138b5f886cc148e61ceafe95e2e8e8f352d59148017b78424e3ea8937707e55c

Sharing

Copy URL Twitter E-mail

General

Target
138b5f886cc148e61ceafe95e2e8e8f352d59148017b78424e3ea8937707e55c
Size 4.6MB
Sample260430-p2xbfset4y
SHA256 138b5f886cc148e61ceafe95e2e8e8f352d59148017b78424e3ea8937707e55c
MD5 45ac229528dd00c8895c907cc84302d3
SHA1 a72cdba2389b803abfe82861e05d297192ad530f
SHA512 f7bca6dc766a23cb180c90df0f17011798f417cd6c4048da1872f3c00b324247f3c800d7e531df6a1b561567db92ab7d6eee5aa573a1fdbbb18ac19837b253ee
SSDEEP 98304:OLixWaw27ayYUkoQFawG8Ca/iwC8H9Z88+iKWZRiOeEr:MiI27woQIj8Yz8HA81KsiOV
TLSH
T10D26235BD7394A22D706B9BB318BCB0A7E359780D022660209CD56E18CD33BD1BDE75E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Bootstrapper.exe
- Size 1.9MB
- SHA256 e2daa6cd4181d8f87fdf11603a4f022c658d96daf256f29231d99f1d20cd5964
- MD5 6b202a7295bf47f2988d97b4d4f41d32
- SHA1 8d89bf82672c7aba7a7b8b8ca87f228a3bb7caa5
- SHA512 1ef6252391073264dfe76d8bedf10515814a2e6fa654c187a507c5b4f84f00b4ebd5d02c8c6caaff2154a1ed776a5bc70c2a16137071348b6a06efe7a8a0ac62
- SSDEEP 24576:Vo+IFvWDhOU263Y123NUjp9tUe9OVPDeJ3/KCg9EqG6WcR1JL+E:VonvWpf3Y12ajp99OVPUSCxOR1
- TLSH
  T170955B01389105ADC499B73248F27682BB35B8180B3677D32F96AB783F33BE11976756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  Monaco/fileaccess/index.js
- Size 6KB
- SHA256 ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67
- MD5 0e709bfb5675ff0531c925b909b58008
- SHA1 25a8634dd21c082d74a7dead157568b6a8fc9825
- SHA512 35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd
- SSDEEP 96:gF8+uLu1uesWwXphskb/9TLsk0ygiuiFuJ3skh4WX+Oskc+3qYskcxiT9:4pMeiTZOyyNZ4We+MK
- TLSH
  T1CCD1F35B59A7211185B2377A6F220417EF4DF837A11A9688FEAC42553FF1802D4D2DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Monaco/fileaccess/node_modules/accepts/index.js
- Size 5KB
- SHA256 be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1
- MD5 4fe4d2c90a2fd19d6e97443a7d24f815
- SHA1 282263f45f6bf80fbf43f4097d53b5b60ff1a05f
- SHA512 c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213
- SSDEEP 96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
- TLSH
  T108B1328535DAB096974310B09ECFE749F035840B312BECA1F19D73B42FD1EAA8255EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Monaco/fileaccess/node_modules/array-flatten/array-flatten.js
- Size 1KB
- SHA256 766ca145b6d25e3d60f352a716e8fa1876bcdf362c0767c360cf24f335bc281e
- MD5 4b17fa06c54846b686b8b799e9dd253a
- SHA1 fc6cc30e8b8ec09eeba62bac076ed627aa3ee8d1
- SHA512 72df1668f464f6942c484155b667086bb6f83f77e826ffcd146ee045079db3334aba270bffb66cdd796d4c9308121ec2a67a404289f19914c45d9a6c15435e71
- TLSH
  T172213AD43DF3302E53077830A1ADD4C5D1A84813613F9A42D10F6F602FEA830666D9EE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Monaco/fileaccess/node_modules/body-parser/index.js
- Size 2KB
- SHA256 9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241
- MD5 b9e991c0e57c4d5adde68a2f4f063bc7
- SHA1 0cb6b9eb7b310c37e5950bbcaf672943657c94b5
