bacc43079c559c55aeac187ac57ceda0c877e792b702f7dd1dad2cc88b9fc794

Sharing

Copy URL Twitter E-mail

General

Target
Aether_Os.zip
Size 61KB
Sample260703-2hxt4agz21
SHA256 bacc43079c559c55aeac187ac57ceda0c877e792b702f7dd1dad2cc88b9fc794
MD5 cbd1ff0c0c79291cb2d466334f80db67
SHA1 e7bb27b439ffb1b7e44388ce99d752f3d22b7980
SHA512 042ff4da8e290c1326651ad479bb4b9fed636d29d14a0b32e531cb3f8081a0072cf3e25aee40937ab3e05e515da1849c28066bbddc77840d40b5c842e087e921
SSDEEP 1536:3T+zFZy1v2RYLBaYFQE/Ah4qJr3AQ/IuGVQf4ppysovH9IHpU332:3T+zFZigYLBaYqu2Y/pMs0+a2
TLSH
T10053E15CBE89D8CCE91790F21C35FB02FB9AB507564E868E50610C8D2D23C5A07AF6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Aether_Os/4ndr0imager.sh.null
- Size 15KB
- SHA256 d8308242d379d623ecf72b2dc0b4085ed7129a7d4dd83c311e8a2ae8aec4e04a
- MD5 a8b6dd1acca6527ffc22957d397a8b9a
- SHA1 fb3861f860c3cdc9f8f36e02b935f706d7940991
- SHA512 f8c85aef8848635e693bff9458e5c6737a1dae1ceaa082cbc9ff15a5937a5e6c68a250ac005c04fd178f384264e1728d90be55aaa4ae6bd311d35e0a9a3f6e54
- SSDEEP 384:NA5JS71HzJMyOBWfJCE0dxgoFKzbE0dSSeZoK:NkShzWywDddxufdSSrK
- TLSH
  T103724038BD5463F4109DC07459C5E081A72900BFA9682C2CF0DEA8B52FBD76D81FD2E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Aether_Os/4ndr0pac.null
- Size 21KB
- SHA256 c9f931467f2926533011f295de792571043c1e77b2b026305ef1a5d97309a147
- MD5 31c7b8cf746beaa058be9ee75c8eb2d2
- SHA1 ced03e5dde0f26a40144cf0a01d4d7116996e66c
- SHA512 aaca4668a76a6122ab5419b9af1abcc455770262dfdc907a7f2e3531100eb18c8a837cdbdff90e1b453c7b0d8866da4d8728c63868a1af3163eed835ae22bfe9
- SSDEEP 384:JdyvTfStFvLSXNsc1tojHNiUQKSwz3GhEA1:JdyrYBIsc1MH4NHwz3GhEY
- TLSH
  T1C9A26432379816B5300BC06E9AE350142A19711F3A55281DF49EF2683FDDB9C93F69B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Aether_Os/4ndr0tools_rssfinder.py.null
- Size 3KB
- SHA256 4f3c89bca86faf899da5d79ceaaf9c0b5d4edc0504ca40a9fe6bdb5c1679e54d
- MD5 628437dee3bf6acf888d56e81f477445
- SHA1 eaa1688c42dd5c8b5d8ef41ea6b73692f9a17881
- SHA512 97fe84c2e29258b7d96f922f4309bb287463dcfd1b90c6d31d77e49d058e5f51043f70dac5c0043456fb8c8b1edb18252443d8af3aea5a0e9a49262e2661dc95
- TLSH
  T1F471B66A140E212B57C2284CC86AE510532BBD9729416971B41CA35C1F9D97ECF373AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Aether_Os/find_all_links.py.null
- Size 3KB
- SHA256 5e172cc90f52f65d5a3e7fe1e959e1cccda1b653b1f1b1d5c6d1b10a4685dc6c
- MD5 2ed77e0d3a0a38280074f10bc3fb3c6f
- SHA1 9261ad115bc80a03304fe14e2fc2896ebbf780dd
- SHA512 65a72b774c159cf2ecc34638d8458526b090c78f27ffa4fcb64243eef17839de395222b94269eb1628e334130a75f1de0c6f0403b522f75d69f87049aa775f84
- TLSH
  T19D81A616DA2238A6D3074CDEC8616241F62B2523050EB939FE7C87C85F41535E2B9FEE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Aether_Os/hydra-killer.js.null
