28bcd965d63ad626f6041211892c0a73fa6fbcc27c4fc9573321d1f7974fbe49

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.VisualStudio.Services.VSIXPackage
Size 7.1MB
Sample260620-g17f2adw9n
SHA256 28bcd965d63ad626f6041211892c0a73fa6fbcc27c4fc9573321d1f7974fbe49
MD5 729fa21cb6b9ebd7bd987dc5fab65d5e
SHA1 06dffae8b06f8b7738f4dca89412b9d83004a58f
SHA512 1486e078060bff93770bb709a5563656bd27aefa761aa47fa5785a74698cb75030de9a680be210bab06d01eefd12b58157d4913cac34ee14f685a45c5276488f
SSDEEP 196608:cZF0itZKayc4wSYekcZA/zFJoXpPfvx2z0cJG7wVs/poq:MFdZgcbV4m/pJypPfvx0ZJG7wVshoq
TLSH
T19676339875B98C0AC97CF834FD91F5029F585EEA6C91380B71DE8B8E4C119F3439689B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  extension/dist/extension.cjs
- Size 5.0MB
- SHA256 866322ce2cbb11b05f4280a7dfa4c835741402866ce282922b90b53f89c71cc1
- MD5 6fdc65a392e93feb504b230325320115
- SHA1 faeb450086acd2b73be7f687e0d69f50e40890c3
- SHA512 9aea586526fdcb5cdec051d3dac217df79706b565feae2e8165c6af99e0db706e841ea8d32a277d86a1d3ab8d35e22fd3fed0057416ebe222a7771e0a7384906
- SSDEEP 49152:/L/+Yk4hfwdJiDJbGZl9sc26KEvxCObyYM9RL+acsfw21812lZ1kFXqxqU4VipdF:3CaNCSZAO8DKz3
- TLSH
  T185365BD97392757207DA61E4D83B0106F37AA958540C803CF7BCE8E77AA5849A1B7F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  extension/dist/server.cjs
- Size 3.3MB
- SHA256 f682d77151833d0017d78377311ffd6b34cc2ec68dde50933bb37b990e817e5f
- MD5 b637ecdd445dd0867ac51c87e217c320
- SHA1 923fbe81f4c822996c45a2f53c688bef0adb672d
- SHA512 0a330d323ceccee15db2d3481c463f0c23393f40fbbd261623236328c334ca7585326943b039fae2eb9834e450cd5504aff363cd2041b2eb829614675337f9e2
- SSDEEP 49152:Zs3rhfyNPV+lkAiyu2Wnr+5VPXrXvLvRSpZBR8vU2T+yHwLS8UuFMmh8S5XAG+Hw:O3rhfyNPV+lkgVPXzYZP886dDmFXtPf
- TLSH
  T1FAF56DD97381B03687CB62B5502F9006F3365558944D802CFB98C9EB3AB9C5C62B7FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  extension/node_modules/@prettier/plugin-xml/src/embed.js
- Size 4KB
- SHA256 5c0e7364822e112c237254d965c11c144ee1ef94a46afd2f3bbefd05e7cdad9c
- MD5 b2feebe48b1977e19afcd5b2fc540e72
- SHA1 3065fd9aae75aff9301fc80719798ea95aea84eb
- SHA512 5aced6f6eb556ab3b8fc754aa369a3076940cdd3cb026cb39aebc72d2758b9d21a210db9e2d064d57bb04d440d5dabbde9ea88baa3ea6323801bdbd3a264b649
- SSDEEP 96:CzRX8oFfVqFy9Mu85mz4EpcLGq+f8SV5n7P5Ch5CZ59G983oDQ:Czqox8M9Mu85Q4EWCqgL97Pshci9Mo8
- TLSH
  T1C481326A36E113350B8512B89A9F70A9B238D027755DED81F05DC368BFD4A39D0B36CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  extension/node_modules/@prettier/plugin-xml/src/languages.js
- Size 5KB
- SHA256 a01f8c355ddc4313d0edeb2ac1dfbc7697094e5b33b8660569fe1d146593aa92
- MD5 93cbe389f0ca04c3e9392f0f0bb7eb94
- SHA1 aced6be9ae832ad296a8b343cc99063f59c0f529
- SHA512 bbb027e000172d653933f589c5a7f7eab579a7649e84f7dc22408ce7cd03bb22bd2dd0395dc5d742db3a4c84b2fa624cf8a5782fcf2c853012ddae44516a73d5
- SSDEEP 96:t2wxWQOK5xeQJq5xeQIo2uxeQVSyA4xeQktg5xeQmlLxCGQCKJxeQlrJQ8O3GRmU:tJxWQO0xeQJUxeQI+xeQVS0xeQktCxew
- TLSH
  T110C1D317C8265DA326A949546CAE2907B93C12E34C00FC3E7FAC6A5D2F9E42F147277C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  extension/node_modules/@prettier/plugin-xml/src/parser.js
- Size 5KB
- SHA256 7073af85fd425da6f77e3b5d2af5624325ea604aa9bc115acf7bbf34e4e89e47
- MD5 5e92595e6e546d2790a9b2fd310573d8
- SHA1 f2ec804ace829bc20f92c3fb2598258737a991d9
- SHA512 2542969613d56261e2ab5351a9d24655569085f3e4d3d46b3a9344f4709f84c29cd56a2a50679f4dbaa94a30e538b1c331fc64e00b0f1308ad59cc40266d8e2f
- SSDEEP 96:i0r/75CxldApsbbD4806sFNDTuHLE4PxUy/bybHU9G:zrT50lssbR0JNDKHLNxUy/bybHUo
- TLSH
  T12EC10F4A256116D3079755943A6F2240B831C87B2C1CBC7336ADE712AF6871D99FB3CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  extension/node_modules/@prettier/plugin-xml/src/plugin.js
- Size 2KB
- SHA256 b77a73a9638be112d43c328d7b8a562b9ec8a8a58167bd4723345c678428bc39
- MD5 f2072a8e62e09401a6ab984d7fa9a108
- SHA1 b5a769532b47a616e8d5d9f5dba755023a7fad91
- SHA512 741724599528e89704c70c6f45f510e56a0843345ad1cfacfc7b11615bb712d1cd68c2b6a238eff5331fb76f6de2d97c6b093bbd78028aad54ed460b3fe56796
- TLSH
  T1B141BE1DA968A1E78A5B90A09D9A95517634824F6E3B7CB83FEC80461F0C58EC0F739D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  extension/node_modules/@prettier/plugin-xml/src/printer.js
- Size 15KB
- SHA256 5eecd90180e55f4b873c1cca183a6b7ce5265143b18a88a6663a36fe8f34719f
- MD5 8e51b27901f2bd0a1469911ac41e262c
- SHA1 31cc4c38d5ac8458182a90d4418752ffbf858a25
- SHA512 d299cb904dab3fe7f639c8417205971451e53ce3b21891ded248465341d54402306594f14952e404db04ca683209b48485ab5e526d31dfee5669640b2be82d79
- SSDEEP 192:CmXRNPg7nRtCclPsOPFlXVyJbVEN4QhGVBgCihB3hD9vOW54S/3o8kD1R+h5V1RJ:CHbtd35o89ADo
- TLSH
  T19662516A24F225160FD7A36ADA4FA109323A9457349DF964F95C82042FC6B3DD0F3ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  extension/node_modules/@xml-tools/parser/lib/api.js
- Size 602B
- SHA256 e07fcdede56488b2c99b7bd2f138d9644719928fc11fd08d23d2a87115f89475
- MD5 af5a8df7797e09400abdca4a5730f5e3
- SHA1 39c68617651b197a2b8d97ace00b9e0d189153b6
- SHA512 9b63c79bd8604b675e754cf49da88eb4ac5ca4258a251b9626ac94df88eeb3d0b39fb95316a1fc213fb2fa1cf3f8bb88e9380145ec3f11ab0bf37006bfbe1a6f
- TLSH
  T1C1F0AC0089B0A6005495059EBE9F04D32552A097751CD980391EC3DD7F42C07AA631D0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  extension/node_modules/@xml-tools/parser/lib/lexer.js
- Size 4KB
- SHA256 176bf9d6a7badbba75b32eda9f692fd6533663a1fe8eda0f52620ce7aea0c861
- MD5 963c3f9fe5e431a11a18adce59138e47
- SHA1 43e414b9292064e0f9b106104d2872e65015d761
- SHA512 0a1f3d463c2a95599b79ee333f03441e17d52f2d677d4e1bef799ddca5a3aa5132415b749f8ef9a9f530ff5ede29c8231695cff5b3c675a2e5ee11a89a83e034
- SSDEEP 96:6lUZjkt5v+LR8wQoF4fftff2Cbzp+6v6wCrY0F:RCt5v+L6w1F4ftf2CblB6wC00F
- TLSH
  T12CA1D02CF5F11591847685E50AB69915E2F14403391DB875B2ECC3E8FFEB68E00BB68B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  extension/node_modules/@xml-tools/parser/lib/parser.js
- Size 5KB
- SHA256 aa61adcf201cf20430b28055e5c2f8b61cb25177471055a44106242537f7fa2a
- MD5 64c928546ceb40374346b40dcdf98b1e
- SHA1 8023c5fb416ba433371f70161515b30d10989d43
- SHA512 0f56439f737cead3981ea3a21b9a8f9f60e78fae7f429b38ca1516b8b65871fa9353e262f12f23d9de07b9ecde257bfbf73878ac0cffc28cc9b81cd0a210267a
- SSDEEP 96:iLpov0h4mDkztLxgj7YN4CbjLvjlQfYo4vS:Y47tFgj7e4CbjTRQgoyS
- TLSH
  T151B1DC5B77F61121483366B89B4F986B72364037D6AADD013E8D62885FC95EC80B3BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  extension/node_modules/@zowe/secrets-for-zowe-sdk/lib/index.js
- Size 494B
- SHA256 2dff85101b4f2e81229721ba80349a256e3d00dc28bc68247a0ad7b1e104447a
- MD5 19ffa3d75c630fad19d3aa69655897b0
- SHA1 d9e3ee7808d7bc01c2dd517c5cef0bfbb457554a
- SHA512 03b4b1b3df2f85d87ffe496bd5263102cebc867205aa2520166aec1addb9cf809c7f9fac1804aff085ff3a5e02b3c5ff64fe50e715356458cbff1e3cf382b57c
- TLSH
  T1F8F09E7BEB7087E557A140C98B33E68AEA4E30A5B12A1025A24D4E59942585151B8120
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  extension/node_modules/@zowe/secrets-for-zowe-sdk/prebuilds/keyring.linux-arm-gnueabihf.node
- Size 359KB
- SHA256 a84620b341d0c399418ba435e5f2c1805614a8d0d718caa47d7dd48efb72063a
- MD5 eec8ad75ea1ff30e67ac7f0a34d2ac4e
- SHA1 bfaaa6fbbc2444ae84f3dd69b289a597a1a62b82
- SHA512 8446d622be393cf8a6ba3ee19dab55dd6994256651e4caee725a0556447ef25db2cc3926125b26ede4f26fc33869c3e3e91428816402e71f183e344ad88a72f0
- SSDEEP 6144:z9tsYXTCC1QQYCd9N9ZKfqwbCA76/qHVH6pqgstbxR+dSTL6dhRE:zPsYXTCC/Vdb99uHUp5ObxQsnGh
- TLSH
  T1EF74199AB8429992C4D426BAF67E82D8334743BCC3DA311ADD15CB347ACF99D0D39B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  extension/node_modules/@zowe/secrets-for-zowe-sdk/prebuilds/keyring.linux-arm64-gnu.node
- Size 352KB
- SHA256 65a62ff79172ae5e5328b33e0aa199b9925973e9913b3ec68c2b696c4a581c9c
- MD5 b67c71c067ad377233a8081b04c8d278
- SHA1 21ac69b071a82c6afafc24d045ca237e7325d0f0
- SHA512 02f6942c7271d0c1996aff34b9942299ac26467ef597c63727592b481ab0236711f9f7f1e0fe1e320dd1301d851baeffc0a72d166cc4bc14ac7b208096b81cda
- SSDEEP 6144:ZRuaosjNQ0jUMMA61NtV3O9YPBxg/M72rL6jNJ2oLN+2CLNZQ9mCof:ZRuaosjN1SA61Nz3O9QBUf6jNJ2E
- TLSH
  T119747D18F50CE936DECAF47D8D4E89A2F02674AC0561C0553422D36EF6427E99B3DBE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  extension/node_modules/@zowe/secrets-for-zowe-sdk/prebuilds/keyring.linux-arm64-musl.node
- Size 388KB
- SHA256 07c503dc3ffe48b865fee951306b10671e5735a19cca627b6f563aa3ad7e667b
- MD5 83a40cd9af6da9570cf41aec66f15932
- SHA1 171c2f0d47190c586445db3f4084a441c97cbcad
- SHA512 40aaf6303ab8928e86dfaede0ca3137cbe39dcac5f11ad45500ff460805fa06da886a69aeaea42e06897d05bfe6229be338d9cac578ea526feb76856a4662074
- SSDEEP 12288:T4GaF+coelttITMn0AAYVGa/jWbHYbg7:EGi+coeBOM0c/jWbHY0
- TLSH
  T158848D1DF54CD436DECAB4BD8D4E85E2B02634EC1521C0693822936DFA427E59B3EFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  extension/node_modules/@zowe/secrets-for-zowe-sdk/prebuilds/keyring.linux-ia32-gnu.node
- Size 402KB
- SHA256 f619cc47e5adca1ec19a4240fe825024d8bd74690481197809aefbc07f68826e
- MD5 bdbc6785e556dae260e53a74f68822e8
- SHA1 09efa462e6463dea2e17e8b5ae32a3c65e07d7a2
- SHA512 194fd431ea65f3463707bfa93d35eee03256c91d8619d73eecddbfbf53f20f9d0d91476fc0e289fe0660881ee12ef778d2667e8cc815bb3ace4ccf74182d3776
- SSDEEP 12288:6E425vdMkniFJwbLKdTwP5BEwKsjcVPT5nY:JN1XnWu/eTwxBEbs4vY
- TLSH
  T1C7947B05F701D1B9F13714F1501FD2B6C9261A39452789EBFFC9EEA8A63A6909F29303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32