General

  • Target

    B_L_torguard.tar.gz

  • Size

    36.6MB

  • Sample

    250328-q4a2nsymw6

  • MD5

    eea4f3400e02aaf0d9f52c8f946d7608

  • SHA1

    d2fd6e464fbf78f30093e8d061868809f2a27f14

  • SHA256

    1a828c7d13de59f9db34489ba5407bf2201181280aa6c6af1e4241982b0d1925

  • SHA512

    575fe23fb257b90b2ca00ee854cadd4b5060ddab4a4bb1fc005d32ad37647e8ae3ce18118440eeac5c7f9f14ea3dda00146726093506ee3dd022e6f2367717eb

  • SSDEEP

    786432:h1304PQ3FkckeNtJzIKCkGHh5n7BLKwwtsGVgtEP8hchbIRdGG0oTpjs:Tk+Q3dkIgH37BmwwtsGVdEchbM4oTZs

Score
4/10

Malware Config

Targets

    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/openconnect

    • Size

      2.7MB

    • MD5

      3da8b2f9d0d1c7c585c3eb5c69b14ac3

    • SHA1

      898ae7fa45f82046abdef1f567d968f39ed38c1f

    • SHA256

      9041abfa28567ade9fbb1ffb61c6496126fb941680e0187d3eff678c0ad5da9b

    • SHA512

      e00aa82f1c164a51d3455d9956909377c719d5c23aecfeab4e03d53a4369e905f4d13e0eaa4f9b590aef4a50ebbc78c88a1f2d37345e918642c3324173e9f3c1

    • SSDEEP

      49152:Lb5zSBrgBKlq2tl7GixDNfEBi/ej3L0VkPkfpdFPveISxaB2CNfTzKB:Ldzk7tlaixDNfEBgw3L0VkPkhreIS+i

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/openvpn

    • Size

      7.2MB

    • MD5

      71e83b50678645a8f18abe45a57ad066

    • SHA1

      368fc9b31201f719ac6a8783087833c78bc59dbd

    • SHA256

      bda689b35e09b4e5bd55c25649695fa9daee39d9bb8df23485e64b659334575d

    • SHA512

      501a3e3e176fe14684e60d3e3d2b4b3cd851d9b26b11c542c9e444daf3a793e267d3e042061a2edf875217487301c6572294ebbfd20f62e94e2c921e7fcf2923

    • SSDEEP

      98304:InFXWLZiRz1D1+6xj+CpzKmfx608zi6oml/TVsFhvKTlMS:IFWUJfzKmfx60Ci6oml/TVsFhvKTlMS

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/ss-local

    • Size

      2.3MB

    • MD5

      2f62a7d8c466acb6a8c8a25e260c6aa1

    • SHA1

      897df6c6db24171a1cafc32a55da690425dde615

    • SHA256

      7fb13ae9c73e0891bb3c108275ac986e1685b0b81f4a87b0028569f3c242d670

    • SHA512

      335fc5bea98ccb7075e4d5751a93f4b765cb53969f09c458cffd5dbfdb4f1b4634ed692e15bcec34300ab500a894436d491f7abc5087bc0a409766f0359e333d

    • SSDEEP

      49152:jyRGtlquVwAsO9LbRO2kLnchxf/Jw1A2IU6i2vMB2:Obnchx5wY+2EB2

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/stunnel_5_42

    • Size

      2.3MB

    • MD5

      737cefe0be9749c18af5167e1442311d

    • SHA1

      2cf9eaed1ea35c8868b996aba18abf2daf57e9b2

    • SHA256

      efa6a1a108c15dda6caa096035d42980d532834e0ab8137cbca2488901c8d2d0

    • SHA512

      7db9b57ad97e38c741dac93875e61096954835cfebea078f1e1ea40d2637366c496fe22e38edec52a7b78bc9d607189a472c44a788b9060dbe2c9c93700f003e

    • SSDEEP

      49152:1R2vz+mVBwRiO3Gtlqz5l9dWP97kDZDMItfVwAsOae52q78npVgIU6iGKAKrmF+T:1R2vz+NDIPyDZp/5/Q9+G0rmFt0

