861b1c25e87237eb8417cf13014394a962a21cabb7c71850ddafdcdc01963214

Sharing

Copy URL Twitter E-mail

General

Target
HDTB.v1.2_LinuxBuild.zip
Size 31.9MB
Sample261107-q5bplayxex
SHA256 861b1c25e87237eb8417cf13014394a962a21cabb7c71850ddafdcdc01963214
MD5 cf5c317e1a4aa94bbaf3c09f90d36fd8
SHA1 2b9c64bf360de81b850a2ac1421adc53ca766e84
SHA512 affd72e9de9669ee47f90904c5f0df08363d638bdaf0f0f427bda2e96c712e5fbe919ea48b02ced5a5c3967256bca6c1ae3eb7642be4b21ed5c3d8449bc26cee
SSDEEP 786432:NeycvyQqCcpPKfaCQVYZesirn2i4OLA+CrG6cSYzF25apko:Ncy91pmaCQc07VVzCrG6cSmF/pko
TLSH
T1BF773312D1A64D0BE00F0AFA6A7C0AD63562AE35CC922D330368F95558757CC6FE1EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild.x86_64
- Size 14KB
- SHA256 32d63b2230467875a851d55ed80d75276dda5b452da048bd400c102b81174598
- MD5 f82bfab3c95d05869e296381a44de1ec
- SHA1 4f750921c93b9c8e4ff3d6d42f33e93f3e7cf1dd
- SHA512 9556fd23dc1efd3968afd680caac5029ad16d8c23ce9e4796ade887f3a7603ca97027149ec47ac2dbb463e0cbbe34d0fed8f315f9c6fedfa2a6bd9460a74609d
- SSDEEP 96:GM1TaxnMBWBKu/YMSu/gguElIuIPIKVhunQtwU3uiabdQR:GoH8Qu/gd/hu
- TLSH
  T1CF622F23E3A9CD7BC89807384807473863B4DD9087A683674702A7247E537E55F74DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

