Overview

overview

3

Static

static

3

follow-tra...xe.xml

windows7-x64

1

follow-tra...xe.xml

windows10-2004-x64

1

follow-tra...or.pkg

macos-10.15-amd64

_collections_abc.pyc

windows7-x64

3

_collections_abc.pyc

windows10-2004-x64

3

_weakrefset.pyc

windows7-x64

3

_weakrefset.pyc

windows10-2004-x64

3

abc.pyc

windows7-x64

3

abc.pyc

windows10-2004-x64

3

codecs.pyc

windows7-x64

3

codecs.pyc

windows10-2004-x64

3

collection...__.pyc

windows7-x64

3

collection...__.pyc

windows10-2004-x64

3

collections/abc.pyc

windows7-x64

3

collections/abc.pyc

windows10-2004-x64

3

copyreg.pyc

windows7-x64

3

copyreg.pyc

windows10-2004-x64

3

encodings/...__.pyc

windows7-x64

3

encodings/...__.pyc

windows10-2004-x64

3

encodings/aliases.pyc

windows7-x64

3

encodings/aliases.pyc

windows10-2004-x64

3

encodings/ascii.pyc

windows7-x64

3

encodings/ascii.pyc

windows10-2004-x64

3

encodings/...ec.pyc

windows7-x64

3

encodings/...ec.pyc

windows10-2004-x64

3

encodings/big5.pyc

windows7-x64

3

encodings/big5.pyc

windows10-2004-x64

3

encodings/...cs.pyc

windows7-x64

3

encodings/...cs.pyc

windows10-2004-x64

3

encodings/...ec.pyc

windows7-x64

3

encodings/...ec.pyc

windows10-2004-x64

3

encodings/charmap.pyc

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    follow-traductor.rar

  • Size

    27.6MB

  • Sample

    230205-nwxjlahb99

  • MD5

    5434a0ade7175198648b49a5e5198478

  • SHA1

    b7b04c8a465c346497ad564f7499bf5c631c3712

  • SHA256

    58e8cf2a77663a1ff5cc36aa9e0777ce952eaa258c9b8220cadb5a53bed89724

  • SHA512

    f6547331edfef165d47d5fa95b054d37801d73829c222fada862e672e0dbac10a32725f70e8b11fe893187a650541bb4db11a0d7063ecc860a36220d7edcd540

  • SSDEEP

    786432:whbQb9Lae3vMfdNg9Sltl8rAAvpOuiQ9A9PXLsjiIjsT:a0b95iikltirAzuiQ4PX4jkT

Score
3/10
macospyinstaller

Malware Config

Targets

    • Target

      follow-traductor/build/FollowTraductor/FollowTraductor.exe.manifest

    • Size

      1KB

    • MD5

      bf413ed840145672db67c4fa85153dea

    • SHA1

      91c743f2148a4b902a88077b6e928c08538ff2a2

    • SHA256

      c7b95e7b1c9848e601ec777f0ea0aa306360c127f5390fb7e141bb55c5407457

    • SHA512

      8d71d10d257114ccc9a1b12901c94e31497e0a61eb1862d019e9b93a7e3ea340408cf6013ff413075790503c929943bb0b3274b7fb745b6163cf8f40b4ed16b1

    Score
    1/10
    behavioral1behavioral2

    • Target

      follow-traductor/build/FollowTraductor/FollowTraductor.pkg

    • Size

      12.0MB

    • MD5

      8a8a9d9bb848de7656e9c1ee73db3584

    • SHA1

      219f3d3abb4ffcb717ae07044031dc0be5f5f0a6

    • SHA256

      f09937939acf70e1c09ebb16055516e9cced3782b0c6395b4d0ffa847c6eb695

    • SHA512

      93d5ae4fc8baa44eb49396715c038fc86bd900312a4aca1ec398b52b656fc643572e14ee698d418750f0ea2b0d95ad48a7fe55acedfa7f35670d59cde51ad988