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/stunnel_5_57

    • Size

      4.0MB

    • MD5

      4ee59f3df00465cda75af6496f372b3a

    • SHA1

      f22a984330bc7d04a3da5404b24ba520adb1e0ae

    • SHA256

      1ee9cb419cf1783214a6d0dd74cd2e5a6faf8285c23ecb5ea8b03142d612608e

    • SHA512

      be2b23c4fbaa00557bb1041d87440a12ca93e09792d81f73ac468892db5c2667a657375e880c1e6269a87a658517084fd41ca8af81a3857f5ada67e66f4ddf72

    • SSDEEP

      98304:ALx+/0ZzMvBzxAYI+9WfsppjyoqduQWVCNGmjkNpBAdKcI4F:RszRepjAkNVCUmjkNpBAccI4F

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/torguard

    • Size

      5.6MB

    • MD5

      57fa17ccaaa72158bf5bfeb7d4ef846b

    • SHA1

      32f68dcc78c330d9074477d2044afaba400c53ff

    • SHA256

      7338245005544a16d2c4df4f21b0cbb3ced06e8083d762bc68773378bbafd6a8

    • SHA512

      cea7b63ce5379cee8fa7798ccfc55279482756fac8095f214c7c284f97cf1df3b65e239a7f25c9da985beeaec76d8833891c607024d9965abab42df8604c2b3d

    • SSDEEP

      49152:lqxoq0FrEiEWD5FdoR6aZRzb4Bc/HlCpKBH2jHnJvLNURCmrDAtkvcNWaL1KFyyz:5HZEqLdQ6aHzbhQJmR0sImeq5jHt

    Score
    4/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/torguard-wrapper

    • Size

      1KB

    • MD5

      4f955ad7ecfa96184ba1716ea2ce2b98

    • SHA1

      1f4b750e09c7ce297a37d82312b92fc9d2891c94

    • SHA256

      2f4f3ac2dfb180c76c7725e38d2bf4257f12f08bf38140035ebfc8a2b1d241f3

    • SHA512

      54b975422a2bd2cea485a8c057ed4f71cf19f30497a0f1d12e1fe0d1c544b57b8a93b2cbcb9822c3b699de00830ea59700dd83f25ab2404b6a6b8194477771f0

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/vpnc-script

    • Size

      29KB

    • MD5

      d2cb448e6dc0e6727f8cfe0287caf4ac

    • SHA1

      e95e9eee840bdebd42734577a27145ce29a59e30

    • SHA256

      5a510e308caeb18dabc036ee5dc4b3d7eab6fdeab92ebe1e57c25599325f3979

    • SHA512

      e69e0f0cdbbe68a9792f0a101f9aa68bcd68371dc72f0575bc408857993b02e61b5eeefcf935b3ec033a4255ad6fdbfb4afb58e2469e3eec5a977a3cde5b620e

    • SSDEEP

      384:cf2uPuK7BQl06zj5trqHviiP1gxyNZOpcKUcW6li:cflPxadzHrKvikCPi

    Score
    3/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/bin/wstunnel-7_9_2-linux-amd64

    • Size

      31.5MB

    • MD5

      874ef3262d7b8848eee7068218c35345

    • SHA1

      493726fb084eece04bfed3d211f4e984427f39b1

    • SHA256

      3791fab2385b9e994ec73bdd2267de703a94b663263e80229b5fa28894537872

    • SHA512

      e7da676a632777597e9da0adcfba03bea80ebbcf7c6562501e2c4a28f34aeb6f31bdf3a002bf81cab43411c6244e380bf3cd97098b43087ae98423ce6efe9660

    • SSDEEP

      196608:DE/0l2Xj3tw/1qRNuXoGEzm5ThPrSkNc7mg:DE/S2LthU

    Score
    3/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/doc/offline_warning.html

