Overview

overview

10

Static

static

10

Install Termius.exe

windows10-1703-x64

5

$PLUGINSDI...er.dll

windows10-1703-x64

1

$PLUGINSDI...ls.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...ll.dll

windows10-1703-x64

3

Termius.exe

windows10-1703-x64

5

locales/de.ps1

windows10-1703-x64

1

resources/...ar.dll

windows10-1703-x64

3

resources/...dex.js

windows10-1703-x64

1

resources/...or.dll

windows10-1703-x64

3

resources/...46.dll

windows10-1703-x64

3

resources/...o2.dll

windows10-1703-x64

3

resources/...js.dll

windows10-1703-x64

3

resources/...48.dll

windows10-1703-x64

1

resources/...20.dll

windows10-1703-x64

3

resources/...b1.dll

windows10-1703-x64

3

resources/...us.dll

windows10-1703-x64

3

resources/...dex.js

windows10-1703-x64

1

resources/...nt.dll

windows10-1703-x64

3

resources/...ng.dll

windows10-1703-x64

3

resources/elevate.exe

windows10-1703-x64

1

vk_swiftshader.dll

windows10-1703-x64

3

vulkan-1.dll

windows10-1703-x64

3

resources/...gs.dll

windows10-1703-x64

1

resources/...ng.dll

windows10-1703-x64

1

resources/elevate.exe

windows10-1703-x64

1

$PLUGINSDI...ec.dll

windows10-1703-x64

3

$PLUGINSDI...7z.dll

windows10-1703-x64

3

$R0/Uninst...us.exe

windows10-1703-x64

5

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...ll.dll

windows10-1703-x64

3

$PLUGINSDI...ec.dll

windows10-1703-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Install Termius.exe

  • Size

    172.3MB

  • Sample

    240325-n94j3aaa9v

  • MD5

    3768a17beecbe0fb8a41d7edf8e485de

  • SHA1

    f2c64004a13b066b653056ff89d8f8c06e7cb13e

  • SHA256

    4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

  • SHA512

    5d366917ed795de2d40581228c972e0db21b62702299df1218187b81320dfe8888d02c14d0857c8f093f69bb1c9fd6b92715a9e95b7109aa346d69f34584500e

  • SSDEEP

    3145728:s8TOrS7FnWeJ8rVXC7CgF6ANeVUgAtT1wXUDFnVt6XLdBbDoyr9hwEC:lpW1rcKA4+gAtCEDNVQLXnooCEC

Score
10/10
egregordiscovery

Malware Config

Targets

    • Target

      Install Termius.exe

    • Size

      172.3MB

    • MD5

      3768a17beecbe0fb8a41d7edf8e485de

    • SHA1

      f2c64004a13b066b653056ff89d8f8c06e7cb13e

    • SHA256

      4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

    • SHA512

      5d366917ed795de2d40581228c972e0db21b62702299df1218187b81320dfe8888d02c14d0857c8f093f69bb1c9fd6b92715a9e95b7109aa346d69f34584500e

    • SSDEEP

      3145728:s8TOrS7FnWeJ8rVXC7CgF6ANeVUgAtT1wXUDFnVt6XLdBbDoyr9hwEC:lpW1rcKA4+gAtCEDNVQLXnooCEC

    Score
    5/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    1/10
    behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral3

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral4

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral5

    • Target

      Termius.exe

    • Size

      127.9MB

    • MD5

      616115fcb2df66fc74c913e7bea40645

    • SHA1

      fb73df51d80d8ea976929b7367127dad5e411a52

    • SHA256

      b98a1facf293368e387c7053c064ffabebb23f39023e046f7cf37661e4cbc95b

    • SHA512

      f417c1a8d45c4d379d8e96a17cbb2dd440beb1975f30ada2648dea075b09bed850255ba3c24481ceb29f4aa24c750ca797f2b844c54bea5d47714d773d77a127

    • SSDEEP

      1572864:PeuFC6t472Ah+FgOqXJniFHUfN8WZis2Vawn0fhj5h8ioZFk5/SDJPtiwhkzLUsB:YSJZqT8Ois+nQAE5m0rWEDFMk5

