Corona[.]rar | Triage™

Corona.rar

SHA256 ec2088547e468662bf7fee713074ad762780b9737984b6b011f94cff0d07f8d2
MD5 127c9b39d474a60a48bb1fe974fb99dd
SHA1 9324d0c189a7ace09fe52ca63d04688d6a83a904
SHA512 f75ac51d9c179c60ed3dd5072e52b69aa22cd23b4dbeab67f64f1ce378920056c2dcdb88649831a112834556f1cf480e9704ea70a60f7ac263ab83df3e1d0c0a
SSDEEP 1536:JpwHJvDEnLMvYcELKpFO++8nOVEECEwH7MlmlCP:J6HZ3aeFXyuolmM
TLSH
T1464302A37BA7754884B184792849973C8C23031676C3EDE7C9E169AF47F75B24DAC0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/INSTALL.txt

SHA256 d2e4c995a555c56350d3bf7d50254ff08bba8b2c6379ad89b58785ca56f3301e
MD5 a6c42d94acfd44a600bca2c2849351e2
SHA1 6e6fb3580c5a2e2feba90015a03e4ee73807af25
SHA512 3b80fa39f21fa1cc06af7e7eb0bec58a40c794a837521b01dfece804103059779868b17a93d96d5a30f639d85afae504154a007061252386be211d897bf842e2
SSDEEP 48:3T4nhcZCfU00pfhW/p7OwNfwtBwlalatj+dvQ3YsckR:kcIfU0EfhmZgOlftt3bckR
TLSH
T199C1256E190F9174A37AE28101FA6953B24B571AEF45F71D30BA05ECE421B1F097B436
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/attack.c

SHA256 04d1864c4ffbed0075007a4100f76032bb7432c278b9eceedf52a00f3d52b34b
MD5 55e144e8b0821545d800bb1eac5c9460
SHA1 97fe7edac122ae3b5daddcbdb1798c4ddf39ef93
SHA512 f1c429b74d1b8c9416da96524e7e81970b152473c81bbbf6a77b88f6a26a9bfbf58fe9089c3b6f95fdd21bb5ec8cfb4bff604e246d953c3746d2ca079658de54
SSDEEP 96:uGN5qLG7xwkZ8aw7M7vDU6CC2s3i9CYk5klEKEaray2QGoHoCPYaXzQ:mQxwkmMPUlJeiF3EaOy2QGoHogY2Q
TLSH
T11DC18E601A775122652BCB6E4BDB241CA26DE01786D7DD81FC1CB1F86F004BC76F1A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/attack.h

SHA256 ecc7dee255623ae24aae27d1c5e8d657463ec6497dc1bfd734978c78f0226756
MD5 f789fc32b46ad8583976387d37c3176b
SHA1 2f75de1c6283df197b8edbae2d30840d54900803
SHA512 baae7e7ea94483029ddf3007f46dfadfdd2150063e87526847dd3713eb37b7fe78488fec776e5276de87c1694661d9974c85a0d9d5534de2c44043c11b572830
TLSH
T1D181FA716F7CD19240EFCA9465E66814A29DD062C18BADC6B40E977CEB002AC82F75CF
MD5 SHA1 SHA512 TLSH

Corona/bot/attack_method.c

SHA256 683b9fb9b7d3a557ef5fe78ff87bdcba699eb5c7ba10a6a8683508171d4278e8
MD5 f6e4d1abfd9546b5d1e785ee71437e1d
SHA1 90113fe5915edb0826067d36405b1b640396e21e
SHA512 c368ced26a4852f2cc7d27cb3b99d31a079ab7e0bcdff44a33552465d1a048f76fb49f296141a9c2e6ed6521baac3b835705c80eea0d53e616776397292a9516
SSDEEP 768:+s4s/mKnTwFItuUiB2u5mBUwUnLp2+IejkBvBLBtA44GiudFm3RVzK:RHbsYrisPU/L30F/jMege
TLSH
T18E73D954A2770811F1A7A8EE4BDBA409635571070AD3DD2A7D6DF6B02F8007CE2B1E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/checksum.c

SHA256 6bc127e052a8bf3859625236ec4bccb9d45d5f6e8d547829c7f8db58fb2340ad
MD5 ef957449eaf91388fc31496d5610c16e
SHA1 79c877c32f512c10e95e9b95a67acd7e0021ba4d
SHA512 8dbb9bf438f0e382ddc0595b3994cec436e088d6d1ddbd2143dd638d92be6468514d473d38cc1ba20e1e1fe512565cefd10472d820eec54aba50e922b4e310ec
TLSH
T10211896D4F2F47A6864660B703CED032C115A02F17C9E810B97CA8E45F036F8E29297A
MD5 SHA1 SHA512 TLSH

