grimbolt | dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591

General

Target
dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591
Size 9.4MB
Sample260608-precwses2x
SHA256 dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591
MD5 00e195d94d3b1f7092eb9ed132f89d1b
SHA1 dbe26539ed4701596371aa585520dd276d437398
SHA512 293f61f26ae80b1d35d07f845705e7ea13cf62d18cf054e95117636c261a217e2c2f97ca1e10e97fd779022cc2db3391109f220cce40d7d236b065ffa412f9e9
SSDEEP 49152:h/fSU3q/X7rUmFnHfytY2i7xmufhyFtE6g5EbZNCRksjjNuELo9Ikj:h/6UOH34E6g5EvdIjTQIkj
TLSH
T13EA64A1463975959F1D686B08F69CB33A9A8BCA21F34C00B253DF3453E76A3EDB0B521
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: GrimBolt
GrimBolt is a .NET Native AOT Linux backdoor attributed to UNC6201.
backdoor grimbolt

Detects GrimBolt Backdoor 1 IoCs

backdoor apt unc6201

resource	yara_rule
sample	family_grimbolt

SHA256 dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591
MD5 00e195d94d3b1f7092eb9ed132f89d1b
SHA1 dbe26539ed4701596371aa585520dd276d437398
SHA512 293f61f26ae80b1d35d07f845705e7ea13cf62d18cf054e95117636c261a217e2c2f97ca1e10e97fd779022cc2db3391109f220cce40d7d236b065ffa412f9e9
SSDEEP 49152:h/fSU3q/X7rUmFnHfytY2i7xmufhyFtE6g5EbZNCRksjjNuELo9Ikj:h/6UOH34E6g5EvdIjTQIkj
TLSH
T13EA64A1463975959F1D686B08F69CB33A9A8BCA21F34C00B253DF3453E76A3EDB0B521
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64