antivm discovery keylogger
- Reads hardware input events
  Reads raw input events from the evdev driver, possibly to record keystrokes.
  keylogger discovery
behavioral1
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Assembly-CSharp.dll
- Size 73KB
- SHA256 4c019651fdcf3ddcf299fa0b5113d37df776b15d059ffc69d9b7317b0b1ef56b
- MD5 ceb5b1c59dff2c4d687ea2f647744916
- SHA1 a48d2e9f5d25a7a83de41e668baa4423c8c47eff
- SHA512 d38a489c425b3182b6e7f7d1fbaf021d8df9a384a4b754bbe26f0a850cf6c4ae172fac3d918b4a865f654f16612d7372865f78873784500063888ebbf04ce775
- SSDEEP 1536:W0xtb8E0Z82mEmH6CA56knEBlHhGhnwKbIJMHYfz9FyRg1fui7DBG3jya75JX8g:xxrCle6CHK0JMHYfz9FyRg1fui7DBG3P
- TLSH
  T15073191232E85F17C6BF17BAB92130005B71EC23E193D7D909E0A8BE6947799ED02363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/MiddlewareTransport.dll
- Size 5KB
- SHA256 ed441c6dccccb6627f48de782a33efd8997a4e803b5d51f7493d7ad865f54f82
- MD5 87f9930753980810ceadb6aed1b6ea5f
- SHA1 55851a78783fa5add77aef42356635bdd412aabf
- SHA512 b668c4d7f7ddb21e4f6dcc1c9c4a8b97cc2f87eebac03be3394706a5af5aebd6a64e4d8979f6f1f03b3bef9a44834966b6e3e3d992c5d5049794ab87d62bccd6
- SSDEEP 48:6swIly7rt/talD/RL5Gb8gr8S/2SNyzhG1NgIzAeJoJKONmywh+nlulnKVPxq:LwwZ/RL5Gbjr8S/TNdzEtNmIIcV
- TLSH
  T1CDB11F5563B012B3E15B477AB9A206412774EA6006A3C39F1E84B6B7ECB33551E136E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Mirror.Authenticators.dll
- Size 28KB
- SHA256 fc7c94f6382cadced375fe64eab1848d1f0df503c11ac5941eddd5c07f175a42
- MD5 9db96d690eee97b25d7995984d04e5a6
- SHA1 54aae1eed45b3a9fbdc7a0316aa9357fab65f4b5
- SHA512 3bfc485a3003ebbf2b7ec7e26c744497b311ab9ad8ef3ea3b50ff22f69579636c790f088cadb6ce5ea17e54fb615ad3c388d3f678fef6a2394f5f1e4074a29fb
- SSDEEP 768:tigOGp1TizEZpAydw+ZlEBlThRhHKHK2KLCV4Y7fRibc:M+Iz+AydZlEBlThRhHKHK5ufRiQ
- TLSH
  T196D2A74B92486FABD64657B9F420B6182B33C37358939E9916D89C784C0B8DC4E343EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Mirror.Components.dll
- Size 107KB
- SHA256 acbd2e44641bd5eb9a30667c60c5f0ea215300bf32c732ea0bc4cf00f8c55457
- MD5 df0487699058f8a4f3be3fff3c622cde
- SHA1 7a00029cf0a88aea06c322fabb0fd105c2c3ca7c
- SHA512 04ae05acd670c6eeef2c3ac81283cf1ba354507e5f9b183422f46203b866aef226bd18a25ac2859f030c28a90998052d521dddc0780d2967a7089daa755fb228
- SSDEEP 3072:TtXRyOe4q07dXzbCJrR8OoNytjB1M82qSNrzV4WnYSL0rgmEjfrdMZxpFVtjGL9N:vyN4qGXzU2rdi+sRM
- TLSH
  T184B3390163DC4E1BE5EF27BAB434B0110B76BD12E1A3E79D5699A4BC08637886E153F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Mirror.Examples.dll
- Size 105KB
- SHA256 aa2d635f6da967f96ada679eb4822e1c6c751d9ebfe376f986c4943f2f390f02
- MD5 2ce643f078e21c0dd324b52f60ba15d5
- SHA1 052c8f520093881b2709bd1643090a906a4e9d6d
- SHA512 bb4deb2ab568fb0a363cd8e0479ac2b7a8feb889544966cc1b0e65928697457f3d9c7d4ce057d3c9a148537e6fd6f89a5cdc34062762e4eba37bd9511c32f732
- SSDEEP 3072:/ndGrw9eI9XtMO9aMZCTEy6LiNbqnzQhEBuq3VCE7sx7e:/GUMdTEB7s
- TLSH
  T14CB35B13225D5F63C66F1BBEB024384037718B23A493DBE76898B8FD14877A45D163A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Mirror.dll
- Size 165KB
- SHA256 7f353ab2887ef7882b3594077441e7e50d8db096d129701872e9fcd38134df1f
- MD5 ef01313fdad1ce7ce7d9fff41ede8e27
- SHA1 09f9c31588e31ef4bdad6fb1cc290e4eb0ce046a
- SHA512 e9bce482e20cd32f8aa6883a91356f0a9815237bea2f9946974a4754170fea9b0f80760edd416d54e4be8c6deaa72bf5bccf38762a78179fefb150bb2e51d02c
- SSDEEP 1536:i85KbejfPcAdvKCUp4x7/ECg/OIheime3cdhVzth0XbGFKFUEtvwhQSQ+m9tF3kr:pmejcQvE2cCBijkgXp3tvt0ucb23s08
- TLSH
  T161F3F75223FC4A1AFBFF3B76E47062414B71F802A937D38E5584A0FE086775899613A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 2662e874f5f33d59c4a27410258a3ffb06ffc0d5f479e08a57b54a8e0a177a66
- MD5 f6f765a226246bd457177d6cc5050717
- SHA1 f954fa62e41619f73bd09b45ae1639531391ab8e
- SHA512 a83c4d7cb1ff768fdf7fb217b8b57704636d0cc4e284955e32676ec320db85614d152bd79657cf487b910e8c2f39fcdcd49b9aa4154978bb4b0a444d52eaa5cc
- SSDEEP 6144:BUjTQ70cnf8MoVRxS9iJdBF119RJXG2yd+Q:wEiH119RJXm3
- TLSH
  T154344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/MultiplexTransport.dll
- Size 7KB
- SHA256 93b57841750bffe46dd49dd3ac199470df9718d6ec97c6729048d8b8714ab910
- MD5 4395ecf4943721fd6b4a1b4fd303e05a
- SHA1 4f474dde2ef727e8d4c57c2921af79c2881df618
- SHA512 1f791a5d5e89f572cbe8ab5bf861d3372b96b053d07ec99727a069a03b0ac52fbade0aaa2f0c7c11641637fa48f85cc1613f173b3c27c2c8c410ab14df4d86cc
- SSDEEP 96:Boq3fooJzHn7t+jGjga8pPeUmxQ/e6ZzMGabi:BZlbJ+wipPerxQ/Nb
- TLSH
  T170F1830AA7F44A33ED6747B678D20302177DE5402623DB5B4E046AFAE8673424A537AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/Newtonsoft.Json.dll
- Size 670KB
- SHA256 87fa9a30e8406b0ccee1ac7f44b529228b4d76f7a3549b1a3817fdda0f5b5b2a
- MD5 95fabcecebe498f780caaaa33483bb2f
- SHA1 c994bc5f781df8fcc8aed36f7858c9e647942000
- SHA512 9b4ada10114c8c5c6d99aab1832682ec8bb9c9f95c0310648b1defba2873e732af70cc6f0a2c1abc23f2170073408120020feaf2b08441f137d4f590572d340d
- SSDEEP 12288:judT4rkEdatCiMGYBsq85XrWIhf8vbTB8jx6nws:j84rddkCTGN7H0vXB8jxGws
- TLSH
  T1C9E4492523F88B26D29F6370F874491847F2F416AAF6EB4F4908A8F91C53B94CD447A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/SimpleWebTransport.dll
- Size 39KB
- SHA256 11c55407f06846a9f056f831c94ed0f0b7c598934b8af58d609634da4145a0d3
- MD5 995c8c3cc7e84811e2b8c44aaccc6b2d
- SHA1 b66db9e2a04a457307155f58ffaca0fb9e65cc3b
- SHA512 c99816b806c8b250564338a746899e6e1c011ba8444eb931b92e0fe1bbfd5ab4306ca753895ed741d97642e6f6a94d29a594ed6c2c15e29cccc0856ca4ad653f
- SSDEEP 768:0qnVFCx7vZO3iC7311250vaSKc8ijsdbMEil8ztnGY2:0cFCpvZ8iMldvaZcadoEil8zH2
- TLSH
  T149033A063BEC892BC6AE17BDB030819143B1EA342613F78D5C84A0FE2953BD49B117E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 1c2e1c6b55ead39fe1a7471c313718736fd433da45d958f59aa363563d742422
- MD5 25798d73669535dbd1ebef646aaf87e5
- SHA1 d83c9a7e7b485b3643aa9b1fc494864ceeba55d6
- SHA512 c5460f1c3defcd114175ad900df3b5b31261f6dd53c5c9f90b1ef2e4bdad0910e585efeb7519a12102354346b5349f457e8afcbdb8141adc47006cea1ea9a700
- SSDEEP 6144:MkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:MkwkYfx8ZNCxL
- TLSH
  T16E44281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 905f77638d07375a16aa3ae2cbecd56dd6220d5fa27b57b4315bc8d8bfabc937
- MD5 988785cece72864d6945b565275d5336
- SHA1 0c84417e9697e76ae1f2e1b3ec7d41d8f018c497
- SHA512 7cc0d96afcb7e7b00839b0d8e17f0c0a159acf927919311b5ae71eadf20e8b8e23aedb85bb7676250b1f49305f00e858d5aa2a0ea2515fa8ebc61512eb646b4d
- SSDEEP 3072:UGHTFkizuGCOE/htnREcacWown5WJGL0MIeegNe:UGHT5+H/33vJs
- TLSH
  T177C3F92563EC872BE2EE177EF8B515100FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 7873b27d3dd57ff8a8ab56519ad58157fd5e2b2b17d6a5fafdab5ae9c4a2d081
- MD5 dfffda2be410d18bacc6335b0e77becd
- SHA1 2ae34f75712102aa2f905db30234f9d084aefdf4
- SHA512 b890496bed705176847bf4f0725cb70f4fb7ec3e4661f8c5858685fbe5574676938c4ecfa0fe422a0a790c2a5cfaf66dc6467dec089820aebc0770090efdc2ce
- SSDEEP 12288:CWl+j47pDKYuRYdyc1QL2Nr6jqQEMM53aLhRfv1XnNJpLFkZTWL1:XLuudywQL2l30hRfnLFes
- TLSH
  T1F6354940B3E88737E6FF3B76A4B546101BB1F946A77BD74F1108A1BA5C92B409C523B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 60c3d167fd9fd7baf8f60022bf9d58bbaba6851fc706e408612387d703088163
- MD5 f3f7f166455c84eca5720d9c52d8107b
- SHA1 4be1f1a1042e5bf9b19d84620f70dfd1e00d6d74
- SHA512 80e24d14a562b29594e564a37240e5eeee01ad18cac25a662a2fa509898f2f8e46264da34a302136133c0602a9c40dd5d42c13255bcda476e6c2c439d1033f36
- SSDEEP 384:EEAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOxYsnRbli3ESmMadMkrVr5UhH:EcZC8Ll4LiMXkv2Y2McdCsj5Q
- TLSH
  T173D2C915D3EC4311E3B727B1BCF9518A8AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.Data.dll
- Size 2.0MB
- SHA256 f22ded3380cf1f2f4733c7a01c815ce747a9b2cc95b31d80ba657917652ff638
- MD5 1eefd68280f6990f9fa80412525ef89c
- SHA1 f3ebd55b2ac94214f893d732c4480e2d5ed158fa
- SHA512 8dca60c010448b076ad29c543b1db90160d24daa905d2090834f7267b93189213bd3624ffaca26a57169f87f50f7446c464458b25514222f37c130316c9ed3ac
- SSDEEP 24576:LRynk/Cyjr8loaRwlp+DRPw+HjN1FtHYlnfB7LB:LRC/2aep+DRPjWnfB7L
- TLSH
  T1A0A52851B7FC5A16E5FF7B71A83510150BF5FC06ABB2E34E6A04A57D0C62B508CA23A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  HDTB.v1.2_LinuxBuild/HDTB.v1.2_LinuxBuild_Data/Managed/System.Drawing.dll
- Size 478KB
- SHA256 81bb083fe58266dc085424283c1dc650bab49350affc6f291df7cde920d0a8be
- MD5 b9b0dacaf36ee9d4fcf35d19e3aa30eb
- SHA1 4852eb7eb232ba81efbd3929a72133edff6684b8
- SHA512 2b35fa51b5139d76b90e9f435c101b26d363bae3d804f229e2a5d50322ed925c6432539600bb0dbf58f35192bc09ce067b0b27c1c63b341ddca6b1949a4b2009
- SSDEEP 6144:hHutOmSUsXjt/z5B4CqvhOgEGKPx+Jg/NY7c/nENZ4k7cheeE0:hOtOmVsXjt/PicgEN/MGq4k
- TLSH
  T131A44A1077B4592BD5EF2B38E0B24968A631FC076B26E75F4681B62D1CF2B809D417E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Input Capture

T1056

Keylogging

T1056.001

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Input Capture

T1056

Keylogging

T1056.001

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads hardware input events

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32