296eb03cc779ec79ce5e505956c6fccf5add0b4a92ac9efd24acc3e593b5ab09

Sharing

Copy URL Twitter E-mail

General

Target
hostbms-0.2.0-dev.zip
Size 18.1MB
Sample261014-vsggjaws7j
SHA256 296eb03cc779ec79ce5e505956c6fccf5add0b4a92ac9efd24acc3e593b5ab09
MD5 ae60173cf1da026de3d025276e25952b
SHA1 f80cc23037395f7936440102bcd88c634cc276f8
SHA512 c0f8723a5dcab4441ff274ab55af34b2c52607186091f9c264811b9deb807568673e3887c43fdedcd98e08e20ad22c89c96926fb784b329f663db3d45f6163c9
SSDEEP 393216:N7mA1omY+yat7s1FroUy7ITBxQKAnXbOB0UXYtMtGHtm8P7frJNGlLeGeG1WbNTo:pX1OataDy8deXbOWhtlttLVNGkGrWbG
TLSH
T14B1722339318F065DD93EBB0DFC6B7D1AB95A0819D833E5730C8A654E0628D64F6B13A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  hostbms/admin/clientsbilling.php
- Size 3KB
- SHA256 258e42f4791332f5cbbb688923f6849a9c8b167051615388b50c1304449bc1c9
- MD5 978fdf5df61d374e7bd6c1f8c0da58d5
- SHA1 f7b59237acfb3ffbca94d97bf556e43e55919402
- SHA512 67721196b2a17211e79a7248e80c7a182bc7b546d3be59f745373b4f6ca0239683e0f78befe5129c9a4fee18a583c858cae6d1e0d1ac0070bcc7e52f9d779a9e
- TLSH
  T141810E66AA6E16F0A9FFE36FC872D8401D615D2315527271FEEC55AC4FC44BC8E2C828
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  hostbms/admin/configadmins.php
- Size 4KB
- SHA256 dac9c6bf3d892052130a79a2412a7bdae2bb1d25882f6a5eb82161aa75de75d8
- MD5 1bec7badc7a1090574b45efb4f0f2222
- SHA1 5bf33d20fc6b9d0859eb7ee7920a7a7ef42efcb7
- SHA512 2bb60ae6b40790192b931dd5c9986c6e5511ec2758889d43c0bcf0a2586e3d3c04b1fc2a98a00b0c96f9f0f213b1419b876f0cd61ef5fda2f9602685e09f5594
- SSDEEP 96:wA3tfTwEbaiT42KyRshGKnj038fvEHCRXqv:VcCD42BRshVQ38fcQk
- TLSH
  T1F191866A0DDB16D08D57F0EFD8884444B661C80365603BB4FEDD1B5C9FCA0758CF4AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  hostbms/admin/configbilling.php
- Size 7KB
- SHA256 0be9a8c6aeb3b1008bf32037803fda17d6a5c81a78d2bacf41bc379f7a07bfb1
- MD5 65cc4f2cbd1f988e91b62cc97215f85a
- SHA1 2fd95750c5892e033451699bb92decc26895b40c
- SHA512 6c077da23a79ea52ff14a2cb96cd5b0fabc5ff64016e632e654bdf6095a9d32ffd8da0752fe7e9f492b643cf50f66b7f6691a4f09c7b84dbb594e786cf25da43
- SSDEEP 96:wE4ha310QhpUMWY82NU/IykVKbhdS/iB0AKBTBvaKdEKnUyi1wznrklA1J39BWi:EQhCMWY8MUgEbhdSqnca1KUyiiznolhi
- TLSH
  T139F1556471BA71A49CB7666BD273890C0D210D534418F5A2FAED6E6D0FD03B0AFB4E78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  hostbms/admin/configemailtemplates.php
- Size 5KB
- SHA256 6a5157745cbcceacddd35f172aabe2da57423d0cd74f17c28d3fb3ad773bbfab
- MD5 ba4ca95392d99f39e6eabf06f4f5a10c
- SHA1 9285f23615691028f15e062c82a3263ffef55c8e
- SHA512 cf2aa18f6455d7d72ef9c27b283e3eb15e34f7725c6e111b1822eaece6de47dd713f0e242dff9dce80a5c1d10c7ccb8b6ec47f14e09fbeded44d95f4212ff5c9
- SSDEEP 96:w+3zKQYtVvnv9CNOfcPNLof0FPJwt5J8CUq8ICf1CBCr7YKuUy66vT8:zKQ8nVCNOEVQ0hmGCUrhdCBCnuMeg
- TLSH
  T1D8B1547760BE87A04973A09AF8527844943148035EC57B63FBDC269C0FD5839EDBC798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  hostbms/admin/configmail.php
- Size 2KB
- SHA256 8b0d289d6b3cec69bebe2a72941959405a81955fb5aac4d6cf518aeb4a02e0a9
