d4170fdedd52067f67e6456b217d1a56ff6545eba3523529b2c18fe163d8
- MD5 30f2b80f8c9609d64fade115ce3c12a1
- SHA1 6d7d1d251a45ce816d3d2d49e19448a7c86d02fe
- SHA512 b60bb7c6fa977753ebcfb55d0e03f5968592367adb3e7e6fc50e2371e80e64d13ebfba434a33eef722bfd4f268888d358941466db71e1a401bc69d4ea9bde061
- SSDEEP 384:nnVxJnhonOS4sy0yuFBruS08PP1a4liAcHmiBiCCxUl89DFEbbFk:nnl6nxpyen6IP9xiFmiKUSFsFk
- TLSH
  T1C2A285C663F4A7ACF6848B7D6320666527F578617832CFC4C74E68257A45ECE292CC23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  fakemobywatel/assets/manifest.js
- Size 401B
- SHA256 439b5cd61e97da36e59ab8fe12cc6398e5cd987a70b388f3349eb62ccb4f855f
- MD5 66f92b840a925554ad53799aa76804ac
- SHA1 7a628e3020b6b12e78dd84df795164f4caf6ca31
- SHA512 bd1c10390e16418bcfc319faf9afd602783885624f69a3871d9997c5839be3bcc4d6cf8b138b2ae5fd00ef8a2a473b844bf2403c83d67f7bead6671d8259a17f
- TLSH
  T173E02BB68C5E2CB30D59000904724B47B21C241B28271A50ADACFCDD32D6EBE1475179
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  fakemobywatel/assets/qr.js
- Size 370B
- SHA256 9f14cbf0194fe644be590e4a99129e79a8224e845009027b8b4392736cdef4f6
- MD5 f087301ca56d5d77071c78020394cde0
- SHA1 b2adb49fc2c4672fece64c49f02c31246fe8cb02
- SHA512 23cedae71c03d8db5d5a729ae976c14fd654c2b5ea1d4fcd6365d4667acceb4b57fdca0e9c06778458b24272f23fef8a9f487b35aea3613569ccc0bedc372abb
- TLSH
  T15FE0C02D99BC053B007F52ABA26B27ED37A410CB41448C243C9C48840FD0DD51DE4BD1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  fakemobywatel/assets/session-check.js
- Size 544B
- SHA256 ff7309f2fbf70bed2f93d3f6e95fd74288116f9429faffdb10dab4eb831e6595
- MD5 e521096de109ec1f9d084a92e4073a6b
- SHA1 1d6fd83c34f61c0589ceb0efb663a0b65c3d3a0a
- SHA512 c33ab1e7037f8b92dc37356699024e1e0a80bdd12437996c027993fef4563c2fb76090ea853631437a62ac921193e933a0f49a4157b62812336436b156cfc4ee
- TLSH
  T123F0C06621FA00250837E43C064EC4122C3B80635B19ED00F98D83415F8574D81C6ED0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  fakemobywatel/assets/trash.svg
- Size 1KB
- SHA256 154dbdf5ef0dc3ac27377b169b28b54fae31b8f6f3e1404a6bcd3cdedd00e193
- MD5 2c3886e2157869dd0efe0945d39a29e6
- SHA1 79256d61fa8e35347874107571a875b208d9df14
- SHA512 2272de3bf0af975acc9fe19be72df96c018f893576dc85960f4efd08812567b4cf4114f1b03931fb7e0455a3592f3666dc511ea7af0a161c16d5c2bab391c38b
- TLSH
  T1632152D28B4C816D381F53BFABB49223232F6030F2515518A8EF5B20105F897DD8BD10
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  fakemobywatel/assetsdiff/bar.js.pobrane
- Size 776B
- SHA256 dd644b4007889580b27c1209a0b469957a17378a1c6fe215976fa002d1628266
- MD5 1d6ab93c4342abd27812b4ef61948c41
- SHA1 735c3349ffbb7b879d11a43ec19df5a21af6bbcd
- SHA512 2a50c6f77387b1bc5cc3bb6a2f98020879fffb1868590d29c89d6a5b4ebb6bb8dd7c68a180b5383e6516c65a224775cf0b5f367a7c4772b737076d4f0868335f
- TLSH
  T1AE019088B6FB60720237293F969AB64D7171500B744DAC02399C8B847FDAD6B07F6D9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  fakemobywatel/assetsdiff/cache.js.pobrane
- Size 1KB
- SHA256 ec1dc5b367bb31c917db4997a65503589412724bca3b45603a847ad99e36af01
- MD5 1bb622f8a96daee4b53c102c367ffcc4
- SHA1 6905a0ac8f4ed3bdd5fcb83d0cbae98be84a62a2
- SHA512 8ea9c2e6f73d2fb29d8b523e4e0b7d4327a9f4808f8a587b210e5ac96fe1d3aab875d54166489de6fa6cd14bf303e51a24efb0936f3f865ebd5c4640dfa06aba
- TLSH
  T18D218E12693B26A1D1B330D88B5753162D1A50073781CDED7FAD82406F8790ADDEA9F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  fakemobywatel/assetsdiff/flow.js.pobrane
- Size 395B
- SHA256 9a7f1a4a524be3a762a1dc16da7cde43c4f0b9e902060f40a3233a0febc50b54
- MD5 175310e209af03042619bcea691a7e93
- SHA1 813221e58d378bebc1068f25e6a1e6186452aa1d
- SHA512 0eaadd1755c48eca6b6e76f0d81c4bc466908fb72a5742671be852411c5a66b469c3f4438ca8070158d939b31dd14b38b36da30ab63e46aa2af7d49c83762d3b
- TLSH
  T1B1E0232C05640DB614DF014DC3DE95793AF04103D0699B1A34EC99542F9077B00959F2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32