Corona/bot/checksum.h

SHA256 a94c73b00814388d8aa38386aa9f6c4d184f8d260ed5968dc4f1d94f7a85b08a
MD5 3b7ce958012a24c5fd24b229533993e9
SHA1 4829d141f75302f2b55e6e510c47865ab273833f
SHA512 0445583eb4e5dada157a45818c8ad0382400a2d7853eac6df99720ea58a5bc7af2f24ed20956dd61de852239f29f0644278db2b1e7dcd003d6b39f273c5a19ee
TLSH
T139C012B8F93D17A7906FC5F12367E135820CB6B4A7DA5632825774E4E00595C3067F85
MD5 SHA1 SHA512 TLSH

Corona/bot/includes.h

SHA256 672634802e4a483b09822155d76754514e1c94076412a8966ca22114cdd2945d
MD5 0c5a88473b71a2be64d11bbd93dc1881
SHA1 20776f64b8924b5769b4d9847ffbdd92b1b8e8ac
SHA512 9d524ead695220c77358015f963bbdaff0d2fd2ad65709c73f540a85b5ae7a2cca05e39338d25a7c251c1e879290968293042e848130d32c56d9f9d70b94e0c7
TLSH
T10211D4540E64774544B45D2930B670259083FD736EE9BEED7905BE3E8C3825134F56CD
MD5 SHA1 SHA512 TLSH

Corona/bot/killer.c

SHA256 5bb9fc6553746ec7a6191ab551d18012ba78b040e3ae6367e784dc61c2b0f58a
MD5 fe59e429c44647b3aff1602a8187e22b
SHA1 d574140a055357b1665e104d362682594d00fd4d
SHA512 566a75d39d6d7ce47361b9be361412953dd89ceb7276922628808ebdcf8a87720c3fe191caf242d24e849e01f5c8aec7208cd11539d0c59e73f24d3729189c31
SSDEEP 192:9OEStogxMdEiyVRLdNAfz8SBi1EljI3o7KIOgzbqeCXsMsrs7L8HNtuHmz4grZFx:97Ogz4sMsrs7auHnDOZLJ
TLSH
T194425438A9B3101123B38B2E4B9F5C1A52116913274A9B053F7DD7E0BF40A71DB79F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/killer.h

SHA256 f3130803b5f6ad6e15f35d8c1139da7f9372c374d07d3f24baedd4ce2c9f07e5
MD5 15b0700bbe37c19091ae5912cb965f5e
SHA1 422c42ee6b57efaa2eba80659613b229ab37a9c7
SHA512 f455bb13e2589bc86605b8401cf765458a02b441d07969ebd8276eb5c6a24c17e60952ad61a55e5c3ff552e44221ecebf7b266b33fea7ec2774ce5fec2c34113
TLSH
T183E07227B82E6402CFF6C7381143A7B9940834720E5C1488AC273DE86C232C448AA368
MD5 SHA1 SHA512 TLSH

Corona/bot/main.c

SHA256 1f834e78ee83d79046d3ffbb7352a06ecd232985066eb4a376c28e7922533264
MD5 5c227a765704872518eaadb7a8385c52
SHA1 6c15566f73834d0a86acef55a4f3e9caebdf5c3a
SHA512 6b49d0e4b1d7b0ee3bf83f1a9fe5c82f537986a42a6a59a1cc569691fa47835246b521cf60a40f665df748071092bdc0275ad5f87aac0b6aa16ee38c704352f7
SSDEEP 192:A9okqQyEfih0Ykg+hoy1y1saT0pKbz+o66lq/C+WCyrWxcnJkUYrwuvBIThlrwut:Aak/1z1y1HzCj+aid
TLSH
T1D332747449BB223063B7C93E8BEB4416415AE10713A1E5007E3ED2D08FA1265F7F5BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/protocol.h

SHA256 1046a57d92b1f0c0024f0baa954e5fbbd562c4eb46156e6d1c1aca89051c3aa0
MD5 650c9b7802974d40cafbaba343140a78
SHA1 879e8d2bb6930013b02bb9df998500af4f31b9f8
SHA512 7861e2ca999454031f94de10e18905a80232d1dfaed712d2849053e42c9a3596beecfb1669c25442fe898393872dbf621598236faf8a801fa6307e366950e0e3
TLSH
T156F0CD2B59B6916204E50E40366DB9259104E8732D8E21983DF5482D9DD3EB5F0F11EE
MD5 SHA1 SHA512 TLSH

