c7a1369cd73c8165be00c66e90291c4dd67784de7c3aa3af18c68ebedffa6ea9

Sharing

Copy URL Twitter E-mail

General

Target
OpenSSH-Win64.zip
Size 4.9MB
Sample260818-ahgpbssdqe
SHA256 c7a1369cd73c8165be00c66e90291c4dd67784de7c3aa3af18c68ebedffa6ea9
MD5 9ec45887d46338a925b21b8b93b76b27
SHA1 c1397157921ebea80c68c08cce0a144d2b6a62ae
SHA512 49b48e45da59bd8f9099a864d547b0ecedfa03919c4b858f96372b5cc7ee2661f7f163d0d2a24de77e894cd6f039f43e29eb01ffbfce65b13cb4ed80b9410d2f
SSDEEP 98304:2BdI4CKjp4655UvsgHupDyUSOBLuDXnqO18LvFvcSeY8ZSM6m5bmPbQOLMeTSE:2BdIjKjp4655UVup/BLuWgKFvcSZFMn8
TLSH
T1703633555B39FCC7BF14F8989AF3267254BE278F15AC52C2B03AE10DD6C918CD929232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Targets

- Target
  OpenSSH-Win64/FixHostFilePermissions.ps1
- Size 16KB
- SHA256 319180401f004cce04998dee4d5934f8ff4d6c952095f323da8b26d971c66fdb
- MD5 fb991b77bd221839ba4f847d9037899c
- SHA1 4f188005ed909a57eab212659cd8728054c94e07
- SHA512 3d3cb67830d483152437d78ba5199c1ceaec731746ae1542c1070879d15a1be263ee81c2b10ff2b458aa34af1106fcb333e9525678c240c7998047e362f13022
- SSDEEP 384:xp8DoR9BvxB2dymHcvFcYlu3Q8xZd/IQEMRhmCYyFZHyAugkdaNQMN5Lft4t/NSR:xpT9Bvx8yrSYlu3QqKQE0MZy/+gQ6L26
- TLSH
  T1D1729DB74B12314704FB9E64CA6DD77ADC18D6071AE2464AE44C3C218B36B3A53E78ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  OpenSSH-Win64/FixUserFilePermissions.ps1
- Size 15KB
- SHA256 8ed3bdcf409d1605f73984ba1ede132255619980fd252af4c594b0e37958cc38
- MD5 0866b964283de0860aa4b0b4a1e3716a
- SHA1 16af70a12a5393601678b8d9587a4366379063e3
- SHA512 7c8a4a62036a1a59794cf31d4cd2ad6e55e44b8de64b03c9833469f075eaaad2230c5e875222ab9f80cf0961ee3a203b7632f45bb62fb2ebd3e2ddb1edf18228
- SSDEEP 384:xpjcXBvxB2dymHcvFcYlu3m89YQMM5AAGHytXIgkdaNQMN5JSsk6q:xpjmBvx8yrSYlu3mgYQMcgc4gQ6Jfk6q
- TLSH
  T1E5728DF34B52350A18FB9954C2AE477E581DC50329E311AAE54CB8228A3673783EB8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  OpenSSH-Win64/OpenSSHUtils.psm1
- Size 47KB
- SHA256 b4c38d2020a633dd697b285e43c2c64dffe11d52f319e7f57627ec65c009d67e
- MD5 4e40d65af31700fc77f409c2df7067fc
- SHA1 5faedc1604be9b376570784bf2d86ff637fec960
- SHA512 f1ca4e854af4ff3a073d92c0fb15ff82d49c1eae3f8ca1aa5996dbd97a390afd2fd91d9f18e2937e56e77475694f7fb746b1242d6f0abdb6ba9a161c4aff899e
- SSDEEP 768:23fJv6zpJjpxH+XVzO/TdRUe8vEDtXyQrPawABvx8yrSYluBg1QqlMH6E1dozWXy:23fF61JFxtrawoRr3lu21rDQ0j
- TLSH
  T16423099BF755527108B643B8EEABC131DC29412F30E50A2DF9DC61902FB8599C3A2BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  OpenSSH-Win64/install-sshd.ps1
