2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6

Sharing

Copy URL Twitter E-mail

General

Target
OpXOyuApWKTlFzrV.zip
Size 24.4MB
Sample260705-wt91xaey5s
SHA256 2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6
MD5 2bfb8be4d04d2bc234a5492745045f3a
SHA1 22ad5ca3f8834c7bbd8e2517d43c514e78adbfa3
SHA512 a86f89d154984997ea9047a9c2cfd0c38003640443163fe8ab8559c04b17ea04aa376b5da3e5a99563201f364719e0488168095f614d51b105353c5289a35b97
SSDEEP 786432:kwy47xWLcV+Yr6yTBR7iN5/4rZrURRzd4F3L3ihF:6tw+YVTDu5/4trURRzd4F3LyhF
TLSH
T1F04733EF8C2253C3F7576BF0D95B9F8D8A2D324AC3A033A689E07245B555A601DB03D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Potassium.exe
- Size 74.9MB
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH
  T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral1 behavioral2
- Target
  WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  autoexec.lnk
- Size 2KB
- SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
- MD5 fb5ebf1ae11a1059b54a7c1cc769ead1
- SHA1 0d4b9b9c8aa8833f2a4c91f595c915f82926a2c7
- SHA512 d66e93ebcb0b496c38b1c9b3468125240530b568de9993cc3c8454aa0be96353ed09337d193195b71e9a0c4c2ae280f36f29f5cebea6df05801e48c8ea269c01
- TLSH
  T1834115035FE60521D3BFCCB91EBB340A8A677262BB4109094114D68E1C71D17ED2AB1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4 behavioral5
- Target
  bin/monaco/index.html
- Size 18KB
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH
  T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral6 behavioral7
- Target
  bin/monaco/vs/base/worker/workerMain.js
- Size 174KB
- SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
- MD5 9ce9e46b6d66d8b2dbcabba577cad2ed
- SHA1 397b0e9e7b2bee37a8444e84bb9788a0bdcb023e
- SHA512 f322ea669fa81397066edef062721ae3dd515b3d61c4ad7bef0db0eb3a53f056da298fd4f761bd3e5d613e6f5803a7c35ed056085ac3b97e06c7bfd47fffad49
- SSDEEP 1536:mi5eQeCEwCP1m9JXKmA1xKzyOQJf9X2K7eM9bWXsUK5QSkSoIMQwr+ZjtQYyeTMO:mHTdkKmA1yyOQJl2K7ns6dZ/RVaNzY
- TLSH
  T1C9044CC53265984353E652F5A07B0107FA38B877680C556CF3A8C9DF2D6A88760BBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes.js
- Size 2KB
- SHA256 9636806a05da6a43937d122e2211e8d2877ed95caaf691f4f079dbaf47e0c6bb
- MD5 c25a7c14fa5635368e75d154c185755b
- SHA1 dcdcdbd05115311a0929390b82b6c5c2b029aedc
- SHA512 3a6b15608fcc48f78a6442fff4fe7781603ceeb7b8bb06f2c6546f821be2cb824612dd5d143bdecfa4de33a3f1f5723d2f643d4d7de2ec2d1bca3fc1ba5eb44d
- TLSH
  T184517096B7CE6BAF598C33ECE4778406A69FE5336116883DFE0C90C410D3119A2E89F5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/base.js
- Size 521B
- SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
- MD5 29e50887a6f1c445e0f63bed73eefb83
- SHA1 b8e006b9ad14bb6012497e164d9a4f926e2d568d
- SHA512 16cc7fd8b5641d347a6a9e8542a6ab29d71a432dfb2f72dae05b21b274d92208ec7c5a9ad1ba313658f3a68aebd9edc3d0bcbf07a03d0f16eae95568f175dbf4
- TLSH
  T1CCF0976BF78F30CA1E474385A73AC1495C6EDC32D2322035F51CEAA94488C2923468AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
- Size 33KB
- SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
- MD5 fabe9b3ec7774eb374f18709ab41c8c0
- SHA1 de6c19413ef008000357bccea90faf0d23ccf605
- SHA512 d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9
- SSDEEP 768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW
- TLSH
  T1E2E231E7F38C3593199B4784A27EC68539BEF6BDE4F10079782C5608079481933AB67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
- Size 11KB
- SHA256 573e821c40792e10d2dab59ee3483e2482379241c94b2b98ec5fb098556e3e89
- MD5 f2adca6e8020236f5e86b8e6aced6806
- SHA1 1f77dc5554c3ad94a78b693d1bd8fb859138de03
- SHA512 040fbb8bdcb58ecd2fbea318ba661efde39f96ac2e3aa751caed100e1b4a8941916b8a9bcc6335ff76875d558a2994866069f50f88beda76b7f09f258fe670c1
- SSDEEP 192:AJCfeXBM5iG6zUMmYmr6QMlr4qLYFQjG6AcE103aNd9xZAqGQ2qFARewPxHFTX0:9feXB2iG6zUMmYmr6QM54qLYFQjG6AcQ
- TLSH
  T14D42ABF7F38D799719438786AB3DDA842E2ED938D93240B8F70C6615248C959232619F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
- Size 594B
- SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
- MD5 4d0ec8edaec389b1eba92c1d18676f09
- SHA1 6eafd8ed47700b9a2ff1e10dd7468e50fab1bf6d
- SHA512 d4c7655d7db8d4f7d4bb2d0add36bef916caf291b2855785685a3e812279369848ce081ac6fb5cc869fb827653a4a1f874273af17bee67987e3c3a441ad368e8
- TLSH
  T10AF0EBBBBF0B3697060B63C8AB3DD740192DC831C4624425F20C5B6040C0C2772360F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
- Size 1KB
- SHA256 f7ada012dcc309b7c1cd272d1a81657b0ddb3d51521e682116522099285d525e
- MD5 09bbad4c05be7ab76cc3c5ef4fa9ddc0
- SHA1 a38cb372349a2420619e2fb629f0912500dc1064
- SHA512 40b753d8e97ba46be9fe4241dbe892bdeb62c902ea088d68ee7ea5ce0506d51b16f7105355a6b5360363c80d98b0f644b7a7ea2b4262210f24870368a2629c44
- TLSH
  T1AB21EBF3FB8E304B1D028785573CDB011C2FD834C87210B9F108A67090C9D42225B29B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
- Size 777KB
- SHA256 799c0657b0ab027c3ec0794e8934bed4a4a8e7f063dcae47783a7f32fbeda25c
- MD5 b1e41317d3ffe843032f5eb6f74806a9
- SHA1 506f617da8d8093ed58cfda68e0d60e1aa2ed08d
- SHA512 fb538a73935fd41b9f2ba9f6ddcdfe066f6f672d5dfe682dad301cae3392a93405fd35ee61126e9889e14f71c51e11cdecb4e20d213ba91b34801ec5b89ce02a
- SSDEEP 6144:0XUmTfyptLD/yxnbDh+hIAKVwhWppLTl+ExT3dsX34hAhbAhQ9qhjLmWhXXu:wVyx
- TLSH
  T136058CF7B78D6A4B2C07934AB63DCB04393EE6B4DC2254BDB65C7B2075CC901126369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
- Size 16KB
- SHA256 807dd6d35bf5fffcd4de4aa4ed1800716223a6fe014077f23f2f652ac86d2a31
- MD5 430fa91891107d6f1f3c3392dde9ff4d
- SHA1 5d42ebec7a7c3f5e5b7eb074c38572345e33c1c1
- SHA512 22011409e428216a619ca085ce8e034dc6bc3a8f9de27fb4f2e3dd6b8aa8cc7aa3b02508af816137f646ca1fa96e083a832e68bd8c8b016bfd7a3674d532a875
- SSDEEP 384:pFcCsgQgj6bPo2nv5CYR8/+qvPNEzH+AK6/NBA8K/tQsdz6FKRjrDcWYUeih+hrA:pFcCXQgj6bPo2nv5CYR8/+qvPNEzH+Ak
- TLSH
  T10E72DEFBF34D36A71D4B4281EB3DEE46261FC67CD83201B0BB5C6A15164885623A785F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
- Size 7KB
- SHA256 17b72f11f227d6261e44b0bf49d6cdc4ed88cef93c68384ba73f7550d9614d99
- MD5 6cf31f5ac3af68e878bf565c9ed6404c
- SHA1 afaa8bf2c9326ebe8658566fe6296a075d49e23c
- SHA512 0fff9572888be7dfcb792c53b006a6f4b8328d6522b971f5cb8fe9b0ce17ba9f82b6ae0a78d56cf585121a9a62772e70b03227074bb4683a52617f46c52202d2
- SSDEEP 96:AqiyuRkcbZjRZ7AiQnRztu6W6cEY4Ef+YepYk6JY3g6RtqYnFNYlyecYqzGRpYSY:AJye3VNZ7/QRvcKEe9fg6zSyz2585
- TLSH
  T167F142FFB34D726A18434381AF3EEE863A3EC438E87356B5B45C5128458C92533A799D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
- Size 1KB
- SHA256 660f088e8da6e3c7c16ff4df184a92fe96c2b2ffb8c3b3411f30b68d93723dba
- MD5 c41248fefc16d5e096019eace4e8ec90
- SHA1 e22931bf5fefeb7a5fc4ce7770283328e588241a
- SHA512 98f6a1367b4be1da50d1a257e726b9c1a66ae22cb8e2d1439b1dd0b4ba4d5a7e22340b165b489911d0a8603fb5c827c7ae43d89daf10dde34352a21304265a4d
- TLSH
  T11621F0ABF3CE7456234701C69F3BC9492B3DDC7083220610B15C99A088B4699A6439DF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
- Size 6KB
- SHA256 60a9fa2721d16f3162f5701b7ada27de313794b97047cc7bba25f82859e4c75e
- MD5 1b0977e0af22c275e5f7df15de461932
- SHA1 2fe9b8a3910fbf4187247dea7402baa402764210
- SHA512 8aceee740df28fdd7e28abb3b42617eca70b33756f5b414366019fead5f94f716f3fde34e3600642a6c12b7ae5904b1700332a1a3a5c20c3f5f4d609652384b6
- SSDEEP 192:AJDF/h+8NpUG1mQqJfL/3x78ONlzN1eFqT:MFJ+EpB1ifL/JNoFy
- TLSH
  T19ED164B6F6EE26F1187A024AAE3B894036D9B3BC94EC7068B7DC541D53CDD2C131607A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
- Size 12KB
- SHA256 251d21959744760aa1e79274b7a9fad433fd42b2d3fb4783f56f0b070d06cf8e
- MD5 b965d0ffcb61fec7f70f4f28a44e9982
- SHA1 2a4c47087318178698368ff06fef670155bdfc53
- SHA512 9da1ea797cbaba01c92dc7a68a586ceed6048565de1b8e40074a76666a8ac1df910a91c547abd5a2f8882686ed5d2cf1079cb47d626eaaf478da74b037d06af6
- SSDEEP 384:XQazTbBakPYkrvL9Li9ZV7+RSC1LQS7FihmJVPMp1TQElbvvQeTRmvhQ:XQazTbBakPhrvL9Li9ZViRp1LQS7Fihx
- TLSH
  T14D5265F7F34C364A1853C382AF3EEF41782EC93DD9339178B64CAA096148915276799E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32