Overview
overview
3Static
static
3fping/fping
ubuntu-18.04-amd64
GETADD.exe
windows7-x64
3GETADD.exe
windows10-2004-x64
3ipscan
ubuntu-18.04-amd64
1ipscan
debian-9-armhf
1ipscan
debian-9-mips
1ipscan
debian-9-mipsel
1tuposca
ubuntu-18.04-amd64
1tuposca
debian-9-armhf
1tuposca
debian-9-mips
1tuposca
debian-9-mipsel
1XINE-2.vbs
windows7-x64
1XINE-2.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
fping/fping
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral2
Sample
GETADD.exe
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
GETADD.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
ipscan
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral5
Sample
ipscan
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral6
Sample
ipscan
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral7
Sample
ipscan
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral8
Sample
tuposca
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral9
Sample
tuposca
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral10
Sample
tuposca
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral11
Sample
tuposca
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral12
Sample
XINE-2.vbs
Resource
win7-20231129-en
Behavioral task
behavioral13
Sample
XINE-2.vbs
Resource
win10v2004-20231215-en
General
-
Target
5e9b4de114e6471cbd7e34b99999cf08
-
Size
370KB
-
MD5
5e9b4de114e6471cbd7e34b99999cf08
-
SHA1
b8d16cd35f3c1e5d49f641ffcacc96c997f09e94
-
SHA256
89f330bf631c121879648d4ce03c280ec48f28bdf2d54d007cdd4b312358d71d
-
SHA512
cba40770731cb506bf014df83b9436e6d4013c77951032191f2747ff07756f915f8443360845d4ef7d627347550814851d46f8f0b30631ae4a0ea957dc275b7e
-
SSDEEP
6144:G1IHRmcuvbrpvlCjJwF4owEz0m/1xrMu7LkF93zE9eDwG0O5xp9unuvJzRyMl:usccufpvRF4oNYmXMunkF9ilPOinuvJP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/GETADD.EXE
Files
-
5e9b4de114e6471cbd7e34b99999cf08.zip
-
FILES.ZIP.zip
-
FPING.TGZ.gz
-
FPING.TGZ.tar
-
fping/AUTHOR
-
fping/CHANGES
-
fping/Makefile
-
fping/README
-
fping/README.VMS.eml
-
fping/fping.elf linux x86
-
fping/fping.c
-
fping/fping.c.orig
-
fping/fping.man
-
fping/lcompat.h
-
GETADD.EXE.exe windows:1 windows x86 arch:x86
98c88d882f01a3f6ac1e5f7dfd761624
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ExitProcess
user32
MessageBoxA
Sections
CODE Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
IPSCAN.TGZ.gz
-
IPSCAN.TGZ.tar
-
ipscan.sh linux
-
TUPOSCA.TGZ.gz
-
TUPOSCA.TGZ.tar
-
tcp.services
-
tuposca.sh linux
-
udp.services
-
VIRIIS.ZIP.zip
-
XINE2.ANS
-
FILE_ID.DIZ
-
LOGO.TXT
-
XINE-2.000
-
XINE-2.001
-
XINE-2.002
-
XINE-2.003
-
XINE-2.004
-
XINE-2.005
-
XINE-2.006
-
XINE-2.007
-
XINE-2.008
-
XINE-2.009
-
XINE-2.010
-
XINE-2.011
-
XINE-2.012
-
XINE-2.013
-
XINE-2.014
-
XINE-2.015
-
XINE-2.016
-
XINE-2.017
-
XINE-2.018
-
XINE-2.019
-
XINE-2.020
-
XINE-2.021
-
XINE-2.022
-
XINE-2.023
-
XINE-2.024
-
XINE-2.025
-
XINE-2.026
-
XINE-2.027.vbs
-
XINE-2.028
-
XINE-2.029
-
XINE-2.030
-
XINE-2.031
-
XINE-2.032
-
XINE-2.033