852aa3fa31b80e47098f1d5e066492ab56ad79d91aada28abff491937d41289a

Sharing

Copy URL Twitter E-mail

General

Target
solara.zip
Size 12.2MB
Sample260705-mvsctabz7t
SHA256 852aa3fa31b80e47098f1d5e066492ab56ad79d91aada28abff491937d41289a
MD5 b32999b053d2d4dc0cdbaea39dfdf891
SHA1 4c7b665b148ec9b26c7b86508cae066936df31e5
SHA512 fa8f0ef3328ced470541c572665fc03d5979da8633595b656ceb9849b57d3e24c3f1a8a877cd12ad1a63cad05673441a27421687c247996cdf23ed78d545a211
SSDEEP 393216:lVQyinjHQWhMqEZmRsbTaWa2AePO6nyS6J0a:lIjHhMqEZmRkTzOwySw0a
TLSH
T127D63337D0B92127CB1FB237334BCF4A79D5A3C995056E0226895A813A2F2F54BB934D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
- MD5 225af3c55fbb7376a11dbc4648a2b582
- SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
- SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
- SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
- TLSH
  T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 bbc50575b6a191fd433df854227921937f256e91a81b47c697d95ea8ed027ff6
- MD5 1c42da9957dad375688d998aed3b643e
- SHA1 071585c1af48e621fb88c72588910e6ade6f9b3b
- SHA512 1b0a87c3ba81a4252e389c2ec392c1265e429ed85a50952f30340afe3cf1e634685390e7f307f55fd8f8255e1f002c6f8370430a0c0ed2cc46cfdbdc0710c2c2
- SSDEEP 768:HyQNb2vIYymJ22Mss+5lQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxm:HVb2vLblQ+ZDgcEST3p4JjrjaeFSUya6
- TLSH
  T15D033A4087ECC517E6EB2E78B9B491611BBA7EC37DA1D3A90C84F1E90C73B9055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 80KB
- SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
- MD5 d8e466f3951eb9a3d22eb098f4cced13
- SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
- SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
- SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
- TLSH
  T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  Monaco/fileaccess/index.js
- Size 6KB
- SHA256 ed94fd8980c043bad99599102291e3285323b99ce0eb5d424c00e3dea1a34e67
- MD5 0e709bfb5675ff0531c925b909b58008
- SHA1 25a8634dd21c082d74a7dead157568b6a8fc9825
- SHA512 35968412e6ed11ef5cd890520946167bcef2dc6166489759af8bb699f08256355708b1ab949cce034d6cc22ed79b242600c623121f2c572b396f0e96372740cd
- SSDEEP 96:gF8+uLu1uesWwXphskb/9TLsk0ygiuiFuJ3skh4WX+Oskc+3qYskcxiT9:4pMeiTZOyyNZ4We+MK
- TLSH
  T1CCD1F35B59A7211185B2377A6F220417EF4DF837A11A9688FEAC42553FF1802D4D2DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Monaco/fileaccess/node_modules/accepts/index.js
- Size 5KB
- SHA256 be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1
- MD5 4fe4d2c90a2fd19d6e97443a7d24f815
- SHA1 282263f45f6bf80fbf43f4097d53b5b60ff1a05f
- SHA512 c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213
- SSDEEP 96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
- TLSH
  T108B1328535DAB096974310B09ECFE749F035840B312BECA1F19D73B42FD1EAA8255EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Monaco/fileaccess/node_modules/array-flatten/array-flatten.js
