617590f06f9a0266ceecb3fd17120fc2fbf8669980974f339a83f3b56ed05f7b

Sharing

Copy URL Twitter E-mail

General

Target
node-v7.10.1-win-x64.zip
Size 12.0MB
Sample260625-ph2rtsbx4v
SHA256 617590f06f9a0266ceecb3fd17120fc2fbf8669980974f339a83f3b56ed05f7b
MD5 06ab7e1de7bb06903fa0d25f6c52d04c
SHA1 6a52ac477148ebf8e4bd5b25c26a448600c8ee39
SHA512 a4218005e0f2aab84b8d74277ca6da4abfa47277048ba5491a055f5688497024de01e1c562d11418f546cf3e941456f0fa239c722664c875907a84910646d9a6
SSDEEP 196608:OunQZCTi2v5EbvnHeAjaS6CMBp8RQ9MylpcczOXm/RJFW/QebxidYumfjm0lzBub:OJZCBWvnH5adh8RoMylpc3m/fFgpeYun
TLSH
T1FDC6E084C1BA0937DEEEBABBF4C9D2A39CDDD7C608106C26086C67CB1C726B156D590D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  node-v7.10.1-win-x64/node.exe
- Size 19.7MB
- SHA256 14d48dcc8fd1845dda208d2f4d9df9b9ebf436ab6cf638bc7d316f646b3aed3f
- MD5 ce1f32b02a3381e12b291807cfe69230
- SHA1 5d05c9ad4d50272d829c0b58e8933b9886daa5b3
- SHA512 3527f60ffc19b897f908835c9d279cf2321663cec5965d20da2b31d0abd497937e09e35a25c0e3919b1c0300227ff5cbcc5e2f212f893d8e955319dd7ddd43c2
- SSDEEP 393216:ewONWck5oCu1bTfq/jkqG2tPaEB28JpdV4AIM:ewONW1928/4AIM
- TLSH
  T194278C46A2E501D4E5B7D17886AB8507E7B3BC1607319BCF206C67522F37AF06A7A730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  node-v7.10.1-win-x64/node_modules/npm/Makefile
- Size 5KB
- SHA256 70399dfc027420e2ad70d37a269d549ad98cb13e0d90e8f185fe1200ce5ec18d
- MD5 7a506b6e91fbca7b5fa2b96aeb68e4d8
- SHA1 7b62f0bab2f780b740c5995176674720ce47b9f7
- SHA512 c119d4e92f6d613ad6bcb66e4ecbd8bb5f849cf9558b3c90f162ba1ffaaf1859df59bf8626051d8adc44c18b6e1d707e478b238afdf4749c111ce438c59680e8
- SSDEEP 96:wPYKltbalzlW4lO6alzMlufvY4BvWcQxio0iMhV9U6gwEEg2YjNv6EmSWxBzWUht:w9B0BhUKOlWcQFwhV9U6DEzWxBzWUh+0
- TLSH
  T146B1E109C923A4786C246FBB92F657A8ED90837B35130152753D8A6DBF937F41192B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  node-v7.10.1-win-x64/node_modules/npm/appveyor.yml
- Size 966B
- SHA256 727bf32807b9bdddba83671ac0c8ae7c8b24afc3d99afa42cad61ee034fdcb12
- MD5 b8efa2f4e2b6c94d38d62bbd162219e8
- SHA1 82613605029935d5395a6dc147a895c430e90bcc
- SHA512 d667d1615f0cb4fe47eb3c6e1090ca0eceaf48742a0447c67ec60e560cd76c44c3eb6be23d967ae19da4009df5efc77ec5ce29c78a73696f56bf450e579a09d6
- TLSH
  T1DB114011DE06D4FC79F00A6B3853EB51E37E92A3E24384AB3CAD42211F1762F06321B9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/node-gyp-bin/node-gyp
- Size 178B
- SHA256 ee2c0cd004287093a3767c0a31d9a0a3c4b00c0517cc974473e2b483eef438e7
- MD5 6e25816f1ec43ca4d9df43634f4fdc74
- SHA1 34dff6b10e03a33507fb0ad9131304ee036381cc
- SHA512 55d1a85ab49a293a7787a7a223977e8472b8204a447135de7e01e8e82566485a268508497bd81fa9d5ca454d23541035e9d7a75ad5521f82c84bd4065d1ea76b
- TLSH
  T191C01235B2F50D960E6D1953ED508C050DE9D2F10D4A5E04D39C2683D4A621194ED00E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/node-gyp-bin/node-gyp.cmd
- Size 149B
- SHA256 8cb8b915e6f433f7f8994eae04e74595d5a169d1e593833bb4a5f2cbe213f02d
- MD5 bb78133f243ec53a16c89c436ab54216
- SHA1 e6071dd04dbe0b3560c3279ded8e44e1d0a0cede
