General

  • Target

    citizen-intelligence-agency-legacy-1.0-demo-4.zip

  • Size

    154.5MB

  • Sample

    240901-phfjla1bpf

  • MD5

    fe90e34e3011df99dda675b0df55878e

  • SHA1

    e764193caa7a233610fd98a8ad9bad7ee45109d6

  • SHA256

    ae1345037a5da96cb220bbb196091976010a3a9c3fe704fc7497e5ed3ab40c2e

  • SHA512

    4c6f74285135f6336e81c4a49d2ef6391b8be4cf8e48926b5d07764db48de63c0aa0f5559015eee2f2e296e7d4c6acbcee85794c23f932b266fab1f13c3f1cbe

  • SSDEEP

    3145728:1RF0L2EnQY3b3QkwtbBq3Qvd0bFjlPnNMZBe+1O/4vLCkwNcC7ANdG:DFdUbQFtbBQQ4FjRnie+1O8wNcCgdG

Malware Config

Targets

    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/config/ec2-ami-user-data-script.sh

    • Size

      886B

    • MD5

      f589746c5f3ccff965ee835a79f9692a

    • SHA1

      09e634e30608b20249370061d5c45e2319277ddf

    • SHA256

      af9cd64ebbb1f0dfbe5236a1814e272cfeadbb651c9ff40abe629eeac18b89d8

    • SHA512

      ba3ac3b0af0c57fa28b0cb1b90b847b86f360bff21b7541fc4ea329a90a0c0a9809692d7d9c34061fb8944c0916ce370d8ff44e6760b19c2cdd8fb951c8cd14f

    Score
    7/10
    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Deletes log files

      Deletes log files on the system.

    • Write file to user bin folder

    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/application/dto/common/package.html

    • Size

      176B

    • MD5

      9aa98f126610478d14f0b4b938f18532

    • SHA1

      7a0134bb8948369f5ae5f052ccf3aab4bf79b7df

    • SHA256

      dce335dc69624ae5de63c7bbb50b0fd868037dbd77e7d76ec81418f3f1406dce

    • SHA512

      1795f9c302bfdd608a47ac240118a57ef9ddf7a75e329f3b4756ced5f54490760bee2235f900d297af057d0ad5e497e717e48ef6ac832e415211272a0bfbc284

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/application/impl/admin/package.html

    • Size

      148B

    • MD5

      20e3f14bca734a5df426d7eab96e3654

    • SHA1

      566b2388a0ca05e7acfd382c9a109646e21a8b71

    • SHA256

      fa85da8fabc3a1a5ed6c5598ea87e23d6d9ae94db1778f730d79306ebff3def5

    • SHA512

      84e9c7884bcdfa8a4a4a3c6ba7cb5cecd7197d2365ce58e22dfb86e7f7d930f3051978189d56e61a28335eacb028379bdabf640350df1fc3c6248dcb8d683378

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/application/impl/common/package.html

    • Size

      142B

    • MD5

      30a22ad97950f632d772fc7481ee5533

    • SHA1

      70394455fdc205af5272d395ed3d1f18917d10e5

    • SHA256

      5cb88c2358c69217b30b9a99140f3f9e902dd2bfdff912305caf0592900fc859

    • SHA512

      aecc3b458a14e267fd9fc1adf59a14bb2b44f2a1aa9e2238bee6da0e65bed39fb620b22dd41b63ac3eb8bcb5d070f2c1f2d981cb0af8959c5160a6492b1f77ca

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/application/impl/user/package.html

    • Size

      142B

    • MD5

      9961981a3bd3138b223799247ac5d789

    • SHA1

      1a7fa4a38a6d63d8407fe04b12ad9514029c05d0

    • SHA256

      5f6fdb4301b82b025a38691ad442cb29866893ce9183b139ad7b71f16c588bca

    • SHA512

      a05b45c7d9711af91f6a317121663807d52edf77f332edaea195bc4cd2bb95debabe9b85e49f24484757fb320fa2b349d319b42cf9be0327125e8f15ccd2e243

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/core/impl/package.html

    • Size

      132B

    • MD5

      b66c6bb2c84aaf565303c4c06a899ffb

    • SHA1

      86283812885546f0fadff552940495967d12a63a

    • SHA256

      fe3c4a48fcef09b22c955ab6521e53ed72fa01a8624babae16f9bc9970747485

    • SHA512

      9e9063ee64ce50f8b7f903f9d0a19797e693f1059ea4a4c91129f4d9d337bea812f80120b12dc710e5bfdfda9aa4ea8d9a0ca2a19f8752fd69c35cacb573d8a2

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/model/sweden/impl/package.html

    • Size

      171B

    • MD5

      b94cd35d98f9eea8073cdfde8530e0df

    • SHA1

      954f8b46a53a613c7a647d5dda98919ed83fa058

    • SHA256

      c4f3e9fb77b05c4d967235fa0d9edd8145245aae27d6916510b74cb2bcde1d83

    • SHA512

      55b07dd511e39476b23de11153466d08c44d0b9a1bd31dcdf34d2657a98f671a5db26c7d3f547b6d29d5424cab392dfa684955b1767ca1fede9b1897b5a403fd

