2310fc27ebd45d1e6205552d14a24f83720e9b6cb204e5fc06d7e48537116fae

Sharing

Copy URL Twitter E-mail

General

Target
26501.1000_arm64_en-us_multi_bc94140e_convert (1).zip
Size 8KB
Sample261020-23tm6sys8q
SHA256 2310fc27ebd45d1e6205552d14a24f83720e9b6cb204e5fc06d7e48537116fae
MD5 f2e497dac5bf122d42550b27f14970ca
SHA1 b02c29ac0b5fbede038da73de606350af1077a88
SHA512 1c393368431fad871fc66c58a5b982df11a392b7820f47f7512fb783aecee68365b048b30d8bc35c972fd5b7a5eea73e6def304320a93c35c45a50bf8185cddc
SSDEEP 192:PJRIBvlKNduw/VZMrp6yAPALPZMEmQPRZ1tXfsd:PJRIBvQLueKp6yaAGEmQPRZ1tXfsd
TLSH
T119027FE0D478DE23E11B7AB8E73521483F3973814A6663CD1CBD584E64A92666B0250B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://uupdump.net/misc/aria2c.exe

Targets

- Target
  26501.1000_arm64_en-us_multi_bc94140e_convert (1).zip
- Size 8KB
- SHA256 2310fc27ebd45d1e6205552d14a24f83720e9b6cb204e5fc06d7e48537116fae
- MD5 f2e497dac5bf122d42550b27f14970ca
- SHA1 b02c29ac0b5fbede038da73de606350af1077a88
- SHA512 1c393368431fad871fc66c58a5b982df11a392b7820f47f7512fb783aecee68365b048b30d8bc35c972fd5b7a5eea73e6def304320a93c35c45a50bf8185cddc
- SSDEEP 192:PJRIBvlKNduw/VZMrp6yAPALPZMEmQPRZ1tXfsd:PJRIBvQLueKp6yaAGEmQPRZ1tXfsd
- TLSH
  T119027FE0D478DE23E11B7AB8E73521483F3973814A6663CD1CBD584E64A92666B0250B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence upx
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  ConvertConfig.ini
- Size 652B
- SHA256 d70a286b1c6d7b00bcf024ffd4136013d97f8434b1eefd048a3f944a17e8df8c
- MD5 5d525060c0da539b02ad6aa972ae2084
- SHA1 912f4e962cc4a0465f02965f6a0a271d20d07105
- SHA512 1a1ed0f825ea5bb991b71d17297c8b2a553cc63129725a5011f81a4453a9be1f2d126c237176d39349141dee0dd0f0e787e003307acd577845195b5d67900d5f
- TLSH
  T15FF04C851B0386FE04E7D1440EF511A161E6C0A39C72224835AC53EC6F6B2685AF9B89
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral2
- Target
  CustomAppsList.txt
- Size 3KB
- SHA256 1f2fbc910a0f016ead61d1feef41d1e7b75e234753572ae37c83d0dae955cc94
- MD5 fbf61cf1243b9d8ba4d7aae6925a2896
- SHA1 6f421f03f3bb6024009f3cba7c81abf64ebc440f
- SHA512 86d2f5d53014155c33406ca2788a0effbc367b58a3baa187668f0767f22d13ce235ce5d9b1154139a9e8de0b8a838273a82dbf67b882fcce60203476b18d8eae
- TLSH
  T1A971589085F9E8D3CE3A3883EDC78A51BDAA0BC79005DF1438E5861E68B37D6B309441
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3
- Target
  files/convert_config_linux
- Size 25B
- SHA256 dfd83df824c5e34b2e402fd176f714d62bb512be8cb2dd07cf530f5e51f23ae7
- MD5 0f802038b21e07556124eef30a64da20
- SHA1 22ba7d64d9197451d39092b9ef34d272ec3053e0
- SHA512 f3372cdebb134f056a6785e2a421bda6762333956443c647442a74a7cbc7a7db29bf6669b63ff206ec555d2882bab7f0df07ebdbaa78f59771b4c1458ff51ed5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral4
- Target
  files/convert_config_macos
- Size 25B
- SHA256 dfd83df824c5e34b2e402fd176f714d62bb512be8cb2dd07cf530f5e51f23ae7
- MD5 0f802038b21e07556124eef30a64da20
- SHA1 22ba7d64d9197451d39092b9ef34d272ec3053e0
- SHA512 f3372cdebb134f056a6785e2a421bda6762333956443c647442a74a7cbc7a7db29bf6669b63ff206ec555d2882bab7f0df07ebdbaa78f59771b4c1458ff51ed5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  files/converter_multi
- Size 429B
- SHA256 a4eae7918ed6ce3dd43ad47a39c9d5e0f06ad80c5f2f1ca52fe113d60827dcef
- MD5 52547b1827909a2dcd77083f4e31f841
- SHA1 7ed60136395209a2c07e23bd2b537ad1e8c8e891
- SHA512 318444275762df4efdaefccf60debef7e747c9fc98445fa0c141893fd203edf301251b1350619c78c0461d72c5abd4d9b73743e40c1c9d302ccbea3754a46f30
- TLSH
  T1C3E055A3813B0B0B22498C1E842C0A66BB858BD48FF292920A14CC859696CB258F7F04
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  files/converter_windows
- Size 301B
- SHA256 be1fcb13934fc4326cece3f667f9c44f9b04c055cf1800398031624e2ddcb1ef
- MD5 f31049d703231fb0bb2a2b7a28452020
- SHA1 841e8e0286e17e49d7f9d192dbe123eb7ff33774
- SHA512 3d78f0be3a7d740b20f18c1df592f34609fdbbe9366c221ff429b3abcc030b0385ffe789869c33966a844ecd1c82e18f634c2901726fbb6a3c080c09130228d0
- TLSH
  T112E0C2FB3922878931071D89B85A189F9B0FC5898AA49B46C0AEC07557158FA0BC2E54
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  files/get_aria2.ps1
- Size 1KB
- SHA256 4cb3b3a9149d7dedfb71796ded682a097dee2454dc6b40ff95e0b33d022db4a6
- MD5 55bd4dcbb931e1592c2e74f426522895
- SHA1 22357bdb378e04315de00aad801597b89b63f396
- SHA512 07b8e6ee8bc91cc566cd6449d313c5b95290c5f16f618dc2857ba6aacb2e97d22bc91eb288f18882e870fd71ae3aa42d62f4d4b525b18e75178b422546f6d02b
- TLSH
  T15431E02AA4B00624A50B16FD4D5FA244659B4137811E1FA9B1FCF1517F9603CCBED8F6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
behavioral8
- Target
  readme.unix.md
- Size 1014B
- SHA256 4a253552b658d0affc4e6dafa55f18fd693fee333cd5c8b64d1ff9b885cc22a3
- MD5 6ac8e0a3282c0b67561ad948de5f7c2c
- SHA1 a3b9e96b3ef31b87e89ec262cefca66ca6d36cd2
- SHA512 6b35fe9f50f5abea014d0415e3fea6bac67ad70e4b20d6503fff3c1058b185dc993f5bcdd8c04ceea398272e94c76a670311851680923679944c63b17cf9d748
- TLSH
  T18B11581E5FC7E3753CC30F90200E89669356EC2C91621B171D7B09F0611F3D541BB891
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  uup_download_linux.sh
- Size 2KB
- SHA256 46721fd124a7293b0ab72857748619808273a6c102ec1234b5b34ed8d35249b4
- MD5 7e3b4b9572f54154a8119cf5a4fbc511
- SHA1 ea98face512ac49a0555fe529eb32a680b40d3e8
- SHA512 d9b0cc3a54bd02060454624d3e7eeb7fbabe620a438103dfb16abbb3e5f73cf666f384a770f7eb197d4d2fcf735c09582ed82fe742168e3b22c398002d0178e1
- TLSH
  T1A351731BF02A696B306C02F9700B61EBA709965F1D18BA7400A3863670865E5F4FB773
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  uup_download_macos.sh
- Size 2KB
- SHA256 46721fd124a7293b0ab72857748619808273a6c102ec1234b5b34ed8d35249b4
- MD5 7e3b4b9572f54154a8119cf5a4fbc511
- SHA1 ea98face512ac49a0555fe529eb32a680b40d3e8
- SHA512 d9b0cc3a54bd02060454624d3e7eeb7fbabe620a438103dfb16abbb3e5f73cf666f384a770f7eb197d4d2fcf735c09582ed82fe742168e3b22c398002d0178e1
- TLSH
  T1A351731BF02A696B306C02F9700B61EBA709965F1D18BA7400A3863670865E5F4FB773
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  uup_download_windows.cmd
- Size 4KB
- SHA256 0410158c9d63cb7cad43dc87acf62530df0b5c3440eb442beb11b7c830de01e6
- MD5 71643b38ca9bf8ee544dbeb7f337d1b3
- SHA1 0e9e3c9b1bb47fb7c05b48f269fa5dcd4c116149
- SHA512 f52324382c735fd9c495e4339b4bb4f5932730055e35dd3be401159c32b2f1e1e204e35dad60636bcd11c7b770e0116e149984c4640f05db428437f4984afb9f
- SSDEEP 48:czUetyOMg2UuGyjrk7PLhPsFibSUGQ0vtDdge7f4HzFzEt8PxOhXgR/FYUk:0Ue+5xXm+Qot7btIxOOk
- TLSH
  T11B91B803242D807F32A44645A22B71A2D318A3EF1E19B65D307A933969527D1AEF71B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Badlisted process makes network request

Downloads MZ/PE file

Badlisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12