Overview

overview

8

Static

static

1

index.html

windows10-2004-x64

8

index.html

windows11-ltsc_2024-x64

3

Resubmissions

27/10/2026, 23:15

261027-28wpqaxvaw3

27/10/2026, 22:53

261027-2vffksef658

Sharing

Copy URL Twitter E-mail

General

  • Target
    index.php
  • Size 12KB
  • Sample261027-2vffksef65
  • SHA256 a4ac9dcd045e9f21bccceef2846a209f25deb2cca87019893938604413ec7e8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target
      index.php
    • Size 12KB
    • SHA256 a4ac9dcd045e9f21bccceef2846a209f25deb2cca87019893938604413ec7e8b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionspywarestealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to get system information.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks