Overview

overview

10

Static

static

10

b0baf07169...71.zip

windows10-2004-x64

1

Resubmissions

09-06-2023 13:04

230609-qaxzcada3z 10

09-06-2023 13:00

230609-p8ltasda3t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71.zip

  • Size

    7.0MB

  • MD5

    f395e476876943cec76696f64284b548

  • SHA1

    e07b69545567a279731bb22ae081e8cfd9e5f15a

  • SHA256

    4b4116cb3c295b3417a075a84a322b4f96a7f98c76c631450ea359f0244ff250

  • SHA512

    3b811252ce1bd74b2056797ac182c55f4e771da579b9b00d8f715a65f9077a3ae5918c72fcc5c393ab46dcfa16d70d1ac1a1e519f135c5c2b426d1c1366c9ce4

  • SSDEEP

    196608:TVOtcycNPxVdPvOqlxxLEBx8nZN4ysSVN/rkM:5OBcXHvjlxhg8HTnrkM

Score
10/10
connectback

Malware Config

Extracted

Family

connectback

C2

185.232.65.146:1987

Signatures

Files

  • b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71.zip
    .zip

    Password: infected

  • b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71.zip
    .zip

    Password: infected

  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/README.txt
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/bash_decryptor.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/bash_encryptor.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/bash_encryptor.sh.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/bash_encryptor1.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/code.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/code1.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_first.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt3.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt3.sh.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt_file.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/pass_server.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/socket_code_sender.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr.save.1
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr.save.2
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr1
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr1.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr_second
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr_second.save
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/supermicro_cr_third
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/binaryinject/Makefile
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/binaryinject/binaryinject.c
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/bot/bot_first.sh
    .sh .ps1 linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/bot/bot_send_ip_who.sh.save.save
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/bot/botsec.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/bot/commands.txt
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/bot/supermicro_bt
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/attack_file.txt
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/downloader.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/downloader.sh.save
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/hosts_64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/test.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/check/api_attack/downloader/test_attack/test_host
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/1.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/bash.sh.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/bash.sh.save.save
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/bash23.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject1.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject2.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject_b.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject_rsync.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject_scp.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/binaryinject_t.so
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/boa
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/bt_install.sh
    .sh .ps1 linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/c
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/clear_log.sh
    .sh .ps1 linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/commands.txt
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/commands1.txt
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/example.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/exploit.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/exploit.py.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/exploit1.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/exploit3.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/exploit4.py
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/g
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/git_iptables.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/git_iptables.sh.save
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/line.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/m
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/mon.8.gz
    .sh .ps1 linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/n
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/navi_index.php
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/navi_shell.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/new
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/nwe
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/pwd.c
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/q.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/q1.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/q2.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/q_casino.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/r.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/real_ip.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/real_ip_new.sh
    .sh .vbs linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/rew
    .elf linux arm
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/s.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/security.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/security.sh.save
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/security.sh.save.1
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/security.sh.save.2
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/security.sh.save.3
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/server_shell.py
    .py .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/service.sh
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/start_process.sh
    .sh linux
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/utmp
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/wowowowow.php
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/wtmp
    .elf linux x64
  • 31.214.157.40_#DarkRadiation_by_@r3dbU7z/main_dir/wtmp_utmp_inject.c