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/admin/package.html

    • Size

      154B

    • MD5

      2ee7651c5ceb7b826a632cd769d7e514

    • SHA1

      750fdeb75e144297c15d5cf514bcdf974c8f17d1

    • SHA256

      b258524f0a137380f85f1bfcb5022379a5c864b38efaee791c71a7069622b94c

    • SHA512

      0c5a671892a6792c02c79a371277a5a99f80f65941b1c22add2f8115b205c68661792dd32d6963a20179f9c9eea185ec3c18ad51392228cf24e7adb2622f0eb1

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/application/package.html

    • Size

      162B

    • MD5

      1707c1d7ddc3ff43c16ce4b3db9de268

    • SHA1

      2f2c33771a4e9c51411e27c620ec81bde7bb9a26

    • SHA256

      d401c76f5cd073b36ad3727382ed18e9ab8df028794ea628852c04e56b1bc167

    • SHA512

      2570b52bb00de3e54437fc5c5458f6ffc4fff3b622df854ab9a65987f3c1a407194b6dbda37cd01f8b29b28f9384fa86f8b62356d963302023f6d216b76f8780

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/common/package.html

    • Size

      160B

    • MD5

      3141d4521a4f7211e87dae8295899d25

    • SHA1

      b21b484f4b40baa614e483ae33a5327dcf480d3c

    • SHA256

      0943d01e6ae4163e4234a95816e9d96cd23ace5b057f0b64e567f7fee0c2a456

    • SHA512

      48b21cd1021ec63f2b2922f75177db28089b950cb394ac22ae103331fd1ae5564bfac1adbc8d4af0ac7d542aff13de1b21ae7d99d9f6838c1187f0de30fc6617

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/dto/admin/package.html

    • Size

      121B

    • MD5

      650f7cf444c295fba6bf58ba80aa3a4a

    • SHA1

      fafa0ebfaeb251f5e998680a773d4a9e5ed27e07

    • SHA256

      2fac40db29193b04aa5c0a39c09a6166a77b33c401679216a405802b29e4ffa5

    • SHA512

      33e668ca5b3e598f03a9ce15333bb3d83be63a2d3412cbe432e2a62630a5ca657a662bf1095a3bdf57d18a0727aed861cf3dac368e00d55edda3354de18c8eb1

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/dto/application/package.html

    • Size

      121B

    • MD5

      650f7cf444c295fba6bf58ba80aa3a4a

    • SHA1

      fafa0ebfaeb251f5e998680a773d4a9e5ed27e07

    • SHA256

      2fac40db29193b04aa5c0a39c09a6166a77b33c401679216a405802b29e4ffa5

    • SHA512

      33e668ca5b3e598f03a9ce15333bb3d83be63a2d3412cbe432e2a62630a5ca657a662bf1095a3bdf57d18a0727aed861cf3dac368e00d55edda3354de18c8eb1

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/dto/common/package.html

    • Size

      121B

    • MD5

      650f7cf444c295fba6bf58ba80aa3a4a

    • SHA1

      fafa0ebfaeb251f5e998680a773d4a9e5ed27e07

    • SHA256

      2fac40db29193b04aa5c0a39c09a6166a77b33c401679216a405802b29e4ffa5

    • SHA512

      33e668ca5b3e598f03a9ce15333bb3d83be63a2d3412cbe432e2a62630a5ca657a662bf1095a3bdf57d18a0727aed861cf3dac368e00d55edda3354de18c8eb1

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/dto/user/package.html

    • Size

      121B

    • MD5

      650f7cf444c295fba6bf58ba80aa3a4a

    • SHA1

      fafa0ebfaeb251f5e998680a773d4a9e5ed27e07

    • SHA256

      2fac40db29193b04aa5c0a39c09a6166a77b33c401679216a405802b29e4ffa5

    • SHA512

      33e668ca5b3e598f03a9ce15333bb3d83be63a2d3412cbe432e2a62630a5ca657a662bf1095a3bdf57d18a0727aed861cf3dac368e00d55edda3354de18c8eb1

    Score
    3/10
    • Target

      citizen-intelligence-agency-legacy-1.0-demo-4/src/main/java/com/hack23/cia/service/api/user/package.html

    • Size

      152B

    • MD5

      15ae4fd0de73f91bd1cfd72f4bb2835b

    • SHA1

      159823a94e7b23426c1eb7790be0f54d1196360f

    • SHA256

      b6823bd97782a9161c95c60eee0f0cbcfd10f9839c2885a0e7b7ef5b25b37f07

    • SHA512

      0c87a4743436c1f6ad76e180de5d27dcb0ea09d4d3464207503039800b7cd2e6cb66bc0b868d9286e35f8cb6b946a290e8e7e1a32c47300febfc3d99a9b37f68

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
1/10

behavioral1

Score
3/10

behavioral2

antivm
Score
4/10

behavioral3

Score
6/10

behavioral4

persistence
Score
7/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10