5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260628-ktrnsags5t
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  Engine/$R1/arm64/msdia140_windhawk.dll
- Size 4.8MB
- SHA256 385ce9aae0dc0cdcbfa21e86abca5a9ea4a7fbf891d43b51852fa7d023a629cf
- MD5 134053ab9dc9f855bc0bad52a05e3abc
- SHA1 4bd552ab8f7f21c370aec808363b358c9140d71c
- SHA512 9ffc60ab29e8e6fdddbd58e775b9efad4c8fb438a4f63b92ffae2004b7814d7abefb107eb79998f3f549f1743ee2da131fa3e6e8a64546710b07edbdbc7ed1ab
- SSDEEP 98304:EzqS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0KB7cFLDiXEpYk23pnaV2sd2xF6tjRxy:RS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0e
- TLSH
  T1AF365C11AE8CA835D2DAD33CEFA34F60213BF574C0688D87F25A035CED96FC19596296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Engine/$R1/arm64/symsrv_windhawk.dll
- Size 708KB
- SHA256 97610e918b8f33fa5ce3b337512534d817057f1bcbed257241aca0c7f30c65ea
- MD5 0f965e8d97122f7ecbc01dca6ee16a61
- SHA1 4a9c724c922b57220858004861511b67b7bfeda9
- SHA512 1bc1fc5a6615e82f4709a4662b136a57ab211cf123dc796d7eb07d67e869cee62f2a2e82a125336d54d81fbf902f212fa448ef33985ceabddd563690ced79af4
- SSDEEP 12288:fyJ+9eO2zqg7XRueQEYpOfUQuj6VhHaYk+nyo3M9NdaknHX:xLjYkzo3Mdakn3
- TLSH
  T167F42A826ECC9845D2D6F73EDC678A24633BB8BD4438D24B6142220FDE9D7C4D9A1763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Engine/$R1/arm64/windhawk.dll
- Size 1.7MB
- SHA256 60c72a84289f333704c8e35d21e7b1362d0481c426041daac0e5eb7af7d13c1c
- MD5 6b285136c41ed5d042ac4d7c153e933a
- SHA1 fefe4bcd935eb2f33502c9d96ed5366b6c575e4c
- SHA512 477ed9ff44d10284d83c7616966397e57f3bed4356ac0a29f62ebc8cd6f76a3b410e832eb6e9b531f59ee61d552eb642aab878170357d7809f90c0f31c2fb663
- SSDEEP 12288:CeQuh4pjNWiwruly0WkVYuLYIL1IBR7KzlWStymDyUEdOZvvATM30ZwRrlDuhsy:rubWiwrul/YJVmDyUEdO1vjrJgsy
- TLSH
  T1C285C5F85F0844EBE1E5E73CBE614D39603D2C76D6A919C600229F07D85AE9872E1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  UI/resources/app/extensions/clangd/out/bundle.js
- Size 797KB
- SHA256 4537d7e62ce3fd248775b44a8df926d183417767d83510f3ec96193d2bdc8400
- MD5 2a1e30271097955b02d3d2e68f0a16b0
- SHA1 5620916ca1cfb36e23bbd9ffa91f7fae0a13993f
- SHA512 0398c9be10070deedec92572241b7687293c865262970734bc0b8e17d63100e727ec28231afab89a2a5bc4de7c4012d1fc13c9c68ce6ed5f610290ebba78fd9e
- SSDEEP 6144:rZGO52dyh05f+g5jw1oMoZdjduXI5WzzRCy0tCL5qSyUQ5/usqY03XEI4elgPyef:dGO5sgWVTIUTnBhLOo7P6K
- TLSH
  T18C05E6D5F2A122AE229E938CDCA6006EA5B710F8600DB434F5C4ECDD149DECD5267A7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  UI/resources/app/extensions/windhawk/assets/main-icon.svg
- Size 2KB
- SHA256 084a27f3ced9a7527d7fc453e0d94f3e3d668b14f30aff6b3ad0af8a5ff69509
- MD5 e644197c4f128b379c68a3f5b573568c
- SHA1 1f70edd30ef7fe22ca0c872c3f359a9d03c85d62
- SHA512 aab9e4b5b1415773bfdc647113fabfd5edeadd7342c7d2f9aca610474d83290a2bf7f0a59984ad80918dc7cec38a6651f77bb8f4b8c73ea744640172317d3962
- TLSH
  T1D841B828830803F4F21E170CC5C578FA32D878DBB248F69890193DA5E5EAD580C2B0DE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral6
- Target
  UI/resources/app/extensions/windhawk/assets/tab-icon-black.svg
- Size 1KB
- SHA256 40424e2915a4790058b86b8c855748b73e977ab2a9b18ca0359819eb55f6d18f
- MD5 a8100c7b4c31ae9d93696a9794e3cd9e
- SHA1 384c6c3946897ced5ff759b9bb03a333b5969681
- SHA512 80f20509ecf5f513ada305ec158ebc9084a67c1f1c02e5dec045df150897a762ef5f6a8fb6e7ed66941d74b895176b52dd843f640c8ae1c2bf3aaec27a0d1f94
- TLSH
  T1C521B12AC2600B74AA4E123C55F449F139C8EDDCE198FABD689B5011F02C6A5A461BDF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral7
- Target
  UI/resources/app/extensions/windhawk/assets/tab-icon-white.svg
- Size 1KB
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH
  T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral8
- Target
  UI/resources/app/extensions/windhawk/dist/33ff5c221241d3c55cad12b54045a5a1.node
- Size 533KB
- SHA256 d52b26d696a7005156e47e1bcbe8f6c4687be2c390d2f7bb6dbbf3278af09315
- MD5 f1972fe0822e77e1cd15bbbb7781f1a4
- SHA1 a3a90c0e4a54882c4dd8299b6315377f2a1d76f4
- SHA512 5e8fa131da80eb97155c388f0408b3b09487c6895a3f55c2012a606eb2d10de6b6c0861f54c48052290f399ae64adefdba94680850cb4ba7357b3fe948b55445
- SSDEEP 12288:wZuRZGuTuiQVEemR+cg2FN9v8OCIBySiWNE:1klWNhv0FWW
- TLSH
  T19EC47C5174918272DCF920F946FDBA3A426EE4B00B24A5C756CC47FEDA209C0AF3765B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  UI/resources/app/extensions/windhawk/dist/extension.js
- Size 467KB
- SHA256 46a52a698db47d04cb134c7dca57a42a294bed614bb1c8323862219532c29563
- MD5 9c6e57bfc7b39fc68224bcd201112c48
- SHA1 dd8e49a6871a825b57a8497d9171700cd551ebc7
- SHA512 626297d2d95723066e86a95d0126c0ffe765c4179b4146afa7d6ff0bb46ca9c673687c0d6b1df43900c9a0d6a813abe74c7fc9930d5f256d67125d306c7917b8
- SSDEEP 12288:LBDupgqVjYlBUrR2YYC91AsKMfZgd1gBGHZpNn2zUQKnolbQ8dc:LtupgqVjYlBUrR2YYC91AsKMfZgd1gBi
- TLSH
  T12BA430A6F6A0139E366D439CDD9200BDA8B711B8604DF834E8C1EDDD109DBCE5257A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  UI/resources/app/extensions/windhawk/files/DbgViewMini.exe
- Size 138KB
- SHA256 8703b7aed15d389324de080a24a4a5672c33e952f0a3461c3608e68e05a0a939
- MD5 f94bc325b06db0e50fd6c4612058a175
- SHA1 19b5628abd23d95c6c0ddfe9838898d052960e1c
- SHA512 4f33f42c49ffdb7a336ac905c76e73dc41b17ce890d731ec0a4e8e810df14968e54e38068cd26b7324173689f9d27f456678b8caf76dfc1bdba1c349f936384e
- SSDEEP 3072:m/p1LbOdij70TvwlOOqhyuw/NqUYvzFbQYTknlwaNfzgbD:m/HPlfqhvw/NJuZQTrgX
- TLSH
  T19CD38D11B1C0C472D87329310974DBB29A3DFD710F50AEDB73981ABA5F243D19A2A97B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-ia32/node.napi.node
- Size 112KB
- SHA256 b979a6bc99053be765ee53d58fc0ef7e944104e5818a0a74bb3f7cfa7b9d803a
- MD5 de11d7e148d07627b1fba4a56bd83107
- SHA1 24d29bf1f04f44324d8a01dfc5ab729b3f6b4756
- SHA512 2233b0d54cb98d4bc430cdd4f0f8a236c62dcfa10b240eabb00dbd54389b9ed1c851d337065b09586140eca5de111e928183f8f80557fae1d6a3a5831f10c739
- SSDEEP 3072:kI5/emAXbQhD+8LqGXdsV3Gyig8HTehXtwX0SFWYc3Bv:N/ens/qGNsXgW3Bv
- TLSH
  T132B35C11B681C131D46F063918309A769B3F6920DFB18EDB77941ABD9E306C1CE3DA2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  UI/resources/app/extensions/windhawk/prebuilds/win32-x64/node.napi.node
- Size 155KB
- SHA256 4e101edf72e969fcec40007f68c40fb2b84bddf038b178b5e52e8d81f15c23f9
- MD5 c89769d232ee68872ac575995294bf24
- SHA1 30e86120ad51815439f0db3dd7d06435eeb2bfec
- SHA512 0c6480edcb6e4b84ae5aec3fa76ebfb31ac8b52bd20914f6422ec6cd12d7ff729535a86e9d84225ea7aae0fad64ccb5814f96585da62ab6e0807c79354c59d3d
- SSDEEP 3072:OXW2nM6Mci8/pc4e+BekFjNyPVXAh7O9QXkdd8HRROqqw:OXPMTciIpbZeQjoHKHRRv
- TLSH
  T1B0F34B0BB2B511BBE176C23985D39A11E77274150720AB9F43A0437A1F637E1ED3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  UI/resources/app/extensions/windhawk/webview/288.096949bbd6c72012.js
- Size 9KB
- SHA256 83e1cc8913ced19c57b57a283efb9093c20aa53347392be256d16edb81f8ac1b
- MD5 ae916ae853ad7e756671b101b33cf1b9
- SHA1 edd9a32d66d32c124c1488a008f1682c81ceacb0
- SHA512 3e7b0b4b5c9a1718c6c412ba1301227de7b103dd6e3177a2a3746d0efc8f547740247a72b95147647d55cc69ced31e1215c1a9846315ecac97c8da8fa527d809
- SSDEEP 192:NuhLiW5DT68tCzLbfIXEeorG0MPhhW82A7/vcwYa1S9brv1nayMeV:ANiGhUbV9G0QhsRA7/v1YAS1rNzv
- TLSH
  T12A1285A4F7E074620393A0A0D17F1D0B73763965548A81BCB264D8EA58FD18DD62BFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  UI/resources/app/extensions/windhawk/webview/873.3a09456777c6073d.js
- Size 4KB
- SHA256 d1ea123f06b61bfadd88af34eed222181f0ff11f48dea67428b64833fdfb423c
- MD5 385c173ad88e246d777dfef6bdb0a41b
- SHA1 9a5b829e7e72a76bdd735e5c852086efecad8872
- SHA512 895be1e5f629087389d6d8e9d334026c818dc50639b0992a386097f2815889df90f7d4a2598eebb2cc52a54b6af6f1370f8709ad9f2892832cacb7a706b0ec93
- SSDEEP 96:k8hjlpch5mV1+/0V1+/OvrBU+A/B1390elEZVOQaB9+aB9wd8rCD53m:kOj3crixBvrOP/BEIIVOJJmqom
- TLSH
  T10291751DD84A260E259E175815F19FE43C893A34D1B9DEC4A6E0C1D4E3B68CC60EBB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  UI/resources/app/extensions/windhawk/webview/editor.worker.js
- Size 284KB
- SHA256 7f1ae47bb78af26a5f43f2e138ba4cc8392286a241b32df03f2b42b849ac2a2d
- MD5 ac9223cbc3245ceca0aab79c40e0da87
- SHA1 52fcecf60ef9b104ea0ee185ba69895cc3eb4aa1
- SHA512 ea1e26699cdadbeaedada683cf152bcaee326f1a578818bf4812e77b8dc1caa9ccfb13e72afae6a1b9130e082eb361acff7a81d0b01794d1a07d40b1b37db185
- SSDEEP 3072:Y8FMjeojSPNqtnh8159PIUi8njZakUYO3dfy3Xhy:EjSunh815dICdWZy3Xhy
- TLSH
  T176541BD13292966BB3E716E760710103A53825A6BC0D147CF3B4DADF793B98361BAB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  UI/resources/app/extensions/windhawk/webview/index.html
- Size 799B
- SHA256 c0020888674a2b7beb2f4079b31b27206492f49a69456fc6ee98893646a7cdea
- MD5 26eff42f15b855c74f361bb5459c645b
- SHA1 b10eec709c07b108e3191ab2ed5c61f8b0342ade
- SHA512 776841c0e8fa4d8cd50b6fa5fc38e1aff685c93d97b5d25466efb2e0d16bcfc0400ea2f9a4064178830a0124766ed64f0801a3e75dfe96320d79efa195b1fa1d
- TLSH
  T1270120528C64C85913841B652EA5BD080D4ADBCBEB09EC543CCE015F8AD4FC9CED779C
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral17
- Target
  UI/resources/app/extensions/windhawk/webview/local-mod-icon.70a258753b360ed1b8d4867fd77337e2.svg
- Size 1KB
- SHA256 e4f7fc71fcdbd8c31f8580110c84ea951870dc20e2e3e3fba9b91203bafe29fe
- MD5 0d29caa52c3150978bccb41a079b4240
- SHA1 a90180d61ac60ef6c538e2231b92add9195a6046
- SHA512 1a61bb7a3eae9feb28db2cf7952c13626bd48b5d977240da5a38eaf4a3a0d0d1976456d027e5885f941e7abd1fcf2ee172aaedff08cf6458e6c5edfd628362e3
- TLSH
  T171218A6C76FC9978085FD7B96F6401B0AE0EA59F84286A78F40DCD31F7128B99932C17
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral18
- Target
  UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
- Size 1KB
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH
  T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral19
- Target
  UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
- Size 5.4MB
- SHA256 a772f98f408cc230e29d6dbebfadffac92310fe4d7220752262c09d6776dba2d
- MD5 a394cbda564c74d5404b7175d915efa4
- SHA1 7f7eb44f90767875a35884d8313e00328ae50ecd
- SHA512 5cae4ab95059926311df1ea40973a722b2069d3e040f3d1698d9c5eac2bc7e0cc9322189ecc4762b2287ae2afeb2db29ae5a225cc7c876dce49514e985931c2b
- SSDEEP 49152:JkwOSFftdAnCpIPOlFj7wMawIPvfUhrqstlsN4n1wauYPkQEQrEf2C9PrSjaFX3/:Snfdazz8uC
- TLSH
  T1FB4639963245706643DB51E660BB0103B3392459B809846CF77CECDE29AFE8672B7F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
- Size 169KB
- SHA256 cff2446e6c40f4151ba3b7a568c0a361a5da31423f242085cb10fe938e5a4281
- MD5 e37fa198f2ba94998952d5773556a6cf
- SHA1 af8b924c85d3925a6d5b917629efc877140f275b
- SHA512 ac83d6586470324b407440248ce8fafbc990f215a01cc6ae6c103c1249d438d1c3aadbf710cdeb8d7d376b85641a2d2d345fdd216f851c12ae39afc055da2da5
- SSDEEP 1536:EX9EL2TLM+H1+TNReVZ4KYJTmqS/n6DrU4aRus+LynbQgStd93ZoJin:EtEq8UUNReYKYJT+6vNkkLynbQgSD9p7
- TLSH
  T1E304E784F291B0E202A76414606F4447F27B1B46A80D99A0F707F9E1787FD4AB1B7EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
- Size 3KB
- SHA256 856bec59e1cea6b7e36d128de2e393eec8548aa8d75b5a389a72195373865bb7
- MD5 a5bb6d4a3db136fd6200785c7dcca349
- SHA1 9519a03d7eca7a3443d3b312cd4e9edc284d0eaf
- SHA512 dcce525424dc27206633c877dfa32469343f38ae54f2f13703bfc80cb56bc2c5e4818e1ea92b57507e2ec9906299e9f62f6037a7929776740f34775824d3340d
- TLSH
  T14961B6A62664F4B727A158D1042FC592F716243705AFF8F0A717DCB5B878CC54862FB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  UI/resources/app/out/vs/code/electron-main/main.js
- Size 931KB
- SHA256 28a11360c6381cdbda5d6110d45d48e080f57ef831c958d928b3fe7fe9745c03
- MD5 8b684c7f178c24b56288ed7bbe352799
- SHA1 454f2a8f36f7434d453a646a3935bdb3b3102dbe
- SHA512 ef8e25342906559d1b2676b25321631b29de73cda9b0f39275fa8ac884787b5246161fad33ccc03ab62570adecb67309860174444a367bc6828de84179368933
- SSDEEP 12288:f5pIK+I2kApZ4HG1CV7PXB0V3dqJoS4nZ28X9Kir/xK+wx:DI02kA/4mW7PXB0FdqSS4nZ28X9Kirg7
- TLSH
  T11B154AC272E66DB203E191E9D87B0102E1796658301C107CF7ACADCF7DEA94A527AF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
- Size 2KB
- SHA256 469bee8975d893e4085d00d9a59fbc09c14b0c1bcb47f3292b611a24ee703193
- MD5 cfa2cf830cfb2bca8f8eeaa7bcfd99a9
- SHA1 952266e3e56079bb4f47c85fb1b2fb56a550618b
- SHA512 bd5c4edc9e52fcb8cee133cacdbfa248983427919e03c33bfceabdd4dec5f05cda8142b835b73dd990c2e1ab97b6691b05185cb93bc4f5a71d4f7a29e2abc147
- TLSH
  T121419728830803F4F11E574CC4C529AA36D978EBB148F79C91597C95E5DAD640C171EF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral24
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
- Size 2KB
- SHA256 3d88dc275cd053bb28435aff34bc98a5bae0ae755d2bbb7f4dc09c324a40c63c
- MD5 aab566666eda5d5a771b84aac35e65e4
- SHA1 4d75b6e976f4de25d6a1da9abd928e058934db8e
- SHA512 79132149729d35e391ba08b39249e5df21fff580e193327850fd3420515ed4b550b74411fc841ff3f6d9ccae2c22f73300f9b6d50805a970e7b5ed8b38e0629f
- TLSH
  T1DE4161CC5FA8588080DC8BC53F53D8981D97F69989C78D50C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral25
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
- Size 2KB
- SHA256 c26bdd09e6c461fff0b553777c4515bdda9befd69cff7b1530b102dbdd85a48c
- MD5 f7c08269b188d70be6be9ab4120ffd07
- SHA1 175d94e7e29fe652a71e4b1ca105744fa22e58d6
- SHA512 78603032225c92816bed0e8589a372c45630a30cc8f6a778752ccafeed52ab489984f4ae30344d4c0e616e43b3298ce801a8b230d845d3cb50e1fa0c69313472
- TLSH
  T1214163CC5FA45880419C87C53F53D89C1D57F69945C78D40C08DAF7A419783DBD83996
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral26
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
- Size 2KB
- SHA256 fe3f5dcfe0c6220932918777540fdbe2acb3f8229a56129fab2e0b4d08977c09
- MD5 95429443e1d822c98c49940588e44f89
- SHA1 d95c099fdf3cdfa9818bc98f04858888c8767994
- SHA512 eee65444613c51a082525102d637157fb3ac9726b6d1257ba11f22b7313ef87b387ffeab78019312bba0edb8d7cce3254a81586e02f835ba6a6b01d6f054cbe8
- TLSH
  T1164161CC5FA85880819C8BC53F93D89D1D97F69985C78D40C08DAFBA41A783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral27
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
