Extracted

• • Target
    authguard/background.js
  • Size 4KB
  • SHA256 c925c8199d17546f57fbcf36d608a405148a525679c908aa1e4c86f73cbeb8b5
  • MD5 d778ed9864253b6ad26b96f71de55f4f
  • SHA1 465926a2f4f962a3a1294f92d3c10c92677833f3
  • SHA512 2a9a6fed150b63f6d1733bc990cedf4432fd240d0dded31fae3a638f66495312a14ce391bb3b52607740457d8038da2f921338b1348f60138163fc388a0134a8
  • SSDEEP 96:lFyvoqhjcNFGPL51yx2ci75YCzj0D6nzgIXfnC0Lo7hH4l+:fyPjcNFGT5o0L1NnzRX/C0LoNW+
  • TLSH
    T1619151211BB1115577707ABFAB3EA8C8E21E9E2D3C40C5CBD3117E0CA504816EEF6675
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dropperexecutionpersistenceadwareransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2
• • Target
    authguard/content.js
  • Size 2KB
  • SHA256 55bbf1af69337ccd7e77c28c66abdbf92ae29973802fe79b012fcc0fa2151a3d
  • MD5 4798470d8f0c0c0db890e1975b5062e5
  • SHA1 6ebd9851f5a55067b140ecb849d632795ba73058
  • SHA512 5e82c26b0d65fe2fde02e4a75a0674dfadf4d1fc2c090d639126509cf031d4c9c8f88b0fcf34da0bec6f5794548ec694d67060c3d45b6bc33fefbed1a0c8e09b
  • TLSH
    T10441FD083EF715784137B0ADD71B821A6222000B3696CE5876ACE3700F609A6CDA5BEB
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    authguard/firebase-app-compat.js
  • Size 31KB
  • SHA256 eeb6f33bbdb49f9bbb9040a671d54b69c5ba702447a78a42c49dea963b26026f
  • MD5 97bf59e1d28c5a93972e922bae6bc2d1
  • SHA1 bc0611da2c8bb484d4f9037c755acb8c78cf7559
  • SHA512 b4fb2b3d6d9477a08f04806e8f5ee926a8110a140ced465126157984ceb6950dc075167296bf2b4aa5938b00551d8cb64ed38ff7f6d5b6c8b66fd6a2b3a7313d
  • SSDEEP 768:doe1yi7IW38Zp6H8udXfC2tMNBLJMYbzljTFwIyc7mfz4ynBlT:OW361uL8bzmVJvT
  • TLSH
    T13BE20B587BE3F0270BFA40DA10362403F72D5A48194D846CF26CEDEBAA95887917BF75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    authguard/firebase-auth-compat.js
  • Size 135KB
  • SHA256 825762d074943a0e17425a467fb4a5a3798107577ac7a271b7b257befacd2c0e
  • MD5 3dbf060b64fad239c72e0de449e426de
  • SHA1 2faeb7773780dcce972e6c095ec0b275343051cd
  • SHA512 f8f23719451369cc8f1b8e746e72802c7fc7f8c99ae6d5b0de944a3bdff728d03ee41db607439293532910792a0b57dd8b3445efeac625862ff9fa6fd385fa78
  • SSDEEP 1536:LpW3e2g+RLrb0gsHUXtqopqKVhuJnO2tvJm0xIDLKXS4crHRyapHZiGdfQWjdViM:OlgCLH0gs5BmZ1xjdELHWGXgWlK
  • TLSH
    T107D31A8573E7E02286E984ABF07B0103E22D59197D4D802CB6299DDE799AC85B737F34
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    authguard/firebase-database-compat.js
  • Size 162KB
  • SHA256 f95f56f0317409ef36dc04e3d0cde031ff3d2b9303f3d2f654fb7199342a042c
  • MD5 f0e3ab82eacc695ba38b1031016effd5
  • SHA1 5c24eff4aa1ecf6d7c7a7062aef0144b6e423d07
  • SHA512 f8199b59dc8660b1e09671ea3c1f732a00c190ed8f85073c3f764cf1f8dda73b953610d5779747738008596abc9807d9d428f220191d705ed1c5602b16311d7e
  • SSDEEP 3072:5OGZyJhNOJVJzJIJ/JXJgJBJlJnJVJ4JsJdJTJd/TVgevklykU4tP3Z:5B2EjdKxhGzndXaqv3d/hgAkEkU4tP3Z
  • TLSH
    T1D7F318483291B52357FA96D641368243F33A18653909443CFA7CDCE678A4A8A71FFFB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    authguard/popup.js
  • Size 5KB
  • SHA256 46cdd157b03912339b1fc50c71fc2ab58ed31669fdd2afbd63d44dee81b7a31e
  • MD5 bcada6382419c313bfa2d9e98b86e9ed
  • SHA1 3a903bd2ccd013d9a6f2d777c283aea3eeed0c2b
  • SHA512 2d7a9c532461de59352cc3dcb8a03f6ff49790ea975a8df72984628d7e674be9b6230ac915fe27c7921d01a3c5b7a667d62575fa8b987a1d2d073220be320418
  • SSDEEP 96:4maxIMMpCZD7AvoE2b6gKaxQZmgddj33qSc1/ydhmUW9fD4FUigssm5eWGDsham7:Bmn9E2DfxOtN3JISUUWxgUiJd4WSshv7
  • TLSH
    T105B1867639BF45351AABD0A293BD2294792244132C89E8353DAD50704FC4DC3C8F96E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12