ee80bdc61f6f6374deac84d5de1f9ed78929bcd83e15bb6cfd698f45c6867f72

Sharing

Copy URL Twitter E-mail

General

Target
Burpsuite-Professional-main.zip
Size 4.0MB
Sample260824-vs7nqa1dka
SHA256 ee80bdc61f6f6374deac84d5de1f9ed78929bcd83e15bb6cfd698f45c6867f72
MD5 bcc4b8004321c34a5330f6b5f9bfe19d
SHA1 f6e243f919c642ce0bb332cfc85987940586c90e
SHA512 99d46abea105823e5da6901f102902da94f81adc6ae17dad4ea3ab40363920f38885fc66c717c0633e7c7dbef7494abe38c6f6b78c09972610db1e43589bd649
SSDEEP 49152:LvpeNkeCJYRmos5thF31nawI1rwRYDxkUIGhW/TgwHni90F9zffMZTZ/7Neoj0UZ:LvdnosHFawvCutQAlC94lIt7M8rOH0f
TLSH
T13216332E146B5408C2A9F9FC6A3F184277614D18B857C6A93FF5C79F4A84CE8E3B14A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Burpsuite-Professional-main/help.sh
- Size 2KB
- SHA256 0fbff6e7065cf3ac7a31c722184693e48eacfd6ab03b6e46da1aba96203d6579
- MD5 cf1dfec47b0699ba7a986816163ecf66
- SHA1 2cbe49d42f88712198c898006fa73df63e7a1e23
- SHA512 e147259212a3bed57f91fdaa9b38b7eb9fe0dab906ef0e319edb5350f256876f0533b4e602cb2adb240f8d111e88adee29f092d8d36238651b744176d1512218
- TLSH
  T17241FE6A3D0446F1117DC2B40027A625F716161FA6A15D3DB88FD2680F3EB9231EE8F7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Burpsuite-Professional-main/install.ps1
- Size 3KB
- SHA256 afa3987f49ead36c887e9c320c5e201a186eaf89ae5a9e81c7adf4b2990492fa
- MD5 d3a5d49252e34d1a02dca7e5d984cfc8
- SHA1 6baacc9c519fe2d483adcb778fd37f8928004060
- SHA512 b65a21c0a66277e1701c39817f398cdd2764507742a2af53bea945eca04896f585064f43574f4514b396f473ccba4c44dbbf0220197ee7807b666d98b6dcc1be
- TLSH
  T17671B63FA1A9D474271C8429B7285A30B723852B8D67983E067FC998CD52A72C2E50B7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  Burpsuite-Professional-main/install.sh
- Size 1KB
- SHA256 3e85703653aa032072d17d61b178acc1c2a3ad4e1d4bab788bfa2554377a336c
- MD5 a23354a268cf52b95a12272c4d1d1721
- SHA1 a6b858cc66469e7250e12f27b32d12f4c9624edd
- SHA512 509bf7e176f99853ee11704822f45b61a37550c52276df53880b8d1e91667d0099ab50027e501f607ad7e4524d88bfeca41f949ac6b9d6e27532fec34e0fbdd0
- TLSH
  T1592100FA9886C139277CC9D0E2606C317B370D25DDF39425A22FC6C09D66E4101D80BF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

credential_access defense_evasion discovery privilege_escalation stealer antivm execution persistence
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Write file to user bin folder
  persistence
- Writes file to system bin folder
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Burpsuite-Professional-main/install_macos.sh
- Size 2KB
- SHA256 8c8e0cd0dee5d4994dc555c0bfee7ce1fd4718ede626b2e6e3de048f40ad423d
- MD5 adc510eedc6adfcdf9762b22d7cb6008
- SHA1 cb174ce48276c4bc8dbb733df04983177b038e7d
- SHA512 1c162a86316f1718178fe98a13a530c8621542618c81f335e15860496e38387b628d3246afcd8f5b685e246c6a8a92f09190fe9bdc38b0d9584cf820a2f32d7d
- TLSH
  T16D41F5FE81CDC165933A405AB6B18A22B6330D365E93FC157ACFCBD08F5278146C1179
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Burpsuite-Professional-main/loader.jar
- Size 36KB
- SHA256 dcdf28acf360554a5a98d78f403c96ccea500be24b27d02b020e142820637c0a
- MD5 a3b1b3be59e6d3d374a2d3344213e6c7
- SHA1 3d0e27962c83c8db2955fa79c27256442c0bcb55
- SHA512 6cb93d2af6aa1c62bd8f94c0a7e192cc08ad092724753999c92e8569c9bd76bf8ad254d6eca757decaa7922f7a806143118b90d806de80f3c36eae5e8b8bbe64
- SSDEEP 768:yG6uWNygZJbmjwB4HC8tyPAR8N4x3kWDuWYkfLb:yGbWNfJbmjSwNY4x9DuQf/
- TLSH
  T116F2C02BBAD5C624E53EBAB202D64D97C767CC79870BA00726A4085DED17CC877414EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  Burpsuite-Professional-main/update.sh
- Size 1KB
- SHA256 a7874c8f60c5b5c2bcf1349d25e73086eefcc2d8c1ff9c6c076cc4755628a413
- MD5 9361c48cd6c645064928cc7ff1e3319a
- SHA1 6d4c9f57bb01d633f4dec604f2ff50fd8afee45e
- SHA512 e825d5aadba0ea3aea85a34014a4f89b1d97cf95991878b652cdad37c774e95bbd7742bab70b2d2d10291afe279d2cc04c553f3e6b0ec36c2fa7711d8a0f3528
- TLSH
  T1DF21DFFA9886C1781A7C89D5A2616D317B370925DEB39415A11FC2C19C65A4501D90BF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery privilege_escalation antivm credential_access execution stealer persistence
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
- Writes file to system bin folder
behavioral21 behavioral22 behavioral23 behavioral24