    Score
    5/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral6

    • Target

      locales/de.pak

    • Size

      367KB

    • MD5

      cfc9d90273c31ccf66d81739aa76306a

    • SHA1

      ecab570041654b147b3dd118829e2f7ae668f840

    • SHA256

      8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

    • SHA512

      c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

    • SSDEEP

      6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql

    Score
    1/10
    behavioral7

    • Target

      resources/app.asar.unpacked/node_modules/@termius/keytar/win-ia32/keytar.node

    • Size

      115KB

    • MD5

      da698607c47fc6c765ab1fae782521d8

    • SHA1

      7b277fc7b086016f176e42b925f215898f38d666

    • SHA256

      bbd551f2950a407a834c15eeb7c71a818a6fd866dd24b16fc0ba135407f84fdd

    • SHA512

      3a0a2d44f6746dcc3d983637a703cf005428e18025324c344593d3430e9eab98ec756fb9456fc393da5bf61b2744582d82634199241ef80a8675d20ba522f421

    • SSDEEP

      3072:BKHnhWXw0a4PvawDIjHpl0whj4g8X/TNptYtPd:cHnh8w/IaVp14vPtY1d

    Score
    3/10
    behavioral8

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/index.js

    • Size

      486B

    • MD5

      33eb3f81c315aa1cab4dfa57e28b8c57

    • SHA1

      ed240e139d672e27c73f8987564328253fc6fa52

    • SHA256

      7823e992fe7f6c4e8951b3ef32302fcd1c719bd8301511e36b9781cbac50b05e

    • SHA512

      d4842523b4650017fd2dd06d0974e04bd87b1222a1143ac6c87b6a2cd5e6c51b050bcd1aed36af83cb87ed783037507ef80c87261330e12d2cbefef42f99169a

    Score
    1/10
    behavioral9

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll

    • Size

      180KB

    • MD5

      e004b0df1216acd143851c4b69b7dea3

    • SHA1

      aa4b8f9d4f29b19e521a0c766714c02e0e3d70ed

    • SHA256

      db32c80110d514e6c4357d201107a9277c2269b05aadb6a451df6fcf6b611377

    • SHA512

      2d8eba626452b1c3f14a57db72bf66f546bfffc6ff92c7b05ec22b0082c9cf3439c991c026d4ed417835818e11b95bb408a69f20f9676d3f5afd9374f725df94

    • SSDEEP

      3072:5fzKUbDcqIfV4E54DIPQePucoINTpuqc2lv9HGjCv+GcAgnXl61x8aZTTVAopszI:5K9GjNWUXkyaZTppeiexh

    Score
    3/10
    behavioral10

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/crypto-46.dll

    • Size

      1.4MB

    • MD5

      d9aa5789cbe34a176d54d6dc5becf57e

    • SHA1

      3e5a87324e4c40e0557a20d8ed7b2800f1020360

    • SHA256

      7a9f53aa3538a4547ac29db37067a74b5059439ae5b8860a614ec8bb79b1175d

    • SHA512

      0c5479d08535f487a9ea1daf2a8a77c046e6dd86d273413d1d3ac4afe76673227628ed25724e3e63cd8d756ea5b1b0c88e265e29f3ee4c2df3ddd60414a26ac1

    • SSDEEP

      24576:zyx8nkZgVU1Y4bgaxmDKmOIgfAkGCK0jX8uv+PlH7NrJ/G6idIXDRNvKJ5uvHln6:+jBnxGKppK0ouWPlH7NrJ9XDRNvKJ5uI

    Score
    3/10
    behavioral11

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/fido2.dll

    • Size

      225KB

    • MD5

      057a0b7293ae60f58151baf322711c2c

    • SHA1

      6d5ec2d345cb930ed4ddf5f1108047377b018dd6

    • SHA256

      850a71f1053c617f2c93ec2300d2802fa06ea934117d37823d636eef42493fb4

    • SHA512

      f5b80870d87a072e5dcf3ac5a30bfcc392eab9d478965cf33332f7104f0b9f2a0828ab609440c1a10660bfcddf421c79b37f0a36f337f9ef43cf37c035e10baf

    • SSDEEP

      3072:mfvYjfgLOq2dMcChh7fM3TK8NqTq/zYykZEx5kcFOGQbe+mqIf+s6IAFvn6YhW:Egj9Q1v8QTUYy4oucobsV0hW

