oob-worker-samples.zip
- SHA256 911c14d867fd7578922084221900193295cccbf0cc3da0543403b3002ff96d95
Overview
overview
7Static
static
5stage2_linux.bin
ubuntu-18.04-amd64
4stage2_lin...64.bin
ubuntu-18.04-amd64
stage2_lin...64.bin
debian-9-armhf
stage2_lin...64.bin
debian-9-mips
stage2_lin...64.bin
debian-9-mipsel
stage2_mac.bin
macos-10.15-amd64
1stage2_win32.exe
windows10-2004-x64
7stage2_win32.exe
windows11-ltsc_2024-x64
7stage3_decrypted.elf
ubuntu-18.04-amd64
7stage3_update_win.exe
windows10-2004-x64
5stage3_update_win.exe
windows11-ltsc_2024-x64
5Behavioral task
behavioral1
Sample
stage2_linux.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
stage2_linux_arm64.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
stage2_linux_arm64.bin
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
stage2_linux_arm64.bin
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
stage2_linux_arm64.bin
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
stage2_mac.bin
Resource
macos-20250619-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
stage2_win32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
stage2_win32.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
stage3_decrypted.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
10 signatures
150 seconds
Behavioral task
behavioral10
Sample
stage3_update_win.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
stage3_update_win.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target oob-worker-samples.zip
- Size 14.8MB
- Sample260805-v8d2caxyfw
- SHA256 911c14d867fd7578922084221900193295cccbf0cc3da0543403b3002ff96d95
- MD5 fab439ebad1914b5a408300975487fd7
- SHA1 16bcd946dcc715f6933788e8c9a54f388553cbba
- SHA512 fc4fbe8ce24c0bae7fb8bc2921443cfdb2ef6ef374cc3d54facdbbb1edd63a7a64e929fc2ab38d4b962f13f8afffa9b09a05dfc6f559199455071f7d68247dce
- SSDEEP 393216:ehVUV51ioUQ5smOshJXzZaOxwQptIbdD5D:gC5spszj5+YybJ5D
- TLSH T1CFF633294FCE9EB7049ECA2F3A63154B17379505106E0B75EC7DC3680A527A27C8E3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/stage2_linux.bin upx static1/unpack001/stage2_linux_arm64.bin upx static1/unpack001/stage3_decrypted.elf upx static1/unpack001/stage3_update_win.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/stage2_win32.bin unpack001/stage3_update_win.exe
File Explorer
-
oob-worker-samples.zip.zip 14.8MB
-
stage2_linux.bin.elf 109KB
-
stage2_linux_arm64.bin.elf 114KB
-
stage2_mac.bin.macho 83KB
-
stage2_win32.bin.exe 52KB
-
stage3_decrypted.elf.elf 4.9MB
-
stage3_update_win.exe.exe 9.8MB
stage2_linux.bin
- SHA256 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3
- MD5 d382fdae4e2675b94419fdb115dbd397
- SHA1 bc3ae1e11c283e9e3d57c02abf24870f4e8cfaa1
- SHA512 dadb6e029c0d9a2fc3116e265c815929c0660397a37531a7313b125062d1616e8d6759e48a1e87cc1fccbd9dd90b54a271dab351a2fea6bf885d50f888b50d93
- SSDEEP 3072:Dty+4EYtesvCQONbnTjOtbq2+r1GmDmDxBiDLZxCY:Dty+4EYt/+TKtbq2+RGEmDxBiDLZx9
- TLSH T1ACB3124F813E4421C9FB867309A738D160793ABAEC6A0F19664D3C739FA9A074CFC095
- MD5 SHA1 SHA512 SSDEEP TLSH
stage2_linux_arm64.bin
- SHA256 aafc37589c0d21fb729761a1579ca3b278b95bce152aacfa29243ffd27f5eeb7
- MD5 30fa54ad2163d07185201295e6545456
- SHA1 0815062d5c00cd84acb1a9339324ba16b4ee7657
- SHA512 d77096db2d242296461c65fdf0804eb0a30e11679af5b0a4de446fb04d09bc30bd62ed480639712f5bfdfec09a1fdd896c420f974b307420e819840b5e5c1be6