Corona/bot/rand.c

SHA256 cd36c92451298faf1693563a551076f83a58782dad978d99605ae06e0c8a9ca8
MD5 e2c99688ff406d96e61216ab033706ce
SHA1 c50f8aef78030e9f3c3f871ab65eb046901d1089
SHA512 0ad959f4516724248bb61b81c56b5c1bb6fc2d097f14032ad11f77679154993a6b0640876545525a459d733057b0b3786d582972e46b5eb4124c21226c32a8ad
TLSH
T1E121AA28986B4925458788B297CBC0369194702F4BCADA30722FF2F5FF000EC56BB2D8
MD5 SHA1 SHA512 TLSH

Corona/bot/rand.h

SHA256 2308a6bbbefb2019b4f852506dd81cf31d3a0c9ea7564be21fc1f4a7642e4904
MD5 429a343bb7393f64f93abdc2b0396c8d
SHA1 c879a4858731c70fd451fc63fa45b39429bf4063
SHA512 be04e40fcecd3e9cf827d10d14b87dd64d48abf5c400e97fe98fa95f1035fb3a8e1d07e42dd952c785c8ad6f526e82192c25ac1fb4f92bb4c3b56cc5d12c7b15
TLSH
T1CDC01247542D290B02AA823187DB24EA814074579AD39C50B843F6AC9132094C070568
MD5 SHA1 SHA512 TLSH

Corona/bot/resolv.c

SHA256 e424f831fe77f2283d92782f8409e28c674086b92c3e199ff2938371b6b49819
MD5 d3c29c6e37687222e28908ec6b0719d2
SHA1 f6e067cb2f2c37d421019858e0708ad42c02dbc3
SHA512 7d3e91fa8779dd1f84c59e68967da2714e2019338c8379b2ab199f3de1feba7c0c357f2c7b725a4e4f9939d2c3ed250fac5c890fdd12566f491dbb051cd7bb48
SSDEEP 96:uGsKiyi1TAx/Iatk2hWo1uX3H7VEgSLKwDvg1AtCxRXBfzQmCCXv7Kvs:2KiyiRAx/ITDH+1FDvZgtRCC/As
TLSH
T173D122585C7F115463B7B93EAB8B14055228E1036349C5007A6EE3F46F823B4FAB5F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/resolv.h

SHA256 43a7d79e8cf3c02ca6222ef5354661a960cc79ea0dc7b7f7032b28bc3cb04856
MD5 1d0db4535c073d0061a48b905d7ae0ce
SHA1 334d2a673ec88507bca88e1794927ecc8048fe39
SHA512 ff0612f8fd74019a24b0cb994521aaba7e0cd0a815ab29097d229d934f45017692ff4835d8fecf853324339c07b44574224d9a87a26dd6f5784f0dd4d3649936
TLSH
T1A2D01728A038935A82F5FF59A6D5A85B422CB011648998409A16B36869033E0AA36D3C
MD5 SHA1 SHA512 TLSH

Corona/bot/scanner.c

SHA256 9a5128fd15cf4cfcdde22eb570cfb5ddb3e0ba50fbdd61c07be43f2503013ba8
MD5 1ad1f81866fb2538e8a0ff76aa29aa28
SHA1 e3059aa610a4f7f6547d3eb7852f13ea4e084a2a
SHA512 e8ed5eb16c8b3204c9eb447d779f9b46a2b4d7ca40d2d84d6b9c36377d946052dace47fac0ac2c1724f4383b53b6b6a0950095dd8dffd948a13944dc66763528
SSDEEP 192:m6ynSqokGij0mzV3rEcqAcGyQQmgbm9ia1SqNS/H+Hb7NPcqLjRCq9mxwqlC6VyC:leVjy5mBpnNjTrq3xwmXzIDpvwHz
TLSH
T19E03FA748873205294E7DC3B1FBFD404822271139690EC557E6DD3901F94AB1FABABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/scanner.h

