Suspicious
Suspect

9d6f9af0db3a2c612b634a1f769a8dd5

ZIP Archive
MD5: 9d6f9af0db3a2c612b634a1f769a8dd5
Size: 7.74 MB
application/zip

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 9d6f9af0db3a2c612b634a1f769a8dd5
Sha1 9fa1b399e17b5c79883b24a7c7feff4b1ae5bab9
Sha256 0507f067f172fb4d8d152d360b362ae0de6d6fd77c4c8f4c6c1560c875b5a4ff
Sha384 767786ace95bb6311432f4668a589164675b37fe18507dc396fbe854ef70947e60c4026ffb83cf359d30e81506316fdd
Sha512 dab136bada0a10198971cc9fff199ea6e9508bb98577bfed04fd22d976f1de9f8ec4255582518c43674f6b77023122cca6c1dba756497a268093085bc1531575
SSDeep 98304:4XquhpDBT10r5JKvPC18313VbdxyxLneZs4psUp48YnWLNkh7VtUiU2Vp6RAwUND:4awTCPH1wHdxKUzjpwWEU7CERAGpm
TLSH E27633FE26845081EF03A474415AEDC390C697AF439EFAEC35FA2B0D0DD696C219D91E
9d6f9af0db3a2c612b634a1f769a8dd5
corporacionbi
config.php
facial.php
facial.php
0x00001993.svg
0x00001B00.svg
0x00001CA3.svg
0x00001CA3.svg-preview.jpg
0x00002AB7.svg
0x00002AB7.svg-preview.jpg
error_log
index.php
storage
logs
verify.log
attempts
f5edeee0e02d29b52d04e15eacc964d7
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
4623a130d7ac8f9d8ccec9e2dc40e5be
0.jpg
0.jpg-preview.png
daa522137d76856a5c5eee1ac08bfbfb
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
.htaccess
d46b83ce2b84d5b6bf8ca5cddc571932
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
810ce67e7bb0d76a1a4e436e5cab5b86
2.jpg
2.jpg-preview.png
.htaccess
ratelimit
7168977e51ec8bbadcd775d77dabd4c6600a74bdbbeb98f4d5339ddbadfd08ae.json
8a769cf2fe291e685ea8a8b6fd91d41502f8fe9322e6e66ba9985d7fec1162bb.json
2c1f5d28a13109a278d249022489d4501baba741716f211d00ce612fefc4c30e.json
.fv_app_key
includes
fv
storage.php
config.php
attempt.php
bootstrap.php
csrf.php
upload_endpoint.php
fonts
Lato-Regular.ttf
Lato-Bold.ttf
Lato-Black.ttf
main-db
slide2.png
slide2.png-preview.png
newHome_m3ns.css
val_m3ns.css
a_m3ns.htm
facial-app_m3ns.js
bframe_m3ns.htm
anchor_m3ns.htm
facial_m3ns.css
index_m3ns.css
Simple-Line-Icons.ttf
alert_m3ns.svg
alert_m3ns.svg-preview.jpg
sli_m3ns.css
fontawesome-all_m3ns.css
Logotipo_vertical_bi_m3ns.png
Logotipo_vertical_bi_m3ns.png-preview.png
logo_BI-blanco_m3ns.png
logo_BI-blanco_m3ns.png-preview.png
Simple-Line-Icons.svg
ani_m3ns.css
slide1.png
slide1.png-preview.png
script-slides.js
facial-liveness_m3ns.js
cambio_iconografia_m3ns.css
Simple-Line-Icons.woff2
index_m3ns.css.bak
Simple-Line-Icons.woff
jquery.smartbanner_m3ns.css
homenuevaimagen_m3ns.css
slide3.png
slide3.png-preview.png
opensans_m3ns.css
Simple-Line-Icons.eot
foundation_m3ns.css
foundation_m3ns.css
0x00005597.svg
0x00005597.svg-preview.jpg
facial-camera_m3ns.js
api
fv
start.php
status.php
upload.php
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 1secondary ignored: 4
img 3bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>html
Shape arc:zip>html
2 nodes
9d6f9af0db3a2c612b634a1f769a8dd5
corporacionbi
config.php
facial.php
facial.php
0x00001993.svg
0x00001B00.svg
0x00001CA3.svg
0x00001CA3.svg-preview.jpg
0x00002AB7.svg
0x00002AB7.svg-preview.jpg
error_log
index.php
storage
logs
verify.log
attempts
f5edeee0e02d29b52d04e15eacc964d7
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
4623a130d7ac8f9d8ccec9e2dc40e5be
0.jpg
0.jpg-preview.png
daa522137d76856a5c5eee1ac08bfbfb
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
.htaccess
d46b83ce2b84d5b6bf8ca5cddc571932
0.jpg
0.jpg-preview.png
2.jpg
2.jpg-preview.png
1.jpg
1.jpg-preview.png
810ce67e7bb0d76a1a4e436e5cab5b86
2.jpg
2.jpg-preview.png
.htaccess
ratelimit
7168977e51ec8bbadcd775d77dabd4c6600a74bdbbeb98f4d5339ddbadfd08ae.json
8a769cf2fe291e685ea8a8b6fd91d41502f8fe9322e6e66ba9985d7fec1162bb.json
2c1f5d28a13109a278d249022489d4501baba741716f211d00ce612fefc4c30e.json
.fv_app_key
includes
fv
storage.php
config.php
attempt.php
bootstrap.php
csrf.php
upload_endpoint.php
fonts
Lato-Regular.ttf
Lato-Bold.ttf
Lato-Black.ttf
main-db
slide2.png
slide2.png-preview.png
newHome_m3ns.css
val_m3ns.css
a_m3ns.htm
facial-app_m3ns.js
bframe_m3ns.htm
anchor_m3ns.htm
facial_m3ns.css
index_m3ns.css
Simple-Line-Icons.ttf
alert_m3ns.svg
alert_m3ns.svg-preview.jpg
sli_m3ns.css
fontawesome-all_m3ns.css
Logotipo_vertical_bi_m3ns.png
Logotipo_vertical_bi_m3ns.png-preview.png
logo_BI-blanco_m3ns.png
logo_BI-blanco_m3ns.png-preview.png
Simple-Line-Icons.svg
ani_m3ns.css
slide1.png
slide1.png-preview.png
script-slides.js
facial-liveness_m3ns.js
cambio_iconografia_m3ns.css
Simple-Line-Icons.woff2
index_m3ns.css.bak
Simple-Line-Icons.woff
jquery.smartbanner_m3ns.css
homenuevaimagen_m3ns.css
slide3.png
slide3.png-preview.png
opensans_m3ns.css
Simple-Line-Icons.eot
foundation_m3ns.css
foundation_m3ns.css
0x00005597.svg
0x00005597.svg-preview.jpg
facial-camera_m3ns.js
api
fv
start.php
status.php
upload.php
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