- MD5 8d4165e25bf6f587e010baee17b42bab
- SHA1 561eabd3f6d609f3fb93b8f1b2ca85529a608e0b
- SHA512 4ccfbf4f35098ff5a6c3e17899f99b86db69fc908e28405918b331e96cbbf2f91346e8ba29e7c420f001fca070c19c7f6025cb83d45c7256a2c365f1de916cef
- TLSH
  T1BB51CE05106B11E5983BD6DBE632D6045A030D270932B8B3FFAC6D4E4FC9B5C7DA45A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  hostbms/admin/invoices.php
- Size 9KB
- SHA256 a3e65af69fd2294dde182de78a5cb8a1561f9d0b6f955c5b98d11aeb87eff29a
- MD5 5a2d06d93510262ba915a57698096e77
- SHA1 f65b0203de560cfdaf8c9c41dd4b35177c70d515
- SHA512 fd67bdec18dabfea0e20d4dd78d7c053f01534d6d96b1d0edbba0c54757ee68066f9a680e6551fe97e642ec9c4b228f0e51652fbc1027a9511962b8baa0c3315
- SSDEEP 192:2BqBaofjb+zINI2DJqYmWZ6oCEkuCoYOS0BBBeqdYfWc:2kdOIGOSIn9dYec
- TLSH
  T13D220B1DAAAE52F298B7611BCA77E8001D250C1398927670FEDF146C0FD41BCDE7D968
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  hostbms/admin/ordersadd.php
- Size 3KB
- SHA256 c154abe2831caaae328bf3d23c2ea4d51ddba7bbb77f3e7da1f48f142daaf9e7
- MD5 b3186fb594a09b21734a12c34a8323f6
- SHA1 4a1368f4468ccfda793e579f21d4b13995210603
- SHA512 62e65977776da2c5f2e695a546cfc175d510836f79a885a54143022287cc958bc0a5ce00e68e919f48b3417fef30e121cd460136efe1a9ac8c1fa4e2e2ff0907
- TLSH
  T187810F91E6BD11B0C413B6AFC4869CA0AE25A80394E276E1FCED262C5FC0438CF3586D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  hostbms/admin/quotes.php
- Size 6KB
- SHA256 e560fef694d5ec76dd54e568b6ca1bb0baedbc0355fff88ecb4d1a8634311626
- MD5 bc79e71c7e98c2cddda05a86d1da5e6e
- SHA1 bcadf04a2ce235f3c75c5c39b1514b8d711288f7
- SHA512 480232713b08b2097e74b8b13feb06c9762fe7c7edeea8ed6b5bba2d65a36bf240ec190c02e3c01f0b2e6a43ad753833ff9386e61b66b725717739daa02a0941
- SSDEEP 192:uWwIPCyrxFuHW0QMBfmGX1qP0dM2aGBgnrBQBB:uWbw5mGw00GwrKX
- TLSH
  T193D11F1A55EF15F0CC6BB11B9EAE98706E22481394917B60FFDC781E8FC4178CD74A64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  hostbms/admin/supporttickets.php
- Size 8KB
- SHA256 5d218801f31dc413977e3716a08c40466b8a18ac6de537ec74aa307a16db8f8b
- MD5 576d283976a139c6efc8e6b2be2015b1
- SHA1 664e15257a6fdc4d998c3b9191bbe72bd123be78
- SHA512 82b350bb083ad402d97253f3fcefbfc47953ea705fee4824b32a41fe3fbad8d32d678047c90ab2b38dd2eab8445a6d331a1eb17c603cb7825250825d42d9e41f
- SSDEEP 192:PzBTEiIBvz/0KErER/nOlGpowbI1GZaWBFBV6:r9yd/0Vr4WlGRTX6
- TLSH
  T171021F34A6BA65E0DC33700BEAD3A5517D62AC23649173F2FE9C598C5FC4078CEE8558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  hostbms/admin/templates/glass/configbilling.tpl
- Size 7KB
- SHA256 d146eb44c26e444a19239e1e6e097c370e140ec7dcb82897bc9621aabaf0e39e
- MD5 23b19722ba2f51db3c11f9bc95d6923a
- SHA1 aa98fd76729be82051726a48b678d529661033f1
- SHA512 b556d93bf9c9cb68d6e2e20192c01040c1c026c27ce1a992dd65cf7631d61c04929b3827c783c6592425c3fcc479c6ca4182707ae4a1191217a01687e0fc5f1e
- SSDEEP 192:HFqG35AQDyUFuDfTOZ63rFIsXbyZaDzdZ:HjqyyZDK4HLMQRZ
- TLSH
  T1B0F1A41430F0AE3685538CA5BEE65B165C6AD203D70C285071DDD9ED9FE3C94CB33AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  hostbms/admin/templates/glass/header.tpl