SHA256 e7e8d1cf4972bd395b0c29bb2661e6a6e5638295079650384387c080190caa82
MD5 8556607459e3ca848344aa5e793c4fc3
SHA1 bb0d527b72b99809c1653ff1783d7ff6d9f6d538
SHA512 3f650a07f7f67d1187c21827718d9ba7902c491992fd64aa056f42da243b7cf61486bacf50fe9a48814fc78e4add49669f78a2b91ffad7d4bcb3638c04e97fbd
TLSH
T16F415B2C78A6627189DB0B2507179D0801DCF337ED59A06E7A2E7A24CF3535521FD2C7
MD5 SHA1 SHA512 TLSH

Corona/bot/table.c

SHA256 786913cc0e48dc6c8da192cf2edf661fb2f565d7bf54c71963da804dab8053ab
MD5 30c205644a3ead07db86163cadf97607
SHA1 ae29be0a9b8b19401c9449c3aadcb2af8ed4bda5
SHA512 ca75a08d49660691de21ef9bedf879f643c69bbccb5ca1458a1e257141217f0d9dfd0098cbc763b3e49bd982088f19efa0e86eec37a014128800c351a9ed93ee
SSDEEP 192:e/wMx8Feb5haNe6VsHLoeSTR+UcxRD04dcOfsOotcEDrVk263F:aIUf7bTmEX
TLSH
T10A5282C4935DD807658D5D03AF41DDEB6132B2AB06BCF243A21CFBC52AA36D581EE84D
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/table.h

SHA256 9a467d38c49be07a2684297f08d5ca6fea56bbf36c3e13895eee9c94dee26f52
MD5 316e0dc1baea7224ef3b49de8a386109
SHA1 76a4568b2afb0389ee7f839fba82829d7aeccf53
SHA512 2e50f68810f01fac3a6c8bc4716fd1e4f2c87900d1617ed7a9b28dc484e3b897bd94c2cd2e65ad4780468e6de7b22a0507803d8377e379634ea70e7ec1c1534d
TLSH
T10F310D532CA06010B876D5010B6E80267914EC3BB16568F9367E6A5C2FAD24017FADFE
MD5 SHA1 SHA512 TLSH

Corona/bot/util.c

SHA256 5b8d54793994d3af4a00f67c8eba9e4df903806baf48a054548b719cc6d8c520
MD5 12c15973131e847888ab2507425ed582
SHA1 90cc0904321ad187389109a96888a3a0803a194b
SHA512 f4f208c5d808110d084c45ecfa3eac36ff18529ce37d030052e4134d3ff9acd588148d1b8e48fd1b1228deaf1c63d8ce98a589f94f211b744f713fce6c3991c0
SSDEEP 96:u1Fsw72wiwdQOrbx6r2wWRYPYhouxKoWXTjYamebnKKrjMe3K2ufC+F7nYc+zHrI:qD72wiwdQaN6KTbhTxKoWXTcamebnKK2
TLSH
T1F9B1218449BB00A16BA7C73E479FC126512DA52713CDAD20BD2ED2F45F810F4D5FAE94
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/bot/util.h

SHA256 5685dd3796f93cb5d6b0308d8793eb001b6b219004a7d0ae41b06aae9dfaf163
MD5 f250be1e8d0201b2ac81f9dc61db3d9b
SHA1 3ad663490d47189224fd73333ced7c7201946d59
SHA512 9d5c6053e1cb45e39ff1aa748bb6c0a07053c21002a71e8d6dc25ca0bcb96eb4a352e54abf090a9744d395c839e5a8f4669e3f37f3f9b39923cc22c3ac61758c
TLSH
T167F03705A8142A43DFB0CBBA6A7BE15B8615EB6573C8F181C4B26E3B88134F4D57DF14
MD5 SHA1 SHA512 TLSH

Corona/build.sh

SHA256 c70d9a95153e1a68636d27060cf080ad12d0b8e6bfa1c1501053901a0325a4c2
MD5 c0f4ff3f67e325a82dd2d28e17568957
SHA1 fe0678155af14dfc8578c2297fd528474d37603e
SHA512 8f08284a348b182f99c738099f6f93b627228e39ec54a8500abb3a42e6de579b04cbac71f30b127c8b18ac6c55adc1f84a8b6c0fa44dbecaf2b5c2c09ae22fcd
SSDEEP 96:W2vwpKXg5YyHv1ZL+8H14TVkfyu5ejQDQyQXVQaiQBQYRQsQXXQBQEgMQSZL+8Ha:l4mfUlHSOyeLObNYswhWtQ
TLSH
T1CC023A29B086786F54875837B133321BB175E0B69B30516EF07342458FEAAE520979FF
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/build_payload.py