- Size 1KB
- SHA256 766ca145b6d25e3d60f352a716e8fa1876bcdf362c0767c360cf24f335bc281e
- MD5 4b17fa06c54846b686b8b799e9dd253a
- SHA1 fc6cc30e8b8ec09eeba62bac076ed627aa3ee8d1
- SHA512 72df1668f464f6942c484155b667086bb6f83f77e826ffcd146ee045079db3334aba270bffb66cdd796d4c9308121ec2a67a404289f19914c45d9a6c15435e71
- TLSH
  T172213AD43DF3302E53077830A1ADD4C5D1A84813613F9A42D10F6F602FEA830666D9EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Monaco/fileaccess/node_modules/body-parser/index.js
- Size 2KB
- SHA256 9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241
- MD5 b9e991c0e57c4d5adde68a2f4f063bc7
- SHA1 0cb6b9eb7b310c37e5950bbcaf672943657c94b5
- SHA512 3bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6
- TLSH
  T17E515349656C7523820B4ABC8C6FA092E5A98703112DD8B5B9E8D7F9BF1404C81DBEFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/read.js
- Size 4KB
- SHA256 1e9e274755366c39ae70e8b9a7a42fc12219566e67efaf9b7ebc2a8b337f5b6b
- MD5 c148bb38c59ce266e271c96ab1f2d192
- SHA1 027f3fbd8a5370ddec744d33ec9d594db41f6293
- SHA512 bc4779cda1a3b130eb8cf76bb40676046ceb514ddc5c1891d7324776e6188e5d5ceb4c0799cf2fbc007786849ed07903cb59f61ffcac407300eef0a16cb7c498
- SSDEEP 96:1F2ISKMGJ0n9WbOaHSb+IR1+GFQBnPQCbfkZ/OPqgVB9OuCyMQ:1FwZYbhHSb9R1+GFQBICbfkWVBqlQ
- TLSH
  T18D9120A6ABE434016347E475C44F9A0AA1B4F023372D9E9530CEE3B56F58434A5F6EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/json.js
- Size 5KB
- SHA256 44f8b529333004e2aaff6db3a1dbe7068f1ac5fa1173e9634686a78c2262af35
- MD5 6b036408f968978bf9668496db9953ba
- SHA1 af1f14428152576f1c047c3462d26a7feb98635a
- SHA512 89bef97d3d5d0c8da0f3aa1e178fee1d04eee5200c2f037bd55761a61e6c6a251f7314e82343761ef227a997909f4a0237a3ff5f79a1a7bb9e879a465ab84f86
- SSDEEP 96:1F+Graz+dz1PbSDp2qjlvqzi+QBYwxcG5l+NbkAZiVl7g6A4QYSR:1F+Graz8TUj0mx+wOgybriVZg6ffSR
- TLSH
  T102B163A639E4B007535B6939588F9652B1A4C413361D9E13B58EA3F07F8843885BFFD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/raw.js
- Size 1KB
- SHA256 4e9cc80a7ee8bd667c68c264b4c374b28e731246ddb6ec22c3968daf837e30a2
- MD5 acb38e4fe575afaf8d1a257e47c6e362
- SHA1 ea7411ff5a71df8d426322d07103e5894630e29b
- SHA512 157427ad25390339b045b9bb81753709498b69b2cc8b9c918c19d52d1cb4f6bbe5b6b07885d0a7f66ef359b7080dc9a42216f71911b08ade04c1a112192bff50
- TLSH
  T135410BA939E5B5269313A8B8864F804775B0C823A24C5E13749D92F07F5802C62B7FCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/text.js
- Size 2KB
- SHA256 54a6e8ef720b06a300b21f6c60387805dec743a64154784a609dfe8c6860776a
- MD5 beb4ada09306f8d6435566d9e88076d3
- SHA1 eda9bc036c9d10f1400cd2e4a8832949671cadc7
- SHA512 5d9c9c6837b9599d29db9b1eb54cd2a4e215feeb028137f31c20f2b02e38f600aa8c02721444dc41d7bfc206ad39a810076853d09fa1e3113b5708a75443131e
- TLSH