- Size 20KB
- SHA256 07badab2eaa1d155a4ad01ebfceaa9fc6dc434d7f8b0a1742c5a69799777195e
- MD5 601b0712994dfea0aa4fa98adc577347
- SHA1 55f77bda886ffdc959ed44dc1488ccd7a3da3931
- SHA512 49fa39ad6bbf72b46797d0402afe15e7a06acd5398a75b215bd0596e8ace5e56964bfd6b831198c9a0af3cd8b5b1a3d6fa2221dff68bcd755e3d15a044c88e90
- SSDEEP 384:4pqOGWf1/2EWhBvxB2dymHcvFcYlu8X8uUXQoM3hjHyJYogkdaNQMN5/Nr+jeiLe:4paWf1/2EWhBvx8yrSYlu8XfUXQoO91l
- TLSH
  T139926CFB0B52311509BB4B21EC78CB67E81AC40E26B1651AB18CBC029735F6D93F59E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral7 behavioral8
- Target
  OpenSSH-Win64/libcrypto.dll
- Size 1.7MB
- SHA256 3a14dd554f5f44de74914564ed89c57eadf4431f6b219c9c0b94c134297c4f6c
- MD5 d1a49192939f8e5f20bbdfd1e36a3f3a
- SHA1 f31ce54839a6aa2fe8e1a042bc227160862ef92d
- SHA512 01ea35fba34c8a60499dfe93fde9e02d2d3c6369708a1717731016666b01bebc1390f9223382242fdd0ed182fa88f5c19a9bce7802f623a7450c6c5571a07f10
- SSDEEP 49152:yJsbF5kVWSeSMma9KweoLTaPVPdVr1CPwDv3uFsjO:55kkiaeoLT2P/r1CPwDv3uFsjO
- TLSH
  T133859D15B6F805E9DD7B9238C693912BC7B1B45013B0AFDF06A24BA91F07BDA173A344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  OpenSSH-Win64/scp.exe
- Size 427KB
- SHA256 e5edbcbe152b74d29becac05065bcf3c74215384c0d8464a44b67a32a13e8ea3
- MD5 6aa0da0c274b50d52c9c306eff9046a4
- SHA1 8e900ddcce39ad8a42495cd1b01b9fc5cceaee1d
- SHA512 708eed2c047f21f662fed5c0d28b77c6cc1de8f892b5ac7384e0a1623bdf63c73618842f83c1913d440466d958ab27365c081f1d460925b8ffc3a58d1130868e
- SSDEEP 6144:Bofrt9OzDmiGgKBwkYphzOqEMaL166UW5OXSraJ8axYzoTtXgn86hpxk:afuwffqETL46h5OijaxYzoTtX6Xzk
- TLSH
  T126948D55B7A100F1D87790388A865653FAB278210774EFDF0AA8CA752F336E05A3EF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  OpenSSH-Win64/sftp-server.exe
- Size 374KB
- SHA256 06aaecfdbb4f8f8580b3b9b64863dc883dca695248df05d8df8dc585bc448709
- MD5 775b95784299b6634c1fe4ab6643b505
- SHA1 72238a4fb980fbd6c1b75e5ffe6bcfee1908d553
- SHA512 46fafe06688de0199cba51959a5463b23d1f3ce132a9260b424daac7cf9241ea66b68af6f71d34216b1df3bca09bab514b7932b0fe9f8a22572bac0e310c8ba3
- SSDEEP 6144:pteOhGLkXeVRbXThg6UQ78mMpaUOgmSDEe7DEAmHdm0h2:LeCGXrtgPQepvOmEe7DEAmHQ0h2
- TLSH
  T1AF84AE15FB9100F5D877A038CA925643FAB17C690374EBDF5BA88A661F336E01A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  OpenSSH-Win64/sftp.exe
- Size 455KB
- SHA256 2f97dbd6363dfd07df711df2862765a994fecfb22a7fa981d3f2b48293f92a43
- MD5 dfe7864b2ba65f341cdd9f5df1846871
- SHA1 2fbbc0ec4542495cf2cf2c9a9cd63a97cfbaf4d3
