Analysis Overview
SHA256
9309cbe621ced13494dd892250ea9ef33716713f316c384ad094b7dbd1ff73a3
Threat Level: Likely malicious
The file CollapseLoader-1.2.5.zip was found to be: Likely malicious.
Malicious Activity Summary
Patched UPX-packed file
UPX packed file
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-06 16:33
Signatures
Patched UPX-packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral5
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522-en
Max time network
132s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral14
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
130s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral21
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:34
Platform
ubuntu2204-amd64-20240522.1-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
131s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral7
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
130s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
130s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral9
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:34
Platform
ubuntu2204-amd64-20240522-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522-en
Max time network
132s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral19
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
130s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral20
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:34
Platform
ubuntu2204-amd64-20240522.1-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral10
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
150s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | location.services.mozilla.com | udp |
| US | 8.8.8.8:53 | location.services.mozilla.com | udp |
| US | 8.8.8.8:53 | locprod2-elb-us-west-2.prod.mozaws.net | udp |
| US | 44.241.205.248:443 | location.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | live.thunderbird.net | udp |
| US | 8.8.8.8:53 | live.thunderbird.net | udp |
| US | 104.26.2.27:443 | live.thunderbird.net | tcp |
| US | 8.8.8.8:53 | autoconfig.thunderbird.net | udp |
| US | 8.8.8.8:53 | autoconfig.thunderbird.net | udp |
| US | 104.26.2.27:443 | autoconfig.thunderbird.net | udp |
| US | 104.26.2.27:443 | autoconfig.thunderbird.net | tcp |
| US | 104.26.2.27:443 | autoconfig.thunderbird.net | tcp |
| US | 8.8.8.8:53 | support.mozilla.org | udp |
| US | 8.8.8.8:53 | support.mozilla.org | udp |
| US | 8.8.8.8:53 | www.mozilla.org | udp |
| US | 8.8.8.8:53 | www.mozilla.org | udp |
| US | 8.8.8.8:53 | us-west1.prod.sumo.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | www.mozorg.moz.works | udp |
| US | 104.26.2.27:443 | autoconfig.thunderbird.net | udp |
| US | 104.26.2.27:443 | autoconfig.thunderbird.net | udp |
| US | 8.8.8.8:53 | start.thunderbird.net | udp |
| US | 8.8.8.8:53 | start.thunderbird.net | udp |
| US | 104.26.2.27:443 | start.thunderbird.net | tcp |
| US | 104.26.2.27:443 | start.thunderbird.net | udp |
| US | 8.8.8.8:53 | www.mozorg.moz.works | udp |
| DE | 13.32.119.185:443 | www.mozilla.org | tcp |
| DE | 13.32.119.185:443 | www.mozilla.org | tcp |
| DE | 13.32.119.185:443 | www.mozilla.org | tcp |
| US | 8.8.8.8:53 | thunderbird-settings.thunderbird.net | udp |
| US | 8.8.8.8:53 | thunderbird-settings.thunderbird.net | udp |
| US | 8.8.8.8:53 | services.addons.thunderbird.net | udp |
| US | 8.8.8.8:53 | services.addons.thunderbird.net | udp |
| US | 104.26.2.27:443 | thunderbird-settings.thunderbird.net | tcp |
| US | 13.224.189.48:443 | services.addons.thunderbird.net | tcp |
| US | 104.26.2.27:443 | thunderbird-settings.thunderbird.net | udp |
Files
Analysis: behavioral12
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | _http._tcp.security.ubuntu.com | udp |
| US | 8.8.8.8:53 | _http._tcp.se.archive.ubuntu.com | udp |
| US | 8.8.8.8:53 | security.ubuntu.com | udp |
| US | 8.8.8.8:53 | security.ubuntu.com | udp |
| US | 8.8.8.8:53 | se.archive.ubuntu.com | udp |
| US | 8.8.8.8:53 | se.archive.ubuntu.com | udp |
| GB | 185.125.190.39:80 | security.ubuntu.com | tcp |
| SE | 194.71.11.163:80 | se.archive.ubuntu.com | tcp |
| US | 8.8.8.8:53 | _http._tcp.saimei.ftp.acc.umu.se | udp |
| US | 8.8.8.8:53 | _http._tcp.chuangtzu.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | _http._tcp.chuangtzu.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | _http._tcp.saimei.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | chuangtzu.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | chuangtzu.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | saimei.ftp.acc.umu.se | udp |
| US | 1.1.1.1:53 | saimei.ftp.acc.umu.se | udp |
| SE | 194.71.11.167:80 | chuangtzu.ftp.acc.umu.se | tcp |
| SE | 194.71.11.138:80 | saimei.ftp.acc.umu.se | tcp |
Files
Analysis: behavioral15
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
130s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral17
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522-en
Max time network
132s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral13
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral16
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral18
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:37
Platform
ubuntu2204-amd64-20240522.1-en
Max time network
129s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral22
Detonation Overview
Submitted
2024-06-06 16:33
Reported
2024-06-06 16:34
Platform
ubuntu2204-amd64-20240522-en