34fb3b5923f2d2eda6d24643103c7717358094c64683f186b339dedcf421b0f0 | Triage™

Login
Reports

Overview

overview

Static

static

EvilDuckS3...les.js

windows10-2004-x64

3

EvilDuckS3...les.js

windows11-ltsc_2024-x64

3

EvilDuckS3...lse.js

windows10-2004-x64

3

EvilDuckS3...lse.js

windows11-ltsc_2024-x64

3

EvilDuckS3...ffs.js

windows10-2004-x64

3

EvilDuckS3...ffs.js

windows11-ltsc_2024-x64

3

EvilDuckS3...x.html

windows10-2004-x64

3

EvilDuckS3...x.html

windows11-ltsc_2024-x64

3

EvilDuckS3...al.ps1

windows10-2004-x64

3

EvilDuckS3...al.ps1

windows11-ltsc_2024-x64

3

EvilDuckS3...es.ps1

windows10-2004-x64

6

EvilDuckS3...es.ps1

windows11-ltsc_2024-x64

6

EvilDuckS3...les.js

windows10-2004-x64

3

EvilDuckS3...les.js

windows11-ltsc_2024-x64

3

EvilDuckS3...lse.js

windows10-2004-x64

3

EvilDuckS3...lse.js

windows11-ltsc_2024-x64

3

EvilDuckS3...ffs.js

windows10-2004-x64

3

EvilDuckS3...ffs.js

windows11-ltsc_2024-x64

3

EvilDuckS3...ta.ps1

windows10-2004-x64

3

EvilDuckS3...ta.ps1

windows11-ltsc_2024-x64

3

EvilDuckS3...ls.cmd

windows10-2004-x64

3

EvilDuckS3...ls.cmd

windows11-ltsc_2024-x64

3

EvilDuckS3...al.ps1

windows10-2004-x64

3

EvilDuckS3...al.ps1

windows11-ltsc_2024-x64

3

EvilDuckS3...les.js

windows10-2004-x64

3

EvilDuckS3...les.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
evilduck-source-code.zip
Size 98KB
Sample261030-xf2m2sfc78
SHA256 34fb3b5923f2d2eda6d24643103c7717358094c64683f186b339dedcf421b0f0
MD5 00649f413421061b20d3619c164d9d3b
SHA1 9d8219ed220059cb8203f8e85d015580a1d5f102
SHA512 5088964400040c8877cb84b51362f7e879ece6e8f6af4d6705bde8ca6525af67cd9c068593c3aced699794a853f3bf4ddb0ce193549f056c7810fcb4a0163cdd
SSDEEP 3072:3Vqw98emHl57JP15geMadJJO7uX/p8ZlGpY0Jq:3Vq+8xHldh15gejrQUh8Zl2YAq
TLSH
T1E6A32BB4D718BD70C96F7C34C45B2A09DEA7014A3E3028A67B40E623F51B1A6BD7DD26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Static task

static1

Behavioral task

behavioral1

Sample

EvilDuckS3/data/advanced/01_variables.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

EvilDuckS3/data/advanced/01_variables.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

EvilDuckS3/data/advanced/02_if_else.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

EvilDuckS3/data/advanced/02_if_else.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

EvilDuckS3/data/advanced/04_save_spiffs.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

EvilDuckS3/data/advanced/04_save_spiffs.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

EvilDuckS3/data/index.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral8

Sample

EvilDuckS3/data/index.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral9

Sample

EvilDuckS3/data/windows/skull_loading_terminal.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

EvilDuckS3/data/windows/skull_loading_terminal.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

EvilDuckS3/fetch_locales.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral12

Sample

EvilDuckS3/fetch_locales.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

EvilDuckS3/scripts/advanced/01_variables.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

EvilDuckS3/scripts/advanced/01_variables.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

EvilDuckS3/scripts/advanced/02_if_else.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

EvilDuckS3/scripts/advanced/02_if_else.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

EvilDuckS3/scripts/advanced/04_save_spiffs.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

EvilDuckS3/scripts/advanced/04_save_spiffs.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

EvilDuckS3/scripts/sync_to_data.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

EvilDuckS3/scripts/sync_to_data.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

EvilDuckS3/scripts/windows/run_hacker_terminals.cmd

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

EvilDuckS3/scripts/windows/run_hacker_terminals.cmd

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

EvilDuckS3/scripts/windows/skull_loading_terminal.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

EvilDuckS3/scripts/windows/skull_loading_terminal.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

EvilDuckS3/webfiles.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

EvilDuckS3/webfiles.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
https://raw.githubusercontent.com/SpacehuhnTech/WiFiDuck/master/atmega_duck

Targets

- Target
  EvilDuckS3/data/advanced/01_variables.txt
- Size 119B
- SHA256 b5707c6321e10ae244e5732111734bf3d6b4e074ab957542c85eee255049e482
- MD5 9addbb27689f4a1c3a0ebc66006f01ee
- SHA1 3afbe70e1c1cdac3027c5a45a389aea53b600c0e
- SHA512 ca537afaafa15855279d0cb12a5454264fd5662c7c78fb4e8f1fff8c20f5bdabe00ca0c8f9dc7c3ae630b2001c95493215a9b1c1aa412bc888fee8d7d02cf838
- TLSH
  T13EB09B45512196A55C45546081D431951A025165BD055E504144E5C2557949F535EFA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  EvilDuckS3/data/advanced/02_if_else.txt
- Size 129B
- SHA256 7fa2d615b57959f79c47372430410ff22a5a65ecce58713c0633cb8a69b4d216
- MD5 95bb38f622d3bed1139abc4f67988bcd
- SHA1 bdeef28d9fa790261f31ed4ca5ab2f9cf64993b5
- SHA512 938ff810482a6af5c70885dfd7473c7b66585f6de7f0e9b30628b706a37cee794316a17390bdb44d7b969b96195e909cb7774f2a11c8cd35ecbb3332de0c7c50
- TLSH
  T1BDB02B4533219B0024E0E0C080F50178110F273137050C424D628072C4F5D772603300
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  EvilDuckS3/data/advanced/04_save_spiffs.txt
- Size 98B
- SHA256 660f8e371961ccc91b440dc26ae080a1466ccd949232eb63bc13fde27f4a7f14
- MD5 67792cc0edc48790ad082d7c335e9992
- SHA1 9133bb2061f791f3e79f432bdd546ed8286e9d63
- SHA512 001ce400cf8f3cae22c4607aa0277185279eacc14232ff8892cbb2c832180100ec5ff25ade082611c6e3619ee4463751971ccefd96ff24334f039bf6e1afb9d0
- TLSH
  T1A1B0126B2B2585E01060C26731D374848CC0E51F93049F30421CC4C4140F08E12431D7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  EvilDuckS3/data/index.html
- Size 246B
- SHA256 c67a22c88c1e5741138e035018c07bdbf600aeb5f18d5367f8e35203565eeb83
- MD5 993e9685f6bfb514915e91bbbe68d431
- SHA1 207d52e7fac1bc51446e182a907911535cbcf596
- SHA512 6192a2437a6aad76184d21ef0de38bbad77a59ce585b701c2482f58ff01b6d64971ef5da21bd2ed27716e0e0d0d7c047b7cfa9106531bd96975ecab9c194a5ef
- TLSH
  T157D0974280401206C2301B006FC1F7256103B605AA880829C6AA72BE48D4352C58F68A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  EvilDuckS3/data/windows/skull_loading_terminal.txt
- Size 3KB
- SHA256 2fa38649cbcc5fb491fdf9298cc2d24d4f61e19d96985db6c8033f9e62d0aa39
- MD5 ff1e561301214556035c1f1a012db5cc
- SHA1 2c23df19283572a6c6ec14822a2abb391fa5006e
- SHA512 47c4a7a23a3b4acca4bc8c8f33bb8eb8483a10e789733b8d8696dd10b6a2d49ecb4de2eba194bbb82d2e59e9915c10a4bfe46c073b7890f503628a5a59df3086
- TLSH
  T1C981E092F036831A0EE4446606DFF1556A45CF9BB046BC6036ACD342D78B99C8BCF46D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  EvilDuckS3/fetch_locales.ps1
- Size 799B
- SHA256 b7290777966bc4d32c301115149f134420ae2ea6195a2710c004205ff0d13eb3
- MD5 5c36e37d60b266c9cda010422a4031d2
- SHA1 3222517bedfb5a26f50ef9b7e93f581dbdf3e56b
- SHA512 bf05ee2cfc00345a8c5fd99278b59bf2c5ce8cb8c0fc24b9a67ae9b295cf9c6c4332f8e1c8c86c075d2ba40c39dcf0f7125022415bad927671c5df9674b6b8ac
- TLSH
  T1CB0147061E6BE05726E0EDD1BF0153846D034029854F7E619977A614A8AF37FFEE0028
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11 behavioral12
- Target
  EvilDuckS3/scripts/advanced/01_variables.txt
- Size 119B
- SHA256 b5707c6321e10ae244e5732111734bf3d6b4e074ab957542c85eee255049e482
- MD5 9addbb27689f4a1c3a0ebc66006f01ee
- SHA1 3afbe70e1c1cdac3027c5a45a389aea53b600c0e
- SHA512 ca537afaafa15855279d0cb12a5454264fd5662c7c78fb4e8f1fff8c20f5bdabe00ca0c8f9dc7c3ae630b2001c95493215a9b1c1aa412bc888fee8d7d02cf838
- TLSH
  T13EB09B45512196A55C45546081D431951A025165BD055E504144E5C2557949F535EFA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  EvilDuckS3/scripts/advanced/02_if_else.txt
- Size 129B
- SHA256 7fa2d615b57959f79c47372430410ff22a5a65ecce58713c0633cb8a69b4d216
- MD5 95bb38f622d3bed1139abc4f67988bcd
- SHA1 bdeef28d9fa790261f31ed4ca5ab2f9cf64993b5
- SHA512 938ff810482a6af5c70885dfd7473c7b66585f6de7f0e9b30628b706a37cee794316a17390bdb44d7b969b96195e909cb7774f2a11c8cd35ecbb3332de0c7c50
- TLSH
  T1BDB02B4533219B0024E0E0C080F50178110F273137050C424D628072C4F5D772603300
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  EvilDuckS3/scripts/advanced/04_save_spiffs.txt
- Size 98B
- SHA256 660f8e371961ccc91b440dc26ae080a1466ccd949232eb63bc13fde27f4a7f14
- MD5 67792cc0edc48790ad082d7c335e9992
- SHA1 9133bb2061f791f3e79f432bdd546ed8286e9d63
- SHA512 001ce400cf8f3cae22c4607aa0277185279eacc14232ff8892cbb2c832180100ec5ff25ade082611c6e3619ee4463751971ccefd96ff24334f039bf6e1afb9d0
- TLSH
  T1A1B0126B2B2585E01060C26731D374848CC0E51F93049F30421CC4C4140F08E12431D7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  EvilDuckS3/scripts/sync_to_data.ps1
- Size 774B
- SHA256 103f1f45641921b97f45f4b5d4f842b62d540ec7ce96cdd5d100edc868a5a534
- MD5 216c81b1ece416f2a95a4a1e91aa566f
- SHA1 8feeadcdbc589040fa8b727f86ccd4f833e75f67
- SHA512 02389af4294ca066c1a68ae94bdc777d3e16311583bddc612a1f6feadd35c62826fe30b652996b0aa7ff20335912e43f2f6cf2d8a9a297a76cf899e84af3fa6d
- TLSH
  T1DF018915BC0DD53489E103BFABA8C44EAD16D4AF42401E42B28C45C9BDA293E9E36760
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  EvilDuckS3/scripts/windows/run_hacker_terminals.cmd
- Size 266B
- SHA256 402c0056d6eba24f2e2c9f80f99cd1e214b1a327c2a7f5aba0235024727193e2
- MD5 42ccd1c8a32831689530584eda6b2290
- SHA1 6eb6ff0613ad47be5dbf7271432670579065fd66
- SHA512 28f64d182b1ee89aaa75d75c4bb4c1b18eba003834d9670554bdcc484611595466cd9eeca842a67cd3fb8ce2cba1a32375b59f38f2a6a4dfac59b7a6ec8b5bd0
- TLSH
  T1E9D02B41DAD4932A5C7A5B6DC5DC08F668089A9AE151DD655C318375F0CF098C4BD1D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  EvilDuckS3/scripts/windows/skull_loading_terminal.txt
- Size 3KB
- SHA256 2fa38649cbcc5fb491fdf9298cc2d24d4f61e19d96985db6c8033f9e62d0aa39
- MD5 ff1e561301214556035c1f1a012db5cc
- SHA1 2c23df19283572a6c6ec14822a2abb391fa5006e
- SHA512 47c4a7a23a3b4acca4bc8c8f33bb8eb8483a10e789733b8d8696dd10b6a2d49ecb4de2eba194bbb82d2e59e9915c10a4bfe46c073b7890f503628a5a59df3086
- TLSH
  T1C981E092F036831A0EE4446606DFF1556A45CF9BB046BC6036ACD342D78B99C8BCF46D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  EvilDuckS3/webfiles.h
- Size 58KB
- SHA256 ba67e8550607a69c3c2c93b0ae089bf64527321c2f3814a4c71bf2f656bf7892
- MD5 cb916b55acd97b4b35fea11bdadcaa42
- SHA1 7ab889b2158d649411e1a08552072aac0f010e4f
- SHA512 bb4cdc41531e1cc49f3924665e5effeffb75666033156cb85c6c0c96ec7c96829bed1a83a6451fcd2897e9210bfb992494e25626c959697fff3be810699aba34
- SSDEEP 768:CV+r2EwumC/v+wrsf8qlQhoFGbQt4XYo13+RhMIKm+MuiEXFHfYGptxZ3SVQM9k6:6O2numgoLY7YMOMIKmrzEXFHfYGptXh6
- TLSH
  T13E43197270F2583619B784EB90A3874BBD90D007F917C044BAFC19994FDBE86DA27A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

PowerShell

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

© 2018-2026

Terms | Privacy