Overview

overview

7

Static

static

3

Flux Setup 1.0.83.exe

windows7-x64

7

Flux Setup 1.0.83.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

Flux.exe

windows7-x64

1

Flux.exe

windows10-2004-x64

7

resources/...ry-cli

ubuntu-18.04-amd64

3

resources/...ry-cli

debian-9-armhf

4

resources/...ry-cli

debian-9-mips

1

resources/...ry-cli

debian-9-mipsel

1

resources/...per.js

windows7-x64

3

resources/...per.js

windows10-2004-x64

3

resources/...dex.js

windows7-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...ger.js

windows7-x64

3

resources/...ger.js

windows10-2004-x64

3

resources/...dex.js

windows7-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...oys.js

windows7-x64

3

resources/...oys.js

windows10-2004-x64

3

resources/...aps.js

windows7-x64

3

resources/...aps.js

windows10-2004-x64

3

resources/...ker.sh

ubuntu-18.04-amd64

1

resources/...ker.sh

debian-9-armhf

1

resources/...ker.sh

debian-9-mips

1

resources/...ker.sh

debian-9-mipsel

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Flux Setup 1.0.83.exe

  • Size

    100.0MB

  • Sample

    241121-sgm4tsxnbj

  • MD5

    405a033317cd59781ff25d6512284ed3

  • SHA1

    069d928bfbcf7aeee625708143485621382f2866

  • SHA256

    3a6fb161d92cda9d5cc9399073070393ac23afd27684a08d2ce6f84586c72f20

  • SHA512

    c9fd4cbd5b90400e5649be7f3b81072beb4e8bccb954963cc1e4b48272225dc2c978828b10e933c494775099d6f8f90a4bbbe8cee836068a91f150ac12baab42

  • SSDEEP

    1572864:It4opqebTEWRCrJnR0sD7GHv9xFJgHaXOTqPLk8rDbDkkagQkpIEDG5oiP2Wo6gM:ItHlb7QJRnDQzFJsNH8nkkagQfroU2RQ

Score
7/10
antivmdiscoveryexecutionlinux

Malware Config

Targets

    • Target

      Flux Setup 1.0.83.exe

    • Size

      100.0MB

    • MD5

      405a033317cd59781ff25d6512284ed3

    • SHA1

      069d928bfbcf7aeee625708143485621382f2866

    • SHA256

      3a6fb161d92cda9d5cc9399073070393ac23afd27684a08d2ce6f84586c72f20

    • SHA512

      c9fd4cbd5b90400e5649be7f3b81072beb4e8bccb954963cc1e4b48272225dc2c978828b10e933c494775099d6f8f90a4bbbe8cee836068a91f150ac12baab42

    • SSDEEP

      1572864:It4opqebTEWRCrJnR0sD7GHv9xFJgHaXOTqPLk8rDbDkkagQkpIEDG5oiP2Wo6gM:ItHlb7QJRnDQzFJsNH8nkkagQfroU2RQ

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      Flux.exe

    • Size

      154.5MB

    • MD5

      87278673be7f80f2fbfc5dc51d4cd83d

    • SHA1

      19c05e365d15da1705cb6e057eb74ff7c1340ddc

    • SHA256

      e3ee85f2d8fd1496cff031965769c6222cae8ffc66c52e0f8e832ff0d5e2e831

    • SHA512

      0ecdd4568faf37f6aac7a9c41381a9e0ebbb36496fbfcc8a832ffb2c470c24cfdfbea17c2086eb22578e636b098ddb9170821070be91b02a98ed617088e5f4df

    • SSDEEP

      1572864:1CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:xDAgZi

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/bin/sentry-cli

    • Size

      487B

    • MD5

      b7c89ec5dfb8b15555f32a3bef6c3103

    • SHA1

      a92048052f5fc0af532cd97ebf82c1a9fbf12342

    • SHA256

      7c5c97aaee075241bdc4fbc610b356445747e962ac3d986c5016acefd66a6ea0

    • SHA512

      c47baa0e0896684403760a13cfa6dd5826152ec7ae83f783040d186eaca8af70bc97530bbb22b720d7482a4ad18c3959ab1af8ccfe3689b19a51955e777884e8

    Score
    4/10
    discoveryantivm
    behavioral13behavioral14behavioral15behavioral16