SHA256 01669a12124560f54d0de1ed472054a4720e9c9326e8b91138cf0d9d7abcd522
MD5 3ca6d5407c3d0fb0425554b7d0b0a09b
SHA1 a426dccb822457a378d3d9d9a0c6cbcaf975e9e4
SHA512 847b5f68575f8004955b604ef725768588cdbe7e248063a0bf07d9b9796ac7c0a847319170f079f6edcae3e435937c8fcadb9f111ca8ce5a4d4b1c1c093e16f1
TLSH
T191812FF66C6944743CE2AA31336A0D08396B205B0E9A3944757EB0F807DDF4D93482A3
MD5 SHA1 SHA512 TLSH

Corona/cnc/admin.go

SHA256 c1b4670d48e45d7f30e106923b9fb283cf9f22dcdf019df4547c4e461d072b2e
MD5 894a2de8c30130a7292aebe36775a8eb
SHA1 9f6b5ef1aeffb116112c12d82e46fef7e0ed1912
SHA512 3c912216ffff9103c385281e18249875a4ea915544d932dcbd0ac4976847de6165c9ed8416c1a82e3c9ac0c9d6bae12936fe11757617d92d55db23560466e113
SSDEEP 192:0oDHHNMLG5ZoIyaHHNMplHHtsZQtnfUn0nA4yPCVPtWw79RABCysWUv7LoyxQn:bHHNMKrHHNM3HHtsGTi
TLSH
T11132CB18637D33625603246C4DB38D003BE0B927691A8DE47C3CB6E6FF61279EC78A65
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/cnc/attack.go

SHA256 cc3d3215f8c78f6195a5d60c5ad1b1ca267d8e48e67e52d7de64603d74ad15f8
MD5 fc3e39a848c9c55811f7793f077cefc9
SHA1 592427c837d89b14f856ebc37059543f8e642c1f
SHA512 6d6142ed4ad23136814b594e2bd414ba6eae894f161d5d1dafad415425c1aa1894bca238d85e76f5b38524b2415cc70829720df6aa0d25b7f548c69389c893ca
SSDEEP 192:e8h4/zSaNK2R6NwNYNqNGNQNpzVzKGwDwliQxNYFJUZuSEl7gPOvwZEMcSC0hDbj:HZ8AoFVGK
TLSH
T1B63220589BB05A1E1B4FE01844D65C03B3B8D19B5C2EFC8ABA4D558D6F2C2EDC5B07AC
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/cnc/bot.go

SHA256 362454aecac8cf92268ab43271b2a2c3089b7fe090e6990c00e18261b401f583
MD5 b0933cc784e76409c43954f8ba4879e7
SHA1 3ddeb198f9bb9e86a32f7e16b2a8b61aeacf7c17
SHA512 035e30a4caf58eaee47a41ecae6c135f10692546afac2503db5e196a6e55ebf3696d5a4469b475f17c166269ed3c692278bc0b1671f94429ff367d6de85d7978
TLSH
T1BE017B0E4AFCC8B30943A9098942E40933586907640E9E94B81D72EA4F110ECCBBC574
MD5 SHA1 SHA512 TLSH

Corona/cnc/clientList.go

SHA256 9bcbd7016eefc1f667e9fa4d76246067a9d45335400bf8a7b99a5e04bdd23bfe
MD5 98996d04bc9b8fd39b5f55cad51221bf
SHA1 69be0d7a9f878d3b35a89b869d294421a4a2a988
SHA512 eb5b01172ac5a03d965b8f5e6a85de1c31f1735924f14d33de57cd9bad2dcbbb3c85368e890e41c2ab17be8052ca177af962e89c1f962cd713fb81457fc76b33
TLSH
T1C0611006ABFC66AB05878615595FA212271CD017085BEC2CBCDCE2EC4F061A093BEEB0
MD5 SHA1 SHA512 TLSH

Corona/cnc/database.go

SHA256 9b8703d8527d0db7dcdc004728aa5ed3736431cd0046c1cc8bad2578a91131fd
MD5 4708062a3d398bece6c8797e6d623b83
SHA1 267394b490cc30941302c03edb30d008f9a8e6e4
SHA512 a13d33e1f0fac7a959b2e4265d2dff537a3462492842918639b296856b4a2f0d26e1643d701a6f3fa75c2c2661f0e3cc5ea1b5e706fcd43141de48867c84c8b3
SSDEEP 96:6xh1KQ2+voQ5qd28lMekM3TrJeRbPJV4oJOWdGNCyiQw18lM1IB2wqrp+e13V8lS:iDKMoQIAukM3QR6lNCyiQi/IB2wql3Vd
TLSH
T183A152926AE149651B8BA43D88C6D800B7B5F40320575C50FCAEA7E43F1C7309B7A78F
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/cnc/main.go

