29d1ac17f6d9adb836731ff57ea9801d084dd2c923146db005179c2c19f10ffa

Resubmissions

04/06/2026, 22:47

260604-2qrcaagt8z8

04/06/2026, 22:25

260604-2b2vgagt2v8

04/06/2026, 21:13

260604-z2vgzafz8n8

Sharing

Copy URL Twitter E-mail

General

Target
73j3B9.7z
Size 1291.2MB
Sample260604-2b2vgagt2v
SHA256 29d1ac17f6d9adb836731ff57ea9801d084dd2c923146db005179c2c19f10ffa
MD5 796c939917abbfd697e8a0daf94af794
SHA1 074e5ddc637f1b8c4303b86358d3a4a684277134
SHA512 045e1c24af93afd1b599360c36466b03ed37c9d6a492de6f7b75743b925a6421d43456d38a31982ee3a4ba8d3bbd111506186a7b6430ec244bf3c9a3f5ba47d1
SSDEEP 25165824:Ht3F4o1opZ1td+rn9uP1zncD8wyMU4xQBRhTK2/9xdl/ORyf:NOo1mZVnPpcD8wDU4YzP/Xdloyf
TLSH
T1E3E933DBD7411961C0BF8236CCD7A115BAB62DFDA52A6406DE06F73034717EABE21381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  73j3B9.7z
- Size 1291.2MB
- SHA256 29d1ac17f6d9adb836731ff57ea9801d084dd2c923146db005179c2c19f10ffa
- MD5 796c939917abbfd697e8a0daf94af794
- SHA1 074e5ddc637f1b8c4303b86358d3a4a684277134
- SHA512 045e1c24af93afd1b599360c36466b03ed37c9d6a492de6f7b75743b925a6421d43456d38a31982ee3a4ba8d3bbd111506186a7b6430ec244bf3c9a3f5ba47d1
- SSDEEP 25165824:Ht3F4o1opZ1td+rn9uP1zncD8wyMU4xQBRhTK2/9xdl/ORyf:NOo1mZVnPpcD8wDU4YzP/Xdloyf
- TLSH
  T1E3E933DBD7411961C0BF8236CCD7A115BAB62DFDA52A6406DE06F73034717EABE21381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2
- Target
  KanvasWebserverLinux
- Size 15.9MB
- SHA256 13334c8ccf4812118c224eda8b917c34a7e4a2f36bc1993fca2904a0283d7ff2
- MD5 bca59cea0ed59dd61eccdb1bb68cc5a9
- SHA1 e258c35b60669c1633912e58b5a04ebf161399fc
- SHA512 217aa5d28605725d0ffa66548fa823abbe914230fae8b2c9962bfe93597a7bc4bd77a365d4d2fcbf7c3fe0e4eac46a06b548fd6585bce8b86ad39e4f33bafc63
- SSDEEP 196608:9QkArxOsCmAPpZqqxtZaUAtCeA19DSVHIeL7B8:Vq5RAtxtZTAt0
- TLSH
  T1A8F69D0173F89F27C5EF8776A0B1444963F5E85AA363E74B2580A6FA2C63B801D517E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  KanvasWebserverMac
- Size 15.9MB
- SHA256 63e09a3cd9e455fec13b76b0adba91c806093743cc5538e176ce218b9c6c0a22
- MD5 8445a9bac2b0ac856c27d254b8ed8da9
- SHA1 398d7710aa0bf4ecbad1cf74c704d48de7fc7f34
- SHA512 e7a2a70dbda335a924c4febe4a79a9ef59f5d8633412ffeebb43ffae6d2ac77c3603fea34c84008c4e30543fe3d5503ba11761412b20663131a76b8512f207ad
- SSDEEP 196608:qQmArxOsCmAPpZqqxtZaUAtCeA19DSVHIeL7Bj:Sq5RAtxtZTAtL
- TLSH
  T1D0F69D0173F89F27C5EF8776A0B1444963F5E85AA363E74B2580A6FA2C63B801D517E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LinuxScript.sh
- Size 691B
- SHA256 2a94c7ec2e926f239240718a0f64b072f11b9bbc9390854c016512c517be36de
- MD5 e2d9d185c0ceefbe001d285710e41ae4
- SHA1 450d5fd3cc6e4e712268dddea761a7e792322e12
- SHA512 47def885b16c42a8c57bf17119740cdc8d7dd861c1ce92dcf93cc80208f03bd4d3218f95db6cf52545b47c8513329e228bbddc09a83b01a4dd4cf4cac0221db4
- TLSH
  T12701C01DE638AD3D2D6003195A5FF7ACC2CE113AC04A72D47925531686EE057E8459B9
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  MacScript.sh
- Size 755B
- SHA256 e6f0adfcd80615744cead517e934376219ec6d2cd849a97d819ada216b623f87
- MD5 8a8c5806ecc28daac493d219d10e153d
- SHA1 aa718431d776f26e04e0e315568640a855047829
- SHA512 d1a8d0e15f1063cccff463cb6e0a830365889a6b1fa8662b16ac88fdef8f66512d858a9d30719df6669265914092d4fd297cd520666180eb8688b2d6dc09a751
- TLSH
  T14B01979DC300C27AAEE0131E93CAF3E9D78D20FA84A03A569412765A726F11F906787C
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  MacWrapper.sh
- Size 196B
- SHA256 2eaec7be1e6ee5857b695b2f3b0e2668f01c3a42f875d6371d395684ee5d8b0c
- MD5 79ff3c3d4abf59bdd6b8b4df379219a6
- SHA1 fa4b28aaf151ddc7d4c33b6de57ce85228546b44
- SHA512 18be22c0e0f780682658edd646d1bc438182a7de1ea51d36fa5ec6a4151948554815d2c57b02b4c2af58641abccac88367d863f39b45d18a228114a440087d1a
- TLSH
  T1EBD022696F08E7F80E2ED93A0E2DC18688F2607E1471B80870D0C8A55F203C265BDB0E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Enumerates running processes

Uses Polkit to run commands

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16