2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6

Sharing

Copy URL Twitter E-mail

General

Target
OpXOyuApWKTlFzrV.zip
Size 24.4MB
Sample260623-glspbsav6m
SHA256 2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6
MD5 2bfb8be4d04d2bc234a5492745045f3a
SHA1 22ad5ca3f8834c7bbd8e2517d43c514e78adbfa3
SHA512 a86f89d154984997ea9047a9c2cfd0c38003640443163fe8ab8559c04b17ea04aa376b5da3e5a99563201f364719e0488168095f614d51b105353c5289a35b97
SSDEEP 786432:kwy47xWLcV+Yr6yTBR7iN5/4rZrURRzd4F3L3ihF:6tw+YVTDu5/4trURRzd4F3LyhF
TLSH
T1F04733EF8C2253C3F7576BF0D95B9F8D8A2D324AC3A033A689E07245B555A601DB03D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OpXOyuApWKTlFzrV.zip
- Size 24.4MB
- SHA256 2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6
- MD5 2bfb8be4d04d2bc234a5492745045f3a
- SHA1 22ad5ca3f8834c7bbd8e2517d43c514e78adbfa3
- SHA512 a86f89d154984997ea9047a9c2cfd0c38003640443163fe8ab8559c04b17ea04aa376b5da3e5a99563201f364719e0488168095f614d51b105353c5289a35b97
- SSDEEP 786432:kwy47xWLcV+Yr6yTBR7iN5/4rZrURRzd4F3L3ihF:6tw+YVTDu5/4trURRzd4F3LyhF
- TLSH
  T1F04733EF8C2253C3F7576BF0D95B9F8D8A2D324AC3A033A689E07245B555A601DB03D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Potassium.exe
- Size 74.9MB
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH
  T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral3 behavioral4
- Target
  WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  autoexec.lnk
- Size 2KB
- SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
- MD5 fb5ebf1ae11a1059b54a7c1cc769ead1
- SHA1 0d4b9b9c8aa8833f2a4c91f595c915f82926a2c7
- SHA512 d66e93ebcb0b496c38b1c9b3468125240530b568de9993cc3c8454aa0be96353ed09337d193195b71e9a0c4c2ae280f36f29f5cebea6df05801e48c8ea269c01
- TLSH
  T1834115035FE60521D3BFCCB91EBB340A8A677262BB4109094114D68E1C71D17ED2AB1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral6 behavioral7
- Target
  bin/monaco/Fonts/JetBrainsMono-Regular.ttf
- Size 167KB
- SHA256 1f376439c75ab33392eb7a2f5ec999809493b378728d723327655c9fcb45cea9
- MD5 0189ed701950c39aca7664f1e9c3781f
- SHA1 b0b6367aba2b3b1af5bada719d1c60fb3f948153
- SHA512 6b1ec7ca142cfd4e4c10f4d111418a1e5f02caa51375a1e7f910ec4d4c597bf8ae4d7592954c46ab3cb638028ee7f78ed4503c873c20241d39e116749cd6bd3f
- SSDEEP 3072:6P9e1jwajdz5///geSPx0tCxS0SHWaTYJDKcHjHORg:6P9e1Eajdz5/XMyCxS0SvCHjHZ
- TLSH
  T155F32907F78BDB56E5160E34427933B5A362EA23AB57438B94486A59DCDB0CC0E2D3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8 behavioral9
- Target
  bin/monaco/Fonts/JetBrainsMono-Regular.woff2
- Size 56KB
- SHA256 d43399032a7a3c539287a31645ded08075a3ca72de0921b62a51f65c3ca7a002
- MD5 8b0d4df1e1345ca043a37fff49f47ed6
- SHA1 0927db10012a27d2504240a93cf79077097da4dd