- Size 2KB
- SHA256 6b72b3aa6368958c1b4a5f2fd1a5505e6483e1c6be918c61e34f2828fb236878
- MD5 a7843b695be3344de305cfed51024149
- SHA1 582e403a243c59745aa243533e1cad953eeb8716
- SHA512 8a2b279c1dc190741d8d0def89125acd5c1ad360063a4531a0443939a60a46cf572ce5d7132028a2a36795d0973cb7a9a94480581f2aadf4a2e581f54ef24550
- TLSH
  T1B441650250610AFF677382D0ABB3B3ADB4E3A707D5062C007EE5076D6FA2D12983796D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  hostbms/admin/templates/glass/login.tpl
- Size 1KB
- SHA256 17e1e99815e6f2d59bd4f72fcb89d2ab20888a7570e67d7b16b741fcd3446630
- MD5 a9c8a19aa57628e227b04b93c3737429
- SHA1 0389dd35acf783e80d980909039554f1e488f6f0
- SHA512 276a5683aba1e43abe0c69880bee00cd5fb03aaf2a16570a6b19a6df75f0fd42423447724ecdd4552d7d12984d32c6ab3afaff00d64366234a6cbda4527f6ffd
- TLSH
  T1D9214E01509A0DBBA3028290AFEB121934DBC76783565D007FF8E65D6BB5F518C3B52F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  hostbms/admin/templates/glass/login2fa.tpl
- Size 1KB
- SHA256 4d2a371beb9c0e08becb7cc0c6374efeedf649b847e251c8d0ec85fe5ec70189
- MD5 c8aa346529ac468e56aeb753b079b335
- SHA1 1a0b6f14f99bf72c70041f7fc6ad0574e4656c65
- SHA512 d9b62262b0166f6d7baa8a01d83c9a6c4953e8221a25a964b6ae51b5254379833e7544f8d1b9df62faaa662fa660c9468c57874ec254f07764e0581927cef9c8
- TLSH
  T12B218701609A4D27038340E4EBCF0306549FC793C6595D047D78B1A12BEDF119D7F25E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  hostbms/admin/templates/glass/pwreset.tpl
- Size 1KB
- SHA256 1e735167b62284f02d8403833d214e1dd7ccd8c34abd60d98511b283ccd996ef
- MD5 f16400a62c82595f5bb4ea2556f3e43b
- SHA1 89db16fe014c93872b7f7728b24cf83887066408
- SHA512 11e122ca51b061951394b9bcbdd36db73921eb51be4528ad18cdfd894199fd1a46d39971f7c8264b3c70bb051bc7d31a7611d4ad11beb5243871d03b9c3022ea
- TLSH
  T1AC41640100A44D7B8702D6916BCB12297877C2978A764D00BBBCD7AD7BB6E0209B75AF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  hostbms/admin/templates/glass/quote.tpl
- Size 7KB
- SHA256 82e23e1b946aec65b909fd7784e1d89f8cc31fc7fc2163b876b1e27d023bbb71
- MD5 99ec0060438ee29ca9064e77a5fb636b
- SHA1 9bd23e32392059b9861b51d91d21f3ebbfef8048
- SHA512 f6f3443aa797e3e455c9d4b5cfc1a75d63d2bc05a596cccab670e1d7e407d1f84fc36d69e306388df40513567e042779d66acdeb8f10baab606d732ebc7c282b
- SSDEEP 192:HpXpe+xL9xzHFSaQouGvia4Zy4M45yz+iEnvsocw:HpXpe+HxpxQnGB311z+mw
- TLSH
  T10AF1A500B0F09D72C5B76860BF9D9B366DA6D21BC9843210B6CDC5EF4F9ACD18613659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  hostbms/assets/img/hostbms-logo.svg
- Size 1KB
- SHA256 7722ac50b631f1ecf50e3a88ed701f82a4826b273c4a21225538b540847afd55
- MD5 d408975d0ff6d0786f792c71adcec9ab
- SHA1 8936afd3b88ba975c55732ca7fb42416efe892f5
- SHA512 f54700b618245b1f3c61aa4be1fe9adc6474d8d5ed1f2c144857ef51627737d0061a318a908744ee6c978634812b82207e93d0f45fbd43ea06f4671c4024370c
- TLSH
  T12F219D65E20C8C2FE350C21D971561B4326F91CB8789D318B8902E3D9A284E7BC673BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32