0fe6702324fd514045fdc8c69d850d4545caa60f8b74e70cddec8aa8bd941d3f

Sharing

Copy URL Twitter E-mail

General

Target
tuttobene.zip
Size 3.7MB
Sample261027-pceecacz2x
SHA256 0fe6702324fd514045fdc8c69d850d4545caa60f8b74e70cddec8aa8bd941d3f
MD5 f6c03f5bb334bd13f05023cdc8dcde77
SHA1 9eaf23d3ecbf96f864fa1131a0f2a176274b92e4
SHA512 e74307a38d16f5c53fac58450e39dad9ad1833ff9c2f34b2dcab28bd51318dd538745221674580222b68535f0f45c3c3098dd74be64f5e52351fbe5268faf8e5
SSDEEP 98304:IC21srBgEgi5a40B3vNfGI/u8xCRiDLyOv5RQt7sdD7Y:IC2upg/dtvbD5vQ8D7Y
TLSH
T1CB0633E1E2FE0A03D086F0787CAA45409E7C7349B6B5BF8E125953C56F809ED690877B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  idhandel2login/assets/js/jquery.js
- Size 265KB
- SHA256 84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
- MD5 2ac898daf1837381b1264cdb792319ba
- SHA1 532496df4622a43699ee57b612180a21aedad065
- SHA512 f76767b86456a59400e0c01aca45bb8048870d3c3f345024020bdc7395e95a7dcf429a014781d1d386eef45830a8b454c51bfc1f94ea71f03d81fdfabc0186d0
- SSDEEP 6144:nCfa6/j7/KDT1krl+xFbP8s+JgOO/p89lPuY1BHpkYpHeGEbM5AeQz:npbxFbPuhY89RJjHe3bM57Qz
- TLSH
  T16044C4D9734F115F4BA233AAE43B5249FF7DD1B0520551ACB58D986C24A081883FAFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  idhandel2login/assets/js/jquery.maskedinput.js
- Size 10KB
- SHA256 b134fc3f777a1aeb46d45b7999e88fb655daa62f4fafe5bcaed5f70b4bb7bcef
- MD5 8d8ec956b7eac73a9b778a210eb795a7
- SHA1 931dbe67bdabb253767000230f692b5d06eedf34
- SHA512 54a35645e694a742370f12a46a98b176226f80d7617778ce575c8afbd6efec632a10757d96ee92e8812046ff09e44cea50afe183449d6bf658d5f7eed44d6e6b
- SSDEEP 96:VBRRS3DZo/zdr5Q29ONKjGOBKzwPgWYMg8RHYTke8KSO7JPoxg4OOaYjrdofdkXE:a3OBtn9HKOEzUr+TkxAoxMu0T
- TLSH
  T11922630ABCA9516552B3B33BFBEBC809F63B853B4085D504792C20506F3199447FAFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  idhandel2login/assets/js/jquery.payform.js
- Size 22KB
- SHA256 c184992d8f1593c2dc3b9aa2c824456ce98b0e4642db9e60f1ad2fc24b546969
- MD5 bb188ec6403e22d8d3e35d45280d2f8b
- SHA1 4482f9d1611762171fd19ffc729e032b3e439a02
- SHA512 bf6fcc71923b77834e9ebd21c518641cd7eb6d0a334043f62bb079b71cdf31476d236a5c9632ce359296b08e8f2bf0aecc747b1202c7f8b2f5fc5a9ea22605ad
- SSDEEP 384:27/PVdHMog62PSIOKzVXACzzrpqUPw84qh+9+SZHb2:27/PbBg62PoC/E84qhDgHb2
- TLSH
  T16DA2DC88FAF761E08227F13D47DF95466634C993080CED26BC8C5A606F12D6C56F9BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  idhandel2login/assets/js/jquery.payment.js
- Size 17KB
- SHA256 95d434ce5101fa0215bc35d3422c524705f6cd7998b728fcc6d8277b07f39730
- MD5 d0cd37a5f6132b4fe1666c0ac4f50189
- SHA1 5c42d4bf60af3f907ad071190f2dabed2b714fbb
- SHA512 d753dcda50ba27a2e1f0dee4a07ed0f78608666f3901a51e7a87c2b150cc2c3bdd543f6e0c1b3e8b4f1721415e3f5ae3556b67dbe51dc48bca3d6d3497cb5ff9
- SSDEEP 384:ygyTYL/0cWA1uHHfxiMlCg2N71j7dcCUsFAaDP:ygIK/4jfkMgbtm0FAsP
- TLSH
  T17D72C08CBAA660D08633B3384FAB9505EF7E867714055259BCAC61916F31E5093F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  idhandel2login/assets/js/jquery.validate.js
- Size 46KB
- SHA256 643cec1f3b8b02da905715f06e046d7c03d743b500a09457040503bdcf46f422
- MD5 7a45b98cf941a7424ada1fe86ec32043
- SHA1 691c70b507992c9a24aa42fb849b940a8f90bddc
