9216450cbac1b33274b5686d72f3856f83b38183e2b671a7ed71971e0a9b51f5

Sharing

Copy URL Twitter E-mail

General

Target
lethal_wt_0.3.zip
Size 114.4MB
Sample260703-ex4jvsbt3v
SHA256 9216450cbac1b33274b5686d72f3856f83b38183e2b671a7ed71971e0a9b51f5
MD5 8b4aec6d9c5132eebc69e6008cf7af0a
SHA1 eec6a597d0fcc852dcd0718256d4741c5c9fe902
SHA512 a001871f523143d7aa27dc00429eb0e899dd3702edcb45be80e94c59c838f3f8f6a1bd3547f15a2901e1116dcf82191b7623581c10280adc82c9fe505283556a
SSDEEP 3145728:tKlzlO3F68yV6Rf/zzdjhv/IlcEE0TsSTQ24PyU:ulO0mfLzVhXIq70TTY5
TLSH
T1484833FBD9705E33DF2E303DB05AC250458ED24184196E46A9AC43863BFE6D126F5E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/bin/semver.js
- Size 4KB
- SHA256 bd2513623cb89fdd6b0de34553d45b41957f179fb8c7ed7fd57aadb00599dfcf
- MD5 c11609b448f71e61626691fd4f03951c
- SHA1 60d9dd42ff5105a0d9d960cb5a930a72d302420d
- SHA512 22289d1a7c3b4dc553333e210ddc5577648318d38047cf94f2a898bc47216f388d52b25005b7e28779b19ec9b4cbbe91c7c32e3eb7a2aac5588cadb39673765a
- SSDEEP 96:iwiLIwe3EkZMZMkFeEIe+0XOxnpV59DzmGnXeWYHInKxRfSft:o8we3Cd+V1d9DbXeWYOKxRfM
- TLSH
  T190A16127A8E4923F4B03023E489E80467B7AAA23751458F6788DC60A5F5167D63DBBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery antivm
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/classes/comparator.js
- Size 3KB
- SHA256 5e6c49b503b8dd4d62435cddf50763bbad210e180648ebc96311a5207c4b776e
- MD5 754cf7f04150712c94e109d80f007f24
- SHA1 bbb95e311cc51af3911406848972f6cc50761d8f
- SHA512 1cf6fafa0c5318b0c72e47cd6d56b8a33ba72a2bf7721704d663beb4c0576fa5bf61f3bc4a0d54dd4cd86e65eea4b5a6200bf284cc04f3835b9c43dcaf9cc7f1
- TLSH
  T1D8717C4876E95126079333B85A5A8048A735C663B50E0D5EBD6D07E1FF40478C7FBEB0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/classes/index.js
- Size 129B
- SHA256 3eab3d0ab16e6b89eb282a8d97e0020f85d938b2d064386445c7d10858a2be98
- MD5 cdebb721742b46bd269e0a96a9513ed5
- SHA1 3489dbaa44d72927f206fb2c6c1b5897a2bfacab
- SHA512 35f1b2a22dd2816d4548e5b9ec7e273e0c50791f90690f533c692a130dee0a8b78c5a5d487b1b71d6fc1a9da135f48e0a07fa452ff82163a20191ce094e85fe8
- TLSH
  T13DB09B871ED4F94D210A7AC4D2C101453192C685D50D1421434C2887704C55007D5DFB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/classes/range.js
- Size 14KB
- SHA256 9c8e93a7d2976ad9155b57e4f473b209da99e1916bfc5e1f9c71841903be4b31
- MD5 585ef6c583082a199129d84d3c3e5839
- SHA1 49ea81742058369f806770d7d1b1a73192f0ca75
- SHA512 9f0287c693376b241c0f16503bc35fa7aeef668f68b0a703146de7d34c7e3a78b48c2223f9b3a7a34f70c3bed29cf62c04acb17229f72feabb7f527a3f1c295c
- SSDEEP 384:OFGb4dtrgnX+55O/Qhk4g8bGWpRTIVFVkaZHy1xPeil:LegnL/QvRkVFi
- TLSH
