eca79f1b028ef0a2a3b6aa8f40b5db731aaf2ba5955716d29586b78ed6a60760

Sharing

Copy URL Twitter E-mail

General

Target
rabbitmq-server-4.3.2.exe
Size 22.6MB
Sample260720-qcsgmsa19k
SHA256 eca79f1b028ef0a2a3b6aa8f40b5db731aaf2ba5955716d29586b78ed6a60760
MD5 b0e66b275c8e8463ffe61933ab63be38
SHA1 3de75831d0936740695d83cca4d4d0ae367e2635
SHA512 0cd62f56575f7febd4fff70fc21ea13160b0ed4e094bb7ab95bd8efcb353c42f0403635a0451ca081e4b694e06a87e9de9d3c971aed87a7a41efef1ce5baf467
SSDEEP 393216:oakIvPTU1b3Vgb8tmryJ0JAUVvM4GXdUij9DamNwPO6r9FmKGQgOWMZOvq:8OmrVGmPAV2XJZLNoOGFtG8Oi
TLSH
T1DD3733490E28DC2AEC0E1171917749B6B86728218FE51315BA60176BCBE7DFFA313DC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  rabbitmq-server-4.3.2.exe
- Size 22.6MB
- SHA256 eca79f1b028ef0a2a3b6aa8f40b5db731aaf2ba5955716d29586b78ed6a60760
- MD5 b0e66b275c8e8463ffe61933ab63be38
- SHA1 3de75831d0936740695d83cca4d4d0ae367e2635
- SHA512 0cd62f56575f7febd4fff70fc21ea13160b0ed4e094bb7ab95bd8efcb353c42f0403635a0451ca081e4b694e06a87e9de9d3c971aed87a7a41efef1ce5baf467
- SSDEEP 393216:oakIvPTU1b3Vgb8tmryJ0JAUVvM4GXdUij9DamNwPO6r9FmKGQgOWMZOvq:8OmrVGmPAV2XJZLNoOGFtG8Oi
- TLSH
  T1DD3733490E28DC2AEC0E1171917749B6B86728218FE51315BA60176BCBE7DFFA313DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 13KB
- SHA256 933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f
- MD5 28c87a09fdb49060aa4ab558a2832109
- SHA1 9213a24964cd479eac91d01ad54190f9c11d0c75
- SHA512 413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d
- SSDEEP 192:V26NwF1FF1bl9UsZBpDOjH3RGz47gnrVsybWZeAW4MwNR5yRR4XLLF/NTNIXoslk:T+1bYsZBwWsySZeIBZdP40l
- TLSH
  T19D52D8260EAD03FBE1A216392791663397D6D20570C1570E9FC18ED72813BEBADBD217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 6KB
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH
  T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ShellLink.dll
- Size 4KB
- SHA256 d1d1642f3e70386af125ec32f41734896427811770d617729d8d5ebdf18f8aa7
- MD5 aad75be0bdd1f1bac758b521c9f1d022
- SHA1 5d444b8432c8834f5b5cd29225101856cebb8ecf
- SHA512 4c6e155cdf62cc8b65f3d0699c73c9032accefaa0f51e8b9a5c2f340ec8c6f5fab0ea02aad0abed476b3537292ba22d898589812850968e105ac83680d2f87d0
- SSDEEP 96:Lno1dF1kBjthIjDfCnke7+bzYz3Cl6nfkfLGO:LU+h8
- TLSH
  T1B8914229A7FBD0F1D15B8F7B095D3AB34786828441B2154C5FC81F8A192331F2EF6A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 93f95a43ce04cc82251a7a7d5c7234ef860d05426099a666d15e50431ce5f7bb
- MD5 5a926f709f2d7d34d780beaa4cec8148
- SHA1 4c38dd8f2d44430cb3b109f4620acc270bc7170a
- SHA512 2d40c6917d0281552243538fd6575e5c0ee2faa2745e3eb446383d5da12e5d1aca5619999d6553d1599bc1161885948eece08d13ef930af970404f15aa7ff1b5
- SSDEEP 384:ezdjmJfBbHot5DSKbSw2/aKN6yi6SvDaYiWqxOheKRH6jWYQ8emt7:ezdjmTbIt5DSKbSjzBOGFWT4xjQB
- TLSH
  T1B2D2291AF707C8F3D162A1B04BDBDBB78226BD1485725E63FF174A5CB933392560920A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 7b62b0144e690828af34fc23ebdd23b853309fd21467bceba63dafc074bc4adb
- MD5 e7ca37c6bc95834ab50e7ef363c6e7a3
- SHA1 e7eba0604d1fd473159c7fa651c35103a27538d6
- SHA512 35b3149c3f41a721f0be8fdcb7669948a3d60bb801b92ccf6f11a6a030175db4895a7949e2e9ab53bbd64df843533b88e6fa640b99e4bb069fccbb9927adf3ca
- SSDEEP 384:DwI41m2hICX1xT4YS3ySnvWd0OWXVgoz:41p4T3+U
- TLSH
  T1AB52B50EFB2254F2C1329438575BFB3F9729B45AC92B4B51EE670A5CBD7B231181E206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $_52_/amqp10_client-4.3.2/ebin/amqp10_client.app
- Size 1KB
- SHA256 86f01229b319157058ea6188afbbab70d99e21cfe1accc8d80df7eeecd91f8d8
- MD5 6a641454b962c33284484217a7823e27
- SHA1 ce46e7ff48f2a1e3827abe76526fb91cb5923638
- SHA512 1cd5f8d12cf97f1b05f9d8a9629ed3eb8648355c5d0c2ba161360abd0bad83c4544b9618c95314e4b132a3bbdb4473fa8b286445803adb97583394dced95a1e9
- TLSH
  T1E7115BB38754AC163ED2D793EA7CD441CF7AD91F9ED37842F152049C7A5D01242C9034
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  $_52_/amqp10_common-4.3.2/ebin/amqp10_common.app
- Size 839B
- SHA256 552a0df37fe3e5a7a003ea53726fdc583e479801b8689f486951ffe5ec906a6a
- MD5 a75ed3877f2c22d443481e301796b8ed
- SHA1 45d3e510442bc1323255b00a9546cd6ff509f7c8
- SHA512 a365ce3248a74e3d16031ab94bc42ae34c96f6b04c208bab399855c421bb4541b6fde57ac62db4694566c6c5b0f22b1062499a48c5d786b54cf78346b387d4be
- TLSH
  T1C9018CB3C7969C077B82F693FF5C58C28BB5551F6C92A446F04A046C738E01205472B4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  $_52_/amqp_client-4.3.2/ebin/amqp_client.app
- Size 1KB
- SHA256 8bcc9ff46552b380d8f7c2a26b112d8cd6ca1d5986489c4a80069c192946d67c
- MD5 8c715d2d7fb84f41ae47d47939d8ffeb
- SHA1 a20ad174c99041cc003e8c0b5afa1112ae7b78d8
- SHA512 4a44c00ba19f54b9431a59c7c144479adb30741fe73b0ea70c90c7a3d8792f60382667d33ad244fa8e15474ba9f5922c79158c0f0fcacefe2b7439ebdb977f7f
- TLSH
  T13921B393C754AC0B62E39517BB5CE1814E79F72F9CD7B0C0F1E2046CBB6836090961B5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  $_52_/aten-0.6.0/ebin/aten.app
- Size 681B
- SHA256 76b436eccf4180be2f1f531a3206ba48f4d3a4150013d743fb9e259602bdb4d8
- MD5 db3917b85d0ffa0bb4fe4f82d2fd0534
- SHA1 8336b93d0b43ffddf70c899d411a58ccde912a1e
- SHA512 2be35a1d359ced5c635abfecdcd1924583e663fa7d702311838c6152646feb3bb994b2b58621e6a145a09db97ffbccea8acc2bef5c3122676cd68d85e7579225
- TLSH
  T1D90184874802603A5E49A88E5792A10AC13305CF0CC6BA00FBED41480F9E05D92BDE60
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16
- Target
  $_52_/base64url-1.0.1/ebin/base64url.app
- Size 396B
- SHA256 c948482cfb9ad99cd33372e24003a04554254fb9a3d0075f3b0f116cf0b74da9
- MD5 404abeab3d0793bbb3ec3bfbe30c9eec
- SHA1 002d8fa8ae83bed19b15368d4a285f949763c1ee
- SHA512 0c8338a10d94d4d1b0b1643d37cd52e0cd80456216c0ad8f36aa37f1d828b011a6bb12f7c025c420379f80e5f5ea423eb8614b451066371d9976a3cba81fc6ed
- TLSH
  T168E0C7834841904A2FC83AADAFA0400E84B622CF0EC2648C7B0E01890F9C04DAEB3534
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  $_52_/cowboy-2.16.0/ebin/cowboy.app
- Size 774B
- SHA256 f68afb0f7debce762444d733a4eeef761f0a38f3f5e5183758b12d9616e07631
- MD5 f8680e3bd263b9efaf4176bafa69ab6f
- SHA1 63077fe5517628c8407ffac058e200497e94b90b
- SHA512 1c2facb182acd5ad85e1f19960fddae8ff1e8683ba89325b318c3e368154174f5217abe762f7d19e73a79abc0dd75db8944e8164e1671c7481b5e403cf9eca8f
- TLSH
  T19101D4D318D4A18946C9A63F6A88C3D742A6DB3CBF649104E5178170F1C5C52717F223
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  $_52_/cowlib-2.17.1/ebin/cowlib.app
- Size 590B
- SHA256 c5ce83e7d2069d58b31af60286b12ba97c78dc9819e765c4807210726cfc5525
- MD5 3923b8669c3518c332d6e38b323d705f
- SHA1 57a605d743aac6a7e4514bfe52e55d3d5c5d44fe
- SHA512 f65cd8afb2de3ad38b32be26c71a72defbf775ec2fe1a4ac78a4abd9e7df66702e8a615a8570e1d62b9c0dfdf88f04f99b7d7e674f4be2ad99e62a2815df0a82
- TLSH
  T130F0E0C35529D35A4BC5FE37724884E7E7F6450C7F62AE4FA15A452154C38DD841E630
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19
- Target
  $_52_/credentials_obfuscation-3.5.0/ebin/credentials_obfuscation.app
- Size 673B
- SHA256 c92043482a798810739b0bf382232f82f23d4cd1edb54467df7d285d4dfcef30
- MD5 e913ea0fad713606080f7b692982e0b7
- SHA1 115048520930a911b88e777cac2f72d439bf764a
- SHA512 642144b7a1912d3bed50f9501c16cd89cdb35dfe05f0244b5fe6d3a3fda9ef00ac41cfffa4497cdeef6518ce05ee0f33601cce5c635e75d2b1fd35fffe63b3a0
- TLSH
  T1A50162C38EC490A41BCB951FF745D02D413B894ECEE16594BB3D0446CB8C61ABBFA528
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral20
- Target
  $_52_/csv-3.2.2/ebin/csv.app
- Size 546B
- SHA256 a9d5f4e67667cdc1c34687a59a3bd71e1d6c03203914adcb6a503af1b40f6bd6
- MD5 22c6ed369f1688b65d7b66f850e61070
- SHA1 6dbe6b28fa2f4f36efc7e3a5352c5161d1b5be32
- SHA512 2aee037bb8a7108350158030db600c1efb8545fb3728d085b2f371bcba3974226d3a35877e3c0a7a2e46e9efc1f29f45e2773597625480c62d70cdaf38e045d2
- TLSH
  T1EBF06DC74F6AD2E70B2CB52F2ECCCA4B4239115FDA17A670A55650DF34052E4CA29230
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21
- Target
  $_52_/cuttlefish-3.9.1/ebin/cuttlefish.app
- Size 903B
- SHA256 61f751266a5f88b7a4297be85be9148ebd0674683f94e0ad416c5ed84e298704
