Overview
overview
3Static
static
1env.sh
ubuntu-18.04-amd64
1env.sh
debian-9-armhf
1env.sh
debian-9-mips
env.sh
debian-9-mipsel
health-record.sh
ubuntu-18.04-amd64
1health-record.sh
debian-9-armhf
1health-record.sh
debian-9-mips
health-record.sh
debian-9-mipsel
post-install.sh
ubuntu-18.04-amd64
1post-install.sh
debian-9-armhf
1post-install.sh
debian-9-mips
post-install.sh
debian-9-mipsel
post-uninstall.sh
ubuntu-18.04-amd64
1post-uninstall.sh
debian-9-armhf
1post-uninstall.sh
debian-9-mips
post-uninstall.sh
debian-9-mipsel
pre-install.sh
ubuntu-18.04-amd64
1pre-install.sh
debian-9-armhf
1pre-install.sh
debian-9-mips
pre-install.sh
debian-9-mipsel
pre-uninstall.sh
ubuntu-18.04-amd64
1pre-uninstall.sh
debian-9-armhf
1pre-uninstall.sh
debian-9-mips
pre-uninstall.sh
debian-9-mipsel
start-stop.sh
ubuntu-18.04-amd64
1start-stop.sh
debian-9-armhf
1start-stop.sh
debian-9-mips
start-stop.sh
debian-9-mipsel
bin/AsRemo...er.pyc
windows7-x64
3bin/AsRemo...er.pyc
windows10-2004-x64
3bin/asremote-srv.pyc
windows7-x64
3bin/asremote-srv.pyc
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
env.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
env.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
env.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
env.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
health-record.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
health-record.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral7
Sample
health-record.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral8
Sample
health-record.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral9
Sample
post-install.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral10
Sample
post-install.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
post-install.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
post-install.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral13
Sample
post-uninstall.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral14
Sample
post-uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral15
Sample
post-uninstall.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral16
Sample
post-uninstall.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral17
Sample
pre-install.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral18
Sample
pre-install.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral19
Sample
pre-install.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral20
Sample
pre-install.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral21
Sample
pre-uninstall.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral22
Sample
pre-uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral23
Sample
pre-uninstall.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral24
Sample
pre-uninstall.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral25
Sample
start-stop.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral26
Sample
start-stop.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral27
Sample
start-stop.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
start-stop.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral29
Sample
bin/AsRemoteCommandsHandler.pyc
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
bin/AsRemoteCommandsHandler.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
bin/asremote-srv.pyc
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
bin/asremote-srv.pyc
Resource
win10v2004-20240226-en
General
-
Target
bin/AsRemoteCommandsHandler.pyc
-
Size
49KB
-
MD5
0cce18733b419438bca64e6f79cb75b5
-
SHA1
d3f30ed452a774c0eb468c6e426a6665e131b49f
-
SHA256
68841421ea718752bd8f280680b1801b25f10a42ace193c1814ce60d4ba33f77
-
SHA512
1dbf0587087915c976184154ebb511d7c20c4fcd2cb90ac27940b68313726e72fe542a5ba832acfe3c8b186b99cc86355394be509bb38b02caf798d56c21bb7b
-
SSDEEP
1536:2oB7EE67b3HECrWvX+pAAe7GRSTmLC+flAu9dmMuFA5UpWwXBLo+6W1jMA1hMATe:cE67b3HECrWvX+pAAe7GRSTmLC+flXdd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2744 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2744 AcroRd32.exe 2744 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2608 1896 cmd.exe 29 PID 1896 wrote to memory of 2608 1896 cmd.exe 29 PID 1896 wrote to memory of 2608 1896 cmd.exe 29 PID 2608 wrote to memory of 2744 2608 rundll32.exe 30 PID 2608 wrote to memory of 2744 2608 rundll32.exe 30 PID 2608 wrote to memory of 2744 2608 rundll32.exe 30 PID 2608 wrote to memory of 2744 2608 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD537800510f10174382d855cc7871e4f6c
SHA13d1e78133cf131d2765ef0f87fd090d95d7a3cf8
SHA25687384e99b9646dfc3038d6ede150ff9c6c0bd72a7ac66e766cf60f096b812aa8
SHA5123f28697a06c83f5b68e7d9f436f77a066c4da84b2894a67aec06b1780df04e769cdc4342fb7c138e1afafa96781e49c0e4578d2b6e850f83ecc4e9dae7b3db38