  T1DA62435522F517754B83B0F85B8E9096A3398187B24D4A177E4D63E8BF42074C2FAEE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/classes/semver.js
- Size 8KB
- SHA256 97fa6bb39568689fc8ea80f9cf4852296d5f72950aa77e0e9fd5e9ea33cb76b0
- MD5 cf33ad018c6eeabea68f462fd5dae339
- SHA1 209950c633d84021324a834a14dbcbf0fb3202f4
- SHA512 76b0f3107b9370f9c83a3ab65b5fe14cc43d3c797d64958ded84fec45639c1b6293aae70eb00c9fe0f68a3b2939167f01dd5fdd06c45f8f488f12a9da0dceb16
- SSDEEP 192:A/rcQgOy9ZQwI1xdeSeOS8CovCF9VpHpEBqVXgyGqOduyr0v9qQ83X:JSF6PvJEc0va9GX
- TLSH
  T11F02DCA663F882AA860330754E9A9044B338C56F57099A3E795E47C17F8707887F7FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/clean.js
- Size 191B
- SHA256 f539e00fdd674e57cec16ac7aa8c0d10483b31bf01c1c3f1f4bb202014b280ca
- MD5 11c3585adc46a11a14d248c2ab2b061e
- SHA1 92466e73dbb620c7b0c58b16e8d39a6d0ff22bc5
- SHA512 3c178f961525f0aa9bf295c988df696ec7ee3fc5963cfb0c6f6e71069598270e7952c9baaaea42a4eea0e39a0495dcd33e99dd47e4404cae21748c847032a0d6
- TLSH
  T12DC0220048B8B03B0647A3E04C18403C837AC1043A0C01A2862E90A5274200C93C3CE0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/cmp.js
- Size 947B
- SHA256 19d0f4d1a269078002691b4b617240c7e3ee5957e4a3610e00c1408c63e9a4a9
- MD5 e19d89e1a044e820179496172524ce0d
- SHA1 50a23a530aac08f1545e15bf6441bf031282789e
- SHA512 8739fb82938a2e4c7e389b352f9e46c13cc4b7a21730c8f76a89d659387ef97db6607bbf861cc1d713c600c8fcfc7ed6ef2ef3e9d8dea29bf33c7ec6cf7c9092
- TLSH
  T1ED11E3B014E69076564F93FC00FEC452BAD5E867202D4EBAB89CC078EF904550BB3BE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/coerce.js
- Size 1KB
- SHA256 6451d7fd1d2ca73ac37f205b9a8ee80785a149b8460451fa7a93e0dc0d124cf1
- MD5 fb8dc646defe3d84ba327421a5e0e288
- SHA1 c64737eb38e2f78a361af16155116dc84c2af368
- SHA512 29600184db3200fc35d59bc588a99b1351950aef2cbbad1ea23a4f18413b5dae20a1fb148663eb8da06dc06a4119104079d55fad075d3e628fd671b78d20f04d
- TLSH
  T18241F0BB14B95224194241B1424CA044BA37C0337359CBD6F59D17D87B874BCE1F7DE1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/compare-build.js
- Size 267B
- SHA256 56191fa0ed27633a33fed9c99d657e305cf5452b1e677dd38610948a050146e0
- MD5 aa3189ca2cb7077ae7263db0d6afe6c4
- SHA1 97ac51143c3f5c2255ba09c0ec0f952a2aecd8d1
- SHA512 39a5bb534542e0e128bbc6b1520f82f34c1b76c6ff6d237199518d46f6a88ec5e92c942a07226f59fc4cb65e5359c4ce1452e0ed5861a32ce727305f5e453d7d
- TLSH
  T1B8D017F131B8D07B3205D3F886A0839733B54750706A86A9421E047F536298C83A35C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/compare-loose.js
- Size 118B
- SHA256 9b75aece458d05e13a299afdd745de6ae6069287862e1d5bc718facb24da7692
- MD5 2a96f1eb367ac64c30183597763341cd
