bf953eaf5007a7a7af8b4a0ffb26033bb81fb115809fe6195d55927a1baca150

Sharing

Copy URL Twitter E-mail

General

Target
ThibitishaBridge-Windows.zip
Size 47.2MB
Sample260629-pdd5zaew5j
SHA256 bf953eaf5007a7a7af8b4a0ffb26033bb81fb115809fe6195d55927a1baca150
MD5 b42956b97cb01ba48b398ef6becbba91
SHA1 175a2aa4384bbee07c97aaa749bf493b934774a7
SHA512 426442a54c59556953a08d68a0376ad31362ab1c68f0e9f978a046f8d77493d648431a2b1df820a3f861a6677f957485d8801917f4000052009ad95d28cd0d44
SSDEEP 786432:Twam4fnJmRew/SRiKukUqfwqtmmPceRg7vhLt0d2ccNbyisxKQIbt+qaN01CE5rJ:T9m4xmReriFRAtxPceKZ2/9tA/8Ru1CU
TLSH
T1E3B733F6B87484CFB0BF44AFCF323715652912ADA2B5751B56AA031B5AC3747EEE0006
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ThibitishaBridge-Windows/Start Bridge.bat
- Size 768B
- SHA256 02131d4e883102eaf52fc1d4e15d745624e320f9ebdf00f5bf5c44f07558996a
- MD5 d1c59e81cd330dc07b602126a1d7358e
- SHA1 bc123c0058d1b4efdff18161a7740cd20fb3e60c
- SHA512 fffd99e8174537a5a504f1b8e3e89f4514490e6f457538d6b5c8839f5e8b144f24566af26f2b2725f2ffb08152f6819d709764f1302cd9b80521eb1f219e2bfa
- TLSH
  T1EA0199D7B2B4813424E223268C80A3283608D1EFC2C48F65B81F42311119BE9FA6E622
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ThibitishaBridge-Windows/app/AdbWinApi.dll
- Size 105KB
- SHA256 120bef587119c6cb926b86b9be90fdfbce38937588eae28cd91a94ce63c7b965
- MD5 47a042211f076ac2ec64a8959f455d02
- SHA1 ddaf6836e376c7a5d649e7c66fb0f7f193097ab1
- SHA512 134a9484acd567957a6e35fc0a872ed6f8bd3ac6c1526cad2efe2ce392879c5bdf467dd994be4d2c7e78e9849f37710a91d506702a7df5e55e0d852f5734572b
- SSDEEP 1536:Rwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPj7+9o:RwqD3L8Tezq0et+ui1yYco
- TLSH
  T130B36A227891C072C8D361B91AECF76593BEF4B10B6589C7339803DADE643C25B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ThibitishaBridge-Windows/app/AdbWinUsbApi.dll
- Size 71KB
- SHA256 6ca69a2ca0e31309c087d288f058977d421ad03500e4c3e1dbd981241a069c60
- MD5 70d9408186450f9aae9b284428593017
- SHA1 af00109a1596f5faa7aa0038d535c3ed54dfaa76
- SHA512 157354d5a866378f854eb3c1e5cb4d3ad8a8dde93931c0f9ca0e786bfda3edf58178212a066c8cf19ca22225363b08eaf68f6d30c986dae52bca512b39804811
- SSDEEP 1536:b72doFmOiHizFbPlspcsbj5ZsP+YeTs1pT7+w2:bSSfN9+YeTs1pT4
- TLSH
  T1F4636C237990C472CC9651B819ECE621A67FBA501BB184C7779C03DB9E203D1ABB9397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ThibitishaBridge-Windows/app/adb.exe
- Size 8.1MB
- SHA256 957e46b8615f7af5b7292a2ddabe98d2e61940c3fb2b0545756507f080613e71
- MD5 f62bbae3edbffbf33f913a536c37f5c5
- SHA1 c8cb0d5720e2d34d359a89f4250e0971ba4f2da1