    • SSDEEP

      196608:AH0VL2Vmd6+DlNJm3Aq6MTNfwZHYYilZFUBBJHfOPV/CVqrHbw6hHMtqJK4VJ1ga:AUVL2Vmd6ml/m3p6MBkqZABJHfON/CVo

    Score
    1/10
    behavioral3

    • Target

      _collections_abc.pyc

    • Size

      31KB

    • MD5

      bdd5e740d9f5f3098c61071b16a25098

    • SHA1

      5275b0147b9fc299cfb7440f822d6d9b3fb2e2a6

    • SHA256

      1999ef0fb54884aaa2c47eb952d1d0f5b63eff25afb5f43975fe08463d2e52cf

    • SHA512

      84f4867b16c70a7f80b4fbac5633d9eb0ddaafec7139e16af8fb67c427e2db50fbcf426906440e9fa35b41853ce47f4db62818c4f9c83c273d86dff51b00ce43

    • SSDEEP

      768:4pDSJBiWAf7ykm4y1BhimAqrEHzerKEEh/c3Ebj:8WkWBkmZ1BhimAUEHYKE0E3E

    Score
    3/10
    behavioral4behavioral5

    • Target

      _weakrefset.pyc

    • Size

      7KB

    • MD5

      1d2e7b3f64f73eebd5dba286acb3d558

    • SHA1

      986d6f1d51bd54d1d2896598f21e6df9e9f3e7c1

    • SHA256

      5f7135255973d195ec7374b7b3153fc5e39cedfc57c688bb91837ae13da7a1e4

    • SHA512

      5859425504fee526a03d54ce499cea004fb8b110d0ec33447ebeda244213daf567d9eddb59d7937cd85b316ff26f94d71d8186715b0d54b60e38581c5b183982

    • SSDEEP

      192:tf0NKYNJiLFeqeJHOHlGbakhujJRrms8N3vQ0aj1mvhCAjk2+QnLIP7F1qGDnJlL:lAvNsLEqeJOFOakhkJRrms8N3vQ0aj1z

    Score
    3/10
    behavioral6behavioral7

    • Target

      abc.pyc

    • Size

      6KB

    • MD5

      15ac4e24cc9dc44f7763a2d4378a45a4

    • SHA1

      0db70690ee85b1dda64351095462a05afefab105

    • SHA256

      52ad89f1bd913d767fd84e819b7e6ee16a4711629620105342792a403047713e

    • SHA512

      50002866fc6f8602213f3685ac448e3595f5e83f737f0e1251f0bdd904cece5d3b6612ab10b7355ecc7966da66f3c40dd6818588a484fbada5a3d5bae1d05b80

    • SSDEEP

      192:gg2+dPAos8UySnUlKs1p2yjRiDsegl9o2UeooawoXLk5ebJUlo:/2+dPC8N3bigYxXLk5eCo

    Score
    3/10
    behavioral8behavioral9

    • Target

      codecs.pyc

    • Size

      32KB

    • MD5

      71916e473c37d5f5ff7855469fee7459

    • SHA1

      80884a21fe0d8c88c7f5760c77c10da857dd368f

    • SHA256

      faedd628eafc0b549dec66e49f42ea003eb8d40a9682c59aa0790198d73f1fff

    • SHA512

      77de6c5d4578e8411095162b99985e3a2e0b7f1d084418a06a34843a98f6ba9be4c17df9af39fda3f39ef67f324509c3e158eb5e06224bac0c3113c593eebfd3