- SHA512 49d39d5196245c531f5dff304efd0367d1b95c805c3ee89f201105345a5d8a64e84bafa80a860ed918a0ec343da98c07f412a4ca3935b8088d982275681731e1
- SSDEEP 1536:EUxT91+sbKKeF5cSY8m3A3Ui9BRjg9/EtePGSsBd:f91+sbKKccrT3A5uMteHU
- TLSH
  T1CC4302E4D359C97E3F06CABBF6C4FF6EC256995A5A41AF43E0BC51E62108108452E22B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  bin/monaco/index.html
- Size 18KB
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH
  T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  bin/monaco/vs/base/browser/ui/codicons/codicon/codicon.ttf
- Size 69KB
- SHA256 4946e7465803ccab735800d9236f188c2200d28b395e77727e9aa0baa443b87a
- MD5 a1cef3d530e1adb0f52b2f62994a2aca
- SHA1 074579894ad91265941fbce44d2b41c863797cf6
- SHA512 423656417849bddd0f7bf01138d9de54b334fc0ca64f28c5d679f66e38f5bc3c601a0faa166734cde4c2ec1e56983c36ceabdb3265c414fc40a7ee3798ede52d
- SSDEEP 1536:ex5Ez/D8G5dlHwkP/7BzekxVL7/b/SS0/hczE00phJgZExGk:ex5Ez/D84HwKxemVHbKSm+zEXHJMrk
- TLSH
  T12B637C06C3615E6ECD739A7E459241118995A406F37FCFF3E947BA23801E8DA0FC9E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral14 behavioral15
- Target
  bin/monaco/vs/base/worker/workerMain.js
- Size 174KB
- SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
- MD5 9ce9e46b6d66d8b2dbcabba577cad2ed
- SHA1 397b0e9e7b2bee37a8444e84bb9788a0bdcb023e
- SHA512 f322ea669fa81397066edef062721ae3dd515b3d61c4ad7bef0db0eb3a53f056da298fd4f761bd3e5d613e6f5803a7c35ed056085ac3b97e06c7bfd47fffad49
- SSDEEP 1536:mi5eQeCEwCP1m9JXKmA1xKzyOQJf9X2K7eM9bWXsUK5QSkSoIMQwr+ZjtQYyeTMO:mHTdkKmA1yyOQJl2K7ns6dZ/RVaNzY
- TLSH
  T1C9044CC53265984353E652F5A07B0107FA38B877680C556CF3A8C9DF2D6A88760BBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes.js
- Size 2KB
- SHA256 9636806a05da6a43937d122e2211e8d2877ed95caaf691f4f079dbaf47e0c6bb
- MD5 c25a7c14fa5635368e75d154c185755b
- SHA1 dcdcdbd05115311a0929390b82b6c5c2b029aedc
- SHA512 3a6b15608fcc48f78a6442fff4fe7781603ceeb7b8bb06f2c6546f821be2cb824612dd5d143bdecfa4de33a3f1f5723d2f643d4d7de2ec2d1bca3fc1ba5eb44d
- TLSH
  T184517096B7CE6BAF598C33ECE4778406A69FE5336116883DFE0C90C410D3119A2E89F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/base.js
- Size 521B
- SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
- MD5 29e50887a6f1c445e0f63bed73eefb83
- SHA1 b8e006b9ad14bb6012497e164d9a4f926e2d568d
- SHA512 16cc7fd8b5641d347a6a9e8542a6ab29d71a432dfb2f72dae05b21b274d92208ec7c5a9ad1ba313658f3a68aebd9edc3d0bcbf07a03d0f16eae95568f175dbf4
- TLSH
  T1CCF0976BF78F30CA1E474385A73AC1495C6EDC32D2322035F51CEAA94488C2923468AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
- Size 33KB
- SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
- MD5 fabe9b3ec7774eb374f18709ab41c8c0
- SHA1 de6c19413ef008000357bccea90faf0d23ccf605
- SHA512 d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9
