Overview

overview

10

Static

static

7

.rsync/a/a

ubuntu-18.04-amd64

10

.rsync/a/a

debian-9-armhf

10

.rsync/a/a

debian-9-mips

10

.rsync/a/a

debian-9-mipsel

3

.rsync/a/init0

ubuntu-18.04-amd64

6

.rsync/a/init0

debian-9-armhf

6

.rsync/a/init0

debian-9-mips

1

.rsync/a/init0

debian-9-mipsel

6

.rsync/a/kswapd0

ubuntu-18.04-amd64

10

.rsync/a/run

ubuntu-18.04-amd64

3

.rsync/a/run

debian-9-armhf

3

.rsync/a/run

debian-9-mips

3

.rsync/a/run

debian-9-mipsel

3

.rsync/a/stop

ubuntu-18.04-amd64

10

.rsync/a/stop

debian-9-armhf

10

.rsync/a/stop

debian-9-mips

10

.rsync/a/stop

debian-9-mipsel

10

.rsync/b/a

ubuntu-18.04-amd64

7

.rsync/b/a

debian-9-armhf

7

.rsync/b/a

debian-9-mips

7

.rsync/b/a

debian-9-mipsel

7

.rsync/b/run

ubuntu-18.04-amd64

7

.rsync/b/run

debian-9-armhf

7

.rsync/b/run

debian-9-mips

1

.rsync/b/run

debian-9-mipsel

7

.rsync/b/stop

ubuntu-18.04-amd64

6

.rsync/b/stop

debian-9-armhf

1

.rsync/b/stop

debian-9-mips

1

.rsync/b/stop

debian-9-mipsel

1

.rsync/c/blitz

ubuntu-18.04-amd64

1

.rsync/c/blitz

debian-9-armhf

1

.rsync/c/blitz

debian-9-mips

1

Resubmissions

25/11/2023, 16:38

231125-t5eyssca6s 10

25/11/2023, 16:35

231125-t36nqsca5y 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dota3.tar.gz

  • Size

    4.3MB

  • MD5

    9b3c490e2a6a0fc1ca971d48e41bc8da

  • SHA1

    f9fdcc978af06aa11462cc731f10ebe8149a62a5

  • SHA256

    85c3bb78f60519055314fd2cbc9652211624cf62e12da00c14d31291ef25c5c8

  • SHA512

    f24549f3df52d240ec9b049efc087ece36bca006e55c8dc56a60420e2c989d362391b4f89cd53024c9724f651efe93304450d6546b060dac29b682c20128bbec

  • SSDEEP

    98304:JvPcxV+T1cAJK0YGjpMehn03x7Qi6oucxotEm8NPwsCmRSo:Vcf+ar0703xGoucKtEmtzw

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • dota3.tar.gz
    .gz
  • sample
    .tar
  • .rsync/a/a
    .sh linux
  • .rsync/a/init0
    .sh linux
  • .rsync/a/kswapd0
    .elf linux x64
  • .rsync/a/run
    .sh linux
  • .rsync/a/stop
    .sh linux
  • .rsync/b/a
    .sh linux
  • .rsync/b/run
    .sh linux
  • .rsync/b/stop
    .sh linux
  • .rsync/c/blitz
    .sh linux
  • .rsync/c/blitz32
    .elf linux x86
  • .rsync/c/blitz64
    .elf linux x64
  • .rsync/c/go
    .sh linux
  • .rsync/c/run
    .sh linux
  • .rsync/c/start
    .sh linux
  • .rsync/c/stop
    .sh linux
  • .rsync/init
  • .rsync/init0
  • .rsync/init2
  • .rsync/initall