- SHA512 57ea8363a56865292ab121b06c207648148a24c8277c8747c1d6302139051d55aa19d7798590d8b353d77390d42b76a83a6b00cf80d6bab434ed247d9092db32
- SSDEEP 768:uuXCYhsDv9BvI/V8cmPb9iRcn1w/qUbKY9baALXMVJmSHtqDkFaMWLGtCXXxI9YT:KYhsDv9dI/V8cmPb0m1w/qUbKY9baALP
- TLSH
  T18C234288378F005F8D8933EAA87A518DEAFDD0759111A07CB8DE14A455F8CA853F5FB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  idhandel2login/assets/js/signin-split - Copy.js
- Size 126KB
- SHA256 4e45f8e99b5340d93ecb7858f56ea5d3540c160487e2ccc8ac359ac9c56c9abf
- MD5 5e8b948d839c58df9c54ef1a2846bb8a
- SHA1 f611171ae043a5ac8193aa47c2cc97f155d0251a
- SHA512 49ba0f35cb16334df5666f8be32830e2bdd0c398bf17efb1ee09a4c9839096364f22c10a09a0127157d8cf29123339eb9a962396193c7fb1236ce3dceb5e645e
- SSDEEP 1536:Wo7IPi0bJ5ic3p8VZtG/w4PWDznzMjI6VWXiPQuYDgNwlVwjNR3Cv:Jwi0l5xpOeICWPw5ciBYk+lVwjvyv
- TLSH
  T1DDC308A231AD1479275B22B774E7538174345D59E80ADA188A3CD4383CB8DDB7332FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  idhandel2login/assets/js/signin-split.js
- Size 235KB
- SHA256 b6ad46110e5f12db2a326c68c9b9beffc4863d3c1ef58f9d75470fb331fafb73
- MD5 73c30d1d7c104707741ebbc18054b761
- SHA1 fc37cbbf017d69a1358b2580fd9bb08f4634ce81
- SHA512 b71124b9f5c86d73691705c44855c9e2c02b5717a1a82fb5b07af12bd404a3738174636246a669b63025f09cf60ffb54737716e5b995ad87468a940418c96839
- SSDEEP 3072:A2fkb+EHp/cPRI5USZ0b0zjkq0z0hLZre:1fkb+EJ/cPRI+SZ0b0zjL0z0hLZre
- TLSH
  T1E434939A31982030E537B3BADAA79108FA35572F9042CE2A3D7C54292F74C55A372FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  idhandel2login/assets/logo_captcha.svg
- Size 11KB
- SHA256 43494decf70910561fa1af6b727de834115d40f4109e043ae96cb0a0d855a2aa
- MD5 7ec03458ae917bb270589164fe43c9f6
- SHA1 d914b05c5fb8b5a944ca2eed3519b87439bdf5f3
- SHA512 c6373c21cc51e557a33e367fcc391fc58f445fe12f63ad9dfcff4cbeaf8aa05a6e51c5ce20d95f80be9997c8482d61ebf32be73d39da4d06ebd48679a8a5d5cd
- SSDEEP 192:RiXFdgKBW/N63Fyy0pC5a1em2+DOIqbloVxvqDFhRcZdXax6OgaHbV2Flh:YXAK8NMFJ5aD2+6IqbloVxyDFhRcZdXF
- TLSH
  T1FD3276DA9F70A1B8E5DE0F6FDF2394956DAF64B91F2645C042ECDE4C94C39A88408C50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  idhandel2login/config/config.js
- Size 3KB
- SHA256 9ee8dd7fbdf14cd27a7c7f21086bf3f1d55a22f4e3b6d41cae76f842a5b840f2
- MD5 52b7bec44c94c9377f92aed04293a634
- SHA1 fe351a6c4901a8776ec5600f2f064ce10f2b0c12
- SHA512 972087c779a31eb9a46af5c632f29792cbd9aa82130bb1b567665729dc8b76d79c387c05496f68ffba14c6be732494b93041141170cae6480a77ac7627d5b3e2
- TLSH
  T12471DE01DDB7F5192A4ECF60BA05EE41FEC5552932C1C91A6F9EC3C2FB93291806D46D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  idhandel2login/index.html
- Size 935KB
- SHA256 9eec2c503b5fd462eb8a63ad4b4a7460e7de7da287139056fa43fb2a4ca49db8
- MD5 5d0db5b34c1db6bb67d75100f2cfaa0d
- SHA1 b57580e602f47b845af2876c0f70a9a3221516c2
- SHA512 0032ad0cde7aa0158aff16831c4d8b121af6115f0d87e422811a18c2f2d5e2f4e95171c3df171efb0c071fff970415a4f6c01269e92f0e032f3c551e1631ce88
- SSDEEP 12288:9xHG84U5l9dmWs0bpsGOqBdfsg+DyphDAfG8wU57o:rm84ZhGfEDyph8e8wJ
- TLSH
  T126152A31F52391BB2A23613E23DA994A2AB4E443CD01FF987EDDB0544FC92FB15D2649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral19 behavioral20
- Target
  idhandel2login/js/jquery-3.2.1.min.js
- Size 84KB
- SHA256 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
