1b1a2caa09246da589e1555a4a0aa7e4d84958dcb76d46e27b7f1216a4607e39

General

Target
cfst_linux_amd64.tar.gz
Size 3.0MB
Sample260718-yspppabw5k
SHA256 1b1a2caa09246da589e1555a4a0aa7e4d84958dcb76d46e27b7f1216a4607e39
MD5 87f9737b84d84a70b4d097af98f3d103
SHA1 c8fe75c38f7e63c4d820d856a5a4945f02408c20
SHA512 50608d54d2a7d0d665240314cc2f9fdc096164bbe6ea8cbebd77bda0112265ee7328910491d6e7ff623f8c18d58a48877535033a2991296adab40c018a5bc22b
SSDEEP 98304:M2cJuVQ7/FDREit989r8K2TEF1s8x6D4jUDo0FOaED:moVIxpETFg4Q80FOHD
TLSH
T174E5335F7741A5E97E0DB112FB12B2180A9B811E95B43171A8F923F67BCB32E4F016D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery linux

Malware Config

Targets

- Target
  cfst_linux_amd64.tar
- Size 7.6MB
- SHA256 27cd9744eaef77ab240faff2365c32079aea706ecfe4895b4755c09f54de60ce
- MD5 107084a015010d8669a927c488af9686
- SHA1 d09794f5dd5a45f8bf791d3b2fdd9afa46b761a4
- SHA512 7216e0939454bf2404e46effd7f26b3f661a7c1121cf56e76d214e4d946768c490d8e6d94e8b8d295fc899a9571916c45c3873f7c14ad5d85210c52d175fb15b
- SSDEEP 49152:2CSlqbfF+67w/N3Kgfpxhwiz2gE448oi18iAtdRVPLBY0iXTUIqoDkE1NDk07wCR:2LoZ+T3TnX4/D9VLrioo3kgt7cRicE
- TLSH
  T1DF864B43F8A515E5C1AED2358A6292527B717C495F2127D73B90F3383F76BC0AABA700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  cfst
- Size 7.6MB
- SHA256 2d0b1f831eea02ea2eb98d1cecbe9d8d631a72f19c46b23bb0457cb12f75e556
- MD5 706539ba37e2189b84bccdd8c367e8dc
- SHA1 29990446fee428e857913ceb384af3454162b153
- SHA512 c3a402d105157874b3078b4aef07ea44b005a550150b556f59f54f27c8d37e2fdf7d8bd6b991597cd8a901702d4b7665c6a268e5ac3fafd54251add04e582bdb
- SSDEEP 49152:ECSlqbfF+67w/N3Kgfpxhwiz2gE448oi18iAtdRVPLBY0iXTUIqoDkE1NDk07wCP:ELoZ+T3TnX4/D9VLrioo3kgt7cRicEB
- TLSH
  T18B864B43F8A515E5C1AED2358A6292527B717C495F2127D73B90F3383F76BC0AABA700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery
- Contacts a large (11880) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral2
- Target
  cfst_hosts.sh
- Size 2KB
- SHA256 40f8fa5d7500f6cb7effeaeb9c7e4c95ea7dd3ffcfd85929526ef4c8acdef0b9
- MD5 f9fabdb3d6b8ba0c6ca7fd2686d18442
- SHA1 bf3e0b16f9778293c91a5f9c3d6ce3fcb3533faf
- SHA512 0bae11ff5770b23e99af390491351f22b1641c57ddab9c7f8bbccc2fa5300f31b763f4b11c6b41a85cc512d7ded5d8c95878a8c9242e5cc73e024982ca349e3b
- TLSH
  T1CA51B57ABCDAD1F84100F0CCDE9441B6FA2C3033CC38A52690D2AE6FB405AE9719C429
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  ip.txt
- Size 410B
- SHA256 fffd71631d4e8ca3933621f915da6b943e748ab5c32980bb39935d7b66517d4b
- MD5 f3e73af6410c8c0977b0878abcecc53f
- SHA1 60f035d777eced8bdbcc5973362f8878c1692636
- SHA512 d84768fd84411ca19ef019e46e11e03a11939fe742da92e226911d8f748871b11dd6d82fb89cdec2c77fafbe6d974c2c57190458f07bd6ee0e0725ac14edab95
- TLSH
  T1DFE0C22153AC1AFB19F0301A8023D77020532B9B01C2B1F3DBBB962075164507834770
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral4
- Target
  ipv6.txt
- Size 1KB
- SHA256 5c2f0c9277c25733fd2a2326ecd63ede0b66f49ba5367e475863481379588400
- MD5 78c7a90c91463e8205438fa55309e322
- SHA1 ca3d0a41d5047f57ea8518043f0460cdc05e939b
- SHA512 84be4610fa288dbe299f3429d06c86d427861889c9e0a1e478caa566292894a03b25bc3e4a53ebb88c5d2ba8d6abaa0cb621a91773730b9d5a449a6da1006cdc
- TLSH
  T17E41CE7C17B9C5EF43484596B92BB8FA0AE7C22A370C319EFE0D6493144AD70C4679A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  使用+错误+反馈说明.txt
- Size 1KB
- SHA256 41e2fa7db5ea5ffa0ea0334df15fef992ecf6e1be893965ca3c08ee6b531022b
- MD5 d1ce5d5b0b382e97a046cf11ac782fa1
- SHA1 24d0725699edbb7fb4187323f10a3bc25afcdc5d
- SHA512 2de623d484faccc84a34fe2195bf35449fef2c79f793bc96354579367e091b58699c5e04a3efbea31c1c3d70f6497070b313743e5b8fc8de99644f7bf69793ff
- TLSH
  T1B23165BB09EB4394051374C95EBC917DA355BCF6DA39B108A6F521E6190CFB1C1C261A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Contacts a large (11880) amount of remote hosts

Creates a large amount of network flows

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6