88afaa6e39adfd8e6e52d5a149c2ec035d2147ea89fe449e5433a3bfeae25823

Sharing

Copy URL Twitter E-mail

General

Target
ps-watcher_1.08-8.debian.tar.xz
Size 8KB
Sample261113-bqfmnset3z
SHA256 88afaa6e39adfd8e6e52d5a149c2ec035d2147ea89fe449e5433a3bfeae25823
MD5 155d05c16608afac0403e96add560e5b
SHA1 9089d932eaa69f060e7667b9962a64dbbb553015
SHA512 2a701423b9bdd5cc1ef11b2a7d690b9a439b7f7d41cbe18f75e928a4f361a760ab702d42d216e4036cc4f8ecd61e481708c4c7d6d5abec5ac64e9125e6ed8de1
SSDEEP 192:I+qUu1nyj89ZpRk4SILQJfFKD9Yt8jAS8E2+TGHb+9n:Inz9dzpRHSIkFef19hqHb+9n
TLSH
T1D302BFD545CA9E8CB0087AE6AA309EE33F141D0E4D0B66A7F23F9AD3145190CA6431B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution linux

Malware Config

Targets

- Target
  debian/bin/github-release.sh
- Size 5KB
- SHA256 8ee89ea10eb4d6d18aa45eb808844d56dcf94be32a35408912be2592c5da0cfb
- MD5 ecdc37bd62b55abfea640b57a4f63368
- SHA1 e3f2a070bc3d69fd26bad0522c096e42587bc3f5
- SHA512 a988cde0b088e9166cba321f3cee6b1d9ca6ea5d1d33b064e1c2d063077b5ee020742f5ec08951925b9bc6b1799c19a0c6a4456577e01698005d1518d615753e
- SSDEEP 96:eCPjkRQH1O8ahKQtQcEgicriE+vXCXEQxbpTWO5Eb+ZR:gRQH1O8yp5YIiE8XCXEQxVTWPqZR
- TLSH
  T10AC1F956FE0407B00A1216F1790AF9DD732882AE0B75ECB8306FD1796377EA461F7544
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  debian/init.d
- Size 2KB
- SHA256 b415b319048bbdd1a73134f2f8bb24364003495e8f1170a82d2ef949e9d13685
- MD5 54d724d13c195ba2440a156104115ed4
- SHA1 5ee9f9b8aa38c785d4fe50a2434560208ee72c73
- SHA512 8f17f5224171147949f508e95acb02993b9b8a115f47ab3bfa7d6f0d2e222a2d27511372fe025ac714f153ba45f6353c789260bb54b8e85a1c61bc223cc237aa
- TLSH
  T1BF415452B24DBEF64E0FC992359753106543536D185A7117702F7BA12FFC3C9A8FA184
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  debian/postinst
- Size 491B
- SHA256 15238ff51bfb2e6f8c6ac9f8b3183d236ed894be704772c4d2754aaf6055622e
- MD5 4dbc6bd3605910e2407e23c8b5c708f4
- SHA1 7a98305417afa4b38f3445b8df3a525f40ff99e1
- SHA512 5666ee9fb3120e6d003507d7981525c004510846a675186774e9b9ac973f6348d2cb76afe7ced05c34086a3dd4eff4129deb5b8dd0f8079d4231421495e19821
- TLSH
  T1B6F030FA6411C9B079949634475EAFB0890A37B737946B13B13F341C1F9E6807974AEC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  debian/preinst
- Size 232B
- SHA256 d00cbc0bb8a5d8a175fd45a482f7fdbe6a72298c94978a0c25f9bda105262a3a
- MD5 3ac46e96a1c2d36eb0235de99d5203a1
- SHA1 33bb70d596a323213da727577d03b372f6830e15
- SHA512 2535c0c74b544b5a4da9c711db5d9d4671540b9369c1f656b8aa2c2a6c6d2df77f51f09a473026a28f95ec597626881fd4756c3c9bf34ddbf0dd70dcd20f610b
- TLSH
  T13ED097A0A850CB811C328F490F17CC30D23C53683A24460B018A32A8F00E080E470A80
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  debian/rules
- Size 1KB
- SHA256 44a964c43eb1b1998229c6dd3006be962161021d7de8240ae4cabf90f13fb6a4
- MD5 6893fd2b35e5ef1704b7635d596e0dc4
- SHA1 c200b2af718444fc4d123dfdc56c07510dc4cb49
- SHA512 d2e915dd63d6a206b7b394de5175d6f66196a45b51cf8cc650b231704b7657220c28bcd666fdb358dfa6da9d7004123b67ef9185ceb2ed9d3cf2a4a5182f58b6
- TLSH
  T1EC411033819D0573AD823AC2136767F4EA59E7FA8882488200DF7608311F589E47F2EB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18