375f8f0eebfe806c871045e860e120f8496fc135b96e988d04562f732a0601ef

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_375f8f0eebfe806c871045e860e120f8496fc135b96e988d04562f732a0601ef.bin
Size 3.4MB
Sample261001-w3hm1syshx
SHA256 375f8f0eebfe806c871045e860e120f8496fc135b96e988d04562f732a0601ef
MD5 c4df5782be92ff67e35c4c9b4b5fa2d5
SHA1 064eb136d24948971a7ac1f14824ea84dbc8ab7a
SHA512 93e6c6a3010b79c0f708619288f4874ae756aee0f02450a9e626fc7778acfffd5b77cf28292bfd6a6cd9b75aa708c540561b935c9009e3c2112b01c496ef1d81
SSDEEP 98304:XaGq5LIgOSGtZpnEQ79XIlKZNJ5UMZe1FW:XuPhontByKLJ5UpFW
TLSH
T1DAF5331E94EBE542C15B1B378D1893FBA3BC16BBDF0F615267122EA09D0F7532C94A48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Targets

- Target
  lib2/WD/armv7/libapi.so
- Size 385KB
- SHA256 b52e8fbab85bfa444c92db6885b8aab8becc591b9b64c86ce9a7a0498b7ac94a
- MD5 2b385f27f654c5df432c312dc8574229
- SHA1 b2de07474cd7ddbb3ef4ba478c0469ec02337fea
- SHA512 b068beafd9c07283652d7448b17520985fb97db3029be4a5282640a6b2115e4ab948e52d4d378c039f3c76c2839508d8b006d4b4885eeae5f89e154ee7a1b398
- SSDEEP 12288:0z0ufsZelG2vDi7Vn5gbl0Bp3xAoTihDNm:E/fsZelGqlCPTa
- TLSH
  T10984CF86F5415F43E4FB853838B70D0AC680A85DEF31834B651C427A7AE63FC6EA4B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  lib2/WD/libapi.so
- Size 393KB
- SHA256 648c47d120e896a11e80f63ebe3229fa52e0221deadb587aa4b66bf7c9b06f82
- MD5 ed9d143b93d84032afdb212cf4cd2dd9
- SHA1 ecbc8ad6c01f06361a1611e7e42cb3bc430f3802
- SHA512 cefba186e93427ce82c45aa64ee978cc4446d155a9133416d87cd830a71c2180cd1d7e6c634ebf69069ac9439713cc59a76cc8b635936654a192d33819feae54
- SSDEEP 6144:nRWXBHlYMZ8GDO4G33U18Blo2jUWFtuEOhdwchqTBPPDbpFkvYE:IFlYMZBDOH3zUWFyZsTRPDP
- TLSH
  T1E084BF0AE9925F93D8FA863534A34E19C1612459FF308B0B595EFEB572CB2FC49853C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  lib2/WD/libcomrepository.so
- Size 37KB
- SHA256 98119250c0856eb841d2f612b01743b4f773199a20b603a22990cc3a58bdf4bc
- MD5 eef91bae63a1dd5331f43ca197d3e29d
- SHA1 3d6d9db5fc37d53c255942ee835ccd15a31d9b88
- SHA512 a9ef7393cb7d23f828707ab769b2e4c5985b9052900dacb339072621c5c6a71b882e484e401f503fe292039b44f7f31bade64e24e8afcc496a71e4f1ce581780
- SSDEEP 768:EYPC4N3/x2xyjBadtcjpAoEw+vWFb9bo5qGq0dtxfEt+:xbc/coLvK9KqGq0dnfEt+
- TLSH
  T12C036D12F58DDB17C0D22E7A31971F22A1EB8D81FE3A079D262C48A571EB1DD5399F80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  lib2/WD/liblauncher.so
- Size 15KB
- SHA256 7275dd8a9b6d34d8144ef62319a290db797b89b9d5e15132c0b083b847f42cdb
- MD5 875b4dd817a2394385786bae552bbadc
- SHA1 94af4bbfcc847c085a5e68e9e6c7d7b5151d28d1
- SHA512 080695d8b32821d15269ec4c9d23fcb8db07ddb7a4dd1e84e481155d19141de363eabc288f8304bf7f93b21d4c8acc7978a599f66595fde2041c477c2209c66a
- SSDEEP 192:xHSNdqCLIgY4n7x8elWlPZE2fyOKaw2RiX5KtdugSbTbLb7ou:xyK2Z7xPlWZEeyOLRiCAlbvLb7ou
- TLSH
  T1B162D74B68ABAA93D5E9F63C16A3DB11915CE4E9C4133F07DADF5404B143ABC8384F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  lib2/WD/liblua.so
- Size 105KB
- SHA256 89a10ee458088472c3157af63f9b4ba568b1636a29e052951159dab9e07f7962
- MD5 dc281bbfdf91b32f94813757e0d15335
- SHA1 8ffa261a6e82d2afa8664e8d12b3aeefbb95c59d
- SHA512 b38412f4ce193a6612b7552cac69b5d459423ec173e82c990928bdd2475ecaa58a84afd0bd0791f19b57a0ce1d77e98cb510baf34fb8dcd36dcc6a12214cf4f9
- SSDEEP 1536:AKDpiFCfgd26Tot9eMxtYo37guoEIb8i2nReqS8Ux0pW9a6Ulb8R5yh:AKDpZG2dtoJTDtvSC3GA3yh
- TLSH
  T131B37C49B150A6C3C055727C32C28C384F7E4D9CF93C9B95AAAC368A7F4DAAC9F14B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  lib2/appmanager/libBsdiff.so
- Size 104KB
- SHA256 883fd8b465d0edc6686101796cfb472689a93bb7fc9218625bc2aac83ffe4c73
- MD5 c4ce7b37696e91c52a83ab682249d708
- SHA1 8f19360d69e81bafab468efb7cc5bf1499397cb3
- SHA512 9142d0b80b453851fdd98d9f7ad5ceee1d197988204157478fd1d50dc3860ac8932944e140d162acfa1689734313380afe44fda8f603fe23f01b02664c6bac79
- SSDEEP 1536:yC/PmtwKq5XB9GNE62loh2FFh5rCL2O+/K2Y1ZAAaTlXBpp8r:yCHmtwKqRB9GX+4GFLjX/kFGlXfmr
- TLSH
  T110A39E2AA9948753CAD990B13B33D95C3322C9D892FE1746704D53462FC633C9FA76E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  lib2/appmanager/libappmanager.so
- Size 18KB
- SHA256 cd370f01a412de3c45fb73014f4d821343a57cc502de6ab31cb56b5f05ea5da4
- MD5 7084b47cbda8568bf69b6cc0ae6f4352
- SHA1 77771049762583d8005304bda71dbf47e4d760a3
- SHA512 9ca6977fde456fe028e895d7aedbcc5888992f4d6dd37160728f9a734144227fba68f2f4ed9913bcf7394c60b8e9bbabd4a14d20fb159bf2e149a933adfcaa0b
- SSDEEP 384:f1CZa4BZ09iXXpSHGKEVnMN/Gcg/5GVluys:D9iJgG/TEVlo
- TLSH
  T1E7820A49F38AD313E4BD663A76A7068914178C2F79605609DBCD181E3BA736F4F80727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  lib2/auth/libauth.so
- Size 15KB
- SHA256 69c5dd23b3986c7e7f8da54405a3495bad773a9aeac40bc4aa67f9a7126d4272
- MD5 13399efcf9498b0a98d116492b481bbe
- SHA1 9fe239b9ded85cd8f895fea5296441cb8899a226
- SHA512 18b4430fd22ff8c125b176fd9f29c2dd16c529c8dbc7684973261d8e77371ad4fd7dc589509acdc8fa20f68d64e79f1351edbf89308a103984cdb3e30a1b59fb
- SSDEEP 192:fEsmNUxtX5qSwSZxY337kBX/NYD3e8al+BO3Eqc0Yfu:ENU7JqSwSUn7sAdalp010Yfu
- TLSH
  T16862A78FF7A6BB73D494E13C318307540211CC12B9B5679FDF1D6C2A2BA469A4E43B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  lib2/codecgif/libcodecgif.so
- Size 13KB
- SHA256 f942b09b8234ddd2ed9dfadb61aee38de772e650b483dee98f6e25a047523da0
- MD5 eece9c80171b0e061127b05d66e8cbcf
- SHA1 d915c5d70a87cc7d4c3829f7cf8809bf45da0dc7
- SHA512 fa1c304ef8d62c1c0a30c6b72993054846a664f2d8b094c5bf157b40dcdf907bea003a2cc4d329edbc73bbc05142db653ea9a062579c0ece87cdcf36212bec35
- SSDEEP 192:iLhBfJhnSZ02Eo5uGLVOLvdT6GnXHjMOrrorpkIPH27vxsBLnYuNDzpuf:qJh602EYVOLvdTLXjtup9WjMYujuf
- TLSH
  T1BE525B45F242AFB2C1DE0571789F1D485825E6A6EE3A0F4B3D6D7C51368D68F7384B08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  lib2/codecjpeg/libcodecjpeg.so