- SHA512 f2b79507c0b83006c304c5e3e0fce19c9685465f9e487fc0992e8447a6f43f47a18aa39cfe0d21b2e4a29f134c16b17285d5463547ca82347eed9f72d36a5577
- SSDEEP 196608:hQbvGuN6MGAaC1spB/fZEf7t/tg/78gPPvSQpZjXvDD+cNGwFZN:hQbvGuNtGAaC10Xi71tjgPnS0BfyMZN
- TLSH
  T1C6869D06E153A179C90310F1212EB37D6F244A148B258EFBDBD4EDB86B659E0353FB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ThibitishaBridge-Windows/app/batch.js
- Size 8KB
- SHA256 1423ce357adeb66a6534009846bd0384ac58ee6eb2a6fb960d5c6b369ffd5ba4
- MD5 069bc08959750a6c474c5abb1ca03bc9
- SHA1 3d18fd15607aaa22e98159cc79316ca322629e84
- SHA512 f48b76821178de11446059492b3f2865ec68f2f47f92a54ab20587a6aaec164000ec7e21be8a1043e9153bfbd532472afdde9b17ab3b21cc7e7871f79df18915
- SSDEEP 192:c4o12B5hw7Ff5yVCQOa+QvGcHNauawStzKwgkAEmEev0ZcDq5LjU6GnU6qSIY:5Bwf4oYGea3wStzKyAEm+cee3
- TLSH
  T14E12D8931DE718304627D0A92FDFC003ED37D9132B0AC9F8751C03968FA991C91AD9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  ThibitishaBridge-Windows/app/bridge.js
- Size 34KB
- SHA256 4ea146745dfa26e4fd631ea5ade8bd717417de9c871bcaaf52e7ab04984d0007
- MD5 4f59aa8f67ded3de7a2c062c799bc3da
- SHA1 8251f04106e80b3c06a8d2fd1bb797fa138f80a5
- SHA512 27a5c572f29ff624d6ef7a1f93d95b5d6bfa4ff98632e02c3b8efea675ccc8bf2760a1c4b4bb6f714021141ef98e8639996c9fe1ea80b3e1e1ba17cc99d1fc98
- SSDEEP 768:GpgUi/53VNOyma1tZmt9tAq8t1X0N4XKQW0Qhk:vNFNma1tZmt9tAq8t90N4TT
- TLSH
  T175F22E09216724ED7FE390281A769031762B801FBD11D5AFF94F431D1F90AFA8AE2ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  ThibitishaBridge-Windows/app/cloudflared.exe
- Size 51.7MB
- SHA256 5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2
- MD5 04ec5209d922b98a947fea48c73ecaa8
- SHA1 ea37f1e3004a5c20af5802c35eb2275594db9c59
- SHA512 d39a9e326dd9f75777a4776766e02d3b61d0054ff3f26a061751084ba82a2e2fa972b632b2e5c2bed41e15fcdf0b076101f459b58ca7fd980b60748f14884028
- SSDEEP 196608:aoh50/6Oto9HF8V8Z5DClDF6YDWWRW365xPhFzF9e4WzKt9uiLBccRLyGbgVwXY0:aMWZtoJeDoYiWRU6/z/dOJx/ShZN
- TLSH
  T150C77C83E86606E6C7A9C1F4C49B460677B4BC005326B3C75B11FB25BDA67E86E7B340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ThibitishaBridge-Windows/node/node.exe
- Size 66.6MB
- SHA256 06c1dec1b428927d6ff01c8f5882f119ec13b61ac77483760aa7fba215c72cf5
- MD5 8d2efa3d036b874d947913923b7a96c0
- SHA1 c0af72e8a8edfe4d8f42037a62f66ae8c4927e72
- SHA512 5c5e3a6af693dc33147b01c25b5d692c52b920cb374442560a59435b2840c4ce641b5defa6d13d72eab0663b500e18856dc4d46b90d56966c021b52a53ce9566
- SSDEEP 393216:m77dcC832ZEa2rzfCOIEVpxhGGv3o5rWjkEQu58EISEhoIaE2FShkWQH8kYOE+Xb:mtWQxhULE6qmGXEQvxOtxTP5bJ
- TLSH
  T1ECE75B4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16