8c9c2487ad018aff25144bfba4e63e968a5f302872f299d8a82fdd3552f72928

Sharing

Copy URL Twitter E-mail

General

Target
data.zip
Size 61KB
Sample261104-wy5xract2x
SHA256 8c9c2487ad018aff25144bfba4e63e968a5f302872f299d8a82fdd3552f72928
MD5 894c6a495a912fc5c86dd24be9c15566
SHA1 fa14a2ab63ac7e2cf17dee766a92e0307cddd832
SHA512 5a360b592013f4b6547172f97c15575ac804e9b2e4cfe562151719f694825e2f678fe5f59ef726bd148a3291106cd4fb394e3a212f2608004891c1e5921df683
SSDEEP 1536:JgJDrT9pFwIId0eyWX8Ek0aeno5yNZ4V8ZLN:J49puIId0eyWU/exNnp
TLSH
T16B539D67D13C2C3AC7CF4430C67EA623D9CAD7866152A58E0DA3CA8147DACC51B36F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  scripts/check_python_certificates_macos.zsh
- Size 1KB
- SHA256 3abfb682a9d8a1e42d2285d0086dc16bc62417d017d745f4bd7e39b81e754346
- MD5 deb2e553c3eb8a9f1482178053afdf44
- SHA1 f8e22027694fdd6cfdc2ad8b1d8c096e8dcd0ba7
- SHA512 ae4735508c6dc769d147b807bda0724f8fe13d4631af2bd4748f065bed7df4dcb177192f7734c5c935e1de3e1e22318bed0226bcf11d4d4f200890c72af9531d
- TLSH
  T12C31A36671A0E1FC1BD101BE144D95CE3E9A6BB75C17306C30AC8CC82F65E69827DA75
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  scripts/install_libncurses_ubuntu.sh
- Size 1KB
- SHA256 ea3584e83f16b5469efbb92257bbce24da176b9e97f7b7d76a9201e8501615ac
- MD5 db1ea1ea3d83f8720a1b18e21d944417
- SHA1 7dbf8b82d33b41ae230059d402af3f0854a3e2b4
- SHA512 1c98dc3fb0a0a4b79be299855541018917c9c6b1a1e4139d01e34a34467b9ab2ebfeab21c5a926e5b45a9cf9ab0e36f901c6eb50b3f7bdb51fa5ff0ed1bf9e56
- TLSH
  T18521236F3046E2B85FC002F6469FA0FF7B054235AD175964F0CC64842356998D37E56A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery antivm credential_access execution persistence
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  scripts/install_python_certificates_macos.zsh
- Size 1KB
- SHA256 72ec78f8d4ca392ded4e05a846d1fcf5cba9148f8739d9169e2890a86e21b75c
- MD5 5f60e7697da7fb0ce8f49aeb9a1a7e04
- SHA1 a47eacfb05bac48a2dee9b3819351228f7e8a397
- SHA512 8d4064befe91625ac5aa634e16471d5cfcf7134144d7b3c6ecacac1de8b1cb7347a83480211c652a717489cb70b4fc4b325b01e50bf59771282d27193b0f5f20
- TLSH
  T1E741201671A1E4FC3B4405791A0D558B2A8A5BB75C27601830BD89C43F65FA8C1BD675
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  scripts/update_python_certificates_macos.zsh
- Size 1KB
- SHA256 e4d226b82458d6857bc963f9a173a7f018d7201d28866d953807c4f9bb1cddef
- MD5 d8475d57ad831e23c2708c3f53f80f2e
- SHA1 1f08237f029fb0286a6836726e9b2b65092d9b3e
- SHA512 3d59b16a61fc2646b9bef5d0af1846f9ad090f4b91b222f454edc5ce53dee00f4a32167e599e414df562f720079255039fc8609c9a4c22af58cc3808b8645ffd
- TLSH
  T15F31F53B6062E4FC1B9102BD254E55CE3E8E6BBB5C57605C306C8C941FA4FAC817CA75
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14 behavioral15 behavioral16