- Size 3KB
- SHA256 50b973013e4dda47ce57a4ba9aaa843b97ef7d6d09efced94175f4dfd73d2e89
- MD5 22b7a0112313542d56bab6cbf3c941c6
- SHA1 50e0ffdc651856cc21fd38dddc0ec4f94a4047f7
- SHA512 cc9d619156bb8edf0a79c63e118100ab1ab698988dcc0e5ad331494f9ab64cd8d9711188e51876b3ced1b74655801756c0ce020a7136baa4d5b8605ebb353541
- TLSH
  T14661A58E18FE17B319A325BEB743A0807D2020037619CD647D9C87292FD56E893B6F9D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Aether_Os/hydra-killer.js.null.null
- Size 3KB
- SHA256 50b973013e4dda47ce57a4ba9aaa843b97ef7d6d09efced94175f4dfd73d2e89
- MD5 22b7a0112313542d56bab6cbf3c941c6
- SHA1 50e0ffdc651856cc21fd38dddc0ec4f94a4047f7
- SHA512 cc9d619156bb8edf0a79c63e118100ab1ab698988dcc0e5ad331494f9ab64cd8d9711188e51876b3ced1b74655801756c0ce020a7136baa4d5b8605ebb353541
- TLSH
  T14661A58E18FE17B319A325BEB743A0807D2020037619CD647D9C87292FD56E893B6F9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Aether_Os/install_ffmpeg-svp-mpv-vsp.sh.null
- Size 19KB
- SHA256 2f3f04b643fbfa81c6df642c61f1b65dd5a987910ea835de4d1cb35c699f9633
- MD5 da09d2c8a04676b263c24f90f2202f24
- SHA1 13ab8e4b0b7e58607843d3f75731905f5a864cef
- SHA512 e392af2a08acfcb13363a51ab9823fdd4bf3f8b81e3076ed241909c9cdcdd4f87daf43cc6e95ddca94d21b6825e7b194f9c23c88bc5623724058d22d1f34fbc2
- SSDEEP 384:dmwtndBCQL6+pKWBWYWS8vkCPPg0WsjAIWrWwW2WqW+WgdiL:s2yQG0KWBWYWS2bPY0WGAIWrWwW2WqW5
- TLSH
  T1649284B1F4503B3039C5A556B7FB10EBA262033B69423C9835EE027C1F55A9872E7E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery privilege_escalation
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  Aether_Os/permissions_rollback.sh.null
- Size 5KB
- SHA256 10c116642e72f44894503418820c479dbbd5de3ddc189c756cc7d0e8166d7264
- MD5 777f779075eb74086a85c902b735cb8e
- SHA1 80533319ac5cf801f86ec5b5fffc800f61ab59c7
- SHA512 2791dc15a280c7e4affe462c66434e265e48bff643cc8e6a95d79597531d7a912e2b97f46b4853b845f852534da95bd1cf84441c3c0ca4af62ba1476c8b25b99
- SSDEEP 48:5jLXOFP+/+/3vkVnnCL/hAd1rgvx/JYFnqXNHelkLR2FRuDT5ABizJ77ihG/VD:MTk0rhucs+HvZplihG/VD
- TLSH
  T11FB130F1E57C41317999E02EBA0D5081AFDB7D7A76AC361120ABFC60B3CC09D215ABB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  Aether_Os/silver_searcher.null
- Size 909B
- SHA256 92fd134e5601c17799e932f171aed1ffa650ee56e9a6f54d33c9a0143b7adde4
- MD5 8b38cea61e4a2ecf4d24aefe77fb7a14
- SHA1 10e32ee719af46f5d3a7dc29f1e0cf44f6467741
- SHA512 2557afe676d81d2ec1a28ac18c684a9a9c84d904bc40e612021a715db8106d488dadc98888cc79f9276014216b1be7992ed649f0a60d7fcc2922030493cc4ecf
- TLSH
  T1E2110C02B00175F0109D20F2FAD1A8C36E64508B1F393CF8B2E042A73B71A8AA1E17D7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32