- SHA512 7fd6648b6e93bdd179f093cd4e1043e634ef2d798c1f9ae112b0e84a9ea6c86fff6286b47cf3149056839098ee2751813a4b5c8dea0924dd49f39a7fc7ff8cc6
- SSDEEP 12288:MfLKD5v6CGV+1qZAzJICh0GwtOy29C29VcU/SFQYs/j:ecGyqZqJICuLOy29C26Rsr
- TLSH
  T1E2A4AE656B9100F5E8B790388A425653FAB278250374EFCF0BACDA721F336D15A3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OpenSSH-Win64/ssh-add.exe
- Size 597KB
- SHA256 e24fb57dcf71f39738571c227c14efbbf5b0bff26be0865d77faadc5c6b7bd83
- MD5 1c69882a76364f85ffd27e8dcbb07f32
- SHA1 a2892caf6573c530a36a4d09237fbb95f35f8986
- SHA512 f5e9b00cec928b2b89029ab4e0115b9458b7fc73cca287e0bd8df9ad4bb87880123d19f3a577cd833847e079dc989fd4504e394a6df4a5bd8e6e4cec1619e4f4
- SSDEEP 6144:5/IgNZVZb/De8cG6i7oGqjat1l/wT2a2rsbTvJgUx5HctkZwO5RaDb2O7fcCnDtu:OgHDe8f6KrjYkKbJgy58DDVkpWL+X
- TLSH
  T1C9D4AE56B3E500F5D077D1388A924667F6B2B8212724EFDF07948A661F236E14B3F722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  OpenSSH-Win64/ssh-agent.exe
- Size 547KB
- SHA256 c834f7325e4324e41b9c21a1457ea740184c8e70f41f9d0edc9aced6e33dc792
- MD5 eb86f5cdb1c92cbc9983050093c23830
- SHA1 d5cb7e19638e4888523e9de30afbf764c9a5a0a8
- SHA512 6cf9b6ee88c534f5e85f3d1a844930659c0f99087a895f6ab3be72a0a3e6608e50dbe8335a523e778fce49055c1ff5e60b8a66d5db9a0fd7c8e166503a7231ff
- SSDEEP 6144:5Cfb7pzUxfuIQDpkQnXPhSr03za3O3IfvdSYarRLdp36aDb2O7fcCnDtXE4EiwyR:5CfbhCuFk8pX3m+3IXdS5LH3/1Ety4Ad
- TLSH
  T197C4BE2576E502F1D47B91388A864663F6B2B8250374FFDF06AC8A511F237E50B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  OpenSSH-Win64/ssh-keygen.exe
- Size 847KB
- SHA256 bc0fcfde59b1dbcb05a429187a670dd050d70dc5a19871c1435b7e09daff95ad
- MD5 48c7530a99f5ec0d6dc9803765f2f65e
- SHA1 8991f4e3ecca6af7f0a044c9d586b1da104b1c28
- SHA512 1420efa410073c55612a7702a2be71efc639bbdccd53fbba9ab68ab30233c52289067403b9c76c537187f7815520a53dffdd15b1d2233a3b2732cbb63a9d3d62
- SSDEEP 24576:ffrTni1cExnnESEU4C1wpF+5hoiquW7MafJgO:nPi1xnnWUWF+5yiquW7Maxb
- TLSH
  T17905AE6567E500F8D87B9139868652A3FAF2F41227346EDF0A948B213F33AE4077E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  OpenSSH-Win64/ssh-keyscan.exe
- Size 657KB
- SHA256 eae3b49ab47d26e22c14d17c68e413b39db28ec2652207e6d79b175f0ec35291
- MD5 f6dbc1fa45a5236dcfaae01e0c4e6aa4
- SHA1 d8359ae0d3ae69da11dbca5c7127f7233743dd37
- SHA512 064ed4af44341d00b62c6708cd0be153eeab0b808d411f6edf3bb483a43d75ebbf039d1839cca657dd706c93fc677344c5d00e437f7c60d4ac4e2a68bffd8b67
- SSDEEP 12288:50bYGi3PNV15wFLU0z4LcQQrtYI4xTpdSrE/1HxVT:K/i/r15wFLbz4LcQQreI4HyE9TT