- SHA512 8a94c4ad3cd4b414d5c6788083b801a6273c970a173461ddef7ec48626fdba8040c9a8f4d1d848bf05240a36ae0eec40db2c779d1a5c3cb04c99ef5bdaddfb59
- TLSH
  T148C08C1A66FC0C174B2B2E23B282803948EDDAE306040952AA5C25E0ABCD00000C2085
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/npm
- Size 867B
- SHA256 90cee2cf125ecb076cfc731034694459fff1206feb33d02e0424bc378993c909
- MD5 593f51650b83a10971cb6d3c90951a20
- SHA1 3ad8081c76f557dfe66cfd96faedc6b9bf684c51
- SHA512 d9dd1fea3d300a4af44fc36fb2b72a0654070944a03204b0ecf9c8f579b46ec85f2bcf0e2397932aa3a48fa46af53ad7f6d99ee4ad778a73b8247f96e880cfee
- TLSH
  T104116BB9A4FC4E992A3E4F9474615C44FC9B906338F024C1762CAA04DFF56B5620735E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/npm-cli.js
- Size 2KB
- SHA256 4e2723fe90c00bbbd2a11fcd82914794dd6f18757bf38f6beefc026756bc60f0
- MD5 644e418d8a1e2de16f37aeabc68e88a9
- SHA1 f123dd7031ffc7b81cbc205e72f2c2b72f900d89
- SHA512 3330cd4dbb0ac8455a11c2ecb5c02f7549ad495aad964dc05456f3b2e63d4007b7a8c5d72cff9faf813bf2e7131d375d62afaa9c6b4408d502c4cbb784abcf04
- TLSH
  T19D410B195CEEA66331364756A80FAD0AFB0299B30330C65174E8E6197FB0597F52BCE8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/npm.cmd
- Size 483B
- SHA256 afa68b96334ea8493bcb908743af3dbd619cf26be7b44460179abd4d75d849d2
- MD5 d5b5acb61c9bf69fb8bfc65eba28c6ab
- SHA1 eebdd696f7f1aaea15ac4e10f5a6e5aa5a6aca8c
- SHA512 69483d7c5e49efdcdf054b3c5d96d9d315e436f60ef3059dd6a80472445d79068655a8a27d868e907f2ebafc49b8f638947b2fb49d42e4a9f427fec74fb58822
- TLSH
  T14FF0E2B6FCA94EDC711A0F613C36482574CB78477C6220E6262C8865C7E46F400C339B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  node-v7.10.1-win-x64/node_modules/npm/bin/read-package-json.js
- Size 537B
- SHA256 53da179c2cf97314b6ba57a610f0cba4cad6163f1d86256182fbdb72d9e6e85e
- MD5 3661b64a3c9c17d4ae80b50fae3f2aaf
- SHA1 f5a8e6d3dedf0863b546172a62a2fe2307cf55ea
- SHA512 981b6785005f97a9f20ad575883e78a1d4280b85c34ce7d77b17bfc963941bc62da38e5eb5f4d0228bd713365221e818a9099535be589d9a9dc65a01aef6f0f0
- TLSH
  T140F02B0469CD11121E322BB0680F290BF6967D2349248014BF1EE5423FF4D20B69ADCC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  node-v7.10.1-win-x64/node_modules/npm/cli.js
- Size 50B
- SHA256 fcf981738c5061cf413e851261c4a2f74c5e4377b0c196b4cef7ea2df88886af
- MD5 fcb16db6641ac2ee196e378fdfb9c4b6
- SHA1 5c1b2d51097dc4dd3c0b234ce4fc395a21d71e90
- SHA512 2b8f086bb7ac28f0f8ef93ebd27f9455ffc729fb13413fdc632ae5f4a4c0b21d4e0c49b33e52dd0601f59b445992822492aef5953f9bff52a8d8e669e0f92aaf
- TLSH
  T1499002646E48445C68400F9100580B106592A46559A4A56981411996DB863D02508C17
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  node-v7.10.1-win-x64/node_modules/npm/configure
- Size 554B
- SHA256 dd8b9dd1fc38caf2f886132fd535433afeb141d924268a26535af6e1defd7cab
- MD5 109a12a9ee7ed798f03e6dbfc1fe5ee3
- SHA1 5a8f87e8a1778740444c31977a2996bb9639556f
- SHA512 daef0ed8d86e7a02ed60f287e98d67a6b8472063f2aa906687b14c5a6e59cbef75fca775023e1f8991d16b347eb1ce32f151c4c1cb91478fc8f50410246ec332
- TLSH
  T179F0C062219669250537A591DF8B002EFA60C16F1123DCA976BFC2180F78C7703C32AE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32