    Score
    3/10
    behavioral12

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/libfido2-nodejs.node

    • Size

      522KB

    • MD5

      1dbf34ad2f295409284625bbc2e8b047

    • SHA1

      2f13dc62b9cdf3dfa8bc9461dd15ebfbe96407e7

    • SHA256

      68384af68d84e83da4c62964b6ddc0e0e0495d8492e72bd242ee1ac3f7c3c067

    • SHA512

      b9c91d4e9242a45444a6bfe7e0b009d042d3822de37c96f6fe21560ea1fe80de6997116a3aa6c0cfe81c7170e3b721064fd7de5342df8f44165bcc9930ab36c8

    • SSDEEP

      12288:XV5Y2vufkpt+VEYupSNNBR8mNZcvAdJt2ZLeu0P/XH2Dg:lG2vUP8mzcvAPXHL

    Score
    3/10
    behavioral13

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/ssl-48.dll

    • Size

      336KB

    • MD5

      d320ff817ef51fae6aa91e10a74d90fb

    • SHA1

      97348daa6eaee9ce63f0d2d12b364a79200bd99b

    • SHA256

      49cddec16aa622fc09dad0d4155952eaba6b78c09c6614d186f5a18b56c6da8d

    • SHA512

      52d33c14d9ad73fc191339094f811928e14b4b5c7806cf75cf28c679fc0fb46d5a73c56249216f857e0f0ba93d320e64596478afcd63d9da437f912709b9d149

    • SSDEEP

      6144:HkH3YkBtTJru5SY1vV0I3zZCBgs21QonocULmo9eObuB9Z9liKyuKlmVOGuf9Zfh:63YstTJykY1v2ItCBgrHvTvLNKAnAdim

    Score
    1/10
    behavioral14

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/tls-20.dll

    • Size

      128KB

    • MD5

      270cc25782b778f53b21fbf1d116e20a

    • SHA1

      ccbcf50655e8d773068199af869f4be162a229ff

    • SHA256

      8202200e32ca225cee525579c86258c91b2d094e78707ee3b4f1c588fea3ae62

    • SHA512

      abd38386504b2317a96f71315a7c067949bacb97699d69a9372eaa2ee90ba17816098ac307ed7d184057e4638aafddcfab8844de70c28f7107bde40c682424ba

    • SSDEEP

      3072:Ja8MstIEHAzRroP6+VabbvW4eB/4PGIQThj:w836BiPbVVPj

    Score
    3/10
    behavioral15

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/zlib1.dll

    • Size

      174KB

    • MD5

      0efc8bd2b6c2d1a9d058887e3b80ab05

    • SHA1

      d4eee29a2395b03a061e8cee125234fefdeddae6

    • SHA256

      a63a24302cc9b690955bec2d0a481d1a8c030bd7dd1d2f7c0a68dd6cfe4cd1b6

    • SHA512

      064382851d4b45e83654b32ded1b2a77f1072e748da48a85c8dd2ac4548937f4a4ebbcdfecf453d46d4fad71bddeb866d04e423d918ea368a4590f6e8941387a

    • SSDEEP

      3072:kja8am40isQsJCqLsh12oMo/aoF9GdXaicmwD70B1Bc6JfJTBfaiFZQilKBCRMRf:T8LisVJDseydaajN83cgTBCiFyCC8u

    Score
    3/10
    behavioral16

    • Target

      resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/termius.node

    • Size

      3.3MB

    • MD5

      011ab6239e1ca6431c06d7fffe98a6cc

    • SHA1

      83806e29f7a25645a782d3856b361fa3556afdc9

    • SHA256

      e1245a3606becd0fb3a9caaa77753e3a7253edc85ef0f87e6cbaf98d801215f0

    • SHA512

      d917d324152ecd5aa9761412578d0351f022b5bf9855c14f72e784375e91f971cde069ca1e4a8a589df505dd476eaf6697e722acf90f59aa580ecde9afd9f23b

    • SSDEEP

      49152:FZ0Q1N88dZ1/drY4p+F+ktNf1Er16/v/ghDp9gsiP+JsklnWuj4rKbvVzSTsGy1k:goM1Er16/v/gT9gsrP4roVzzG