    • SSDEEP

      768:7U/N41w3bo0YqcZCYEg7oUroGXmSKLZxEKfE0b1Th8Z:7BPs+XKLZxNfE0b1TmZ

    Score
    3/10
    behavioral10behavioral11

    • Target

      collections/__init__.pyc

    • Size

      47KB

    • MD5

      d1efe803784a2719f345ed13431b660b

    • SHA1

      6b62f7e9892f38e18b28c764aa36568cd091aa4d

    • SHA256

      8510e1309c74c9a0690018cee3607b69470f1bf58d4a696d0aac618c5edc1278

    • SHA512

      b7b4452c2416bfbb3cd6a912a8e966536fdaaf4c97d3ed4494d78ab5adbc06c15d70e990c9eb0c92ab8b7a9133ac6a4d8a1304d635529ccb69dc73617effac85

    • SSDEEP

      768:vxh29yquFGpyGteye3yDRBPou+eQ5It8AbGm79WxSNj4QHUzmVaSTqKoJodQ5vUv:T291uGpyD3yDRBPoJIt8AbGm79WENsQ9

    Score
    3/10
    behavioral12behavioral13

    • Target

      collections/abc.pyc

    • Size

      218B

    • MD5

      a17254bb48980ade90f84d569e0cbc92

    • SHA1

      530e5fcd010cca814c37a32db604bc4efbf0f2e7

    • SHA256

      16ba4900c8cc21b1c20ecf6833a88c43dacfae9b47e8f4354859a3ecaa8585a4

    • SHA512

      49c85f1ab7ca5a8b1245b16622d6c897abc096a6493931dd40fdc5b6c1137f7ebfa14999899e94e8a42b473b855ab3c3c23f3d08a6c4b9cd5971a090caea8f6b

    Score
    3/10
    behavioral14behavioral15

    • Target

      copyreg.pyc

    • Size

      4KB

    • MD5

      78abb42c4d6be4c73515aa3d54bb4490

    • SHA1

      638b423b88860e00ec05c00a676d6a1f0959c8fc

    • SHA256

      5640ce17f749d268f4bacbe60990e54dec77805aa83867d41697f37015865b5d

    • SHA512

      e7e0dcdecd96befaae7d2b721cbeed3865411740c5b1c742c3a7922623fddb9ee543c54cf0f014ffb3db187abd9cd5a9fa6c7930a504b50b2ac25345395d5447

    • SSDEEP

      96:ApCI7QMLHI9jOeSVEZXaruKxbbJJdbTKqvesaCWfqmov2LYHjmTw9EqH3TAZCZZ:mvHGvGdruKpbRu4e2WfhhLYHjmTCH3T5

    Score
    3/10
    behavioral16behavioral17

    • Target

      encodings/__init__.pyc

    • Size

      3KB

    • MD5

      45932999f233ee5c9161684130411b6b

    • SHA1

      b4d82791a06bdd1587bed1dfbf9b37fbb055b95d

    • SHA256

      9cf668b5fc1277a8c6c0716de1b5a46be187881b5bb2a5a450ece42941165176

    • SHA512

      0536d4f08d58f553721cea65c35c0e9b84f18be66b6be5504184a402172c08b1ece6fb2f0c322ee1b00afc8d4fc90193834ba33e3b56bb01cf87fbc2891d2fd1

    Score
    3/10
    behavioral18behavioral19

    • Target

      encodings/aliases.pyc

    • Size

      10KB

    • MD5

      6ed637d8773035426243f1142c5c80bd

    • SHA1

      c2df5a52606d14bd322fd12e8b1eea9b8e31d0af

    • SHA256

      2706fe0ba3620d9d2cc342c94e02e06f196f1d16436d0f1091237d6d4bebf30f

    • SHA512

      47cde7148ae33d0eef6a5b94b2265762fd3c62e29640ee6f45cc23a488e5872f600a311f68bde541b0383b5223a9480983cec57a6680fd59533902260f739f95

    • SSDEEP

      192:GX2eNkBweGfGkueK4+I14Xqb36RhOgaxL8PZm+/Qnu1iXFzxOkq4bpehh3qkyR0N:GXG0bueBU6uHc+Izx9IX6Ri

