c4825f73fe462081f47fcc3e84299d6a5047fec2fae99f15561036e75cc7938b

Sharing

Copy URL Twitter E-mail

General

Target
54TS.tar.gz
Size 25.6MB
Sample260702-ab4khsf14k
SHA256 c4825f73fe462081f47fcc3e84299d6a5047fec2fae99f15561036e75cc7938b
MD5 2e22a255a19c64907914bab9157b4c9b
SHA1 f68f20c4210d5d41e175c6eec71da52aa82fa6d7
SHA512 86e752599eaf0641c562532eefa406ad4714cab5c90085cf16b72411557d747fe9d03dcbedab3e9e493b090cb992dbb785a0611fe5cd563b3ebfdc05dbfd7304
SSDEEP 786432:lPrLaCCi3ZvuV8BarQaLbHZ4HxYV4PzosHYf:lTLaCX3a8BaU8HCRQWG
TLSH
T18447333EA5A580D8F7E4E29329F8207C72C3845D65D9A437FC8A213794780CB3B75D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  amd64
- Size 4.8MB
- SHA256 5cc907b43309ce9700d132e32fa9a66f82dd50800f653c023c23ae1c6f8e1df2
- MD5 aab2601eef126b88f7c588b6e3aa0f13
- SHA1 5885e0d06b22ef800adf1462114618ea35e1ce52
- SHA512 f16e2e74d885d869783e7e65249158f0a55c6a14c3ea83729322f20fa7e8b63d2160a76f3c88d99a4e2e701ec0b3a4aeae85f7f69d184df82610848d86624955
- SSDEEP 49152:Pbx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPxzU/eq51T9xQH+F:VEauhfY9n6vCSotowEPGTD9
- TLSH
  T1DD363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral1
- Target
  android_arm
- Size 5.4MB
- SHA256 53d61d6d15fe08b11023d3703265f4a34b510bb240a0b42a3671e3efa80efedc
- MD5 ed088414bad8eb417322e4d1cb366522
- SHA1 eca6a59882998cb903af524f215fa73d6d250ab9
- SHA512 b100f60beb90f17863288ffd425512303421f1165860a61b3c3d192ba45928317989bb329c04f066a9536aaa9cc4c39a4306b9bbaa31bf83127efa630dba94df
- SSDEEP 24576:nPzCDEw/vuu7eKFaavTXmCQbeVdVOkfrcrmlGaHxHzb2Ax51yOip1VYUXiy4DaB9:0ZCoVxL/4oPH2rz5NNUOxoOfrUi5EM
- TLSH
  T126461857B8D24A43C4E4367BB9BE80C433631EBA9BC652566D05FE383ABE5D90E34344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral2
- Target
  android_arm64
- Size 5.1MB
- SHA256 1957781d3d4f6f74007ed370b81c14f22254598b55a0e335afa07d677042449b
- MD5 12a3ac97a544a7fe1d26ae8372a8653a
- SHA1 bffa033c7694a3239587a00e680eba773d5635c5
- SHA512 4bba42e50ba838ce53620bc5f7fd34b5230e251db6c5fabc9597bb6667e7dfe2bfe2a3a10f71718da98c0de3372b7ef1c8a8fb0bcb9c4df21067e3971ceff4fa
- SSDEEP 49152:qnuqtyQfieR6bqHSKQDKhFzfC5EgUey4unqi4H:Iuqt3fi+6bQSKQDKhFzf4EPqiM
- TLSH
  T113463A9CF81DE5A2DDD8BA747BA141867639BC45AF81C7232600B76D75F33D88F22260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  arm
- Size 4.7MB
- SHA256 b4864bc11a6bfbc3cc394ab7ccaf27701bf88746caeed517b460241792b12f4c
- MD5 5fdca2c508a717953bbc89f2f9f6bdc0
- SHA1 15d6e2952c71bf60d9397526e88047f5588044cd
- SHA512 c312daba3772922e7b1a68c8dc31efae9ad25338951c20e8daa189e9820d43c4748b33cf15997f8f32371baf1146b34d88b29469b2485a9ff791868167963bd0
- SSDEEP 24576:MjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlNn:k559Id2QET/bY+Ay8ZWPMJyB28wAG
- TLSH