- SHA512 3bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6
- TLSH
  T17E515349656C7523820B4ABC8C6FA092E5A98703112DD8B5B9E8D7F9BF1404C81DBEFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/read.js
- Size 4KB
- SHA256 1e9e274755366c39ae70e8b9a7a42fc12219566e67efaf9b7ebc2a8b337f5b6b
- MD5 c148bb38c59ce266e271c96ab1f2d192
- SHA1 027f3fbd8a5370ddec744d33ec9d594db41f6293
- SHA512 bc4779cda1a3b130eb8cf76bb40676046ceb514ddc5c1891d7324776e6188e5d5ceb4c0799cf2fbc007786849ed07903cb59f61ffcac407300eef0a16cb7c498
- SSDEEP 96:1F2ISKMGJ0n9WbOaHSb+IR1+GFQBnPQCbfkZ/OPqgVB9OuCyMQ:1FwZYbhHSb9R1+GFQBICbfkWVBqlQ
- TLSH
  T18D9120A6ABE434016347E475C44F9A0AA1B4F023372D9E9530CEE3B56F58434A5F6EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/json.js
- Size 5KB
- SHA256 44f8b529333004e2aaff6db3a1dbe7068f1ac5fa1173e9634686a78c2262af35
- MD5 6b036408f968978bf9668496db9953ba
- SHA1 af1f14428152576f1c047c3462d26a7feb98635a
- SHA512 89bef97d3d5d0c8da0f3aa1e178fee1d04eee5200c2f037bd55761a61e6c6a251f7314e82343761ef227a997909f4a0237a3ff5f79a1a7bb9e879a465ab84f86
- SSDEEP 96:1F+Graz+dz1PbSDp2qjlvqzi+QBYwxcG5l+NbkAZiVl7g6A4QYSR:1F+Graz8TUj0mx+wOgybriVZg6ffSR
- TLSH
  T102B163A639E4B007535B6939588F9652B1A4C413361D9E13B58EA3F07F8843885BFFD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/raw.js
- Size 1KB
- SHA256 4e9cc80a7ee8bd667c68c264b4c374b28e731246ddb6ec22c3968daf837e30a2
- MD5 acb38e4fe575afaf8d1a257e47c6e362
- SHA1 ea7411ff5a71df8d426322d07103e5894630e29b
- SHA512 157427ad25390339b045b9bb81753709498b69b2cc8b9c918c19d52d1cb4f6bbe5b6b07885d0a7f66ef359b7080dc9a42216f71911b08ade04c1a112192bff50
- TLSH
  T135410BA939E5B5269313A8B8864F804775B0C823A24C5E13749D92F07F5802C62B7FCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/text.js
- Size 2KB
- SHA256 54a6e8ef720b06a300b21f6c60387805dec743a64154784a609dfe8c6860776a
- MD5 beb4ada09306f8d6435566d9e88076d3
- SHA1 eda9bc036c9d10f1400cd2e4a8832949671cadc7
- SHA512 5d9c9c6837b9599d29db9b1eb54cd2a4e215feeb028137f31c20f2b02e38f600aa8c02721444dc41d7bfc206ad39a810076853d09fa1e3113b5708a75443131e
- TLSH
  T1D34102E539E5B5229306A978C94F911BB4B0D823B14D9E13749D93F07F5802852A7FC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/urlencoded.js
- Size 5KB
- SHA256 752717d87aad57451638af2073b04eba964f348910c0bcf0070c43e732de5eb2
- MD5 906a833480ce8841bfa5aeb95b5c085f
- SHA1 8f74a7d616bf363b78844d3bcc2f554d7c76a952
- SHA512 7676871dd3012dad0472be51698d9d1677622ba3d392417a41d22ef7f6d7df6c8085516bb9bdc45d4f125815161899aa889d756d18cd41f11e2402e659f7934d
- SSDEEP 96:1F+GrIE8S/wtosB5XaYp2Yy+QBYwxcGw+NbaZMz71LX7g6KspqOJUICK0mMQ7eLR:1F+GrIE8S/wtoGXaUyx+wODybGMz7132
- TLSH
  T1D2C162A42AD57522530796B8694F805AB478D233320C8D63B0DD67F07F8D438E5ABFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Monaco/fileaccess/node_modules/bytes/index.js
- Size 3KB
- SHA256 893fcbbbe962dc00e40dc2e4b20e76e92d874dd257345003c6575d940e91a37f
- MD5 83cf8fe86424252c5a9a3e2fe90dbd57
- SHA1 bd46529e5637ff1a659f1d4af2598925b12741e0
- SHA512 f0630152a247cf51dfc677c22323afccc667350a11db093b59b93f403481deba1d44cd78cd53f4c4a3e2df297c35fe54cdc841c10c4667ebb81d3a54fbf56d43
- TLSH
  T10B7145146FD13216065F32F808CDA144AAB89663113EC9D9B46D79D0BF49C29B1F6DFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Monaco/fileaccess/node_modules/call-bind/callBound.js
- Size 413B
- SHA256 2b2fce7622fdd680256d28bcd59c30913546a825bf69d754d21a1d21ccc2928c
- MD5 fda064fefaeb89252271922954d69a4f
- SHA1 7bac1561b456a282abe97cb9bc4e5e0d8a10e769
- SHA512 b0746c9dc90bb513e7d6190470ce0acbb0c2059b97184b9391f581e9a490729669c8479ba8eaafc1980f4e058a396bad11031d048387b5223a7b4b9e6a4b1dae
- TLSH
  T164E02B597DA3D36D812023D0CD760B2D457EEC32B07C4089869DC0F3A9E18148636E79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Monaco/fileaccess/node_modules/call-bind/index.js
- Size 1KB
- SHA256 6b4ea26f8ca351cee55da416500ffca72fdb14eb5909f1512ce8ca68e47d7621
- MD5 40109fa1aade9c89c9587e77011f7301
- SHA1 91f8eaf2fba5ee5c36e33207feeceee846c3e04a
- SHA512 d308a91b496c9fbd2db7d8b907d660142172342e990755093d892cf2b8382504119593bb83882f37db71e925803c37b9b098edc748f09eb6dc3f84b8dcc28f9b
- TLSH
  T11F118C4D77A6F2A2815121D4DABF9D0C98BACC7210A98494232CC2DE5DF468C4A92DAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Monaco/fileaccess/node_modules/content-disposition/index.js
- Size 10KB
- SHA256 e86a88a5d1a9dd74faa753ca4e47a78e38ae930f3206e5e887cf6cb0ad70cbf8
- MD5 43a307ff7de26dbec523ec966c434f94
- SHA1 ed7f187b72a7b1f81d113bad5aa9347c242120d5
- SHA512 79c073d3f0dea6c1606029b9a476cdce30ebbfb7b6ca95935a2e3f2cc97e70f3f00dbe8b7067beea78dae120f4941e60a7aa26592cff18e5cdf56f335127092d
- SSDEEP 192:NnPSCe5ZBHNVzX1t6/khk3bnEm+4qcVupDAGJvyAJK:NnPSD5ZBttXbMqenircgDAwrK
- TLSH
  T1CB225254A8C260108B9766F445DFA71164ACE10B322F68E9F8DFA7641F8DC7091BAFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Monaco/fileaccess/node_modules/content-type/index.js
- Size 4KB
- SHA256 7d76ae0f8ecc0a8c053de97b0f695f3fa3df33f692d1bd241307995304e5f63d
- MD5 4781c7ea0309edac61c3a36e3ea9da10
- SHA1 1b6e7e8d1963ce958cf0f225223fadb5ef12f86d
- SHA512 d458f8962f44ec30bf519a54aef063960d9cac2a954493383fc2ef46781c3244740f18c7daf1821b4e0babbd56b356228f7247ce40de9f3276de91a71c66c78c
- SSDEEP 96:CJFvvhHgqZlI8IDzdlalSqZf/gf6GosMySqUqMGa9Nw+j0i8L:CJFHhAqbI8IdUYVhvJMG6Yii
- TLSH
  T198A1B658E5D2A0014A4B14F445FEA612D0F5C00B321D19BAB4EF87B85FC8875D87AFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Monaco/fileaccess/node_modules/cookie-signature/index.js
- Size 1KB
- SHA256 8d762862020064468b4af17e561ee1ee29d9d55311a1c19d958c4ff2be912963
- MD5 a9634aa95d321b9a6d90bec5d3d23937
- SHA1 bb5c2c0a463aa10074caf991f67681231b1f0c21
- SHA512 214e27edb4367aa2ef322c4d857a918ebd57bc825646184f90fa6911f830b3755fce1fdff30a5d231ea11ba4ddd82b4f2afc36451289f0b4334c445e9a26dc48
- TLSH
  T19721EB0739B1B16251671073B0A3C9427EE9885227BD48F6D38D14A93EDE8B68634EE0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32