    Score
    3/10
    behavioral17

    • Target

      resources/app.asar.unpacked/node_modules/@termius/mosh/index.js

    • Size

      477B

    • MD5

      02e6d746dd460d26e62fd87887a1eb26

    • SHA1

      747c3df2bf72a3f4d3180b3709e78ec6b7fd3e99

    • SHA256

      34210db8dc4f1dba249f9268dffdab6ceae44c03ff65845e3cd1e088e3180baf

    • SHA512

      01c3f8f36e91e3eac06dac3ecbe298bead75405119a6a28c9bfcac3938900ae18dcb8971bab0593e63046834ec3e723c2682de77e5d6362576932d4fda9b990b

    Score
    1/10
    behavioral18

    • Target

      resources/app.asar.unpacked/node_modules/@termius/mosh/win-ia32/moshclient.node

    • Size

      1.2MB

    • MD5

      ab42390942edb5130f1933568c0418d4

    • SHA1

      0e90ba403dbed6f46c5e55e2b8d79267939e8f9c

    • SHA256

      2501366297bf361f7f43a217363559fb1ab2090b59acf65ca91f3ca43ebc911c

    • SHA512

      2d2deff7d6de90fdc361f4b584fb3e8a77241fdf091447176c049ac3109aad18e9993037f54479f599bc6e7cc48c718db5b34114513edb14cdb48cbf06732206

    • SSDEEP

      24576:1FyHHLef2JCS1YoDibo9XWP/Tw1sjgL7RwokHTt:vyHHLeeJCH4WzgNwo4Tt

    Score
    3/10
    behavioral19

    • Target

      resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-ia32/binding.node

    • Size

      706KB

    • MD5

      d0bed07d11ea06d6bf4ac0baa228c4de

    • SHA1

      33f3c3bb0f2789981c5297dba66505dc008605fb

    • SHA256

      c1b244c395c03d29774593d7d9fa7183a9bf06f06970e7d06243ad5b74e38880

    • SHA512

      3da2e1b7171f4a9a60e9871eb5a5b53b0f690c139d9f9ab771ea06e20a207981497c078cf44184369b9ea71abae17fa77bc7c0045c5bb6846c7e4a978e59fdfd

    • SSDEEP

      6144:i0Rs4zCbge4GzRElPAuZU6ON2NKeUPXcyoq2Z6DBwJYfZrmVKuDsutn9Ulda9qLZ:i0DGOJAuZUXNX/cyoq2Z6DsIuDsudCZ

    Score
    3/10
    behavioral20

    • Target

      resources/elevate.exe

    • Size

      125KB

    • MD5

      213e9795c2c0876479333145ea1412e7

    • SHA1

      2182cfcad138f1ae7d90598091a917a22cf73e56

    • SHA256

      8a406f56d8e1df885f7302819748ff6ea092fdfe1326c8a9fe8bed57e9ec753e

    • SHA512

      9e6c3f8758e824b9ab5eb2658b51fc9a848e0666dfc6525e10664b7b38bd6601b4982e9c3cc9830bf4694eacf2404d13294d260dc0aa2c544dc9b5118f7c2bd1

    • SSDEEP

      3072:OVbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYSTmjec:6PrwRhte1XsE1l92

    Score
    1/10
    behavioral21

    • Target

      vk_swiftshader.dll

    • Size

      4.2MB

    • MD5

      dd3a757828c6cc214fac84486f69ba8e

    • SHA1

      5f79beada6f80c903b5d1c04f0eb30e8acd396a2

    • SHA256

      baf14a4d3a28ac7ceab2a750a49bbc5d3259856c16ee160a444b92b8de908e9c

    • SHA512

      9d4943c76f828bb61162517acc50cb34cb181f155e8ddcaa293f493354789fa3ace21eabca833d407aa0c83b89fa7661cb6739f147c3002972d1db364ab4828e

    • SSDEEP

      49152:kaaVmf9fmJEZVCnIveij/+L0X/4oNu4M8ixT9c06huefekRMprAzsxCOBLiwFVx:kabWqSho94uZwNEp9KFGvLqH