  T135360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral7
- Target
  arm5
- Size 4.8MB
- SHA256 c2a79ffd94bff59100503cec2e89f473d9f64ae07956fc52a0a0be81f9495d4f
- MD5 d04e36fa54e03eb1542b2f3854f2e41c
- SHA1 d6fd881d21ac50eecf77257fce6d4b142eb5c881
- SHA512 87e381c5cbb3b6c45254c068e6193d1e3bbd8320d9bb2701a08a5a9294a2ecf6c599e55a15bfeb0fe0c8e55102c2cfb0fb127b66c0ee82f56c541c88652dbbe3
- SSDEEP 49152:/ux/+ioBE1Xuz7pEFPHrh91lXKY4RY/ww6B7VUyizDXenlM17:Gx/+S1X/9HL1laY4R4m5izDXenlM17
- TLSH
  T18A361A87B8D24A43C4E4367AB87D81C872A34EB99B97135A5D04FE3C3BBE1990E35714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral8
- Target
  arm6
- Size 4.7MB
- SHA256 a23746f11d46b62b9f4e714bf770156db8450e7b0795f7c2126fe153db577a70
- MD5 b312cd0018c059cf5cd209d1a68f48e0
- SHA1 e32d3b3bfdb328d674a21bb191f652087931aa96
- SHA512 5a609f478cb4fc0d6bc9b93f0cec19e427d474cc4313a3fa34a82706aa6c4fe1e284f468c74c45abf3ed5e17b0f1d980690fc98675270dc604430c9a721e9c73
- SSDEEP 24576:W1aBkWO3wadzwaH/9lRO8wi4HUFJAlR1anVX0ruJJeiP68sLNBojZw99oPpOiDts:AvIhO/TvWdiSd9wwyc0eLlA1snN
- TLSH
  T196360997B8D14A43C4E43676B8BD81C833A34EB99B9713666D04FE3C3ABE1990E35714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral9
- Target
  arm64
- Size 4.6MB
- SHA256 2823130bc798b87246e72a090502da737b1e44e9522a0b7fe72eb44924b4152c
- MD5 918d3beab498922b092f5f53462807d8
- SHA1 68b2240045a864e73709bec3fca7bdd4a3962be1
- SHA512 428902274de40e53056de93607a83050cb61fa14d44bbc1f09affc5bd012f1ef22e62d04042a310fef8a1577e5328e58211ca891d2d3b0f0f6dfcc2410658496
- SSDEEP 24576:pDNK6Fxw1aDV2IDWZrH2+6wM16tIoRbTCcAHbnSw2sOk5cvE7SCfTqXk59yjydzE:pDdwl27DoRbTCcS92sOds75E4EVPvVf/
- TLSH
  T137266CA8BC1CB552DEC87AB43B6541D5B235FC48AF41C7277614BBADA9F23548F22320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral13
- Target
  armv7l
- Size 4.7MB
- SHA256 b4864bc11a6bfbc3cc394ab7ccaf27701bf88746caeed517b460241792b12f4c
- MD5 5fdca2c508a717953bbc89f2f9f6bdc0
- SHA1 15d6e2952c71bf60d9397526e88047f5588044cd
- SHA512 c312daba3772922e7b1a68c8dc31efae9ad25338951c20e8daa189e9820d43c4748b33cf15997f8f32371baf1146b34d88b29469b2485a9ff791868167963bd0
- SSDEEP 24576:MjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlNn:k559Id2QET/bY+Ay8ZWPMJyB28wAG
- TLSH
  T135360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral14
- Target
  bins.sh
- Size 1KB
- SHA256 7902bb4f23146c836ce28c9c0e63a5b673680cb35d337890c72d81d8161e5c9f
- MD5 f02c70997b3f9295ad861ef26f436eaf
- SHA1 ed20f4ed0d73a87763f92a0d25da0201e00ddf19
- SHA512 c1a6fcaa78546f4206f00a983d1dc0c10c813bd349f7bffa43348da9e742cdcb988b8872e641bdd8a8315f3b6fa2cc6e08d819665f3aeb19c9690887e86b3fe0
- TLSH
  T10841C48B2264D4B38D0BDF75F35490C8D18997E3A163CEBCF46445A3009926CF596F72
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation antivm