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/helper.js

    • Size

      6KB

    • MD5

      c29ad60a23d5406728a51afa4352b4c7

    • SHA1

      2be817215890f5868717765570ce9f7422735c4e

    • SHA256

      faa867204c92db252271c9d850962ae1ff5c9448444ca907af483a6c874a6eb0

    • SHA512

      e1784b8bf7119bf3380b192f1597cb3179425ff7ab347b144011fd17b62794760e6e092a0a1dae99302eb6c333f1638440df4e4e0eaf64f26d4f3cc46a74d04a

    • SSDEEP

      192:WSqkCoOycfhxPBRw/uL2FqRxJRLVeUdrga:WSbCoOycfhJBR+qjRx/VeQMa

    Score
    3/10
    execution
    behavioral17behavioral18

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/index.js

    • Size

      1KB

    • MD5

      50c3a734036b84685a15d56217207d67

    • SHA1

      1893de2684072a3a2961337fa9a9b45a52c52c0a

    • SHA256

      171990f108cd5582f83432c1569f2c3e1aebfbfb159599f4ff2ab693c20a8f78

    • SHA512

      3aa037d12cee7cbf51826fb3e2aa87b4543dd62f5ff5f2f8915128061c07472304601766bddf949647c5ca92e8ee768a77139bbe91bdfaaae99dea4405168ea9

    Score
    3/10
    execution
    behavioral19behavioral20

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/logger.js

    • Size

      253B

    • MD5

      1d26f69361e75ca5cd2eac5f99249c72

    • SHA1

      787d51c708ce15b2c533a180a2bf639648bc40eb

    • SHA256

      d7d63601d3347efc93425f4f93049cfb9ed2b9ead1dce662c9c1bed3cba302e0

    • SHA512

      7350774074462d33ac9f2e130829306af08a6693fd597f40c39bfb194684f66d965cd23c10de5fc4389e4a2ffe84db727aad23dd683a805ae4825f10026cb040

    Score
    3/10
    execution
    behavioral21behavioral22

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/index.js

    • Size

      10KB

    • MD5

      e8282413c1895eaff49de6dd9b71ab13

    • SHA1

      4e058f522a46e20bbd26f15a6922390ec2c1da36

    • SHA256

      d6a28994173c1c36476121f8b0e3633e01ecd0589289901fba34fe218293443d

    • SHA512

      301d2a6ae958e1ba936cae6f555a587ad87567055f4709d4676a3ef5b1a3112cb338b8a9e744c24cbfa784f00f13a1118ad48fd4f6bb060c5608e4ddc8779389

    • SSDEEP

      192:0SLrK4h1VeAdTeTj8rHiZNWgqAKezwec2D6LaQLonNbcWdw2SEfsjy7J1nDIDu:13DLdKHaMKezw1QNbXPsfu

    Score
    3/10
    execution
    behavioral23behavioral24

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/options/deploys.js

    • Size

      368B

    • MD5

      f42c24cde0162b93624df51f4e2abfab

    • SHA1

      f819638944878ac4cb49438d8599d3fbd9081949

    • SHA256

      3f2316e7fb20e82df9a8b08d6169a622a89808742806adee2e4d89885962357d

    • SHA512

      67258cbaf9f46f1609cec9b87b7a577f855cde9c8efafa3d835a0d18fb3903fcc4733489bf81447cdf2c0a55701d569a75f11a81865dab8f624b722e76b7c674

    Score
    3/10
    execution
    behavioral25behavioral26

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/options/uploadSourcemaps.js

    • Size

      1KB

    • MD5

      d060ac623857ad5ca08e3a944768925a

    • SHA1

      26fe78c92f55f9529ffa2b71da403873da29313f

    • SHA256

      8d4bd4c779e177724aa7bf98e768e50ce8b2950ef5bf39fa08033057b400888b

    • SHA512

      ae1b42d7e5c5d60f935bcd08417d4d9055d71bfb80653281e990a687353592731a7c4423655fbb988728152846aa56a5f180335d254885338bf6c96ef2a8357a

    Score
    3/10
    execution
    behavioral27behavioral28

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/scripts/build-in-docker.sh

    • Size

      931B

    • MD5

      94b0fc212af523b8bfcd6c2aa5a5ab2a

    • SHA1

      cc0cb35f7ce729f7affe6b2c463e57966515e476

    • SHA256

      abaa92d196f6752f184b83b19aedd9b1e28d328e6817de213f61fbd108351e16

    • SHA512

      af0a2174e0304fdaa56ddae249049c142450ad4a0a9c8975548f61aa2bc356837b1d7ed441108156af32c979da5647bd0233a49db700ff0bbf528f9fa2c862e6

    Score
    1/10
    behavioral29behavioral30behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

antivmdiscovery
Score
4/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10