  T1D34102E539E5B5229306A978C94F911BB4B0D823B14D9E13749D93F07F5802852A7FC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  Monaco/fileaccess/node_modules/body-parser/lib/types/urlencoded.js
- Size 5KB
- SHA256 752717d87aad57451638af2073b04eba964f348910c0bcf0070c43e732de5eb2
- MD5 906a833480ce8841bfa5aeb95b5c085f
- SHA1 8f74a7d616bf363b78844d3bcc2f554d7c76a952
- SHA512 7676871dd3012dad0472be51698d9d1677622ba3d392417a41d22ef7f6d7df6c8085516bb9bdc45d4f125815161899aa889d756d18cd41f11e2402e659f7934d
- SSDEEP 96:1F+GrIE8S/wtosB5XaYp2Yy+QBYwxcGw+NbaZMz71LX7g6KspqOJUICK0mMQ7eLR:1F+GrIE8S/wtoGXaUyx+wODybGMz7132
- TLSH
  T1D2C162A42AD57522530796B8694F805AB478D233320C8D63B0DD67F07F8D438E5ABFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Monaco/fileaccess/node_modules/bytes/index.js
- Size 3KB
- SHA256 893fcbbbe962dc00e40dc2e4b20e76e92d874dd257345003c6575d940e91a37f
- MD5 83cf8fe86424252c5a9a3e2fe90dbd57
- SHA1 bd46529e5637ff1a659f1d4af2598925b12741e0
- SHA512 f0630152a247cf51dfc677c22323afccc667350a11db093b59b93f403481deba1d44cd78cd53f4c4a3e2df297c35fe54cdc841c10c4667ebb81d3a54fbf56d43
- TLSH
  T10B7145146FD13216065F32F808CDA144AAB89663113EC9D9B46D79D0BF49C29B1F6DFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  Monaco/fileaccess/node_modules/call-bind/callBound.js
- Size 413B
- SHA256 2b2fce7622fdd680256d28bcd59c30913546a825bf69d754d21a1d21ccc2928c
- MD5 fda064fefaeb89252271922954d69a4f
- SHA1 7bac1561b456a282abe97cb9bc4e5e0d8a10e769
- SHA512 b0746c9dc90bb513e7d6190470ce0acbb0c2059b97184b9391f581e9a490729669c8479ba8eaafc1980f4e058a396bad11031d048387b5223a7b4b9e6a4b1dae
- TLSH
  T164E02B597DA3D36D812023D0CD760B2D457EEC32B07C4089869DC0F3A9E18148636E79
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  Monaco/fileaccess/node_modules/call-bind/index.js
- Size 1KB
- SHA256 6b4ea26f8ca351cee55da416500ffca72fdb14eb5909f1512ce8ca68e47d7621
- MD5 40109fa1aade9c89c9587e77011f7301
- SHA1 91f8eaf2fba5ee5c36e33207feeceee846c3e04a
- SHA512 d308a91b496c9fbd2db7d8b907d660142172342e990755093d892cf2b8382504119593bb83882f37db71e925803c37b9b098edc748f09eb6dc3f84b8dcc28f9b
- TLSH
  T11F118C4D77A6F2A2815121D4DABF9D0C98BACC7210A98494232CC2DE5DF468C4A92DAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  Monaco/fileaccess/node_modules/content-disposition/index.js
- Size 10KB
- SHA256 e86a88a5d1a9dd74faa753ca4e47a78e38ae930f3206e5e887cf6cb0ad70cbf8
- MD5 43a307ff7de26dbec523ec966c434f94
- SHA1 ed7f187b72a7b1f81d113bad5aa9347c242120d5
- SHA512 79c073d3f0dea6c1606029b9a476cdce30ebbfb7b6ca95935a2e3f2cc97e70f3f00dbe8b7067beea78dae120f4941e60a7aa26592cff18e5cdf56f335127092d
- SSDEEP 192:NnPSCe5ZBHNVzX1t6/khk3bnEm+4qcVupDAGJvyAJK:NnPSD5ZBttXbMqenircgDAwrK
- TLSH
  T1CB225254A8C260108B9766F445DFA71164ACE10B322F68E9F8DFA7641F8DC7091BAFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  Monaco/fileaccess/node_modules/content-type/index.js
