Overview
overview
10Static
static
1078769e4085...7e.zip
windows7_x64
178769e4085...7e.zip
windows10-2004_x64
malware-an...er.pdf
windows7_x64
1malware-an...er.pdf
windows10-2004_x64
1malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
1malware-an...ypt.py
linux_amd64
malware-an...ypt.py
linux_armhf
malware-an...ypt.py
linux_mips
malware-an...ypt.py
linux_mipsel
malware-an...ons.py
windows7_x64
3malware-an...ons.py
windows10-2004_x64
3malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
malware-an...tt.ps1
windows7_x64
10malware-an...tt.ps1
windows10-2004_x64
8malware-an...tt.vbs
windows7_x64
malware-an...tt.vbs
windows10-2004_x64
7malware-an...er.ps1
windows7_x64
1malware-an...er.ps1
windows10-2004_x64
malware-an...od.ps1
windows7_x64
malware-an...od.ps1
windows10-2004_x64
10malware-an...44.exe
windows7_x64
10malware-an...44.exe
windows10-2004_x64
malware-an...55.dll
windows7_x64
1malware-an...55.dll
windows10-2004_x64
malware-an...xes.py
linux_amd64
malware-an...xes.py
linux_armhf
malware-an...xes.py
linux_mips
malware-an...xes.py
linux_mipsel
malware-an...dra.py
windows7_x64
malware-an...dra.py
windows10-2004_x64
3Analysis
-
max time kernel
128s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:11
Static task
static1
Behavioral task
behavioral1
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral8
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral10
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral11
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral29
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral30
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral31
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win10v2004-20220414-en
General
-
Target
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
-
Size
360B
-
MD5
cfd1923ef62eda51c93b8b3599941acd
-
SHA1
ec8712a15560aa43ba4710ea574f5443ae5c5c5c
-
SHA256
2cd2d3823bacb5591d922756a072b4e934d42a471fce9fe2f5b2fd05fac0c660
-
SHA512
043f86e5448c4bcc941da02471797d3b863644502bdc36a9c97ab693b888eee2fafcf35e5ffbdce1afcaaf1b77869b50c49e49274ad7a0543b49a993d32ff5c6
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 11 3948 powershell.exe 23 3948 powershell.exe 29 3948 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3948 powershell.exe 3948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3948 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malware-analysis-writeups-master\bashar-bachir-chain\files\avastt.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken