Overview
overview
6Static
static
3zapret-win...64.cmd
windows7-x64
1zapret-win...64.cmd
windows10-2004-x64
1zapret-win...et.exe
windows7-x64
zapret-win...et.exe
windows10-2004-x64
zapret-win...ig.exe
windows7-x64
zapret-win...ig.exe
windows10-2004-x64
zapret-win...ck.cmd
windows7-x64
5zapret-win...ck.cmd
windows10-2004-x64
5zapret-win...eck.sh
ubuntu-18.04-amd64
6zapret-win...eck.sh
debian-9-armhf
6zapret-win...eck.sh
debian-9-mips
6zapret-win...eck.sh
debian-9-mipsel
6zapret-win...log.sh
ubuntu-18.04-amd64
3zapret-win...log.sh
debian-9-armhf
3zapret-win...log.sh
debian-9-mips
3zapret-win...log.sh
debian-9-mipsel
3zapret-win...ase.sh
windows7-x64
3zapret-win...ase.sh
windows10-2004-x64
3zapret-win...log.sh
windows7-x64
3zapret-win...log.sh
windows10-2004-x64
3zapret-win...ate.sh
windows7-x64
3zapret-win...ate.sh
windows10-2004-x64
3zapret-win...ype.sh
windows7-x64
3zapret-win...ype.sh
windows10-2004-x64
3zapret-win...irt.sh
windows7-x64
3zapret-win...irt.sh
windows10-2004-x64
3zapret-win...et.exe
windows7-x64
1zapret-win...et.exe
windows10-2004-x64
1zapret-win...ig.exe
windows7-x64
1zapret-win...ig.exe
windows10-2004-x64
1zapret-win...rt.dll
windows7-x64
1zapret-win...rt.dll
windows10-2004-x64
1Analysis
-
max time kernel
2s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
03-12-2024 16:41
Behavioral task
behavioral1
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral11
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsbe-20240729-en
debian-9-mips
Behavioral task
behavioral12
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral15
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
-
Size
51KB
-
MD5
9ddbecaf77d9c20696b679d3bda5bd95
-
SHA1
188bb0b81445b9cdcfd470a9e594fbc97e2cbbc2
-
SHA256
c8ca0e27212487656edce27cc26e5cdf25c2237c717ef9d90722ff54ac4ebcee
-
SHA512
d4accbe38147545186bbf67936ac131dd6e879fc59a502dafd55385180babb8541797da5b250745affa22e5ea6f0325c6277a74f8e45fefed979c9bd1328b854
-
SSDEEP
1536:nQ3Ds3LsiRjSpercIfjur6BdrfrtwWLlQLMnxXi1vIbIksApwmjx:VRjljurEdbrjjx
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 2 IoCs
Processes:
pgreppgrepdescription ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
Processes:
pgreppgrepsedsediddescription ioc Process File opened for reading /proc/460/status pgrep File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/148/status pgrep File opened for reading /proc/694/status pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/209/cmdline pgrep File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/104/cmdline pgrep File opened for reading /proc/148/cmdline pgrep File opened for reading /proc/670/cmdline pgrep File opened for reading /proc/729/cmdline pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/670/status pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/225/status pgrep File opened for reading /proc/695/status pgrep File opened for reading /proc/367/cmdline pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/330/cmdline pgrep File opened for reading /proc/15/status pgrep File opened for reading /proc/36/status pgrep File opened for reading /proc/209/status pgrep File opened for reading /proc/version sed File opened for reading /proc/763/status pgrep File opened for reading /proc/225/cmdline pgrep File opened for reading /proc/334/status pgrep File opened for reading /proc/16/status pgrep File opened for reading /proc/725/status pgrep File opened for reading /proc/75/status pgrep File opened for reading /proc/700/status pgrep File opened for reading /proc/334/cmdline pgrep File opened for reading /proc/114/status pgrep File opened for reading /proc/733/status pgrep File opened for reading /proc/378/status pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/37/status pgrep File opened for reading /proc/727/cmdline pgrep File opened for reading /proc/760/status pgrep File opened for reading /proc/70/cmdline pgrep File opened for reading /proc/114/cmdline pgrep File opened for reading /proc/144/cmdline pgrep File opened for reading /proc/460/cmdline pgrep File opened for reading /proc/filesystems pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/71/cmdline pgrep File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/72/cmdline pgrep File opened for reading /proc/311/status pgrep File opened for reading /proc/695/status pgrep File opened for reading /proc/75/status pgrep File opened for reading /proc/77/status pgrep File opened for reading /proc/670/status pgrep File opened for reading /proc/738/cmdline pgrep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems id File opened for reading /proc/311/cmdline pgrep File opened for reading /proc/366/status pgrep File opened for reading /proc/662/status pgrep File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/17/cmdline pgrep
Processes
-
/tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh/tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh1⤵PID:733
-
/usr/bin/dirnamedirname /tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh2⤵PID:736
-
-
/bin/sleepsleep 0.0012⤵PID:742
-
-
/bin/grepgrep -Fxq /usr/sbin2⤵PID:744
-
-
/bin/grepgrep -Fxq /sbin2⤵PID:747
-
-
/bin/unameuname2⤵PID:749
-
-
/bin/sedsed "s/\\x0/\\n/g" /proc/1/cmdline2⤵PID:751
-
-
/usr/bin/headhead -n 12⤵PID:752
-
-
/bin/readlinkreadlink /sbin/init2⤵PID:754
-
-
/usr/bin/basenamebasename /lib/systemd/systemd2⤵PID:755
-
-
/bin/sedsed -nre "s/^Linux version ([0-9]+)\\.[0-9]+.*\$/\\1/p" /proc/version2⤵
- Reads runtime system information
PID:757
-
-
/bin/sedsed -nre "s/^Linux version [0-9]+\\.([0-9]+).*\$/\\1/p" /proc/version2⤵
- Reads runtime system information
PID:758
-
-
/usr/bin/pgreppgrep "^nfqws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:761
-
-
/usr/bin/pgreppgrep "^tpws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:762
-
-
/usr/bin/idid -u2⤵
- Reads runtime system information
PID:764
-