- TLSH
  T179E4AE95B7E100F5D4B7D139CA864657E7B1F4200324ABEF07948A762F23AE65B3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  OpenSSH-Win64/ssh-pkcs11-helper.exe
- Size 508KB
- SHA256 14d3ee01c10ed7cae4245abfcc87674d76fb1820ab827fe4327bba3f918964fe
- MD5 3f8309a9fb1a91e127b00f53b78cff4a
- SHA1 e42c4a28e508bd2e91e97abf7aa4b13fc23e3730
- SHA512 4bb2b93257e16bf05f4a1aa2f419ae7fb44a3dee51ad7bdda5c8998b1df718079ce1531cde5c755651d8b8daaaad78d7305766573f319a1b09572a3cad9f89fd
- SSDEEP 6144:ykRernyCa7X2viTQAr026d+JvvlGFu7oQ4KRuusaDb2O7fcCnDtCE07Tv11rHMJ:3crnw7XjQA51vd4MoZcUE0nv1hMJ
- TLSH
  T158B4AE15B7A203F1E477913889864657F6B2BC211374ABEF17A4CA562F236E04E3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  OpenSSH-Win64/ssh-shellhost.exe
- Size 184KB
- SHA256 ca672731d18721cd94165b59008297e7f5093765cd57edf55e041d2ab01d08b0
- MD5 27ee7643104c08bf70bb106a6e7b3c27
- SHA1 83daa9097b9865e6bfe32e3f71dbe10bd443d3a9
- SHA512 a2b4f5435fddb3f36b86c1de75be73cea760c9e08d811cc49f089dccae910c1c3de176d0d3497c36cf7d229ab434ad7312688b9cd11702c3b470334e674098ac
- SSDEEP 3072:2OrZgVNvL6PCv2+j/zvD6EhDW599AD+MoIzWatcwx:PlivLGCjTaEhC592HWatcw
- TLSH
  T164048D56B3A011FAE5B7923488544A03F772B8210764DB9F03A453B5AF377D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  OpenSSH-Win64/ssh-sk-helper.exe
- Size 642KB
- SHA256 5a93b42b10467e262b89cd6ed4b95017d0800d563e07fe94fde773c4761a1632
- MD5 dcc90e2ba14a544296d4b1966f5f7d64
- SHA1 61bbd00c6f31c522e08d6714797ce950be5f7289
- SHA512 631110fd9d2e7b596862683456f3af69ac3ded561d1c3856598bc4bae3fe5365a215a167e87d48465507fbd7ee6290eb86d5093f3425c7f6326c5c298c0b237d
- SSDEEP 12288:2UzxtrGTpS5gg76mBzAYDxA5LfR9Ww/E6sI8iIr:b/GTs5gg76k/DxApfeYE6p8iIr
- TLSH
  T1C0E49E99B2A500F5D477D03ACA824617E7F2B4111731AFCF07A48A662F23ADA5E3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  OpenSSH-Win64/ssh.exe
- Size 1.2MB
- SHA256 62578d9bf1f2079968fb92352a535587e47c154b1556c31cb015a60109d0cf0b
- MD5 3981aadf77179aaa4a878affad9dbeff
- SHA1 7aae32e4cc958f3765c37f98344df60d426f46b3
- SHA512 5064f21ff0e8b3b0f9a26f660aff53e53f70baef54f02b95163d187c54066f97abee4eefbf430fa9f7c4c8161d4564571e908e63f62d1da8157518860be58880
- SSDEEP 24576:DJDZGXHrYnd2OxM74/M3qpDicypumwWdGNWTFd:ZZGXLIdKn3qJykVNWTz
- TLSH
  T1AC459E5566A200F8D4BBD034CA9A6267FBB1B02417347EDF4E989B612F23ED1133E709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Stops running service(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32