911c14d867fd7578922084221900193295cccbf0cc3da0543403b3002ff96d95

Sharing

Copy URL Twitter E-mail

General

Target
oob-worker-samples.zip
Size 14.8MB
Sample260805-v8d2caxyfw
SHA256 911c14d867fd7578922084221900193295cccbf0cc3da0543403b3002ff96d95
MD5 fab439ebad1914b5a408300975487fd7
SHA1 16bcd946dcc715f6933788e8c9a54f388553cbba
SHA512 fc4fbe8ce24c0bae7fb8bc2921443cfdb2ef6ef374cc3d54facdbbb1edd63a7a64e929fc2ab38d4b962f13f8afffa9b09a05dfc6f559199455071f7d68247dce
SSDEEP 393216:ehVUV51ioUQ5smOshJXzZaOxwQptIbdD5D:gC5spszj5+YybJ5D
TLSH
T1CFF633294FCE9EB7049ECA2F3A63154B17379505106E0B75EC7DC3680A527A27C8E3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  stage2_linux.bin
- Size 109KB
- SHA256 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3
- MD5 d382fdae4e2675b94419fdb115dbd397
- SHA1 bc3ae1e11c283e9e3d57c02abf24870f4e8cfaa1
- SHA512 dadb6e029c0d9a2fc3116e265c815929c0660397a37531a7313b125062d1616e8d6759e48a1e87cc1fccbd9dd90b54a271dab351a2fea6bf885d50f888b50d93
- SSDEEP 3072:Dty+4EYtesvCQONbnTjOtbq2+r1GmDmDxBiDLZxCY:Dty+4EYt/+TKtbq2+RGEmDxBiDLZx9
- TLSH
  T1ACB3124F813E4421C9FB867309A738D160793ABAEC6A0F19664D3C739FA9A074CFC095
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  stage2_linux_arm64.bin
- Size 114KB
- SHA256 aafc37589c0d21fb729761a1579ca3b278b95bce152aacfa29243ffd27f5eeb7
- MD5 30fa54ad2163d07185201295e6545456
- SHA1 0815062d5c00cd84acb1a9339324ba16b4ee7657
- SHA512 d77096db2d242296461c65fdf0804eb0a30e11679af5b0a4de446fb04d09bc30bd62ed480639712f5bfdfec09a1fdd896c420f974b307420e819840b5e5c1be6
- SSDEEP 3072:XEcFXJViL1AwdjF/Dor/8fJpvYRStmEv9vJgcYd3:xh7iZf3DK8fJd8JavK59
- TLSH
  T178B3128B5EE61B90E45047BAC03140BA7F71B62DA4DF5422925C3FD8EC4A37C41B9E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3 behavioral4 behavioral5
- Target
  stage2_mac.bin
- Size 83KB
- SHA256 c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00
- MD5 8519efa4e2f3cf5dc0a32f88456cae6e
- SHA1 5ecbba745b66f99acb5f40cc9612c1552d934f1c
- SHA512 de87ee49fef9eab1cd54c25564fe463c2f03b4037a270d542cb70a5c39c324f72b7767fa20129b72481bf3bb6513f5267fea40911c1b43937165c377f1750e1d
- SSDEEP 768:t8f5MjMmOe/lRXUGps2Xd6Sgs9APbT0BaVbFG9zvpVj5koYMG3+M:2hMBOe/lRXfUhG93jKMGOM
- TLSH
  T1D5833B46ABDCBA6BD0D9893C4199C79D1293F0713B0A532FEB50C974AEC4394322A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  stage2_win32.bin
- Size 52KB
- SHA256 d632c2c0c7801c3da57cf849fe4b4ca8351d9a7fe73c31050bf5dbcc96a16791
- MD5 57e1882595acbfd3f55cb2c74f6aa872
- SHA1 2aeb40721476f6a77fc2ea5db965af29b5d6b444
- SHA512 91b574f4ebf663dfc64a1372ced3d45285f436fb4cae88710dd423c119a4f8997ea53d9d30e67676d9612a28c65f02c3531c166bff49e901c237d8257ee552f4
- SSDEEP 1536:CPRbLM/Nsxkvlml5/1r9t9t9mGQPONUW5:CJ8/SslWyOD
- TLSH
  T1EF33190BB39394FCC61AC17449FB6B337A31FC664521AF2E5654EA312F11E602E2E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral7 behavioral8
- Target
  stage3_decrypted.elf
- Size 4.9MB
- SHA256 d279a78f15feae407f09311961adb9a0fac215ac339d43ac10f0b8d6a16ebd56
- MD5 0121e2fe80a37ce94eb9f1b3063e9f23
- SHA1 0c80bc3e5c3652fb56438518de06d0fbb89609ca
- SHA512 70a7a0e5b9ffbaa523bc24115ccecabfc57c73001da346d3350e3d6fe6b9606879e6d998317e30c87cd97b1ceecaa35d6d5edcf0b8834d05963e976b1e016548
- SSDEEP 98304:bP0WomvE9T3QoW8Rsp9TErhqqdwIg8WOKXrIUFv8ipsMXCfWCSYHHUxDaZhQ1:bPFvUQAKh0DdG8WhrnFB3XjClHHUxDag
- TLSH
  T1703633E6346F17918F943425BF72CC876289B88D508E502FB26A6A6674FD181D3C7EC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery privilege_escalation
- Deletes itself
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral9
- Target
  stage3_update_win.exe
- Size 9.8MB
- SHA256 d176cc4405b57cfe04014cc4f92e16424aaa0a0a918d7c16705d39bf71629232
- MD5 4b757f79ff41ab21a857826e936825ff
- SHA1 e8f134f9234edf0994357f1a7f88e4b001301aa9
- SHA512 75e16af2eba3d3619930476b2231b74899363cf26e94e2010c8f120704c5e2a469443c7f5b35b605ed87a86d1701cef160d34bec9542fe81608dc09ef7b2dad3
- SSDEEP 196608:1mQdXuQSzIbLJl0G9oj+owpH/to1u73Io4arTpRMxKOCpVtg:4ofhfGo4K9GKOuVt
- TLSH
  T120A633388E8EEE78C3DECD3F2E970457277B5545051E0A7AAC2DC6509A927123D8837E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral11