General
- Target gunslol_checker.zip
- Size 9KB
- Sample260707-k17ctaev6t
- SHA256 f6f52feb70e7ebc7b2fef5a5480270e921d681151bf108a2c91ba2d1dbbc79b8
- MD5 05985e3485a213cbded9d2d3db5706f5
- SHA1 f4e37719fe1374f3387c15149e02063724b9f56f
- SHA512 cd7852ae35592dc01a392ddebce1a6769dc03dddf5f2eb46ee6d80f3c4c0860c720dafc522631ff3d2c437d888a56dc2b81c9a8a5c49ee58482b5d62cdfc6ef7
- SSDEEP 192:aQ7KsntXw68Cf5ms+bm1BURez5aRbo6/9hVZkxbmazMcQk46agrmX1IQgiN5GKyi:aQ7DtuCf5ms8m/z5CPkBhp46agrmXiut
- TLSH T1F122C0508260E618F0CD17F92903788738684B1005F3D11E0EB976BB59A7BE47ED72AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
gunslol.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
gunslol.py
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral3
Sample
install.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
install.bat
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral5
Sample
install.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
install.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral7
Sample
install.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral8
Sample
install.sh
Resource
debian9-mipsel-20260513-en
Malware Config
Targets
-
- Target gunslol.py
- Size 10KB
- SHA256 d6509db0f2685dd95e2a1c191548894de12e21ca340bb72742a15b587071e97c
- MD5 2c64c33ea76cbe5d9a25926a6a509f79
- SHA1 fa5deee986e2804368d0a6db0726065003ab0553
- SHA512 3f9273bb13db3a5172596854fd35bce2baa6f518a17f8684b2f36ac83667532b8c548cb27e9e9a49747d438612919827c45632f89e1c0765865261214a1ae12f
- SSDEEP 192:rDVKHS98zlRIj+BN3dwxZ8Oe1aPjmXTo4Bb+JXpaFGa1pHrzKfiR9wVhGsaxKIE0:rDVJaXoYtmZ/e4PKoYb+dpoz1pLgiR9p
- TLSH T13A22C05FCD030787218D9D9822B9CF4C1B8C724DE548E5EEC9C9D7C006EC6E2D5958E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target install.bat
- Size 63B
- SHA256 698231c7316d122079596f82f5f1bb98d2caa9780b107379a14dfffa1280f838
- MD5 56233d0d721f244c81136fa362571224
- SHA1 efd74d856e17aeec0166cd6a4d435fd6a2cf3979
- SHA512 ecf5a39113715823e487cd212cbcdf53512fb3f5ceefbf3dd823ef5e29c7aeef4e97afeca6b72cb6a385081af075e2877676bbe7e68eafe2d57b58c9bd5a27cd
- TLSH T14FA0222F0A8020B0B88A22E2808300C3220BC00F20208A0202EB00C0C883802C303203
- MD5 SHA1 SHA512 TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target install.sh
- Size 108B
- SHA256 127b2bb7ffb5ddd30fabb437265b215c2db336f81b7e022751372fd985f78936
- MD5 bb6842c4c7d7d252ac2b4a0822c3b954
- SHA1 cd5ede5194fd3103abe8d0edbb600cf834434f92
- SHA512 aa496c1f117d2df7be49e6eed2cb9f69cb19b53425643c3bc2b8c389f0726c413eb0ed793f5d550c8d831db76b8b29d97fc613012c9c26e76825836f312e3b9c
- TLSH T1C9B012C832E0B173750C13BDC70304D33C43F01726140850848786E18293FC4730A3AA
- MD5 SHA1 SHA512 TLSH
Score1/10