    • Size

      924B

    • MD5

      3e72c14436d399576bfb253eabb7ca90

    • SHA1

      35eadbe2008a7b754b85dfad7e791c9d698caede

    • SHA256

      84256a738a5e2e7d60b9275a2981c491ded1921e2fee329156393d162cd1b34b

    • SHA512

      ca2bdaf7e9a4f473744116171042428d70a45824af213edc7aa6a8d4714dcf9ebc9d7cfc450b64d215d9d0326c331b849bc3abf0b92050db11f34949a302a42e

    Score
    4/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Core.so.5

    • Size

      6.1MB

    • MD5

      3a2a30c48a1806b56b15c6f8987c4a02

    • SHA1

      bf3bcdf5f68cf6fbae1ee1269f784296180d0ebb

    • SHA256

      cc2d740f701e0910a77b7de78812ba00a0d21748fe178a0ffa14e4db5ef64f2c

    • SHA512

      7d99e65b1cb70ec4f4a24d3366f1bbf3b3d93dd666157602bd3f1c52136062e12d37c2f2b079ec067420a1fe4013cda652068e25896fd6184bbda74917562e61

    • SSDEEP

      98304:zB2i+xop9JIyHYC/ZUNCdmSVfNJsv6tWKFdu9CHN4Bl4r65:W49JXHoD+Jsv6tWKFdu9CtV

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5DBus.so.5

    • Size

      537KB

    • MD5

      87d5bbf4df1054343c321c0ba072f76a

    • SHA1

      239b7e4867c6daa1c6c16ae2095fc107f637563d

    • SHA256

      c7af6565160979f9ee70abd324e7fead49ea1ebefc52aee97ecf261a1c89bfb0

    • SHA512

      de736790fd98f7c204fb747fd0ce7b682d878fdf2add12797e09f24aff1a42c47f51eddbca1c3e6a3d9824732aac9f1437838ad72fcbafc0125bf3de85895be8

    • SSDEEP

      6144:P0eChh1QhbCo79kEGzxcz4ae9ZvAdQRXWPD4k4ZrDTLUpt0Wpmzz1hsh/iY:sh1QEoSEGzxO+nljkQYclz5u

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Gui.so.5

    • Size

      5.3MB

    • MD5

      1d8498770876b858ac1192ef933ce44c

    • SHA1

      a377e8ba8abe1cd6413ab436aca1e55fb5b9ed4c

    • SHA256

      1432259f26a035f2f9ed7ff5fc4cbbcdb8fbacd451ae193a3f9334dbf8dd5d7e

    • SHA512

      7a85827f64b430f524a887a0bc892a7cd1e1f6c155d2df0c05a55433c4642f8d73c1c2af0502383600c1eeaf5eeb2502d55f628916e2957e08d0cfe512e2f9a6

    • SSDEEP

      49152:SisH662O/UmyOr88Jipa1ZSNAItRJ3M0yyyyyy307oJIEYQ/ymYLYpRBT8+FTokX:da1sAItwB3srYLYpRBD0LjM4eMb96

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Network.so.5

    • Size

      1.6MB

    • MD5

      ed118aca8ea4f6a3037f5e52ff0a8b6d

    • SHA1

      78d4e92e11447c389e7fde9f1e3834833e985dc5

    • SHA256

      ae0b750fb4771798f695e0208505ad5998c9e19367c521b0e5c47d721696f484

    • SHA512

      3e1056b8ca8507c45be14cf7f59780f537b6a5f033bc317d8703c36232c2a1e0266b702fc49df7f6883a5a7ff04b4f6a7bd07734d7c0854d2fc991a41dd4dbf8

    • SSDEEP

      49152:6BtVsy1ee6Vv2cXSPWblRTBOLHgXZaMovhA6P:gsqee6Vv2cXSPWblRTBOLHUZKq6P

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Qml.so.5

    • Size

      4.7MB

    • MD5

      74bc10d4ded462de4c1cc0ef843b25f5

    • SHA1

      441c472db021f9b0f7becb2a921381be4d03d51e

    • SHA256

      191ae3fbcb521cd0dd66ed095983bb50f785b72a61c540d2969d109383fff45e

    • SHA512

      9ee07f9fe3def0b3a2c44cfe384c359bc3f1750cf99732ddc7b2e9d0ac490638015a0884d8ffe166efdcb224d199404f08395b98e3a824750b72e737be0243f3

    • SSDEEP

      98304:z0NnRMllPKmsnM1JnBjUgVbFDjOJMRAhUMSK9zFcpDp:2RMllOnEBng

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Quick.so.5

    • Size

      4.3MB

    • MD5

      8bbb0f22a30d664683552013dbfd9c7c

    • SHA1

      e84fc8205ae98c64eb7c0d7004ccd102af0e1f61

    • SHA256

      909d82c81bc587ce937aac339234b46dbbae968954db2fdc9ab7abc0b3747991

    • SHA512

      ee2831bc7ec9e040e95043e3666b2aa5e2fc0a0d66d485c5bf7bbfbbf8104d789ea307c2b8a9274ece2d4dfa5305534c29ea6f136e16c92977d350c439521d79

    • SSDEEP

      49152:mBVX/p+qJfcx1JaLrgPBmsTKBoJsInhQSY+u3DEneRtAwZ:0+yfK+8L3sqhQSxYSwZ

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5QuickControls2.so.5

    • Size

      205KB

    • MD5

      8ead04acadce0fada968fd735da38e8d

    • SHA1

      251138130a088cbf27b7d526b3aae82ee6d862c9

    • SHA256

      b2719529be87b81e8350fea35a409446056f5867aafaa07036064a98f3ced98c

    • SHA512

      1563ab8623f7c05c74726718a78ce721694a271d167cf91b081fbe65450302bdf15cb4a809f92c0a0d07cd9e16730e02dca4ebb79dd7c162b95d62a80136ed2f

    • SSDEEP

      3072:/5AUGBi/EtIAfrSTRBmOKCr5U5jUUq+H:BAUGBwufrSRBmQrAU

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5QuickTemplates2.so.5

    • Size

      1.4MB

    • MD5

      6daf13cef8eb534553c364d66473356c

    • SHA1

      fe79b8ad3f50e9b0d2f20869104af9ed4be3324f

    • SHA256

      ac7ba47b46c5396971a040c394de577417feb1d47b9c6f22deacba3166bbab63

    • SHA512

      96d710f889ccafc1e534c6d86e670dc59aafdec83cce039d1519099c5f9104146b9faf9a749d6ac6155fd9d11f0aff9553cd74ecc7eb2b0f29e03a20651a4acf

    • SSDEEP

      12288:RYCHRltWE82vSnLl0lb//YHiBnJ6qUMkH1I2UQIgKPXf1BRdKp1uK9Io:FltWE82vSeX9hJ6qUMkHKV2buKS

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Svg.so.5

    • Size

      354KB

    • MD5

      9494fac789940b02b6c9f54642d472a2

    • SHA1

      4ef873529898e78e04bcddf28e92932469138bc7

    • SHA256

      47ae1144fca0b0a637ccb95694222dce3afc03946d14f56d76cd76f8b28f73f7

    • SHA512

      baf52dbfaeb281377109125e7df8d016f2666aca1b713496d7433cbfe289f8a884502197c7c21d5203aebffe79453f1af5b01a36adc1bf2d097f6a5142f6b8cd

    • SSDEEP

      6144:c9oR4IePoZqiwDAdIZdLERpO4avz6P5wtl1dQ9Gzn:caqJiIIDO7vzN

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5WebSockets.so.5

    • Size

      172KB

    • MD5

      d383d5fbf8511b99e4c52737b726f607

    • SHA1

      f20f63d5b58ed254c4f38224fbd73b025244f041

    • SHA256

      420d81def66e2ea10d55f58d71ded63d2b3f4022cc89525065db467f16a09307

    • SHA512

      ce4233e852f9f5d65fd5b557abe2f9b476ce1d97e14e1b5740a69d2212f63cbf484bc230ea57e7433118b2e350b952a7f018e6926fd723f50e6e61ef9dbd4045

    • SSDEEP

      3072:nsHHQ+uJuzTfUFfND8mtAyDT6yEPqCX0:sHHQXuAnDBtAK8qC

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5Widgets.so.5

    • Size

      6.3MB

    • MD5

      6547e2bd33f5974f811ac84aab4643af

    • SHA1

      252eb0de4e9921ebd513e48dda2979950fbff2ec

    • SHA256

      4b6ceb77e0e8b35eeedd6e6623c79ba69ea3bcc1ddf967815b241645d439de9e

    • SHA512

      c7965dd6420fd595d29722e11daf8de7285b1e546d154417f82f1f35ee5e8ab524d3d0e568f36dd1b994c193a662dd752be88d874675e632bd1a97a508ec4d3f

    • SSDEEP

      98304:/iqRhpgEqgY26CS+ZJjDc01ygXazxD1imWt:6ipfJYs7jA0SiL

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libQt5XcbQpa.so.5

    • Size

      2.2MB

    • MD5

      58766acfbf380d88f4ac21b9e9d08030

    • SHA1

      5e9a5cb96246b068da4a60574de4fb133121432c

    • SHA256

      a560a5cf06d1410d4091b631ac609e33f1be0c83a2b9f7d907e94753ef15df7a

    • SHA512

      eb259d85af918adf6256701f7b06cb5eb40ac2aed2ce9ef562f6c8ccf368768c9eb6545413346d437021cda8bd4c0f1eec6f22fb062137ac4b30a0cdf9088b3f

    • SSDEEP

      49152:bvDciBPmhkd/Cg3ab0W1imCXMlOcsLjK31zUWeUOPRdozqE:3mrcXMqLjM1+A

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libcrypto.so.1.1

    • Size

      3.2MB

    • MD5

      5bb911b6e596d494e9731e448faafeb9

    • SHA1

      c1997324d58f925990bdcb15e1f655a1cdfe5e83

    • SHA256

      2d151ab564fcf7b709f3a57f9bf8fa65dc0ed0aa1ee4dbe4803353a0855de466

    • SHA512

      25d409461776117bb30a314a63835cad0918485ed34b64426aa98f22fd5ea9ebe81862378cadd9e885a2ec0921b1b6fd29e80f9d9d78cafed4e5b305e2f7c909

    • SSDEEP

      98304:O0ev13uFnCPwMcoGFIBbC+gTIRbc9EH18i5OZNVJ6MToRNzJeUj:Vev13uFnCPwM7IlMH1jONJ6MToRNzJeY

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libssl.so.1.1

    • Size

      674KB

    • MD5

      4b5cbb925c9a2bd11b9d07c7c052f758

    • SHA1

      d7f1d23cb46a1c51932efbf21be614f0d2f20985

    • SHA256

      41417d7307abdf91e9b249b289684ef830d87d26016e6ab836459c98fafd32c0

    • SHA512

      87de52585caf09fca2aaaddd4702c5eaddf1c63c340c87022db0e1a70634b1f735498906ae1945d6e776e388e2fd52eb484464e0ad35c187f15f64545d74f5ac

    • SSDEEP

      12288:ikv3upJ5eaO8IDyPGPUTHYFiVDzUoH9xnhh4Au48tAQmljFqw8:hv3upJ5K8IDyOPUDMG3UkamljFqF

    Score
    1/10
    • Target

      torguard-v4.8.29-build.286.1+g70e4e51-amd64-arch/opt/torguard/lib/libunbound.so.8

    • Size

      4.4MB

    • MD5

      d35da19dc88717e461766544032b0169

    • SHA1

      1d997ec1a938d5411d1313de97d8887e35bd7ea1

    • SHA256

      d47d0a5f79a0a52adeb6eee91210ffe22226a6cda43a6392dc1956726da324b4

    • SHA512

      8d38e58cabe5069a56a9abbf373b101e053cc3b60eaecc53245d7f9f9445ba11ef5ff92d15fab8b09c05a40cc6133dc74cc5eae82ac4a4f1ebcc6e198dc591e1

    • SSDEEP

      49152:i0T5R6N4mpQvZTCTCwwTzwS3YyWXKKsd53sTFAOdjAVy7SR6ZIbtgX0:i0T5RneHVwTz3JWardRshAOdCYKgX0

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
1/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

discovery
Score
4/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
4/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10