d585efe9c1e4450a6fce2043ec188032004268285acfd97ea2c8817291abc87b

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.VisualStudio.Services.VSIXPackage
Size 362KB
Sample260629-ph3dcsez4j
SHA256 d585efe9c1e4450a6fce2043ec188032004268285acfd97ea2c8817291abc87b
MD5 2d3ff72a5e4c867e116f4b7d3ea0b7bc
SHA1 50fb97981718c28160857995519ec8cc1d0c6c52
SHA512 d572ceba9fc78cb11edb51c1842ce5505a6c5e8c674ffbfc8bf2845ae312420abffbbb086c2b0bf4e9dd7a60f8cc1ff12315deb351135966cc5ee6fc0fe64438
SSDEEP 6144:50qw7eWGF8eZgS4FzAQv4Ulcb/h9ylDtKZ1thvrdw9NNrheXWFdlOhuHTLQSIpqo:50VeL8dzAQgUlc94NtafdS9NN1eXITuh
TLSH
T1AD84236B7F3C8E58DC3073F89C14A502FED02A8E3E57A48D6CA416507C7B7669B461E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  extension/dist/main.js
- Size 1.1MB
- SHA256 9cbcf65a5b381a8d8d61d5a4c4c2982bdf8a4e051abe7fc4badcf4a843fcffa7
- MD5 59b55cc0cac59799ffd2248312d09037
- SHA1 366928be739d7fba772f7fa870170591f71ad2dc
- SHA512 8c5576e266d4b60f62957c51779031c4ff073fe96db38892f26a8335c98fe9c861265708eea6ca42c584000edf09bfa32d05463405f70d7c94b61f7d869dd905
- SSDEEP 12288:/3HuzHJ9E6aTc+Mj51ZMfZ/9EG4JXZJuErScXyrMf/Lsh:/oHb0wVtMfZ/WX3uErScTf/LS
- TLSH
  T178356B71B6E2787203E281D594761002F76C192B750C88B8F72CDCD7AAA5CC9A777B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  extension/dist/scripts/connectionReport.sh
- Size 3KB
- SHA256 0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9
- MD5 e63a6b9fe2e06e153be6ad315e7a64cf
- SHA1 461f36d036b4e32dec3e6d9c7b84188639509855
- SHA512 41bf050e5c40ca9f850efb560444cab644685fa8dcc1599bf73e7a1ac77d6c51fd1fe1ec9eb54f65ed718801a072e9ceeecdd78de983b3eb5b89b85df90acb8f
- TLSH
  T170710D96B8405CB1100BC479A5A36020BB36430F15116C2D7C2EE879AF357E8A3EE7EA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  extension/dist/scripts/launchSSHAskpass.bat
- Size 123B
- SHA256 1165658cec3aad2f3e9b16cc63e47c9b44f764a79586fbeff78ba8c80e5f8fce
- MD5 a519e2864689d90b69c562a228d2db8d
- SHA1 3067e859a9c96c4198d165c1d07679b3d9ed0aea
- SHA512 5854307c9477dc609feb7909a520460f4a916920f93abb3306b57ab6b62c4ef7c65a2e9fd854704991dd14af9543b9de49145d21bfc3489e1de6bd34e52ddff3
- TLSH
  T1D7B02B8C8100A6C925200AA29CD00C514BFCB1CC2A4CA42240D08C4020151402B83889
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  extension/dist/scripts/launchSSHAskpass.sh
- Size 92B
- SHA256 d27ec501f86584c39b132a026f41d4ec220b2e74d257e36608d66c9a6d7fe259
- MD5 af143c9ad2dab4f3bbfb2f1b36699d12
- SHA1 959c143d798df2c97676c65e3c07f48b82bd2120
- SHA512 bf13f281ba22cd812c91e3c231cd8fa423c57e90451ba633f6cf16bf804ae5128410200e316e5e21608f993677eadba73f76ec25b2fd9e7df7fa8c6cf79ae78f
- TLSH
  T167B012CE4251CDCF3C5838704CD00C344D6D92C4055801335262C4963828120F7131C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  extension/dist/scripts/remoteServer.js
- Size 8KB
- SHA256 4e5ec6d8278348fb710aa9a75a4c051eedfc9745a9c1e53645b9431c6145c7ee
- MD5 9637db2eab0999c0e8cecdc1ff7189fa
- SHA1 1578e993258572604f9bf1d113690ee72057c680
- SHA512 6420446199c85c56d5f2599dbd7799ef76a4b063e5d6c6639de354a98e8369779084ab3106354235c6abecfd75fb086f037e5e3180a350a0921486a0d0b6168b
- SSDEEP 192:vCE628mj+0jJuOWD04aj/kzk+psEBFWtFNp341:vFB1dJuT04aj8zk+psEBQtFLs
- TLSH
  T1AE02C94DF9CA202917F621B1907F4117B6A6A934A3189C60E527C4962EF8C1DB3637B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  extension/dist/scripts/sshAskClient.js
- Size 1KB
- SHA256 4f83b8205854673a8545fc7f652c6fa55104db6db1e6d8ae2407f5b0663b92f5
- MD5 c91f33a82a5ad03a32d11b502cc7f46e
- SHA1 8393d892da33c853ef4f6fb27cb55b0e82b5e3ae
- SHA512 f852e23c15f7e718e7957822b8c93e3b99bb3b936f4ad0abb42b9bd4a130586dc1e94005cd2430f24378ee62bff4e58954718437a67e623e97f04bcde304f150
- TLSH
  T18621004789495A2523DB35F5DC0B4522FAA7DB345311DD35720586DD3EE0D64E30335A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  extension/dist/scripts/terminateProcess.sh
- Size 212B
- SHA256 3a059155d6e35d0fc28732681f4420549772411f0117f38cc36efffc787311a5
- MD5 8b0ea5e655d3276ad896fc515014548e
- SHA1 332e34520fda0de66efba0518306c6765eb14fec
- SHA512 52be9f537d047305d29d37225fcd007825f82bd1ec4e9457ef34245528f9d31d4fda95e7e685553b2bd871b9e3fd4446c68deeedcdfa7c82e02bd2dfb25cc364
- TLSH
  T124D0220C7C6A8FB27B413021C6A3830E27CB12A1487E3C0C1AD23838B420390F06E0F8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  extension/media/trafficGraph.html
- Size 1KB
- SHA256 acc3c14e259a3892f1fa4972dc9b93c870c47eb0f581eb42b2a4ffc2ea982173
- MD5 9269bec0e9e9d6e8d5c8778bdac50013
- SHA1 2f11350ab129533b821852dd9b27707b54598b15
- SHA512 c05f56f38a0c21c8f5a0e032df986df87786426df9c91e793e3a21ef9b6d65e7bf92c14c049109ad805b08d776b2004b14d10412d7a50cddd25d94f92da49fe0
- TLSH
  T18B21026548F0512A14E091953DB1924F2FC1EE07D98B418871FD46D54FC3EC6CE8B089
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  extension/media/trafficGraph.js
- Size 2KB
- SHA256 277297d9d630c41e4515d77e0e5859395982427acd4a34bef4053e12ab195915
- MD5 ef0322257ffdec95e5a30fd826278647
- SHA1 7f0a9deb268e25f1de0c9c48f36ec9609d1327ba
- SHA512 a3da2ea271ebb3e51103c554277282326f5f8f1e9bb8226b3e6876d1ad4371729a245c44450bcabf9e76816ad661b78f778a089933c8beadc94c8534989ca70f
- TLSH
  T1B351C8D272B1A82ED116C2890C5CC3816369CC723A47964F753C4EF9AC15E46716BB73
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24