- MD5 27c1c9774d48cb81e909da71df335eaa
- SHA1 06e717b47637fdc343dd663de9cceee27a056c12
- SHA512 c81bae32aeff138715f789abe803fa97b62c6a9d2e493e7006bb2c70ff2ca452540569f3f352e893584f00489623a0fc1d672b59ed20e6224cf64a7b0ff656c0
- TLSH
  T15E1178C245E5C8551B9E364F9A5077D30075C18949BCA850F6EF4EDDEB48D48CFB2620
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22
- Target
  $_52_/ddskerl-0.4.2/ebin/ddskerl.app
- Size 439B
- SHA256 92fc07f37e2f391635c73a55fc535b0c11cf2c12b8ddf1ae107520b5cb1bc0fe
- MD5 1be540802cbda05ff17c7c985d75b07a
- SHA1 d58bd135a8f1e7070eb0d51a21c31f2c0c5e6d22
- SHA512 fd6dba19e3bf0351762e3ae6cc1fc8b4852aa909c3425d4fb6da1afaef10fb31bbc1d6e5580a4f9a03062635e0ab6a6cdb106bc4029450596671b405730e2115
- TLSH
  T101F04FD798915146DFC776AEAFB0B44AD4B2368F4CC0E445B35E08450B4906F95F6760
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23
- Target
  $_52_/eetcd-0.5.0/ebin/eetcd.app
- Size 919B
- SHA256 a233f19097e4f5503a6abc9b24902907b84b760384cbd233041f7facc3c306c9
- MD5 3d14b0ef381f3d350d809e965e78f3f3
- SHA1 31c47b0b2d28aced4aaaf29369f9219660119cea
- SHA512 c6cd77c53887438ab0b3df11c469b839164903f7f04d627fac417acd4dd808c93fdc0e1c6f1a9126dda7a395de8d54d6bc981844e729dadea5ccb116b433c4ed
- TLSH
  T1D811F1D17BA840245918BA0FBFDFF24B442314BE49E4DA08F6FE4408EFB80BE12B6514
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24
- Target
  $_52_/enough-0.1.0/ebin/enough.app
- Size 408B
- SHA256 0740c1637b4defe75fb6e642d642bebf44f428bae6cae4ba1f6f3356982eba17
- MD5 bf4afccea1b7f217db5b59985ed00e3b
- SHA1 78ee9c275cfefc7ca19924f88965fc224cc193e1
- SHA512 37f63655687e8dedf634aa2a711af5b1d59f0a57610b7d48b5fa79c0f7fc7d4ffe04c779582ed44823ad056afcef3e484cff9f1f40d8ff6ad264050b8e800f16
- TLSH
  T15FE026C38C0180432ECE268C9B7C8046E87712CB4DD0A441730C80445F9E8BE4AF3920
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25
- Target
  $_52_/gen_batch_server-0.10.0/ebin/gen_batch_server.app
- Size 424B
- SHA256 ab7280d5dae719d382f314a520d74c3e9f0a82882ce0054a674fc277b53a72c5
- MD5 c1392f793f03d5eb4734f6fcc7cd0b5e
- SHA1 368ad1cdc1af89bec36fc6058c0eb5b54955fd7a
- SHA512 524855b3f505aff4713bbd03cc180e357f3643bf5bcc9522fd0ab68c5d759e0cf48adb4580445dc9587d8aa6662408256c38218c5d5b9307c27f222aab2d3132
- TLSH
  T142E08CE3885A808F2BC62A8CEF64A049527F02DF0DC4B115770D41AA4FAC56E4BB2B60
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  $_52_/getopt-1.0.3/ebin/getopt.app
- Size 396B
- SHA256 30d5c7abf3137e61a4cbc3802a99a025a06c5dbafee3febfe779d5650eb40b4e
- MD5 cf383a9871f203c002db3e6fd11723ba
- SHA1 e02e9c1cf480fcf90296e4cb0e777685f730d7d3
- SHA512 0b7157ed2f19d0f85a7f84b9bc095343383657fc6ad28b0d14b09e54aac1565429ac431a41bf70dca6ad7820e603cc6e318bf8022d38b0c808317fca0a32c16e
