Overview
overview
3Static
static
1com.termux...gz.tar
windows7-x64
3com.termux...gz.tar
windows10-2004-x64
3com.termux...config
windows7-x64
3com.termux...config
windows10-2004-x64
3com.termux...ibutes
windows7-x64
3com.termux...ibutes
windows10-2004-x64
3com.termux...NG.yml
windows7-x64
3com.termux...NG.yml
windows10-2004-x64
3com.termux...rt.yml
windows7-x64
3com.termux...rt.yml
windows10-2004-x64
3com.termux...st.yml
windows7-x64
3com.termux...st.yml
windows10-2004-x64
3com.termux...ig.yml
windows7-x64
3com.termux...ig.yml
windows10-2004-x64
3com.termux...se.yml
windows7-x64
3com.termux...se.yml
windows10-2004-x64
3com.termux...ld.yml
windows7-x64
3com.termux...ld.yml
windows10-2004-x64
3com.termux...on.yml
windows7-x64
3com.termux...on.yml
windows10-2004-x64
3com.termux...ts.yml
windows7-x64
3com.termux...ts.yml
windows10-2004-x64
3com.termux...ck.yml
windows7-x64
3com.termux...ck.yml
windows10-2004-x64
3com.termux...ignore
windows7-x64
3com.termux...ignore
windows10-2004-x64
3com.termux...NSE.md
windows7-x64
3com.termux...NSE.md
windows10-2004-x64
3com.termux...DME.md
windows7-x64
3com.termux...DME.md
windows10-2004-x64
3com.termux...2.json
windows7-x64
3com.termux...2.json
windows10-2004-x64
3Analysis
-
max time kernel
434s -
max time network
1164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
com.termux_118_src.tar.gz.tar
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
com.termux_118_src.tar.gz.tar
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
com.termux_118_src.tar.gz/.editorconfig
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
com.termux_118_src.tar.gz/.editorconfig
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
com.termux_118_src.tar.gz/.gitattributes
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
com.termux_118_src.tar.gz/.gitattributes
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
com.termux_118_src.tar.gz/.github/FUNDING.yml
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
com.termux_118_src.tar.gz/.github/FUNDING.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/01-bug-report.yml
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/01-bug-report.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/02-feature-request.yml
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/02-feature-request.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/config.yml
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/config.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
com.termux_118_src.tar.gz/.github/workflows/attach_debug_apks_to_release.yml
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
com.termux_118_src.tar.gz/.github/workflows/attach_debug_apks_to_release.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
com.termux_118_src.tar.gz/.github/workflows/debug_build.yml
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
com.termux_118_src.tar.gz/.github/workflows/debug_build.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
com.termux_118_src.tar.gz/.github/workflows/gradle-wrapper-validation.yml
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
com.termux_118_src.tar.gz/.github/workflows/gradle-wrapper-validation.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
com.termux_118_src.tar.gz/.github/workflows/run_tests.yml
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
com.termux_118_src.tar.gz/.github/workflows/run_tests.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
com.termux_118_src.tar.gz/.github/workflows/trigger_library_builds_on_jitpack.yml
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
com.termux_118_src.tar.gz/.github/workflows/trigger_library_builds_on_jitpack.yml
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
com.termux_118_src.tar.gz/.gitignore
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
com.termux_118_src.tar.gz/.gitignore
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
com.termux_118_src.tar.gz/LICENSE.md
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
com.termux_118_src.tar.gz/LICENSE.md
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
com.termux_118_src.tar.gz/README.md
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
com.termux_118_src.tar.gz/README.md
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
com.termux_118_src.tar.gz/app/.cxx/abi_configuration_15p1x572.json
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
com.termux_118_src.tar.gz/app/.cxx/abi_configuration_15p1x572.json
Resource
win10v2004-20230703-en
General
-
Target
com.termux_118_src.tar.gz/.github/ISSUE_TEMPLATE/config.yml
-
Size
184B
-
MD5
84cc583d281e4ff10cb2bac69e98978b
-
SHA1
87379bef325e14d4f49ce48c201487a85d8d9ef6
-
SHA256
a4c1497dde418fc6cff15b5a55669ceea423ed283b8621b9e8e0773f98f9b34f
-
SHA512
4e01ef4e496348c45fff4bfa17a07ce0d23c60a2052d6a5d91caab8d6d3e41f5ce05098df57e6ef5bd672ee7416e314bf084c708ef4fe7b6cbff51af41bb1883
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1944 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\com.termux_118_src.tar.gz\.github\ISSUE_TEMPLATE\config.yml1⤵
- Modifies registry class
PID:4592
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1944