- Size 4KB
- SHA256 7d76ae0f8ecc0a8c053de97b0f695f3fa3df33f692d1bd241307995304e5f63d
- MD5 4781c7ea0309edac61c3a36e3ea9da10
- SHA1 1b6e7e8d1963ce958cf0f225223fadb5ef12f86d
- SHA512 d458f8962f44ec30bf519a54aef063960d9cac2a954493383fc2ef46781c3244740f18c7daf1821b4e0babbd56b356228f7247ce40de9f3276de91a71c66c78c
- SSDEEP 96:CJFvvhHgqZlI8IDzdlalSqZf/gf6GosMySqUqMGa9Nw+j0i8L:CJFHhAqbI8IdUYVhvJMG6Yii
- TLSH
  T198A1B658E5D2A0014A4B14F445FEA612D0F5C00B321D19BAB4EF87B85FC8875D87AFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  Monaco/fileaccess/node_modules/cookie-signature/index.js
- Size 1KB
- SHA256 8d762862020064468b4af17e561ee1ee29d9d55311a1c19d958c4ff2be912963
- MD5 a9634aa95d321b9a6d90bec5d3d23937
- SHA1 bb5c2c0a463aa10074caf991f67681231b1f0c21
- SHA512 214e27edb4367aa2ef322c4d857a918ebd57bc825646184f90fa6911f830b3755fce1fdff30a5d231ea11ba4ddd82b4f2afc36451289f0b4334c445e9a26dc48
- TLSH
  T19721EB0739B1B16251671073B0A3C9427EE9885227BD48F6D38D14A93EDE8B68634EE0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  Monaco/fileaccess/node_modules/cookie/index.js
- Size 5KB
- SHA256 9fd02358eabdf6c27b388dfdff94061655620a352253bfc5b01ee4cc30ca36b5
- MD5 db5deda6183845891fe9b5667cde042d
- SHA1 ee23ab87c951b0d3e3cdf1d6072a126a84491335
- SHA512 1b6957f2ef28c5d4e14e02e8d6fea08d7210c0f2eb9de4788799fcc57d806998448622145ca45f0f605db447d97be982c62211535bf421d8c02d9e384e7db339
- SSDEEP 96:sdChhqAp9V3vGycd6mDxj64MRHMqwa+8g+3ndAVVJiN9B2RQhAh++xctZt1Y1JzI:G+hqmP3ObxlvodnwRQhAU+it9szI
- TLSH
  T109B1774819D060524EAB32B585DFA005E6B6A013212E5DEA79CED3E01FD44B88A7DFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  Monaco/fileaccess/node_modules/debug/src/debug.js
- Size 4KB
- SHA256 d8d1c1d6c387ab67c3f28d78fd0b20b9becd69442db9d3efe110ca464b509c8a
- MD5 74bdccf347345d27fe8a4ac3add99c60
- SHA1 a2b8a915c86fc750f56a7137860f19ec1182ee21
- SHA512 c2d47efee2a4442be6375d623f46b4c7ee9552c132b9229eb284bdd98629edd02664167805b0af9b3faaa9b1906e9ed0c5e383396d4995cef7051f9a450e1b99
- SSDEEP 96:TlGI0EEQUGReeJ57vPukDprmTC70WWnuOV123LwdVVktI15wHlL6ci6:JR7Jprp70JX23KVVkWsHZ06
- TLSH
  T18291858E66D739A95753603887DFF1C62A79041B3029C633789D62782FE4C6442ABEE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  Monaco/fileaccess/node_modules/debug/src/index.js
- Size 263B
- SHA256 9a34fedeb2d269c46ed94e6f13039eb0d16d866dd460ec66fa3acd78122fa9fe
- MD5 dd13897ea2eed92695bb7e4e744a9148
- SHA1 182314d32e789e4f9c29e3150ae392f1630f171c
- SHA512 0b53bc984178336ac516601e72d477d2beeef6936800da17d3a79c153e0036f7428517ebd75d296729f65856c7e07749029f5aa192b2ac071efc4d3e39750a32
- TLSH
  T123D05BC5C7FE772944F90444E159940734DDC052074CC0714395D5FA1FA48B04A5DECB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21
- Target
  Monaco/fileaccess/node_modules/debug/src/node.js
- Size 5KB