    Score
    3/10
    behavioral22

    • Target

      vulkan-1.dll

    • Size

      744KB

    • MD5

      bb7496239e0f1b44c935df3954c3fc42

    • SHA1

      d063da60766682cf40b690bc03094e5c7ebd8669

    • SHA256

      e125930a96f0bcb36287932ceb3676d44e5c5e6a9e8ab6ca6ca60faa833f3d9c

    • SHA512

      7b8fecee987d1f551f1d66446348c62601784977ccdca302f5173f049972271f341ec05a0de6c1eee4f2e8cb761538dd7cea03d1364920a5b1dddf02a397a324

    • SSDEEP

      12288:c3KEZau9CO/FfYUHIr/aNnUXhdhKdjLv74eusp:caEZau9CO9flEi+RdhqLvUcp

    Score
    3/10
    behavioral23

    • Target

      resources/app.asar.unpacked/node_modules/@termius/serialport-bindings/win-x64/bindings.node

    • Size

      730KB

    • MD5

      197a211298fb0c93dda85865b5471b65

    • SHA1

      967a8e0735dcea8fafd72b6eae407a3f586877e1

    • SHA256

      50aa3785a77492faec599a30841f165d1427508ae7f22f72d962ab7a9c70ae1f

    • SHA512

      13e1c505f379ce88f97124efd3c0fdc7eadbfc9b51b481d519f72eb753e8105efc3a11ce591c8090aa89c925a9f96228cc7476ff6ed1f5c19dbd3d9ed093c5cb

    • SSDEEP

      12288:8klrkaZcan8m8eGI/MKrhH3R3XDC0/jSMgpDAHmL0/6gCZ/Un01rj:TTcanH/Q9UnQ

    Score
    1/10
    behavioral24

    • Target

      resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-x64/binding.node

    • Size

      890KB

    • MD5

      1a6bdc6f94a6ba383edc524bb0bcbd55

    • SHA1

      84b825349a6ef4e05a0c63081f931316b12a5dde

    • SHA256

      8522fff296b531d9b09ef9ef12c7b5820559808f979697b91c85a04310167ea8

    • SHA512

      1db3889b1b0889cb035a547ef8e7ad6aa358bcb2d6ee35c3a63b1bc5240b46e0c7c7cd60903da6b994c698ef9f7154715ba155ee6c2ede0c49124d1c78085ca3

    • SSDEEP

      12288:le9eKCSfeomr5EJrzOMtSySR1SxIIdxr356KuT5i3fARttdPtqLqv156F3mX:U4SNmr5EJUNALM6F

    Score
    1/10
    behavioral25

    • Target

      resources/elevate.exe

    • Size

      125KB

    • MD5

      4755ef0b762c795afc15049d3d7b553b

    • SHA1

      71e5feb37d02a4a5bdacb0356a34338d9be8bbfb

    • SHA256

      2397621e80b84afb4b2c50cf911f503ccc930f307d0235f1e811a89ef2fc5a3f

    • SHA512

      0aa858563070816bb313632f500827500097c1bed5d29367c12a3499af53f9d938d3f0a528cd8985800cc5733a07a8e6dd04452aa1a7109ff29ccd3eb3ff4679

    • SSDEEP

      3072:WVbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYSTmje3:CPrwRhte1XsE1l9B

    Score
    1/10
    behavioral26

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    behavioral27

    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10
    behavioral28

    • Target

      $R0/Uninstall Termius.exe

    • Size

      504KB

    • MD5

      c183011eadcee3f6e87992afabc83fa5

    • SHA1

      94a31fb2f72c3669fb45d4ef7b61cd382e6b0497

    • SHA256

      801ab9493b714cec96e24bbf8475a89686099003149bc175fe75146ba55b7787

    • SHA512

      d096b43d4d870eba8bfbedc874f29e8af7b8b12a20e020b52efb23c2320c6a4b669019a07463500ee409d40a14812d534eaa182272e5abe7c40498fa12317208

    • SSDEEP

      6144:S740IGdWkvrRNaUoithwE8s2t0EyL+yay:gfvrG0thwcRKJy

    Score
    5/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral29

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral30

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral31

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

2
T1553

Install Root Certificate

2
T1553.004

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

6
T1082

Process Discovery

2
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks