Edit tour

Windows Analysis Report
EFT Remittance_CQDM.html

Overview

General Information

Sample name:	EFT Remittance_CQDM.html
Analysis ID:	1552167
MD5:	c9e784986a5b3aaac4dfaf7aab65ae5f
SHA1:	f11b5f1e4c2aa4c289bbc33803c3ebe472e80672
SHA256:	0e3cfea75f7c94ec9d7012dcad95ba89abb984a41d96dda778ba20427e18e2c5
Infos:

Detection

Mamba2FA

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Found malware configuration

Yara detected Mamba 2FA PaaS

HTML document with suspicious name

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

No HTML title found

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\EFT Remittance_CQDM.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1964,i,14693397857616224471,8995589797010887757,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

Threatname: Mamba2FA

{"sv": "o365_1_one", "rand": "S1NsVkk=", "uid": "USER16102024U30101617"}

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T13:41:55.907346+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49736	TCP
2024-11-08T13:42:35.353423+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49956	TCP

ET PHISHING Javascript Browser Fingerprinting POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T13:41:49.982155+0100	2056643	2	Possible Social Engineering Attempted	192.168.2.5	49719	162.241.224.248	443	TCP
2024-11-08T13:43:56.810929+0100	2056643	2	Possible Social Engineering Attempted	192.168.2.5	50065	162.241.224.248	443	TCP
2024-11-08T13:45:00.933361+0100	2056643	2	Possible Social Engineering Attempted	192.168.2.5	50105	162.241.224.248	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://musicuntold.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPVMxTnNWa2s9JnVpZD1VU0VSMTYxMDIwMjRVMzAxMDE2MTc=#ZWxpemFiZXRoLmRvc2tlckBsb3Vpc3ZpbGxla3kuZ292	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpKbz	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpbSK&sid=cuO5hpjmd2CBC3unAACq	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpcNO&sid=cuO5hpjmd2CBC3unAACq	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpcNP&sid=cuO5hpjmd2CBC3unAACq	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=websocket&sid=cuO5hpjmd2CBC3unAACq	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpbSH&sid=cuO5hpjmd2CBC3unAACq	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpafH	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpLiM&sid=GcA0c5ngDg-Ji0jdAACl	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpMjC&sid=GcA0c5ngDg-Ji0jdAACl	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpLiO&sid=GcA0c5ngDg-Ji0jdAACl	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=polling&t=PCBpMjD&sid=GcA0c5ngDg-Ji0jdAACl	Avira URL Cloud: Label: malware
Source: https://grastoonm3vides.com/socket.io/?EIO=4&transport=websocket&sid=GcA0c5ngDg-Ji0jdAACl	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.0.pages.csv

Malware Configuration Extractor: Mamba2FA {"sv": "o365_1_one", "rand": "S1NsVkk=", "uid": "USER16102024U30101617"}

Phishing

AI detected phishing page