- SSDEEP 3072:XEcFXJViL1AwdjF/Dor/8fJpvYRStmEv9vJgcYd3:xh7iZf3DK8fJd8JavK59
- TLSH T178B3128B5EE61B90E45047BAC03140BA7F71B62DA4DF5422925C3FD8EC4A37C41B9E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
stage2_mac.bin
- SHA256 c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00
- MD5 8519efa4e2f3cf5dc0a32f88456cae6e
- SHA1 5ecbba745b66f99acb5f40cc9612c1552d934f1c
- SHA512 de87ee49fef9eab1cd54c25564fe463c2f03b4037a270d542cb70a5c39c324f72b7767fa20129b72481bf3bb6513f5267fea40911c1b43937165c377f1750e1d
- SSDEEP 768:t8f5MjMmOe/lRXUGps2Xd6Sgs9APbT0BaVbFG9zvpVj5koYMG3+M:2hMBOe/lRXfUhG93jKMGOM
- TLSH T1D5833B46ABDCBA6BD0D9893C4199C79D1293F0713B0A532FEB50C974AEC4394322A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
stage2_win32.bin
- IMPHASH 4214233346d0be8c831b504a2f7834cf
- SHA256 d632c2c0c7801c3da57cf849fe4b4ca8351d9a7fe73c31050bf5dbcc96a16791
- MD5 57e1882595acbfd3f55cb2c74f6aa872
- SHA1 2aeb40721476f6a77fc2ea5db965af29b5d6b444
- SHA512 91b574f4ebf663dfc64a1372ced3d45285f436fb4cae88710dd423c119a4f8997ea53d9d30e67676d9612a28c65f02c3531c166bff49e901c237d8257ee552f4
- SSDEEP 1536:CPRbLM/Nsxkvlml5/1r9t9t9mGQPONUW5:CJ8/SslWyOD
- TLSH T1EF33190BB39394FCC61AC17449FB6B337A31FC664521AF2E5654EA312F11E602E2E794
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
GetUserNameA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
dnsapi
DnsFree
DnsQuery_A
kernel32
CheckRemoteDebuggerPresent
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentProcess
GetCurrentThread
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemInfo
GetThreadContext
GetTickCount
GetTickCount64
GlobalMemoryStatusEx
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
_snprintf
_stricmp
_strlwr
abort
atoi
calloc
exit
fprintf
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
setvbuf
signal
strerror
strlen
strncmp
strncpy
strrchr
vfprintf
wcslen
wininet
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
ws2_32
WSACleanup
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
ioctlsocket
select
socket
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
stage3_decrypted.elf
- SHA256 d279a78f15feae407f09311961adb9a0fac215ac339d43ac10f0b8d6a16ebd56
- MD5 0121e2fe80a37ce94eb9f1b3063e9f23
- SHA1 0c80bc3e5c3652fb56438518de06d0fbb89609ca
- SHA512 70a7a0e5b9ffbaa523bc24115ccecabfc57c73001da346d3350e3d6fe6b9606879e6d998317e30c87cd97b1ceecaa35d6d5edcf0b8834d05963e976b1e016548
- SSDEEP 98304:bP0WomvE9T3QoW8Rsp9TErhqqdwIg8WOKXrIUFv8ipsMXCfWCSYHHUxDaZhQ1:bPFvUQAKh0DdG8WhrnFB3XjClHHUxDag
- TLSH T1703633E6346F17918F943425BF72CC876289B88D508E502FB26A6A6674FD181D3C7EC3
- MD5 SHA1 SHA512 SSDEEP TLSH
stage3_update_win.exe
- SHA256 d176cc4405b57cfe04014cc4f92e16424aaa0a0a918d7c16705d39bf71629232
- MD5 4b757f79ff41ab21a857826e936825ff
- SHA1 e8f134f9234edf0994357f1a7f88e4b001301aa9
- SHA512 75e16af2eba3d3619930476b2231b74899363cf26e94e2010c8f120704c5e2a469443c7f5b35b605ed87a86d1701cef160d34bec9542fe81608dc09ef7b2dad3
- SSDEEP 196608:1mQdXuQSzIbLJl0G9oj+owpH/to1u73Io4arTpRMxKOCpVtg:4ofhfGo4K9GKOuVt
- TLSH T120A633388E8EEE78C3DECD3F2E970457277B5545051E0A7AAC2DC6509A927123D8837E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
71734960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
58.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
9.8MB
Virtual Size
9.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE