16e36c648f5abc154d043a2747afd0ecb76e59a978225e235738fe2bcdcf9b0b

Sharing

Copy URL Twitter E-mail

General

Target
template-win32-x64.zip
Size 7.6MB
Sample260627-aqk2qagx2n
SHA256 16e36c648f5abc154d043a2747afd0ecb76e59a978225e235738fe2bcdcf9b0b
MD5 1c3b25c3bbd6eefcb9562e80e239363e
SHA1 ebdb9e63683ea5135b219d78fd051daca0724a4d
SHA512 4e87d6a5f0c8e79f17e2f8833e4d975b7da0203a2eeb1ef965040e98f2c2dd2a68af501ee3df36b0024795bb6776affb3ae0a82c2e375d937396a333247cd2ba
SSDEEP 196608:CXU0ehGVcGPHRwtGCBrHkXHELtI6cbpo5wCcap5:n0egiGFUDkXHSpctgwbap5
TLSH
T1BC8633CC27022B93C63FE831727278D7DAEAFB254EE4934691991AC44C5374E8731E99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  app.asar.unpacked/build/electron-main/vbs/ArchitectureAgnosticRegistry.vbs
- Size 2KB
- SHA256 27c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d
- MD5 690f4cc91ff68ecdbcd8b014c7974c44
- SHA1 277965313def6d5097ece7c910409dd1b517ffef
- SHA512 e6d6ef66dfbd7da01100d92bd5f9b936dbd408538484f8f9a40228f9e4ddac3f65ad5aebcbeba2180b55aa976b2d7adba3e95bfe4aa4b49ac6dc68dcf799925d
- TLSH
  T16B51AB0B24F696109C6575F0DB7E0D1FC6BD24DEA2A88AE0F2BC0172849252E747EAD4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  app.asar.unpacked/build/electron-main/vbs/ArchitectureSpecificRegistry.vbs
- Size 8KB
- SHA256 6786fe4e7f09d2266678e2beaec09c5bc7fea8bbb2c34033f37a2a4f3779efc9
- MD5 ee5af2ed3dd0d9efbcd172026bdd7260
- SHA1 fceb14612cd086a3e285b5e137b0652e8603b354
- SHA512 b166e68fd6d17d8029b8a2cb3b0ed14ce71b3c607d5182f10e05c7f4d8ecf76300034835670031e283f54fa3fb5dbc165e1ad9a4120140c3fef98a34d834250e
- SSDEEP 192:KQHS6Su0ECBgJOBSrBExBu1B7UBcxAvBHc2GB3XzB3/5BvtdBv+cB3uxYvBvdH4:K3FxECBqOBSrBExBu1B7UBcxAvBHc2GC
- TLSH
  T13B0236094DA3D1142CC869D8CE59AE4DDDEE651833484AC0B5C08E320D6FEBF942EE9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  app.asar.unpacked/build/electron-main/vbs/JsonSafeTest.wsf
- Size 217B
- SHA256 c2fab2eb9137feb5ce29833d58690a0735703a0bd2f38538061758b47a44105f
- MD5 b2f8fff6092358229a94cc309ab6c11b
- SHA1 e4c29b96408d58d9196ad971cabc50d05bc94c4c
- SHA512 a1dae465d9b9ba874d1497485e08d83471d3b97cf1143dcee6cbc24c0121bb6f1fbbb8aff66239aae46ac0b8451fafb1cf7e7a989493b9f91423dd76756aad7f
- TLSH
  T19ED0A9498D27FEA928C930A314B7BC0DC408A2B2A092A82A0D8440390D8A28C6AC0880
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  app.asar.unpacked/build/electron-main/vbs/regCreateKey.wsf
- Size 775B
- SHA256 44201185e05845fef8b56ba9cea0194edffd89d0465b86e055292f84f19526c0
- MD5 04e6d736dda6eec814e5bff7121a695c
- SHA1 bcd113f9b374f977a81e52f1be21c35e9c815c74
- SHA512 6db255f72129f080dd259a3e7603cd1c21702a8810454c7935affe9a9f443a221a614a39cbfecfde1b2e13523992bbc8c222a0d763c018bc4ea10fda0cbfb468