SHA256 cdba23fb9d1ec3d882ea8dfb46abdfca9c4307927fedd9b9dcf9900091a78972
MD5 62e3477d6d79d0668fae6e9a923a2cea
SHA1 9592449fec9eaf1797640088a18a40072fe9f819
SHA512 8e03c577c7f16cd7eaa4d499d58405545512659ab30824e6e73ca41b95e2457b3a23e18824b76e94e8e1b56fbbbe0c35aaf2da93140170b62cd395242c4b2d12
TLSH
T19241A9488A4606350673EF68C493E004FB67B42725714084FD1DF2E62F309A8EAB6ED8
MD5 SHA1 SHA512 TLSH

Corona/dlr/main.c

SHA256 28ade86be9ed4433dd62b8541e4872af7253e960d406d8464c58aad5c62da593
MD5 f1f7c58e154bdf14c804d9a1e47c7087
SHA1 4e852b41176f3bd10f5078d8f9a2a523179a79a0
SHA512 999c3ed45785780b265f26d309bce2b92f6300a5da05ad652822049c110527093d89b1963d1cefe7a21599ce889aa800a2086a4a34775569a12751beb9ff6245
SSDEEP 96:X1Hx0MTfSJ1cDp5ecEW4cyK9X4EXlZG9cYRaB24ud7Dc/YSYeu3ci9:FHx0MTfSJ126PK9X4IZG9cNQHc/23ci9
TLSH
T11EB145A48CA688B4B777D32A4B4A8809730FE64353D8B410791EAABC5F52001E3FE75D
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/loader/src/binary.c

SHA256 00399eda10c0c2acb5a7cbae087b0c0c1c6b25e3b10965287f96963484ec37f4
MD5 ba0d42193a455ccd5cc78be800cc4c95
SHA1 77059886d51c1904680bb23431f43c3450ecaedd
SHA512 3ce65e06a45620f43a4a4759b35abf8d994a27e17dc8323cf90dd490890f714bbe809803c3a5c5a8c2f4e90b62ede889634da6de765be8bed401ee0443b79485
TLSH
T1FB4111A0955BA18764B7497FCBB3CC15221DFC7736D988007F4DA1B58F01CE059F168A
MD5 SHA1 SHA512 TLSH

Corona/loader/src/connection.c

SHA256 aae4d89794dee7cfcdb06cc80c578759f0da1e1723b806854d54b8d07147de71
MD5 5c409db769d8941f5de9abcbcd1f7c55
SHA1 6fd7a13b6fff314c02a1774d5d0e8e6cdd00883d
SHA512 f68379b63b46b54367d612540942fefb43309cba38daacd4b642a314d08a0c4edafc2fa10cd5813048c203c2fda1de796a70d26c7d4ab11e2bcc0a1ba4c1d431
SSDEEP 192:LSocwKN7oP62hXyn7RdnzkpnouMnE8mTg0gnsB/dQFBM/Jsa9yiaXKCiIRrOO3W2:+ocZihed2AFK0OeCmF/
TLSH
T1EA527A616862156317F39C6F4BA79124D125741B43C4A8887E2DC2A05FE07E2FEB3B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/loader/src/headers/binary.h

SHA256 46c6f4339c9cd99c20e0c9163e0d2d1ee0e62df19c38f27c1192107084b8010d
MD5 321d2a7e58a0d9c1d8e5d03f97ed6149
SHA1 745aa55751bf9805a9f1e4d247f6861deede2fcd
SHA512 13236189a3f8cdf057482e3c9d51d6af2865af12c701f35af3163abb910b680a2dbfe6d39272afcb8cf526c6876e79d144c694c91e22fc7b7a669c03a3e7cea5
TLSH
T126E08009657DE1D7E4B14F70162FDD950118BD7B325F5549181178FC8D02DD361F2AD8
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/config.h