- TLSH
  T184E07DCB499940122E896ACCBBA044999CF607CF8CC0B0603B1F40450F2905E44B3130
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27
- Target
  $_52_/gun-2.4.0/ebin/gun.app
- Size 758B
- SHA256 f96e9c9166800ebe732f59097822afc5a7cee910c257a051daeec9e816fc09f1
- MD5 188c1e36351a141396f2ea602de7a991
- SHA1 82d0268457c1dc3712ef7d150b68167cf47a6d65
- SHA512 05cc28e16fc5724c0566c22e3e0edb8cf89f6c2b412be06e72d82581a10c4b4da2ad5aefe8ed456180236a5aecf8d1b6d5c899d639763125d27146da19b30aca
- TLSH
  T1E9017B978BEBA2CD8559751F33CC9015C2B1D70C9CA9A34CE5878474E5984E0BE1AA20
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28
- Target
  $_52_/horus-0.4.0/ebin/horus.app
- Size 729B
- SHA256 201368d2566b7023bdfe2c08cd5e7d740882e490a5985110d77877cc3756c189
- MD5 226be5df4b1018459580cd4dee6d6858
- SHA1 647117100a88afe9efeadbf1333d129ab3d57973
- SHA512 a59b6ca1fceb71bd2227a949b015031b6bd9e3ff1c0b1acd57f5d32702df349b6dbd1d12da6fe77989b84ecf2f92beea6ebe31ffe0aec7eb9197a956219cb104
- TLSH
  T1CE0122AB487808452B0A29CEFFE98486C0B5259B4CE074607B2E62484F8C01F90BA775
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  $_52_/jose-1.11.12/ebin/jose.app
- Size 3KB
- SHA256 d18cd467e4d828826fc87ae0b7fdcb74f54691bbeff8e93e07d25c609095d347
- MD5 cdcfd058113fd17ddc67a7dc9943ebef
- SHA1 2ddd8e1f6d79ba4c3f276b1891a0ffb2edea033b
- SHA512 07517b1701b0f297b56252b5b766634c3b0c689a5a853bc4079b33ff161f5f7e64d3cec53d52d8c3f5a056150932870fb43c145a19eb7b58c87058a2e9a890f3
- TLSH
  T1E5518D2B1F15E8D2AE0B45B7BDF44BF86A611F49CBBD8DD1DE071492278110F523192C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral30
- Target
  $_52_/khepri-0.18.0/ebin/khepri.app
- Size 1KB
- SHA256 10ef098d5dbe068ca10fa10f87e43ea5c71e6cbf770875fe63074a9afb75f7e2
- MD5 e37a6399793d4600dabb394a915fd7fa
- SHA1 81854e7259d742f2b35263da09dba98b97d3a193
- SHA512 561f649761113db4f4415f65869cd56dc22919e0f086c35c2c39b8219018a5687a11fa054331c0d2a57d75b3b1d29cc044cc37766d4f1cb88a0c54ffd9e2d53e
- TLSH
  T11D11E0D7C458C43DD7D928CFDBA0A0D28076358F2AD0E866F22ED2640BCF01EAC75660
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31
- Target
  $_52_/khepri_mnesia_migration-0.8.1/ebin/khepri_mnesia_migration.app
- Size 1KB
- SHA256 1a8c09a54f2a00e7af56fda167d44bce93a973d3911f9eb094b2f4660abc8630
- MD5 aac1611d8d3b5d26eca5a958a7061845
- SHA1 17d5bfcd69ebdb0030808f14040ac93a637d0220
- SHA512 9591c2cd099162afbee4df8f596ce2e756307c5242d62d0403b72cbc95d7b02f94f55a7f1a48c4fd60121bac296e24d1458311041df4b856cea03ac4f74eeb2c
- TLSH
  T1A7118CD3C6E004112B42AE5BAF50B4429475695F0CD4EA90BA6E851D0F4E23EADF7B30
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32