Overview

overview

10

Static

static

10

Install Termius.exe

windows10-1703-x64

5

$PLUGINSDI...er.dll

windows10-1703-x64

1

$PLUGINSDI...ls.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...ll.dll

windows10-1703-x64

3

Termius.exe

windows10-1703-x64

5

locales/de.ps1

windows10-1703-x64

1

resources/...ar.dll

windows10-1703-x64

3

resources/...dex.js

windows10-1703-x64

1

resources/...or.dll

windows10-1703-x64

3

resources/...46.dll

windows10-1703-x64

3

resources/...o2.dll

windows10-1703-x64

3

resources/...js.dll

windows10-1703-x64

3

resources/...48.dll

windows10-1703-x64

1

resources/...20.dll

windows10-1703-x64

3

resources/...b1.dll

windows10-1703-x64

3

resources/...us.dll

windows10-1703-x64

3

resources/...dex.js

windows10-1703-x64

1

resources/...nt.dll

windows10-1703-x64

3

resources/...ng.dll

windows10-1703-x64

3

resources/elevate.exe

windows10-1703-x64

1

vk_swiftshader.dll

windows10-1703-x64

3

vulkan-1.dll

windows10-1703-x64

3

resources/...gs.dll

windows10-1703-x64

1

resources/...ng.dll

windows10-1703-x64

1

resources/elevate.exe

windows10-1703-x64

1

$PLUGINSDI...ec.dll

windows10-1703-x64

3

$PLUGINSDI...7z.dll

windows10-1703-x64

3

$R0/Uninst...us.exe

windows10-1703-x64

5

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...ll.dll

windows10-1703-x64

3

$PLUGINSDI...ec.dll

windows10-1703-x64

3

Resubmissions

23/05/2024, 17:43

240523-waxw8sag8110

07/05/2024, 14:30

240507-rvdlwabb6s10

25/03/2024, 12:06

240325-n94j3aaa9v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Install Termius.exe
  • Size 172.3MB
  • Sample240325-n94j3aaa9v
  • SHA256 4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
egregordiscovery

Malware Config

Targets

    • Target
      Install Termius.exe
    • Size 172.3MB
    • SHA256 4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral4
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral5
    • Target
      Termius.exe
    • Size 127.9MB
    • SHA256 b98a1facf293368e387c7053c064ffabebb23f39023e046f7cf37661e4cbc95b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral6
    • Target
      locales/de.pak
    • Size 367KB
    • SHA256 8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      resources/app.asar.unpacked/node_modules/@termius/keytar/win-ia32/keytar.node
    • Size 115KB
    • SHA256 bbd551f2950a407a834c15eeb7c71a818a6fd866dd24b16fc0ba135407f84fdd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral8
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/index.js
    • Size 486B
    • SHA256 7823e992fe7f6c4e8951b3ef32302fcd1c719bd8301511e36b9781cbac50b05e
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral9
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll
    • Size 180KB
    • SHA256 db32c80110d514e6c4357d201107a9277c2269b05aadb6a451df6fcf6b611377
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/crypto-46.dll
    • Size 1.4MB
    • SHA256 7a9f53aa3538a4547ac29db37067a74b5059439ae5b8860a614ec8bb79b1175d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/fido2.dll
    • Size 225KB
    • SHA256 850a71f1053c617f2c93ec2300d2802fa06ea934117d37823d636eef42493fb4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral12
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/libfido2-nodejs.node
    • Size 522KB
    • SHA256 68384af68d84e83da4c62964b6ddc0e0e0495d8492e72bd242ee1ac3f7c3c067
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/ssl-48.dll
    • Size 336KB
    • SHA256 49cddec16aa622fc09dad0d4155952eaba6b78c09c6614d186f5a18b56c6da8d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral14
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/tls-20.dll
    • Size 128KB
    • SHA256 8202200e32ca225cee525579c86258c91b2d094e78707ee3b4f1c588fea3ae62
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/zlib1.dll
    • Size 174KB
    • SHA256 a63a24302cc9b690955bec2d0a481d1a8c030bd7dd1d2f7c0a68dd6cfe4cd1b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral16
    • Target
      resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/termius.node
    • Size 3.3MB
    • SHA256 e1245a3606becd0fb3a9caaa77753e3a7253edc85ef0f87e6cbaf98d801215f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17
    • Target
      resources/app.asar.unpacked/node_modules/@termius/mosh/index.js
    • Size 477B
    • SHA256 34210db8dc4f1dba249f9268dffdab6ceae44c03ff65845e3cd1e088e3180baf
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral18
    • Target
      resources/app.asar.unpacked/node_modules/@termius/mosh/win-ia32/moshclient.node
    • Size 1.2MB
    • SHA256 2501366297bf361f7f43a217363559fb1ab2090b59acf65ca91f3ca43ebc911c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral19
    • Target
      resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-ia32/binding.node
    • Size 706KB
    • SHA256 c1b244c395c03d29774593d7d9fa7183a9bf06f06970e7d06243ad5b74e38880
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral20
    • Target
      resources/elevate.exe
    • Size 125KB
    • SHA256 8a406f56d8e1df885f7302819748ff6ea092fdfe1326c8a9fe8bed57e9ec753e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      vk_swiftshader.dll
    • Size 4.2MB
    • SHA256 baf14a4d3a28ac7ceab2a750a49bbc5d3259856c16ee160a444b92b8de908e9c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral22
    • Target
      vulkan-1.dll
    • Size 744KB
    • SHA256 e125930a96f0bcb36287932ceb3676d44e5c5e6a9e8ab6ca6ca60faa833f3d9c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/@termius/serialport-bindings/win-x64/bindings.node
    • Size 730KB
    • SHA256 50aa3785a77492faec599a30841f165d1427508ae7f22f72d962ab7a9c70ae1f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-x64/binding.node
    • Size 890KB
    • SHA256 8522fff296b531d9b09ef9ef12c7b5820559808f979697b91c85a04310167ea8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25
    • Target
      resources/elevate.exe
    • Size 125KB
    • SHA256 2397621e80b84afb4b2c50cf911f503ccc930f307d0235f1e811a89ef2fc5a3f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral27
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral28
    • Target
      $R0/Uninstall Termius.exe
    • Size 504KB
    • SHA256 801ab9493b714cec96e24bbf8475a89686099003149bc175fe75146ba55b7787
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral29
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral30
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral31
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks