439ee1b82ec75ebbd298a20d4843c1677925edfad33bf2b6c35ec60257d03655

Sharing

Copy URL Twitter E-mail

General

Target
continue-win32-x64-1.3.40.vsix
Size 71.0MB
Sample260620-kpdw5ad13j
SHA256 439ee1b82ec75ebbd298a20d4843c1677925edfad33bf2b6c35ec60257d03655
MD5 991aac74bf98034af9e150751a287ff1
SHA1 14890d61e008b4c6cb769152d0def33f4967e5be
SHA512 b5be71eee76e26667f3c3ba6cd0f1ba5499a8792a8e155dc8df0015c1b837847ad0fa6411e9ec4379876735ca0b81a39d01223fa85f185a02cd809b2e62c5c91
SSDEEP 1572864:XDhaVz0OJVH0NWa64CFVQ30au6yUxXA7Do8Fg/IWNy5TVWsMyB2:zhigCH0NWaJCDau6y7T8kb4c2
TLSH
T111F73388C6A5DC94E32FEA7C28BADE3CE55D11732C3141C319D18213798776298F9A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  extension/bin/napi-v3/win32/arm64/onnxruntime.dll
- Size 8.9MB
- SHA256 b459471badb73d361320ff876068324e73c4f041a9a3cdb0c479deb815ebc98d
- MD5 0771dee58639540a641f1f54aa47043a
- SHA1 52d9ebb6c653cb5bde110590d4c42a03e5ea38aa
- SHA512 6972183110daa78a630419c3fb7ab538e39eaec4fb6f4866752c325cee3ea3a5caac4251b4573fc3d95f53e00c8293e6afc12512ec4a802f4f1e93634cba16b9
- SSDEEP 196608:c2CoNjgpQjxeLQUhtFputk/usA+qKu3qfugqPVXuN:c2QFp2sA+qLtge
- TLSH
  T19F966C909F5DB8E8E5CAE37CAE924F94712FEA50951485C7B47B030CDDF2BD082A5272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  extension/bin/napi-v3/win32/arm64/onnxruntime_providers_shared.dll
- Size 20KB
- SHA256 159375e0c825dc91d6862f7ee0b16063f3ff84fe754cffeafa32c02b9be3b7ec
- MD5 43503cd6ad6d46ae6a92109bc8d8f928
- SHA1 2f4d2a072305c68ae5726af50a41f2282a12dd01
- SHA512 d92de81d41d92bb467aca9943820e5be94951b2505b339d919c7c484e789a22ae7b2033104a2cc231a30b0dc2ec103ecd3a027bcf6ef230e0bf6f65a5d44b2a8
- SSDEEP 384:33KJ/wr3qWPz9TOHP3Wd5WorHRN7qr5G7YDR9zS7EQOh:36J/aFiiJrYG7Yl9zIE
- TLSH
  T184926C80EBA80C06F8A6EB7065A9CEA67C3FFBE25550C2576151F1590D937C1FB3422D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  extension/bin/napi-v3/win32/x64/onnxruntime.dll
- Size 8.8MB
- SHA256 0bcdc905db10abd392f03ff0da737c4d55331827aa5ec8310e174b2a5ad2055c
- MD5 6b470267c5e4e5cd176ca71b98639c6b
- SHA1 f542d46c556a66954a355ae1f36d8ec5b16712fa
- SHA512 6c684d40cc2b3250ebf466409c95b88f4e3cce385d98779cc01722621fedb8a841881780c97013982889824cc9108f020e3e341a653bf2f68d44ca207c4d0048
- SSDEEP 49152:nkEdsth9V8m1Y4JLIO79T4sK2b9M4ANSveNeVppnTf3x0OoAWGRlstesWDwhRgtZ:ncgCCpIzQaxed5dlNKMXRFsaqbnPD
- TLSH
  T169966D1766A902ECD1BFD17C9B47AD13EAB1340943715EFB02A005A61F5BBE0AF7A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  extension/bin/napi-v3/win32/x64/onnxruntime_binding.node
- Size 210KB
- SHA256 447b01363735daafb5b619f4d594b758105a84d5b3e39a71949e64cd595220ff
- MD5 ca876501241595b73c029cf048f1f093
- SHA1 deba543b543e096b2e2446e41173e03134140ca1
- SHA512 7039592dd208d7e747de80a0e6ba4d19c12bc253f7f8323307baba2d14eadac3d559671fc000a8a4af9b35abe0bbd5d4142d518d26d51829f67a3d0b5cde6250
- SSDEEP 3072:EvJowWGHlabqhXt85fY7Jz9sIwMXH+S1mR0S/Sl8GkYG:Eiw5Oqn8ZqJ565Sl8GkY
- TLSH
  T1D9243B5772684176D4F7D1B89AC7EE02E5B3344083249ACF02D2477A1E17BE9FE3AA50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  extension/bin/napi-v3/win32/x64/onnxruntime_providers_shared.dll
- Size 21KB
- SHA256 526a897198caddd1e64047deb822f51a5ef1b16a0fd73fc56b056129e184215a
- MD5 8eaffd37f0e3d61b00a299c81e28c634
- SHA1 12b90bc4b698a24a7e78d716e7d215d430aa4293
- SHA512 3d0dad963a5126ef99e8ea9e73318c38e90325d566f95e55d606081259c3c998bc1476b97adf428fdfd58c494ea7d3da0030be713b0ba11637f9c918d4de9051
- SSDEEP 384:TdySmxEje8cTC03Wd5WBrHRN70k5+R9zustiOlK:TuxsejTOorHg9zuB5
- TLSH
  T163A28E86FA680046ED65163082B6CD0BB83DBB871761639F1360E56D1DF33D6B7243AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  extension/continue_tutorial.py
- Size 3KB
- SHA256 53e267c63e2dbfec89c6f0070ebee27ab15f04da54243e9d529ce6a1f54643db
- MD5 835dcea735bbad0ecc6f5ea66c8765d5
- SHA1 18ea98ce01ee39c269a9f8968dc12dedfdf2a643
- SHA512 3a3928ffe1d4164d5e423b477ebc033bcbb2a00b22ba64bf8021e0fe0dd6d99eb8cc28c97074fa3e6c8e3e2a3ec056571b5b74de636dc24e75d8eb19c0b0ee57
- TLSH
  T14F61CC321F42D62D063935BB0A8FE46CA78D5449D52C6833336CAE8CA773514C36AEDB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  extension/gui/assets/XCircleIcon.js
- Size 145KB
- SHA256 fe330cbe90a579b999b33a65acaf86e82c64bf05c41302fd37f521f9ed6cac32
- MD5 893f91998d095044ef829df74d9b967a
- SHA1 5c401db4ff85110d44522b62315a89a1dad7743d
- SHA512 aa9bfd64afb6bbd67c19264eec1545ff60d1b33635c07e31d14e646b4ca798738f52ac7249b24db1720b3127ba0d897bffb752bed2d29ffaf1e5fc82950d9584
- SSDEEP 1536:c+TW2vn/r/IHcZ9MdLs6k/U3o9rXAGBgZZQ7Iddc4Oqk+fXOOJeqe:BTW2//0Ji/27Zq7IE4OqLfXPe
- TLSH
  T134E31CE831BEB6626BA346B5106F1507733C29171C4C8860A511FEAE77F540A90BBFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  extension/gui/assets/_basePickBy.js
- Size 2KB
- SHA256 3bcba545d9c745e34801aab30a156489fe1c8759e8815ff74da39d5ab5faa896
- MD5 b0d1c2ecdc30b1e39bc1787d1dc9d076
- SHA1 890014a403f83d5e592b91a7d01dce5398ad47fa
- SHA512 f0096f9c0040d56c63a7dab18b9b3fe2b6ef98b38ea8a73e3500627e4c23dad0aab3d3550a80892a96338edd2aa3526a4b782cf382c8636ab8970e677516cb37
- TLSH
  T14C5164CC76C2F5689393982080BF1CD7E13E6F61681CD680D247F0A9797981AC27BD2C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  extension/gui/assets/_baseUniq.js
- Size 11KB
- SHA256 4ac771f6996ff65c9c109423a5445813e800761ec380b82d9997368ff8b7b57b
- MD5 80fa039c0c78dd87b2b96b00c59a68a5
- SHA1 b630a94c9bb22783b69f8f97df806475d5e57744
- SHA512 e4ba5fe148478ebd0fe5dd0407cc3d3fa02d36e8f2b6044f5da955f251c2e6701771fd0ae99cd83bb4e3c8744709a874131085e5af47b61f83b3bac3d0e7eca1
- SSDEEP 192:mj2LvapmzoHW5a1y6VH7HsMZsfm6s3ttaizndAru1yoos2H:Dvapyo2U1y6VQMZr6sZzndAr0onH
- TLSH
  T1A73251C839D2F46653A698B540AF1CCBF13CAC50944CA650D1C7F0E8BDB466AC937E6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  extension/gui/assets/arc.js
- Size 3KB
- SHA256 d2d3ff1a3ab0e29773172b819077e0f9663df740e2efded95aee58e7e237e09b
- MD5 98f23f2e6fc3c783e954795bf4c94b4a
- SHA1 17637786f43c20393b6c633f8f8d0d9a143709da
- SHA512 0adecb387ebb971581f0f80e4b5e184ae55a56549588aefe1a9fd165bfe0fcdfb05590e67b3ac6166eeec1b366cce21dc00fef291e4c01e67515a6688c6ca582
- TLSH
  T14161549C7D6976E3967390A4103BB88BD3367C901E395275A00D55B438FAD3B8073EA7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  extension/gui/assets/architectureDiagram-2XIMDMQ5.js
- Size 145KB
- SHA256 8708c83ae7fe9bc7e1bb47596063d405f1c0f031a5911e5002b476a3ad732aba
- MD5 5741d846d42b116264a0363be615c3f1
- SHA1 eb8d38e3c5259edcd16be5ac8967c9f4da395e48
- SHA512 e35e1efb9ca80d0c600c199f75b224b52fe8ee5cf17f8e96a8338569515f5ef345c4836a67dfb981c590f6a64c59df1c1d51552938e03c81721af610e9a18b58
- SSDEEP 3072:B/P8vSWse5DgGgZQCov9A6IGq6b+n2oTFP:BH8me5MGg89A6vzb62oTFP
- TLSH
  T17AE32A9AB3683472835274F8492F0246A33B54148889D0BCBF79C9D35CFAD4B15ABF79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  extension/gui/assets/blockDiagram-WCTKOSBZ.js
- Size 70KB
- SHA256 6cce1b13ce1c3e12ff636c9c0f53e10351a2341d57f4981d192c28586bbdfdde
- MD5 0deb54ca04c78663dc11ece9be4b5e26
- SHA1 c8f7ba377d63cf8fd3fbc1cbf69c7c98037081d4
- SHA512 a2ec3c4fb2ccc23c0601460c8de54e9c87c2c5ec4380830a5308ed2da30f2b9450cd0f39922196fef2eff3f74576dbfbaac1470d573c1f2f6feceff9a9d649ce
- SSDEEP 1536:YDb16zybtXYkq3TdlITBpCjrPFx4Ib0p9orij0CqNcR:YUAYkq3TdlITBpCjrPFBb0p9orijkcR
- TLSH
  T13B633B6621E614AEF21824DAB9763134612D431DB31BDC9DFBAD8AA71D00D1110FBFAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  extension/gui/assets/c4Diagram-IC4MRINW.js
- Size 68KB
- SHA256 ae6ad1facaa60d5c8759557f99972d77863a64745718dc34a2e9dd71e22fa24c
- MD5 8bc49b2b2072ca712b39d5ec3687255a
- SHA1 c567cbbdd711fdf87d06424d8c41492ccef1fea6
- SHA512 4415aacf1db82c9b42fe0dae89807df9a50ad42b89d85b94b1a48f047cd7f769302eaeb1d95e5a89d7a3cdd484a9b0881c732f022f7f5aebe36b48c4dcf64062
- SSDEEP 1536:RKoCIRkjmuV7XVDobKc/7tHKcWhoLGtTzV8140rKGOLgPHHK8h9p27f4E6:0bXVo7tHKxftN81403OLSHHK8h9p27fM
- TLSH
  T12D6319DC2165230DD18961BD573EFEC446286059308688AC6FFBE7EB6814E41783FB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  extension/gui/assets/channel.js
- Size 135B
- SHA256 3b9ef33a5b37b92c6c3bfac9ec2abaac9d81710744217f4164edb27887951760
- MD5 92697452f036df409f1a949e1b04291f
- SHA1 adddf392dffe70f3247ad6eae6a4dfe8e8021298
- SHA512 faf7f44deacf75350c6917b4d312e94ca3c3cdc5562c9946163057278a680c2ca1b433039777a3c3e9204c897cdd18c4695a2f13d970aa2177aed94709046814
- TLSH
  T1BAC02BC6487803B42D436CA541150C0B4116C870FB0BC1E1600831780130AC6981DC20
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  extension/gui/assets/chunk-4BX2VUAB.js
- Size 324B
- SHA256 90c18a3da2e7c19af911265e10f9f55392cb4902e8180a4669588796dfbc5861
- MD5 33dc401db80827a0a596680effef590a
- SHA1 eb9b9963e1c9d73bb0e5d6a7c0b74cb56d0a15b5
- SHA512 b1e39d9e4cfdcd3a02e121360d298dc0ed957da7b9f0b89ef63e189284c22adb3b21d5abd97d9f332b668e04093de24336ffa3407865a3c43bbbafa56fd72bb2
- TLSH
  T11DE02CDF0A3A7424AA03370D0C5A1B4302EB6300A8818C0CA030F173AB383D2E56E87A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  extension/gui/assets/chunk-55IACEB6.js
- Size 262B
- SHA256 7a039210ea40993376b450dbd04653c2fb7761e9d3425cf926140318e423052b
- MD5 9c929f9238f63ce0672aba71993a7f9a
- SHA1 1d21b84cadc43484bba856dc1341e6367ff7ad59
- SHA512 8c1278cbe7927e8829be04acdc9335aa9994d4c1cc1ddf41290079b139a5107c6acb15fa3969b0feb6af0a2e4edf99b41b7ea3fa2bf1aaa80143eb118112b47a
- TLSH
  T14BD02BFE38B0B6B003A459CC01458D06207B5575D12AC582E014061820F65C5147FD75
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32