- MD5 c9f5aeeca3ad37bf2aa006139b935f0a
- SHA1 1055018c28ab41087ef9ccefe411606893dabea2
- SHA512 dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58
- SSDEEP 1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
- TLSH
  T14483E6D9B2C67062977730B950BF410BB17A98DAB44C8C60F158D9D47EB8A8D907BF2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  idhandel2login/js/jquery-3.4.1.min.js
- Size 86KB
- SHA256 124e731b25dcf93cdcd68fe4b17d9aa4db2bb2ca7809f71906723a4da1e1304d
- MD5 0ea41e0e21ab2fe992f05010eacd7510
- SHA1 7670f148bc578fad7d083d402cd5ec76e8636652
- SHA512 0983c2305d93486c381e3707af06af2050d94af5cf76e5876f5a322c980fce2a42dbaa5bf842e054aa62676ae6a1f0b57c2b72ea2fa2e12b372db33632417216
- SSDEEP 1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZIOPmw:jgZm0H5HO5+gCKWZ7PmHQ47GKc
- TLSH
  T1A48319DD72C6706257B761BA00BF540BF236599E6C4D4410F124E8EABC78A4A823BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  idhandel2login/js/jquery.maskedinput.js
- Size 10KB
- SHA256 7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
- MD5 1cdeafe84120b621dcd953592a94c998
- SHA1 cedacae8a3b765d2d905a5c51769027733ef6823
- SHA512 c9570962e56599a3ebbf71517c16066d76aeac7b01d9c1a6c87af845fd5cc404be20e7bfb42ab1598fc4a0128ba03927638a08d41349d65494d9dc711a8f560f
- SSDEEP 192:mpKjopavcSu8i3w6GSAySgVMq3myTlcOSXUiSHNMGXujp9ulWz:mM9UX/LEvP
- TLSH
  T1BD22620AACF750655263B03FBBDF8809623B952B508DDD05392C22505F15AB44BFAFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  idhandel2login/js/jquery.maskedinput.min.js
- Size 4KB
- SHA256 fb82877818fa23c8c028053cc5744c5d7947faca82bd50a82b918016499bfb62
- MD5 bb2a5846df151c66877e0c198b61b684
- SHA1 95a26d7d09bff3cf0c3a8a3b75056c73410e90fc
- SHA512 7782a4428864f87b301ace80d5de866a4e816fdacc5adc6339ad08898e3d4374de15de710338d65c30815bd452ee6f3a150e11cccd8174799d2679ca458927c7
- SSDEEP 96:rNYaTbFaRZqD1B7sfha1s+Gib2V81qJQOPG:KaQRZqKhadGib2VyO4
- TLSH
  T1A591C999BDD0710361B308E500BF861981395FEA542F95D2A021F9DCBD38E2921E7D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  idhandel2login/js/jquery.modal.min.js
- Size 4KB
- SHA256 a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
- MD5 c8f50397e0560719c62a35318f413e16
- SHA1 a643db87287e6e940fbabe6d8cfee5a8775692d8
- SHA512 fcf2d708251c814a4b84572e7c2f6ca64c0162267f7f5a6007e94e7a475abb4b9ee36da58a91a19196c451bf6ef223b6249d9171bb620b2bdb50fa11d88bc2a0
- SSDEEP 96:jPCbS/KZzQeF0VczC5x4MIKG3okQ9vGmzSUXd7INVdYH9LzYIED1OlX:jKbS2QeqV3v4MdG3zQBHzS+PYIED1O
- TLSH
  T165A11F0BEEBC635902FF90AA3D9E1D394135A2B06407448C7578CBD979A8C08606FE7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  idhandel2login/js/jquery.popupoverlay.js
- Size 33KB
- SHA256 4aa49da63228c28cf30fcea427842fc6d8dcd2bb493fcdb127a2e473de9f49c4
- MD5 6c7e6ba5273829754551f4bc428498a6
- SHA1 c9bd9d9285644ced4faff31dfce6555b2662e391
- SHA512 476bf22cd32e85a7338eb65a8fa1778f94dee32b4a23ae491bb73ca558f5815136b709661a6dd3ee85fcc94ac68ebd1749ba5494fe73a1ed39819b820946d17e
- SSDEEP 384:AUSYPMeipx0z8YYmmHJ29B0OGFuZu1RelOgoCm9vw+vwBLRXwbHhPejY1GD+sLrN:VPMeiu8YYWOu2BSYUnAu
- TLSH
  T1FEE23049A063335258BFA7B95FE6594CE73C423766014E243D6D57D80FB0A20E2E6EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32