- SSDEEP 768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW
- TLSH
  T1E2E231E7F38C3593199B4784A27EC68539BEF6BDE4F10079782C5608079481933AB67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
- Size 11KB
- SHA256 573e821c40792e10d2dab59ee3483e2482379241c94b2b98ec5fb098556e3e89
- MD5 f2adca6e8020236f5e86b8e6aced6806
- SHA1 1f77dc5554c3ad94a78b693d1bd8fb859138de03
- SHA512 040fbb8bdcb58ecd2fbea318ba661efde39f96ac2e3aa751caed100e1b4a8941916b8a9bcc6335ff76875d558a2994866069f50f88beda76b7f09f258fe670c1
- SSDEEP 192:AJCfeXBM5iG6zUMmYmr6QMlr4qLYFQjG6AcE103aNd9xZAqGQ2qFARewPxHFTX0:9feXB2iG6zUMmYmr6QM54qLYFQjG6AcQ
- TLSH
  T14D42ABF7F38D799719438786AB3DDA842E2ED938D93240B8F70C6615248C959232619F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
- Size 594B
- SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
- MD5 4d0ec8edaec389b1eba92c1d18676f09
- SHA1 6eafd8ed47700b9a2ff1e10dd7468e50fab1bf6d
- SHA512 d4c7655d7db8d4f7d4bb2d0add36bef916caf291b2855785685a3e812279369848ce081ac6fb5cc869fb827653a4a1f874273af17bee67987e3c3a441ad368e8
- TLSH
  T10AF0EBBBBF0B3697060B63C8AB3DD740192DC831C4624425F20C5B6040C0C2772360F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
- Size 1KB
- SHA256 f7ada012dcc309b7c1cd272d1a81657b0ddb3d51521e682116522099285d525e
- MD5 09bbad4c05be7ab76cc3c5ef4fa9ddc0
- SHA1 a38cb372349a2420619e2fb629f0912500dc1064
- SHA512 40b753d8e97ba46be9fe4241dbe892bdeb62c902ea088d68ee7ea5ce0506d51b16f7105355a6b5360363c80d98b0f644b7a7ea2b4262210f24870368a2629c44
- TLSH
  T1AB21EBF3FB8E304B1D028785573CDB011C2FD834C87210B9F108A67090C9D42225B29B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
- Size 777KB
- SHA256 799c0657b0ab027c3ec0794e8934bed4a4a8e7f063dcae47783a7f32fbeda25c
- MD5 b1e41317d3ffe843032f5eb6f74806a9
- SHA1 506f617da8d8093ed58cfda68e0d60e1aa2ed08d
- SHA512 fb538a73935fd41b9f2ba9f6ddcdfe066f6f672d5dfe682dad301cae3392a93405fd35ee61126e9889e14f71c51e11cdecb4e20d213ba91b34801ec5b89ce02a
- SSDEEP 6144:0XUmTfyptLD/yxnbDh+hIAKVwhWppLTl+ExT3dsX34hAhbAhQ9qhjLmWhXXu:wVyx
- TLSH
  T136058CF7B78D6A4B2C07934AB63DCB04393EE6B4DC2254BDB65C7B2075CC901126369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
- Size 16KB
- SHA256 807dd6d35bf5fffcd4de4aa4ed1800716223a6fe014077f23f2f652ac86d2a31
- MD5 430fa91891107d6f1f3c3392dde9ff4d
- SHA1 5d42ebec7a7c3f5e5b7eb074c38572345e33c1c1
- SHA512 22011409e428216a619ca085ce8e034dc6bc3a8f9de27fb4f2e3dd6b8aa8cc7aa3b02508af816137f646ca1fa96e083a832e68bd8c8b016bfd7a3674d532a875
- SSDEEP 384:pFcCsgQgj6bPo2nv5CYR8/+qvPNEzH+AK6/NBA8K/tQsdz6FKRjrDcWYUeih+hrA:pFcCXQgj6bPo2nv5CYR8/+qvPNEzH+Ak
- TLSH
  T10E72DEFBF34D36A71D4B4281EB3DEE46261FC67CD83201B0BB5C6A15164885623A785F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32