- Size 2KB
- SHA256 c46688c88a6e90f0b48043dbb42e533097fac1a62d3b73b60083c3a2a492f589
- MD5 ae4c77285cdf81dc69ceb29d949d33cd
- SHA1 7801a805ea7bc3c4037a6843697c7050ab36b972
- SHA512 e9e6c7c78bfd96118468cc9f48d111ddd5562760b05ee0dd9377c6bc4ba1cef89bd512ade5bfaaf2363d6931e1bd024f7fdb4a64b7fa22e781006c0a39a9e28a
- TLSH
  T10A4161CC5FA8588080DC8BC53F53D8981D97F69949C78D51C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

1^/10

persistence
behavioral28
- Target
  UI/resources/app/out/vs/workbench/workbench.desktop.main.js
- Size 11.0MB
- SHA256 6bea55d21c1a94193a811941c59db4370fb875e90e11b1955c087f1d046f693e
- MD5 18bbd1e7a61bff5470285d607b92e6be
- SHA1 d7dd1fd0f58b5d35f0ce71537f73a722cae5354f
- SHA512 67f18277ac3dc1d4813ba686ece8d2b9a6117e29c62eae1642e344a5388bfe690c55feb9311b435e8cd93583eaf642aa9173e7e77d36895106078f010ce1aa6e
- SSDEEP 49152:rriuOMnm6s38Vg+fvzG18UpBzxe0O0QAgvNo+5pY9ILsj93/uzTEev+Baj9oSoKX:DNXRBs92BNmypZ
- TLSH
  T108C64C97329A247346DA90EAEC760003A2395155B40DA06CFBFC5CCE16DFE897276F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  uninstall.exe
- Size 432KB
- SHA256 ec6cba90113312562fe5b91bfd13b32b8d34d143c7e284403c2326574c244e6b
- MD5 8c26d80875b69590b2d086a495e0cde0
- SHA1 e1b8ed7bcb12979684323f643a4557f3f6748830
- SHA512 41d5dc1e1c7019f08c0f89fecd846d1c9d607e2a9a2655f3387bccc2118d1372a52c4d3d49cd96e894e44218dbd80abbf44f430f312acfe3388850bcb41a390b
- SSDEEP 12288:7X4pMJ0gLuX+NjAG/Bk02Iqukbs08rZ818b7BPQ1:z4pMJXaX4jl/SIqHs0uZ81qU
- TLSH
  T15994016533E5C807E03409315BADC7B36B69B9D0FA29DE0B33D0167F6D516C2BA1A24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Deletes itself
behavioral30
- Target
  windhawk-x64-helper.exe
- Size 18KB
- SHA256 d8f771ca3bf96dadb24767603acf01255c2b3bc509c9d7faf463edc388dbcd99
- MD5 a11128109315ed9c31b397cdcd411392
- SHA1 2ef9d4f3518acb95a67f17e5fd0c6bc6acea6cf3
- SHA512 dcf3539a68a1a359ac5c11d33842be6d48493bda2ed37b5f17352f4db82b0e25c2e17ae52d7b5202e20c3b13970105bf1860610c1f81a1e13ec7698e4ccf3837
- SSDEEP 384:BImrj8kK8KkK8pvZYLX2Ip4Q0Q/qjdAA1m5wMr5DRuV6Nlm+d:y3J8RYT2Ip4Q0Eqxf1mlr5AUNlR
- TLSH
  T12A824CCA4A784103EF83BE70E3D8D983BA7C97E3A862865774A9D18509473D1F74513E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  windhawk.exe
- Size 815KB
- SHA256 52db87dee0160a13cf51e31bee6320da09767582f1f359f8cf9a787d1228bf44
- MD5 fee446a7a51556046a5979ef2e983182
- SHA1 b13a3e2e666cbfee618a13025fb81759fbf41320
- SHA512 2d767fff8c67418af355ba4766d3cd37b5672726276b82cb6474cd6083e43110f46921881b847f32e09a15a052d04fa03f1f8fe10a3c8a98db1790570c5bad23
- SSDEEP 24576:YJPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0x:YAoUkI4ujKeT/ZvTDrHjBqmu2x
- TLSH
  T1F9054911779AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Deletes itself

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32