    Score
    3/10
    behavioral20behavioral21

    • Target

      encodings/ascii.pyc

    • Size

      1KB

    • MD5

      5b9186df4a5ad6247c4579654fbc3a0f

    • SHA1

      8df3c98c1b9245cf725d4cfda4d4b5eff02befb4

    • SHA256

      a260af800dd9a77a6fb7dccbff41cc6922f21f7f955045b52d99659246935d5d

    • SHA512

      aa051f09acd8ef07cf0e0471faf257ad84ce0d04c07ef6f0f313c09516ea93ddc18c9405b78908a86c6a3f31fa39e528af8308ccccea6bf7e4ec701e818bbfb4

    Score
    3/10
    behavioral22behavioral23

    • Target

      encodings/base64_codec.pyc

    • Size

      2KB

    • MD5

      9be24d15d41fa5fba1c8e7c880e8a21a

    • SHA1

      55a2df810f08bc78e69677d9ecb86011c3f49b45

    • SHA256

      5bf789a9d266b1efe934b3f72ac8d4918d3f230b8be5a75448c121de94e7dd28

    • SHA512

      8e4a319db078049e696c2a8d2a19a5076f043cac2fbc7dddccfdc93e6a93a2c620b8c0d78dd23d10b236a4e11a2b7ca2cf4d669d0bdeec63266593b102c5cd6c

    Score
    3/10
    behavioral24behavioral25

    • Target

      encodings/big5.pyc

    • Size

      1KB

    • MD5

      30dd3023824783afa5783270240af633

    • SHA1

      bca37f76d3a98539e31bfb14de232895d5749979

    • SHA256

      9ba263ce55ad578a24b415b92ea6a40c535107910b569a3b0eb3800838f529a8

    • SHA512

      361c23253d6bd4e132401201cc42917b7ad4e18ea0002e77d23403df7b9ad331300fb1b9cf7ae5b9b977100de19a9c7835bc5d6c3c1192cc84e98ad59b887880

    Score
    3/10
    behavioral26behavioral27

    • Target

      encodings/big5hkscs.pyc

    • Size

      1KB

    • MD5

      858c2aed1b411db7f240127f465907be

    • SHA1

      cf54bc905de4425f38531ea1abd15e624946f9c9

    • SHA256

      91a65aa014bed7de528559afea50b1d31fa03df301144ae9cf3a062be7cf7dbd

    • SHA512

      98e10efc0594f9066d43323b339cdd7402ada87ff8e1bfa723351f19dd600a13b98151db0a947f3d1e0994cd99f92cd5e4570ff1c4c64000006d8a1047686224

    Score
    3/10
    behavioral28behavioral29

    • Target

      encodings/bz2_codec.pyc

    • Size

      2KB

    • MD5

      df92025a794678fcbde84921de6d47d9

    • SHA1

      518e314be1fd311557cd5d7102c3a723f8a70230

    • SHA256

      8f3d12df9c806a0f8b15200ad7200ddc32cd01b993c5b5b01ecbb1ec6e3c2415

    • SHA512

      32ce1784ca9d1f377f29b561ce4fca8e5ab926a595fdf33eb493db65091d1677d814c56faeb5e957f9ab5b141ccd0a3139028362f3713e32471ff21cecc50627

    Score
    3/10
    behavioral30behavioral31

    • Target

      encodings/charmap.pyc

    • Size

      2KB

    • MD5

      51b1c9f8790a32f75171200a22da11c6

    • SHA1

      d60e02d557c05ee68636534b480da1bad1b030ec

    • SHA256

      3e6437462d09fd58d7df10053a9023dffb1a959ab92ca7b5b437b7dc7f2c1f40

    • SHA512

      32a1cff7df6f13aabd5516e1c50cdf2f59c0e49413b5582666decf5d1c66d92d9adc68a0c79a7114dec26b92f35b4aaaea9c18496cea5cf1b4d1ccb5bd4ac497

    Score
    3/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

15
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks