Overview
overview
10Static
static
100/panel.ps1
windows10-2004-x64
30/panel.ps1
windows11-21h2-x64
31`25.apk
android-9-x86
61`25.apk
android-10-x64
71`25.apk
android-11-x64
7777/panel.ps1
windows10-2004-x64
3777/panel.ps1
windows11-21h2-x64
3main - Cop...ng.vbs
windows10-2004-x64
1main - Cop...ng.vbs
windows11-21h2-x64
1main - Copy/Rat.vbs
windows10-2004-x64
1main - Copy/Rat.vbs
windows11-21h2-x64
1vip - Mine...ng.vbs
windows10-2004-x64
1vip - Mine...ng.vbs
windows11-21h2-x64
1vip - Mine...at.vbs
windows10-2004-x64
1vip - Mine...at.vbs
windows11-21h2-x64
1vip - Mine...Pn.vbs
windows10-2004-x64
1vip - Mine...Pn.vbs
windows11-21h2-x64
1vip - Mine...ng.vbs
windows10-2004-x64
1vip - Mine...ng.vbs
windows11-21h2-x64
1vip - Mine...at.vbs
windows10-2004-x64
1vip - Mine...at.vbs
windows11-21h2-x64
1vip - Mine...Pn.vbs
windows10-2004-x64
1vip - Mine...Pn.vbs
windows11-21h2-x64
1vip - Mine...ng.vbs
windows10-2004-x64
1vip - Mine...ng.vbs
windows11-21h2-x64
1vip - Mine...at.vbs
windows10-2004-x64
1vip - Mine...at.vbs
windows11-21h2-x64
1vip - Mine...Pn.vbs
windows10-2004-x64
1vip - Mine...Pn.vbs
windows11-21h2-x64
1vip - Mine...ng.vbs
windows10-2004-x64
1vip - Mine...ng.vbs
windows11-21h2-x64
1vip - Mine...at.vbs
windows10-2004-x64
1General
- Target قفقوس.zip
- Size 4.7MB
- Sample251230-wyncpsyrey
- SHA256 0b76ab1b03a4ea153c5de738e5439a42711e870d208db7889a4efd41f57d0695
- MD5 72b0d43a511bcfbaf5434d0bc9550c67
- SHA1 398948854d84f31ed0f2aea8b497e43156119727
- SHA512 cc9d0225b92d4b9a14cbf15b006fe81a2787205a18ac6d15fcfa953b15573597839ca2ffc2d9aeaf4d86dd0842e24b583e11ca4ee83bc44b59277ff6a9b59fd3
- SSDEEP 98304:jSfF1jckKF+IdIykFle0qMpioTjEgnM+e0xLMppYTMSitrlvMI1kJbr2j:ojc7+IdIykLvLMpeASKdMI1Wyj
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
0/panel.ps1
Resource
win10v2004-20251231-en
Behavioral task
behavioral2
Sample
0/panel.ps1
Resource
win11-20251231-en
Behavioral task
behavioral3
Sample
1`25.apk
Resource
android-x86-arm-20251229-en
Behavioral task
behavioral4
Sample
1`25.apk
Resource
android-x64-20251229-en
Behavioral task
behavioral5
Sample
1`25.apk
Resource
android-x64-arm64-20251229-en
Behavioral task
behavioral6
Sample
777/panel.ps1
Resource
win10v2004-20251231-en
Behavioral task
behavioral7
Sample
777/panel.ps1
Resource
win11-20251231-en
Behavioral task
behavioral8
Sample
main - Copy/FirebaseMessaging.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral9
Sample
main - Copy/FirebaseMessaging.vbs
Resource
win11-20251231-en
Behavioral task
behavioral10
Sample
main - Copy/Rat.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral11
Sample
main - Copy/Rat.vbs
Resource
win11-20251231-en
Behavioral task
behavioral12
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral13
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win11-20251231-en
Behavioral task
behavioral14
Sample
vip - Mine - Copy/Rat.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral15
Sample
vip - Mine - Copy/Rat.vbs
Resource
win11-20251231-en
Behavioral task
behavioral16
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral17
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win11-20251231-en
Behavioral task
behavioral18
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral19
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win11-20251231-en
Behavioral task
behavioral20
Sample
vip - Mine - Copy/Rat.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral21
Sample
vip - Mine - Copy/Rat.vbs
Resource
win11-20251231-en
Behavioral task
behavioral22
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral23
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win11-20251231-en
Behavioral task
behavioral24
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral25
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win11-20251231-en
Behavioral task
behavioral26
Sample
vip - Mine - Copy/Rat.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral27
Sample
vip - Mine - Copy/Rat.vbs
Resource
win11-20251231-en
Behavioral task
behavioral28
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral29
Sample
vip - Mine - Copy/SmsforPn.vbs
Resource
win11-20251231-en
Behavioral task
behavioral30
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win10v2004-20251231-en
Behavioral task
behavioral31
Sample
vip - Mine - Copy/FirebaseMessaging.vbs
Resource
win11-20251231-en
Behavioral task
behavioral32
Sample
vip - Mine - Copy/Rat.vbs
Resource
win10v2004-20251231-en
Malware Config
Extracted
-
ps1
-
exe.dropper
https://google.com
Extracted
-
ps1
-
exe.dropper
https://google.com
Extracted
-
ps1
-
exe.dropper
https://google.com
Targets
-
- Target 0/panel.php
- Size 110KB
- SHA256 0b1560be0312e0f6d2264efa669842f2122f852da9df044a449661780d5bd9e6
- MD5 592025efdc2470d991c05fe913a19e8e
- SHA1 bc8d6ae47ce5028f45969283ab1dcf7659c53c7a
- SHA512 18da82b89bca8b35117b66c6cfd9f763361a169a43f8c71b2139ef9f0b0f7ea642587fd3a9f22e9fe1d931580360aefbe0bfccc688d183004611910f3eb4c184
- SSDEEP 1536:NWomVbflc46kf8fcfIfdTpfHfMf7fffqf9fRfrfGfbfjfGflf6fDfwIED8e6MLOM:NCG3Tq6rvPWcANUDluu
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target 1`25.apk
- Size 2.8MB
- SHA256 6b685f39cafe6bb9bf8c4edc931fa5c869d4c5b70c5cd578a9a6e4cdd16b400f
- MD5 d342b4806e5f3e3b5450a8d967e55b5e
- SHA1 1d703017c8cbed223d0f1854458e0a9c95f14cc4
- SHA512 964b270dae6fb380be8d090f6cf7b92f72ccd3d24de7f7d9ffa4b98b941073420ccb5e43fb6876c3337c335c65c610b84f558fa45cce68f950ea18d8b214cd26
- SSDEEP 49152:zEuqfq3NolL0+JmNX7wy4W9swxpPW1l4FENv4IuDRSxONBgxNTou:SfqdolXJmJKW02FENv4IoNuTou
- MD5 SHA1 SHA512 SSDEEP
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Queries information about active data network
Queries the mobile country code (MCC)
-
- Target 777/panel.php
- Size 109KB
- SHA256 3a815409425f8b1a7ab077a866139a90e67af736f29f41f2dae6b3c93b5a22b5
- MD5 6b9e2b36c000062857717cf7d0a908ea
- SHA1 70872758666c84ff3270af0043a976fd96e8e2c8
- SHA512 cdcb3bb510f40deb00dc20ffedbb95cf66dfd608995fc99bc29703febdce80a2bcece6ab04f7b60e3cd04dda944b09a8cf06b54b55db2d2b629785326e6a62d2
- SSDEEP 1536:dWomVoflc46LfQfMfsfdN3fRfIfNfPf+fTfvfVfSfFfRfSfDfSfxfeIED8euJOW5:dCHWNQ5rvPWcANUDl2u
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target main - Copy/FirebaseMessaging.bas
- Size 8KB
- SHA256 81efbec980e059025682b3be5a1fe269412d1283fe22edeca19676042b64a2e6
- MD5 5b7c288a84e434a76373a67393c4de7d
- SHA1 144594d19040fa1b1c1c47a0673d4cce5d2e58d8
- SHA512 a0446733cd252b3dc783850f5cb0cdf20d63fa31bfbcc7008dfa5404d117004d26fedb39ce964e92ddbbe7fd1ec02d259a7fba61bf91e7d53c31b0f3abe52d01
- SSDEEP 96:F+aKw1oiolaUMmOY0aV7gynIjN3D2enmruno1cSSS7gynIIfURlRnQCQNzohSsoF:IMa5mwINzUh/fUz+UKEAg55M8erbNz
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target main - Copy/Rat.b4a
- Size 7KB
- SHA256 3d12c0bacdabcc7fbf098e90d7ee7933ca621126b220f1105f1c0a8558148060
- MD5 1502118770bc171f68153424da9ec332
- SHA1 d2d66d4889788479cc89d23d10ea641b46812ff1
- SHA512 634fc28da1f9ed531c21b0a593b3aefe0b79b445a254136fc7f3d7ef330402d2971e9ca65a442880de31267661f3f94ffec54c697b7c5f809728b3f30f8ec98a
- SSDEEP 96:kTAj+gmJ8opH7VxVTNb/0Mv0hbkqHbG6bTs7b2/bMb0yUMmOU88N7ecHnLNYTook:kTAj+pJsbje444NH5hoB+
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/FirebaseMessaging.bas
- Size 12KB
- SHA256 2e9f89564c970c128c38cd339f8edc9cfd61f4d5578312fc351126c998f74691
- MD5 1b5c219dfcb0bd2e5276f5f5cf6bd5b9
- SHA1 ba4481e800259a7f40da3008c21152af3206183d
- SHA512 42187bb75d2de4e231eb4e8a95965986378e9b3e63c6fe05e71bdaec9b6caed49da30d855159170db56bfac936c968dd1bc9cb5b0245d37848d2fe19b832734c
- SSDEEP 192:AWa5SINH3fp2E3mmo6n5PkO2Ci1u6SNPo:Ar5SINHPkVmo6n58O2Ci1UNg
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/Rat.b4a
- Size 9KB
- SHA256 0eb59051526ae1572ae7c3979cbf0b4b3cf731dae606e36d9953c4a9bef0bf86
- MD5 e0a883ff07c615aeb6b2f1b9809bb6ca
- SHA1 8a2eb15d9bbb0bbe9eba15ace115337ee67f89c6
- SHA512 3f74e12e3e58d97669a8c2684ebb5d3f48cf06d7fb4f6a68c029319e7303600b63a1b600799e8bc17bccab4978c2634a866a3d7bcabd11117132fb7912e7e91e
- SSDEEP 96:4AS2zCwHJzopys2c2bni6Sm/Ytwf5b9KhwohU9K8biMv0MDDkq+DDGlDDTsKDD2E:4AhCwps27StbSDSDaDpD3DXDxN1hoB+
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/SmsforPn.bas
- Size 2KB
- SHA256 ff4dc714b647800398d4fb8d40f67f98035277b8caae636ee95a99b0b2ea29eb
- MD5 c28df3da3d8d0970e741f9777158f979
- SHA1 bde639b1e1cf5cebe758ab7bf59168f85aea6e59
- SHA512 212ae9906c7a51047cc2ff349e071cf344195ddfdfc38cd4ec235aea9662ad136e01d129f1ceccad66b25eb1252abcc443a321156c8c8076bc63d741aa4f9ba5
- MD5 SHA1 SHA512
Score1/10 -
- Target vip - Mine - Copy/FirebaseMessaging.bas
- Size 11KB
- SHA256 0bb9239027057fd35dea222b33f53cc16a24ff5b527211cf28ee9c978ac10b3f
- MD5 a8e189108f18543f8c0a138c544b2ca6
- SHA1 a4e0b9c343c4595cacd3fa2b64a19a573473c275
- SHA512 ff808df6bfbf668cd6f155665d6e4088ee7ef7c476be7b65d5c1d75e054c8f87c39dd667b118a10a0c7b62d3dbf6c8caa87bfc40bd39070327551e92c083f5b5
- SSDEEP 96:FSW1oioJkaAFabNH2nY73N7gUwQasfpYR6qQkwmL9ooN5ha7WS9BwMEieoiSmoEG:AWa5aINH3fp2E3mmo6nK2Ci1u6qE4NPo
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/Rat.b4a
- Size 9KB
- SHA256 95d288a28927c4960312836d1fb58675bd589306a215efdba788692063aab0d9
- MD5 652c6a37437d85b7950e5b6b55152a9c
- SHA1 3edd1a7b73de5d2ce468825fdfdfdf0c7391239b
- SHA512 fee23006b95287badc61ce94bb600832bd7d01a679cccd6187d5069e42b40dc2c1e4a8f998d9fb844f01e97ed308fc4fdbf1104afc8736acaeb19958cbeaf1d2
- SSDEEP 96:88ACT/CkmJzopys2c2bni6Sm/YtwO0b9KhwnhU9KmbiMv0MDDkq+DDGlDDTsKDDx:88AC/Cds27StbhDSDaDpD3DXDxN1hoB+
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/SmsforPn.bas
- Size 2KB
- SHA256 ff4dc714b647800398d4fb8d40f67f98035277b8caae636ee95a99b0b2ea29eb
- MD5 c28df3da3d8d0970e741f9777158f979
- SHA1 bde639b1e1cf5cebe758ab7bf59168f85aea6e59
- SHA512 212ae9906c7a51047cc2ff349e071cf344195ddfdfc38cd4ec235aea9662ad136e01d129f1ceccad66b25eb1252abcc443a321156c8c8076bc63d741aa4f9ba5
- MD5 SHA1 SHA512
Score1/10 -
- Target vip - Mine - Copy/FirebaseMessaging.bas
- Size 11KB
- SHA256 642dde687f3ae9bd5ddd2ba7c5ddb0094aac783dda7262436a61b0f2e3423c4e
- MD5 6afdee141ea10637df0a118d7552c41e
- SHA1 486b475585eef9b7dc227c62bd58ef4efa023308
- SHA512 b5bca857d436eee5bf5203591c4d1d50628df0a5a9009147f659a3653d564a731f2d60973ddb799008c8466448b163fbe2ffba341559d9884f80e49e464d8458
- SSDEEP 96:FSW1oioJkaAFabNH2nYG3N7gUwQaWfjaR6qvkwmL9ooN5+/SWSk6wMLReoiBmoEo:AWa5aINHUfjsD3mmoL8s2wizC6KNPo
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/Rat.b4a
- Size 9KB
- SHA256 46184ecfaf9e2395cb3f09313200b55fc7706640d3e5f6d77fc095a38e0e2a36
- MD5 014be542c69f131a7106750508180df5
- SHA1 9766b30c225870423a394f5ac647c164d3a70a31
- SHA512 c26867392354bf5a49c5979cddfdcb276e609d83733cb59d821692cf68b0e46cbf31bbf395cf08be4426d055ddd15f17834b163608de4dfcf114ce1d17d94ff9
- SSDEEP 96:HACT/CkmJzopys2c2bni6Sm/YtwO0b9KhwnhU9KmbiMv0MDDkq+DDGlDDTsKDD2E:HAC/Cds27StbhDSDaDpD3DXDxN1hoB+
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/SmsforPn.bas
- Size 2KB
- SHA256 4460e8257acfe88afa94e64573a3f9cb96e6fcbc178e64377c115b9b3d70ca63
- MD5 0d1577ab702036d63627b6b4821fa2eb
- SHA1 40f5b5c10d670e8d32c2390ddb37d7ff86b44795
- SHA512 09c83f653bd8d59b6c91173e34aa30af8e7ed2c0afb37e019827b7d1eda59fd90587b4c72b1835360864821922bcbfe6f9babb4545debdc5427933539db4bea7
- MD5 SHA1 SHA512
Score1/10 -
- Target vip - Mine - Copy/FirebaseMessaging.bas
- Size 11KB
- SHA256 72d1eaf58c47458c72958b796d503d77924a929f3b364ad72eb352e1d2ee7edf
- MD5 e4d94ab15f05120159344fcac2edbd25
- SHA1 b4e0eab7c58f925c002afe3978145545a7a67702
- SHA512 f4608fd6d9f000aec180c3c8b622c34907eeafb75928eb5c4bc5a5c8cdfb604bf2928a1d0852a15b13167db8a74503eda5552e5519a3c5fb0027333714e7fc15
- SSDEEP 96:FSW1oioJkaAFabNH2nYG3N7gUwQaWfjaR6qvkwmL9ooN5+/SWSk6wMLReoiBmoE0:AWa5aINHUfjsD3mmoL8s2wizC6+NPo
- MD5 SHA1 SHA512 SSDEEP
Score1/10 -
- Target vip - Mine - Copy/Rat.b4a
- Size 9KB
- SHA256 9f48c44b07ddb2f8df13a3510380239cb35f68456570871df77c504d8e28577f
- MD5 ba3b2c851dfd39c60b10d1240db54312
- SHA1 23132fbb57ac149a625e188fcf7fe3e25f1cb366
- SHA512 1e0496c538cea36c724be0a0fef60cac38844105069b1eb19b42fd5674d0cd2e90616e41ab557b2d67d763553913f7ba9570e652a3cfbd299f17c181e7adade2
- SSDEEP 96:1ACT/CkmJzopys2c2bni6Sm/YtwO0b9KhwnhU9KmbiMv0MDDkq+DDGlDDTsKDD2E:1AC/Cds27StbhDSDaDpD3DXDxN1hoB+
- MD5 SHA1 SHA512 SSDEEP
Score1/10
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1