- Size 4KB
- SHA256 854c2aaead5f2bfb7544be94f7863b46ab9ef896c1a86c275021d62225f15779
- MD5 388b1c62849790fe48aaa8c34bb4fbb3
- SHA1 3434ee2b1224a4b9f30becae353760326f9a81e6
- SHA512 5c521f533f1c271b17cbac6e33af2337e58fd25548f398698369a30113f5ca6a2d0aead2261bf5323a939b34e7c410c963f129e380c3915287b0ad54a2c1ce79
- SSDEEP 48:OujN+rejmWhikQvghVT6hql5DbjCSHiP66IR1tfB6su4H1VyomOhQmi+BQGCZoFu:H8rsaqRTfB6M1RbvIuWGvir
- TLSH
  T1DEA1A445FBD37FB3C4EA227831A38BD4216890904E5D120A370C68663F61BBE47A6F49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  lib2/dresden/libdresden.so
- Size 577KB
- SHA256 8da807db3c925d6e38185d2e41d4ce4b3943f7f92339b7665b14561c65e87f24
- MD5 00331d73b46906106fe0874e71733849
- SHA1 b27a8767731b863dff13b85f2aa102d5c60251bb
- SHA512 1ee25c9294375f6a759c0d6fb001f8e47e370bf8b42b7aae53ec9679fb04ef7102978f351684399da3afbe09737453051938ad58fb7b5544fe9e9be114755f2f
- SSDEEP 12288:qhcI+Lo2kTcJ4Eg9w2bPAvXINXVnV3jIS5KN5P3:gc9o2kTlH4qxE5P
- TLSH
  T14DC48B86B986AF81D4DB1E39B1B7CAB284F11D5BEE308A35D25CD2503BCB9FC4756204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  lib2/httppipe/libhttppipe.so
- Size 119KB
- SHA256 290c08910b0ed916d29aad307ab6c46b50de3430be5577b87d94d43f6e72aaef
- MD5 8fc99901c4c35a149b63e3f3a9efe904
- SHA1 139f8f0448070081e2323ae253e53b908c8477ca
- SHA512 bdeb7fee2cd545c777126003d42f63078955c5acfd2afcad8b4a7e65c8c4c5e4400ca8b2719795fe54df20b3d03b14af1835010da4b6d81c4ae9341164cde845
- SSDEEP 1536:R7oOP34+sXPzsnJPAwLcuzZNeTF/Kbqnah/8pEKSqXm+HBj3mboX6v9zzK:KOP3K/4Aycam/Kbrh/fKSqX9BjCzK
- TLSH
  T140C35A0AFF869B83C4DA9BB4756747418BA1CD4EFE3447165A8C1C097DCE2ED4E8A306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  lib2/httppipe/libhttppipe_https.so
- Size 123KB
- SHA256 6829a481727cbcc94817f2ed6b864bef0e78e88a595a0aadbb815ed0711c9baa
- MD5 8cf1e559aa68bce18bdd3ef787215126
- SHA1 2becc009d33c34f892ea71f15b176e1a0122fa18
- SHA512 fcc33ecf7ebb9b24fc837fe0fa427aab6fe67fa09e13c77e67bb4b0234555d37a69ca84c48b39af5bc6be7e649d85789106d069abda0282eb321be2abe5fbac9
- SSDEEP 1536:WrMskBvtwuNt8kuG2pP7ROrhm9vgRBHd7XKcMRSLAZBgymnT45bPoR:W0NYpP7Rj9vgRNd7XkSLAZBLOG8R
- TLSH
  T117C35A49FF869783C4DA9B70712B46419BA29C4EFF304B1A9B8D1C096DCE3AC4F95706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  lib2/msgpush/libmsgpush.so
- Size 13KB
- SHA256 6adf056e40d893c431e9202292eb7e0aeab241f07b7b19994ac0432cb077b0a4
- MD5 f38d6f5d86eb0c57f6818b0bd10b6bbf
- SHA1 376dd90c624daab82db7847bd7888f41b4b39a99
- SHA512 effc4989ea2e1e6b53435c030eebcf2c72a79ec6c64b9905fce0629c523797dd7e56661b9c4e8d2b4a4ca224a1b90aa33f4c3dcdfe81c692fdc43443f1b7ed28
- SSDEEP 192:EyUeOzP//k3fieJBi5phUx09BDDLbkOO+d0HU0Ru:d/OzPn0a6EPDLbkOO+dFSu
- TLSH
  T1FA520A5BF7C1EB61C9D9CA34345703836943E522BB23631AEB58844E338128F9767B5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  lib2/sysplayer/libsysplayer.so