- SHA256 a3e83594a4ce88997e2e4fc66bc942b17b9d736290ad62560c7f09d6d0989ad0
- MD5 25807a97fbb1fcc42a013abc7d7768c4
- SHA1 f24d52cbc9144b011def218234ff7b50e7ddcb19
- SHA512 8d316b63700126d7c8965a886e9b35a332d3f7e68d28f2264d235c0afad28066f877f25821e1983ddde5f2d5052716cc73338779b41b6f4d1b90ad33dc3e9f24
- SSDEEP 96:2l2OYeMOqXfMWj7/UZIjh7X7QcYX82ue1jGVLE9RlbME6tCUXXuVTtAH1ReKLGH/:WAX3tJ7nYMu1jGVLE9RlbDECQoTtAHbC
- TLSH
  T1B0C1A34F9AE532010B636034C74FE2916EA9551B0425CE36B09FE3A46FC46284336EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  Monaco/fileaccess/node_modules/define-data-property/index.js
- Size 2KB
- SHA256 e34746e8c69bbf6ba2182b7362e9c4dc5fb3c19cace48091781ae967370bc065
- MD5 92d50385cb04e9bba48103d21a4a08dd
- SHA1 137bb6b7b4e8aede40825f23805cb8b8dc3eab4e
- SHA512 dc291a9457cffc5f6eb39694fd91c72877502829bef01b07dad5df47a11751b2910e1807d52842fad38d8b8309eb6d8207c042ce705a211866717695b6d6d1be
- TLSH
  T1BF41F101D768A6C30DD59040587FF947F8194EB31D7C8CFA931A7F3A2891A94689FE36
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  Monaco/fileaccess/node_modules/depd/index.js
- Size 10KB
- SHA256 4d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91
- MD5 002a1f3e813cc05d9e3cc011f6601628
- SHA1 1690c27457637ec234d6b7658f1b96e547a0eb99
- SHA512 ea1ad9bcf09a73a10dd1fd8a66daac12f87725e16ad27e7beff6d9fda937579976cd5d7ed6439c4122b16178c3ffdf410d6c7a54918f94bc98fa7950adf3bd54
- SSDEEP 192:vpe1221Fdc5jXmXUApvcvcBGtXY/KQYbUY/rRgrNoYo8GVHXWVhVO:vpe191Lc5G0k//YsNIVHXWVhVO
- TLSH
  T133327555AEE071011693B175728FF35176E8D50B013C9BA2F5DCC3A13F4C8A982ABEE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  Monaco/fileaccess/node_modules/destroy/index.js
- Size 4KB
- SHA256 b54f50db059987726ce2bdadca5d66a1e3ceef183aa5f43ce61aa53f05c36cb7
- MD5 35723299a9b5b96d111cbf94c56c898f
- SHA1 6547e9c6dbfb287cb22819955726efc01a29950f
- SHA512 d68622a50b1efa8c3ba52fbf8f1a036cffafe608dc0788013f9b7347c7077f3167cb2504d54815750225dad601c376a485357906f3c0cb6493bbac67d4ac9579
- SSDEEP 96:QDxP4dH18X0MJ1ncBEPwxr+Pfdm6h0eFoFXJ:QDxPEVXM3ncBEPwocuFoF5
- TLSH
  T190910E889EB4220326C524F5F18EA706B2D2506B132B19C6B1CFE6F91F550BD4973FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  Monaco/fileaccess/node_modules/ee-first/index.js
- Size 1KB
- SHA256 29d3cccddc7148f48715bfc94eb6f7b9f9132a5ecb704b9d4b713de87e7603dd
- MD5 e7a3f46d4b903c9f8a025cb753b1a538
- SHA1 6721b521ac3509731d3d0f9b0074908176e1fcc4
- SHA512 8e679ea25f82928ed7d55a6e2c08a647c6457d84749155716273ba3b33a030c262dd359a3bbb12465a58e3dc89bcec9c3fb7e9ce64b3ecfbf2b14df49b9dafea
- TLSH
  T19931FC089AC835FA274F623DA7EFD84678B08497290CDD90301DBF915F20A7C52A8DE8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  Monaco/fileaccess/node_modules/encodeurl/index.js
- Size 1KB
- SHA256 1d0a4e941c1504dcd9bc6cfbb77f7b44d93e56a29cba6f2ccebd78d501a51c16
- MD5 b90cf71779f72e14be703a4e494e968c