- TLSH
  T1D901BD195C2DFA5CEDA21093B3B38905C8BC5B76ECDCB8A0398D043848C0EDFA9781D1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  app.asar.unpacked/build/electron-main/vbs/regDeleteKey.wsf
- Size 695B
- SHA256 3db8ee7f2056d79a97fafdcc7369867e7b49ecaa58b7c6ad442be858e1dcc6c2
- MD5 82bd86d76a25e9d3bc5e7ffb15311b16
- SHA1 f749b997b38de6df0f06380049e0cc370bd633cc
- SHA512 eb1876453aeea894e0c99314f20d54883e45aa29a9305e3a1cfc55187bf9a4abf299d955a7ee8f53f6480a10cdc803e3464759e01b330f93264892fc999823bb
- TLSH
  T14301CB086E1DF65CECA21083F3E3484AC86C5636E8DCB860358E183848D0EDF9A781D1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  app.asar.unpacked/build/electron-main/vbs/regDeleteValue.wsf
- Size 718B
- SHA256 080b83a9b8666c5f02a5af1a0fcd351d3073a05c2319628e060fcdce7f70ab35
- MD5 2f99f4a960ecd045306ad0581854cd8e
- SHA1 b0515c23e51bc05012256aaaacf04e7a21563244
- SHA512 7deb0dc297184bd87360b63ef411ccb209f12649e672447207cc6753fde015a09a56527d505c7a96e8414de0f8f58b854b007926982ac47d22eba30afbbcda9a
- TLSH
  T19C01C00A2D2CF55CDCA21093F7E35D0ACC7C5623B8D8BC90669D143488D0DAF9E785D1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  app.asar.unpacked/build/electron-main/vbs/regList.wsf
- Size 1KB
- SHA256 1d5b1dd86cac924a6acf746778020c46195e77750901eece4c954450c3bbb362
- MD5 c57c91809118b64333bc73eddcfd429a
- SHA1 33e6de2a7b41fe406ba1994cd45be673c19f0cce
- SHA512 4ca78a5b1d95503963b0bc7c70deb9041480f32b5e15cbc97f924e747689ab7c499bd153ba4f352513b2928faf2491dedfaffa4bef4daa37a29a32c5203a0a02
- TLSH
  T19611E147BF1EEE6F0DE1545729F15446D85E40B0FCC8D4E577AA54340880ECE45B66E4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  app.asar.unpacked/build/electron-main/vbs/regListStream.wsf
- Size 1KB
- SHA256 da4e3cd96dcecbcb2ece2d1e35a8adcc7dbaf79cd7a843856f7ce2872304fc88
- MD5 9e16e93684909d901ea9dc300a3371df
- SHA1 37876c009c65472a5e9dd46b673febb238193722
- SHA512 0214051bb35dcdb1cec9d4835555b4da5d14120360eab5921e02ec805f35ff35d13a839e77b638f18cb793a4010c7212424391e8230620b3c7b4d9c9dbfea748
- TLSH
  T1B8214603BE0DF51F4EE110B736D64556D45D9332BCC8A895376908346880DCD46F6DE0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  app.asar.unpacked/build/electron-main/vbs/regPutValue.wsf
- Size 1KB
- SHA256 5d43ec5af7744fb1de15e4a3058305ecb3f20e9daa7315df6812be5571466272
- MD5 f41c18da4e7cbef3a564613c74eab95e
- SHA1 b4fae739fe5fd97b398a6a5c95c2077e9c1070c0
- SHA512 bad5443f288e2d84c05ac30045ea04b253779c377b0a5d401c53648b75c55a008faf7ef3f8cd944c2cf3130b897f144ba7c04a4b48c48f2c9753ed44b5a2f34b
- TLSH
  T15821BB095D5EFA6CA943D087F7E31809CA7C52339C98B8B4F9CE012968808DFADB80D1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  app.asar.unpacked/build/electron-main/vbs/regUtil.vbs