SHA256 fa432eebffe9aa06525f65924f01398bcbc841c571621be68a8c857bca811804
MD5 0afebe6bee36e0a214ac2cbca3c14193
SHA1 c6a81db4f8a00d0bb826228689d7b5f8df43ab09
SHA512 4c790d6267667f26d5bab8925b2dc4f50c93bcc6c7dbfea7cda2fe34afd97d29deaca53e95a894c54f925cc53099568d9ea278c852ba7bc222c0a8a6019fea01
TLSH
T16AB0924008C20A440F60A08B6A4970FB100AC83B0400DACC660F982C1C1F2345EE51ED
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/connection.h

SHA256 ebf9646b8e78fb4d431dc758a36ad0371c78f4902b31b17092d88b0f6df094a5
MD5 b8645a55dd7e04c3f714ce471570dea5
SHA1 9ca9964347eff53f5d51d1c97de2f6b1208a3def
SHA512 b13686389d80c651f45c7b8a74d70a1e02b0ffbaf39eeee6c29a1c499aadf6cac04e0efa655ab37d978cfadfd96816ff7a1f996b6cb0587351cb187af4807c2d
TLSH
T15951AE05B839A5916AEB0E14139F9A101525F22B1349A5147A2ED3388F373D5BBA37CF
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/includes.h

SHA256 e464669c9684250ecebb51a8357620530143da4681c022fe2469010b91f32a75
MD5 2118271d874eda1980be12e76f6a8b32
SHA1 3e55f4746882667a1c7338bd0c354004ee5f3f2c
SHA512 e9fc7550a950e35513981dbf03bdc524413d1d23931bf79bbd3fa3218eed3da3312000f494e7372da72eb3edd5a9253467bb6f696c6f61a05ca387f80d4edc72
TLSH
T14D01D1E80ED826A884B8A261246DB879D087EDF7195491DC3C396CFC2D0A9D562F7DCC
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/server.h

SHA256 9789c18607f9e54307c4b49ec819ab91143286ba1fa1c2df7575119b97361d35
MD5 8b59749d64c927cc04d2394ef6cd3554
SHA1 6952aadadf3cf9511be1ad33a3868ea103958299
SHA512 a44c747cdb04ec87161a19478f03cca2f6649de3557d68cca36e6e0b4126de1cdf07754c48836eb33ec79d7a2c80433d8d080271db99cc29aa060a86f982b2c7
TLSH
T10221AB09A93DC0E794E84F1147A79DB8532A303601C7E090FFB2E7B59E821DCA275B28
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/telnet_info.h

SHA256 d0472c38b5d82e5b5b92b803e7ec1026f09dcd2424b8f4f8473b3738b820ae69
MD5 f7656c30fa72aa9f3719cc71c23ee3e7
SHA1 954a72e21de7e09d3138f3fa4ef532fa2770fd00
SHA512 518430abc23b8cd235c5c439c7a4bb97c457e9adae33e2d046d8fdedd0e69703f5ba7d22eb5769f4e1cd93c8853433b04382e250ee419fd33909a747a5e9d04c
TLSH
T1C3F02018133EA1D3E4DC8F3226036ED847C4A027150DDCEC35ACA3792F07AC8E0E5820
MD5 SHA1 SHA512 TLSH

Corona/loader/src/headers/util.h

SHA256 9688555326b9d413180ddb7bd6226fecb2fcb9e731a2ec235580516ffe768f47
MD5 65a883b911f73875783df5ca2179d2e6
SHA1 f2e6da04bb3825e9387daea7f047d9a2d6594c0b
SHA512 4b3687f9740b6f4a0fa2e1ac2c05fdedcd8b5e608161291753ddabd1066d4f9927be9984367c383003fcabcba90ed6bce380bb328c5518f05fa9ea6d108e80e3
TLSH
T1AD31DB150DF66063F6B58634213C64191104CC378D89E8CE38362F6E5E7E3A84AF92CF
MD5 SHA1 SHA512 TLSH

Corona/loader/src/main.c

SHA256 c96064efaa2f5958d1d26a2d7d6fffe4f645c9fd1251cd4aa104b923cd1fd9b5
MD5 cdeb475c47716cd90444ece01d60f04c
SHA1 6864df72571f5c187a3f470220b70319f487f3c6
SHA512 0a35eb734f58e26c6a36b7b6071a1fc814ecc7daa086fd1dfd2dcfe1cf5ceab46b8334db021cc4e448502f0702763d1907e17948210542d0e85750d7ac5aa1da
TLSH
T1E3411014D47F91D3927798B28BC3A4315219601313A9C869BE6DA4C4EF800BCFEEF799
MD5 SHA1 SHA512 TLSH

