Overview
overview
4Static
static
1META-INF/c...binary
ubuntu-18.04-amd64
META-INF/c...binary
debian-9-armhf
META-INF/c...binary
debian-9-mips
META-INF/c...binary
debian-9-mipsel
anykernel.sh
windows7-x64
3anykernel.sh
windows10-2004-x64
3tools/ak3-core.sh
windows7-x64
3tools/ak3-core.sh
windows10-2004-x64
3tools/busybox
debian-12-armhf
3tools/fec
debian-12-armhf
tools/httools_static
debian-12-armhf
4tools/lptools_static
debian-12-armhf
4tools/magiskboot
debian-12-armhf
1tools/magiskpolicy
debian-12-armhf
tools/snap...static
debian-12-armhf
4Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
META-INF/com/google/android/update-binary
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
META-INF/com/google/android/update-binary
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
META-INF/com/google/android/update-binary
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
META-INF/com/google/android/update-binary
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral5
Sample
anykernel.sh
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
anykernel.sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
tools/ak3-core.sh
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
tools/ak3-core.sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
tools/busybox
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral10
Sample
tools/fec
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
tools/httools_static
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral12
Sample
tools/lptools_static
Resource
debian12-armhf-20240729-en
Behavioral task
behavioral13
Sample
tools/magiskboot
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral14
Sample
tools/magiskpolicy
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral15
Sample
tools/snapshotupdater_static
Resource
debian12-armhf-20240221-en
General
-
Target
tools/ak3-core.sh
-
Size
32KB
-
MD5
273e5ec7fcf39c7b5141c70258aa3506
-
SHA1
7baa42a0c313b9eb71424267595cadb08e909e51
-
SHA256
1537bb4c91d3c0d3983bec077f9306daf1959caeae685b0937a37cbdfbafcc57
-
SHA512
11d04760fcfb947c1d59edfb50e6db2cb0fcd4975a40961210a1df275feeac40cb243aa6d7a6573aa6f12b5b682d36a15ef89d3ce60da190c43a18403c92d480
-
SSDEEP
768:8dDlySKKreeJIzYv78vn5vK4HO9Ex0xe53E3QG027ZLMI0kGD1IzpcLZg:/aeeJIzfD1Izv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1700 OpenWith.exe