- SHA1 1c581d61f0ab057af7fed4ad01c66d0998d1aa03
- SHA512 37823fe283a02d5278264cf2dac6811389c795a2074ff9528e34676e4e2e177988573a51b19ff462f061c3203ef641f85323da9125acf23304a871cb38b4f3d2
- TLSH
  T187B0923934D8622E321854D883A18997B8C1A3A0342C4371862ECC8580459B0C2138D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/compare.js
- Size 156B
- SHA256 cf3e198a250760cf344e0b575dbaad7d8b470cb56e25ce2152adbdf82fa3e5e8
- MD5 c4b3073651fdc985032e3d4654077cd8
- SHA1 33ec903e117ba1fe05cddedb86a9601d94e193a7
- SHA512 bdc425d93d9a18a75b211b8e2fcf4cc30bdc1390a57824fc080471c8f89376f5baac8696d74e6a80e720aa168a2f2b21bc444f1fee8cda9f1b55924cb4a2d886
- TLSH
  T1C7C08CE232B0107A3109EBAC625000D731C09391B078429C003DA88FE031C8883434D0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/diff.js
- Size 1KB
- SHA256 c6694c00d8a5dd9592b9767c53b3cff370cdd039d3de43a2735be73aa4da7aa2
- MD5 c3354fcb20f23cddd3a953aa2207597d
- SHA1 a52f6ea79cf0224fda0d44968159b8dc13e36d7c
- SHA512 ea9053433e42a7edc6a32586e335a0cba4343f9efd4c6f1d87833bb076ad8557e2c96ab50b4e8368ad3b4205b1217d0e5622a41942aa1e200fa3f848f2097b0b
- TLSH
  T1CC31BEE625DCE1B65E00A6B71A8F640437BCC5133306E9F6B55A03207F439744672FE6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/eq.js
- Size 112B
- SHA256 ee5dc50b4a4b35219e016730aa8631b25d122447dd7df56ec447dd202fd79ad4
- MD5 ac255be167064433906949ed2ee45c65
- SHA1 498639a97e5682386b94c24096f133db4fd163d0
- SHA512 1836e5681cbc7c309661630f5aeeb625a0c1f5a962e4859fd5285569d7439b8cd0398401f59fbcf4b5476218fc21dfc02fcca04d250ba66499d5ec3247281296
- TLSH
  T1C8B0127230D8633A3604CBE4C3600A7774E1C3D0302C436DD19DCC5D408581C8742EC1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/gt.js
- Size 110B
- SHA256 0776eca71f280f369a20f6edbd03c192b1722dfe6a0681c40d63798bb81a6459
- MD5 10a39ec1811071babb91462c19b950bc
- SHA1 d5e2d5e6294e56ee0a42e92e3a89d8cf294cb833
- SHA512 73e18ac95079fd936ecfa2d8fd25eed970e932aea3d4e5347f876a28f286e1627b411fa0d6a299b1e6ba73dee7e803d75e497c8acad7eb0ae1e617937a8f1784
- TLSH
  T13AB012363094633E3105C7E4D366086774D1A2E0345C8399851ECC9D40CA4288203ED0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app/node_modules/@mapbox/node-pre-gyp/node_modules/semver/functions/gte.js
- Size 113B
- SHA256 67f27bd87586a498c22954fd41f45971c079aea34cec7d63563becd62de0c810
- MD5 07110ce00d60765b5d12a015c53f0634
- SHA1 b9c50a385c8e3877108a001fb8548b122a155193
- SHA512 88513bf0230e123b80ba46a772dfd324b580237c8556a5cc69c1580822221de42e4732b84d337bf839d0295a1aa02ec96dd04d2727013f9857759c3ec984a04c
- TLSH
  T129B012333096632A3204D7D4C365086774D196E0345C8399853FCD8D00C5428C302ED1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32