Corona/loader/src/server.c

SHA256 47aeb3c2d51c0677430f662a5abe8d50ce5eb62ee7841eedc8a84fa2d5fa4ab9
MD5 6659f682744b3ef45a822fac4f108a18
SHA1 d7ef4dfe3b930c8ee03e9410739fb3cfc5166d6d
SHA512 dc1b0cd84c3edb368357de027a63d1c01c75f2c2b0f373f0339067055aa0ee8e5949dbc04e3abf7b420d918b55e873b004f2c73e99ee2fae7b7fc21b59062fdb
SSDEEP 384:seYqUKQd+sAKlZzpXHypuqpzKyIjpBXbFo0+vcJdRIdT:bU/hZNXHqFG9BXZo0+vc9q
TLSH
T188C251848DB3105365E3AC3B8B77A92CA216F1972395EC447E0DC6949F422D5FDA338B
MD5 SHA1 SHA512 SSDEEP TLSH

Corona/loader/src/telnet_info.c

SHA256 bf9521025fb1d2703c96e9f6e1c221b8ec01f853a6c5e9495e33e56bf3d8f5bb
MD5 a993b32c72d626aa3009981b6b9f0181
SHA1 63d679ddbbe2e1b34ad2f9d6c6a01fe402f2b9b2
SHA512 78fef2c363d5ea4c5f362594173b220c30921ddded9379b55c70c2465542b16406b28b135bfac377a4c8710699679386de2d787215a861516f49506cc33e1f5f
TLSH
T1B2317840856B725392D24A75874B8CA492F81047234ECCB8B8BED3F89F50CFCE5F56A1
MD5 SHA1 SHA512 TLSH

Corona/loader/src/util.c

SHA256 278b9883661a1535dda3c400ef18f060361f7231434bd3365f6bd8c48fba9c53
MD5 4ed3221722a2061fc606b500e15953c2
SHA1 36ca01d2e9f7b40206af6a92e604d1f1e95e4ba0
SHA512 b695e9902d8f6bac5b09b46cd3041de64de72ba65c1b07be9025e0787505ee369a5f3092c05d9739a58bc22ce8f9dd7ad4aafaf5b2ae456bced5954a1a9c74bf
TLSH
T1E55140A8C8BA80A56767C07BC7D7C404215FA80703CE8804BD1EE2E0CFE2068D5F57E9
MD5 SHA1 SHA512 TLSH

Corona/scanListen.go

SHA256 257b790146aa5aa996e1d3c98d1243ea0ff4622fcf6c45075a8fe15c4287217b
MD5 5195bf2dc96f591437720c100960c868
SHA1 00e799ab62c257511bab2ee631fc82f51fee33bc
SHA512 a8c1db143582b510de9fff5d3c5a06204d98ebbd95142e8d18dedbc3567485d1f704315ead785fe1b5fc3a4d269a6b5fd895ac526cb710a46d5744febb074a16
TLSH
T1D241C0A154AC26508607B12D9959D00A73D8E887247C2D00BF1CF2F16F98AF4DEF9BE9
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

Corona.rar

Corona/INSTALL.txt

Corona/bot/attack.c

Corona/bot/attack.h

Corona/bot/attack_method.c

Corona/bot/checksum.c

Corona/bot/checksum.h

Corona/bot/includes.h

Corona/bot/killer.c

Corona/bot/killer.h

Corona/bot/main.c

Corona/bot/protocol.h

Corona/bot/rand.c

Corona/bot/rand.h

Corona/bot/resolv.c

Corona/bot/resolv.h

Corona/bot/scanner.c

Corona/bot/scanner.h

Corona/bot/table.c

Corona/bot/table.h

Corona/bot/util.c

Corona/bot/util.h

Corona/build.sh

Corona/build_payload.py

Corona/cnc/admin.go

Corona/cnc/attack.go

Corona/cnc/bot.go

Corona/cnc/clientList.go

Corona/cnc/database.go

Corona/cnc/main.go

Corona/dlr/main.c

Corona/loader/src/binary.c

Corona/loader/src/connection.c

Corona/loader/src/headers/binary.h

Corona/loader/src/headers/config.h

Corona/loader/src/headers/connection.h

Corona/loader/src/headers/includes.h

Corona/loader/src/headers/server.h

Corona/loader/src/headers/telnet_info.h

Corona/loader/src/headers/util.h

Corona/loader/src/main.c

Corona/loader/src/server.c

Corona/loader/src/telnet_info.c

Corona/loader/src/util.c

Corona/scanListen.go