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  bot.exe
- Size 4.9MB
- SHA256 e2ad4624ee3d6b73ce5d5f5e5a147b3908e2d6969045de5771fe5574ba5c0f0d
- MD5 c3803dfe4da599236da2b1cb7f9d31b3
- SHA1 f16c50345512e0b386161b5c46d9f647a6c355f8
- SHA512 5c2879cac575a4240beb126fe16e0c9b726bc034e7d31e54057f0493dc900f806a50829fa12b16a4d9ea71b4840f60effad2ab52f5ff2d0a631a5b9e3a583938
- SSDEEP 49152:NLtLyRe/Y9TdpEav+kf9RWt1wLvTIWSMZbTv692Y5EXRFT2PqX97/SYUJ:Y9fqkfPWaZSMBGREXyqtW7
- TLSH
  T1DB364A57EC9145A9C0EED231C5629252BA717C485F3123D72F90F7782FB2BD0AABA704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  i386
- Size 4.7MB
- SHA256 fc5ff09d7071a78bc61c8db3bb26ed5f79292d8e27bf2cd7f406207a21a84a17
- MD5 a1c255370f7f9d0f3efeda51d5b5eda8
- SHA1 a875551bf96e3fc1612489ee0de7b1f9469dff34
- SHA512 fde61a3e490c101c0a63909ec7aa1485b8a5dcd93671549dbea0991514dc0fe06503b7b0455ca88fee279df00f97e4dde2ff1e453d632f649ef8baba8a9f2c8d
- SSDEEP 49152:HF2ItAqee7182S4P1EiiFV8YommyEW6WcqPIxaWWNTfAhvg:l2ItzeqYX53AJg
- TLSH
  T1BC361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral21
- Target
  mips
- Size 5.3MB
- SHA256 b8c35574fe5710fbd79638cba6a00e78d22446e70dc7c1987a8ee680179d2d6c
- MD5 54bef97c9f9413bb5844752865959592
- SHA1 f711c677fe76110431a8c8a479453797a7626b38
- SHA512 bcc04655214a0da9c493a3cd52630b1116b93c4f94241b2eca52edb33a09a83f67f7e7b315c7ce76c379c92f7f9aea5c1a5a0fd4d214368a002adbea53f06a26
- SSDEEP 49152:9b02CbccirWGBnPRts2wzNdncsBeG0xjvbYNAMj260bAW5rqXJdQhJ69LZcB1V0U:SGUIEK1V0nU
- TLSH
  T10E4619277A28DB0ED228213458B1CE99673A2C4646D7A527B391F30DA8F20BC5D5FDF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  mipsle
- Size 5.3MB
- SHA256 77ed8fae517c78b0c00b626e69c1cd69686570a32041c22447978dad2ea03859
- MD5 0c00a30dbad22b5573cef980d73e50fd
- SHA1 05543dd6c38afc6cbffba53c381c949774e93c87
- SHA512 d24b47abd803d977bffa8f023ffc3712265144b7e4aa3f25f23d827ad600d1fcb73bf9af1f603a98780e77d28fddde2f53d98a3c7295fc174ae2b360d4e7d71b
- SSDEEP 24576:9Zd8DI+mz9x9sx5Rxprkglm1R1Q0UDAnG6Xi2NWdK7lHsI2SbbSKD0HpiKiEfdiF:exxYUUbKYJL6nEaj2buvKDLrIje
- TLSH
  T1F546FA15AC843BE7C02C9B7494EACE5623745D144AF24A362694FFACBC762387F4789C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral23
- Target
  x86
- Size 4.7MB
- SHA256 fc5ff09d7071a78bc61c8db3bb26ed5f79292d8e27bf2cd7f406207a21a84a17
- MD5 a1c255370f7f9d0f3efeda51d5b5eda8
- SHA1 a875551bf96e3fc1612489ee0de7b1f9469dff34
- SHA512 fde61a3e490c101c0a63909ec7aa1485b8a5dcd93671549dbea0991514dc0fe06503b7b0455ca88fee279df00f97e4dde2ff1e453d632f649ef8baba8a9f2c8d
- SSDEEP 49152:HF2ItAqee7182S4P1EiiFV8YommyEW6WcqPIxaWWNTfAhvg:l2ItzeqYX53AJg
- TLSH
  T1BC361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Write file to user bin folder
  persistence
- Modifies Bash startup script
  persistence
behavioral24