- Size 11KB
- SHA256 f993e9f2aadba976fd1b1cffc6ee1ced7f005eb6b2f384c3216228d594b4436c
- MD5 889a634f36c715306fb74bf8262839b7
- SHA1 611b79adb8800a2432abe2583680b39a89616810
- SHA512 6ead30c3ad19bfcb0cd4e148f9c9fa10924e77bbd629935df216dc0ce6131758f8729a5efd148924d6b178bae7bcffa0256abfd9878a416428ab91feb5ae29e0
- SSDEEP 192:vI2k7aekxvP5aeN6PNa1xj4pXuNzETRLGjqB9zwVG1F22m+DNRuK:g2g6vRaeXPiz6W22mgu
- TLSH
  T19C42EA12FF89DB75C5DB8138306B4323A145E83167274115BFC6A48D33AEA4F47E6B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  lib2/webbrowser/libwebbrowser.so
- Size 14KB
- SHA256 2071ce93ce327d312a1d1ae48fba30e55845804c58be5f3548faf03ccbcb9c23
- MD5 6e5639048a40332780ecceee17866173
- SHA1 a4b0ed77c15cc4361703e77852b80ba12799e048
- SHA512 258fec61dc20e366d24134357802b833ec77917524a0657239f1b0f95aa50405f7af78a3a7c8e3dcf39a993d0111c4f8576a21b1c68a11eca48c94bd9e17126f
- SSDEEP 384:VbKNsirLJruUOe29JDrVEutIrpp2oVriu:QNsi3huUjUJNGpp2l
- TLSH
  T1A6622B66FB85E6B3C8E9813578970B223120E565CE3E534BBF8E3C88374619E4BD2745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  com_wondertek_wrp/common/menu.lua
- Size 22KB
- SHA256 b126eec435bbefd647368dcdc920d93c771d6f708d0663c4e6d11380e12ec674
- MD5 4d0a8ba09fc321b687a624416f5eb349
- SHA1 cfe7b423a658bac41440d66dadd4958e74ed26ee
- SHA512 571acdfdd736ee8694844ddb6976de0fcf79e4cef2ec62e74900e77152c1fed34a61cff5485d7937fac2f92c97b31a919e70d2ee4ab359fc594fafef02d8d2c5
- SSDEEP 384:+4WOUZm/zq0Hnm/0qiYotcCBTsK/b5xdLkIoqNAw9DfwQstgw/S:+4VXNxYotPBTsK/b/dLkIoqNAw9TwQsu
- TLSH
  T114B2EE34AD49C8B28146CAB1B60F8417ED418217D31CDA58FAED81E67FC967D40FF29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  com_wondertek_wrp/common/menu_ios.lua
- Size 22KB
- SHA256 3c1e26213cb2bff37393e23099e600d993dc9a39ef500508832721d1ee170c26
- MD5 4a18e6754fd67c89c3aad21207a74697
- SHA1 c132b5eb57b3751f99c17cf3450847eb9bee4f4e
- SHA512 f82c3ca09f1bb5962e34c08b52692f4f1a9fbc2182b2dd0e7ece48b0d5b06c3156872259546eca8f00832918bd52afc615a203e2153bfc6dbc09121e22460124
- SSDEEP 384:+4WOiem/cqTHnm/0qiYotcCwTQK/b5xdL3szGVoqD9hP2gw/S:+4LiNxYotPwTQK/b/dL3szGVoqZhP2la
- TLSH
  T1DDA2EF34AD45C8A68246CAB1B60F8417ED418217D31CDA18FAFD81E67FC967D40FF29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  com_wondertek_wrp/common/util.lua
- Size 57KB
- SHA256 b3c58e93c34a62bc8b9475241687143ba9a28074375b80f6cb4c4d6f5bfb87e9
- MD5 00e1df83ac7b74f03fedf515e06310de
- SHA1 26549c364d5ccf3b667cd7e773c4780189f5778a
- SHA512 81affd82ca83b043a81c440704c7302c5506ffc8ccd398d2cd1c3e767aead60c9ac24f89e6a969c33064e9196c23e5c5331516e37ef5fb551bb40c9e497e7d7c
- SSDEEP 1536:/W3UomRu2BnTtQdSQVuEGhXtGhaGyap/NGn2XxutldpIqdBz+vhKTTyzrd2Zjq1U:e3Hmg2BnxQdSQVuEGhXtGhaGyap/e2XI
- TLSH
  T1924395212E07A5754383CAB4BD4AE506EA155923D40C9934BAED82F57FC033DC1FEBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22