- SHA1 842f42d9ee581d91ac82a7fa018f61bb3f8ef63a
- SHA512 8db5d9a938f397c11c75c77c0cbe6eb609c5d4f81a590f221163fe3291cd0cb2a6286ba8935c8f8cfdabecec9f7e49a5bfa836dc777e936271fbe0daea7414e6
- TLSH
  T106313357158529330AC6023873E742A729DDB1CC73BE5A85BDB4E2693C0C892532ADF8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  Monaco/fileaccess/node_modules/es-define-property/index.js
- Size 358B
- SHA256 9c4b9a7edafeb02d872b9ad6258154311fd4f43cdf719e2de736973c016219d9
- MD5 b7bc620dd53aa6a7dd2ec301305117fe
- SHA1 b9844cded75ed1bc40675391eca0bbc19dedf42b
- SHA512 8d92d968347fe07872f7e6c9081493b987d9c61e2d7fa27d6f0acdb82f9a7babc4b6ab8563abb7964f67ce86c5de47e803e81d8bd06f3bb455e12c2abe5ad011
- TLSH
  T195E0D8479B35AFF9528112408DBD2816DED4CC37053455DC271CBF5EBC805C41490E72
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  Monaco/fileaccess/node_modules/es-errors/eval.js
- Size 75B
- SHA256 d3161a97f162b483206e9849e41bb17fd54166810c76ebaa1df068133e54caae
- MD5 1e89f5b29003f4edb43df2dd17d42317
- SHA1 3dedecc34d8c8ec860e4c49e51051f60f4d87f82
- SHA512 6edae4a2c632c3449ea3e3df655e7666eefefa768b6ce1b8c6167618bdc87dc06dff2f354ff138fea0a96fe88c01bad4e6fccc41b3d2c22998029ad70ea55609
- TLSH
  T121A024CF4D3050CF134400D0C3D0D5707CD010700310573D4D051D730004C4C4450750
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  Monaco/fileaccess/node_modules/es-errors/index.js
- Size 66B
- SHA256 28fee350e89561019cf27ea37a313b4b4995f521fd087198fa235a8f135962de
- MD5 f8ebbf637a1ab43a7188d855fdc7787b
- SHA1 46d0fbbffb2d11bbef33b5c23ff2014f0f1b7abe
- SHA512 b44f3cd6cad2e4d3a476ba898bf7d87525d42f013449a935a3de92bef973b925805a3faa9c8c3832cd8bcf121aa9ecb5efc552e165a5ff3c09d14fd5150c893a
- TLSH
  T136A002CE8735A19B93545054D7D4E8B5BCF454780324E57D4E48AABA4658C8C4C647A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  Monaco/fileaccess/node_modules/es-errors/range.js
- Size 77B
- SHA256 e376220f3a0226bd5b09b6d5a1411bbac274db8d2d9f7eb723142b7e676374be
- MD5 bc149f1f9a727b3ce635241092c84a55
- SHA1 23e843a0476ab2bbe089589022cfa2ea627872dd
- SHA512 8218173c907ef499563af1b33cca5d8544e9ee602b632aae42153ddd24ecd2334e87d3d5aa9d81cf97f11de2cde37e61229d062ef9a28e3e7d0fbea0e1f16d7e
- TLSH
  T1B6A0228E8A30A08F03800020C3C0BCF2BCE000F0A328A33E0F083AB3082CC8C08B83E0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  Monaco/fileaccess/node_modules/es-errors/ref.js
- Size 79B
- SHA256 31945f1740a0a2143fb8c38943afc6cce5de5ba6fab7af42d17b7874a19a0900
- MD5 219b6e072aebeb07620cc1fdddf70185
- SHA1 b86ea9e706e4c9df6639d12e5f728acb9b18ef72
- SHA512 9fb0646015b5421b7103ab86d16f97c042d94c2d566d189e8743b90ea9ca91d423a6a0b2cee42bb603dc6e991ba8fc04acf81b49650113b4260e641e3c354731
- TLSH
  T1AFA012498621D08A03000000C2C1595568910430021469281E0829B9041CC880815391
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32