- Size 8KB
- SHA256 b35888252d3b2c6cc4c37d0f15311f1b4becbfbda7a766ccc38c6536ae0106b2
- MD5 e2a96b441d2cb55d3f0dff04e605907c
- SHA1 c4c353788a9d3710ab5ad327531c018b8c41ba81
- SHA512 9c3240c76aff8b7ef95862e0d889bf39542e6f9154423b2f73c098b9503d90fcf95d206b126da934b4ce18b08d34be9bd5b2acce2f833573eaab4df28a7a2718
- SSDEEP 192:uL5OpODVtmFCuOFRO5On5RpUHIrXzySl2lxco+jebCULcvizzv/oaZrZJABJ/5f/:uL52GVMFd0c545RpGIrXzrsvcfq/LaiC
- TLSH
  T12C122F07B9AD392CCE1070D8CF4E584ADD7D1866A0AC45F1F4AE0035699196F42FEBED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  app.asar.unpacked/build/electron-main/vbs/util.vbs
- Size 4KB
- SHA256 d8ab1f1cfa9b8afaddf31f7f905e5bfdf01025e1c4168e0d4aeceff045fd2261
- MD5 93a94731c49a9061ee563decf2fe1388
- SHA1 3c64e4a5f3f86d2d21c2fc93a763c1df9908e861
- SHA512 fe93e3dbb17cda51ff89fb74daa68fbd45054d9846eeb5b5c47faad06ddff6d596e811a39a39fff9983b2caf2fcabccbf1165f710e9e3ed76919e2b702d6ca36
- SSDEEP 96:o+fVSqeeysrTAoArx8nKHBeQKrOKbBP6tsB1f0Or:npULd8KHglBP6tiz
- TLSH
  T1ADA1660D7E09353DB5472A9E239E668F1EF86460C2D0C2F459C864881EE4CBF9675BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app.asar.unpacked/build/electron-main/vbs/wsRegReadList.wsf
- Size 1KB
- SHA256 c4e328d261837cb7d7937d717bb02800eb33e7d8de33e203fdc0f239844cb29f
- MD5 bd0f81f4bb40b49305df5b581930d75e
- SHA1 2303e8175f826e020bc64689b1139a0602cb0122
- SHA512 ddae510efc359fd2a89933fbf83840bc55d2877ba192bc766a3185e0e1dd15f4d5439cc2545536902aec97fc3e0c9035f4ba7721873fc002ff88e02195a47aef
- TLSH
  T1212156CFFE1DEA2FD8D154862E968C8FC46C8131B4A884F6B78544784C45BCF91D54A1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app.asar.unpacked/build/electron-main/vbs/wsRegReadListStream.wsf
- Size 1KB
- SHA256 48c9aeeb401d6bc509880d89c16ba6304f713f7039736d111ae2c4599a616998
- MD5 220b104f272214aa1c1c21463506e903
- SHA1 5bda1b524f703190660d3c75a4eaad5e13f735fc
- SHA512 d2cca398acd24879197857fc1d31476daf4a2e82a417416c836213e9577ecb795c5d83f467022acd0ca617e55b22fe5bfda307f6612db1bf379fec7949d76bae
- TLSH
  T1F921754DBE1DFA2EDCE124D63B874C5AC47C8332A8A86CA2B7490078CC416CED5F58D1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  node_modules/electron/index.js
- Size 1KB
- SHA256 331e1e14d5f00ccbc61af0df6af6767ebabd48cf2f05d38d3d3345b20f8ce3f9
- MD5 fbe95e0cb9675816ee43f4992901774d
- SHA1 00ca3d48d62f8eb3e62000853048fa4224c610e4
- SHA512 07070feb8e3337dfe39b483021b7fff66ac5c327973ebde8fa8944015383b426c3155755a7429e0a7a595322341299e07c3a7916e0c8bfda495a3ee4b4b391dc
- TLSH
  T12231E05B1BE32330C017DB62354905576AABC4A7320C9860B5DC42953FB91B885DEBEF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28