General
- Target Potassium.zip
- Size 32.5MB
- Sample260706-3t5vhsdw3v
- SHA256 afba84900f7fc7f4a27a2b113f44fc07e21997a92be65fcbd97e64517c2076ab
Malware Config
Targets
-
- Target Potassium.zip
- Size 32.5MB
- SHA256 afba84900f7fc7f4a27a2b113f44fc07e21997a92be65fcbd97e64517c2076ab
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Potassium.exe
- Size 31.2MB
- SHA256 1d7008195a7d92a54ccfff95720cbbefdb83fd7a1f1e9585d7423116936a394b
Score10/10Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Executes dropped EXE
Loads dropped DLL
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target }�; ,<�.pyc
- Size 1KB
- SHA256 bd482109f74b92d7272c24a2e84c048f1480ef98ebe7899bc1da5e6e063c13e5
Score1/10 -
- Target WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
Score1/10 -
- Target bin/monaco/vs/basic-languages/lua/autocompletes/libraries/task.js
- Size 2KB
- SHA256 6cb2b2065771052a1941a6a9b35c6843ceb969ea9fd3c2c2cfc09576401fb26f
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/basic-languages/lua/autocompletes/modules-table.js
- Size 5KB
- SHA256 0ac3dcbaef38a2e3fc08e9358ec14602b4147188b11a08099461ea37fa410d4f
Score3/10 -
- Target bin/monaco/vs/basic-languages/lua/autocompletes/modules.js
- Size 904B
- SHA256 23130da74b1fe70272eeb8d6f25d87da4f2c60b05c6cb7a231c7b4e3c7bd8990
Score3/10 -
- Target bin/monaco/vs/basic-languages/lua/autocompletes/params/DataModelServices.js
- Size 47KB
- SHA256 2f06d60e90c8a526f12ef0e450f77beaefda0225b79eec62b66950da28c856b3
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/basic-languages/lua/autocompletes/params/DrawingTypes.js
- Size 4KB
- SHA256 12d1a59f76c3608cd3fdbecb04c5ab72902e7a9b75ae40eda196d3d129f54301
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/basic-languages/lua/autocompletes/snippets.js
- Size 1KB
- SHA256 9b8838acacd8610567b65dbb65981586cb4e23ba1ab8623bc285dda454b813b9
Score3/10 -
- Target bin/monaco/vs/basic-languages/monaco.contribution.js
- Size 28KB
- SHA256 42e79ec54895ee725c4f793b79fc5ca3c997a0193645060233277e524a7a34a4
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/editor/editor.main.css
- Size 68KB
- SHA256 85b305d49bae83ae9fb7d5d1c84d93989e3dc252db38a7dc07b7d349902a89ce
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/editor/editor.main.js
- Size 2.4MB
- SHA256 f9ffe3e01f9bf58ab25b37da98eaf5e80f6e37f9347e663bf249d3a6190a28ca
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/editor/editor.main.nls.de.js
- Size 76KB
- SHA256 217aad6fe9cc93483f3423bd790c1d840b1aba274439b7c8ec34b5d14811eed7
Score3/10 -
- Target bin/monaco/vs/editor/editor.main.nls.es.js
- Size 76KB
- SHA256 656dc966b4ab36a0d7846217a2434394810357cef5cd3bc8877fab4637c81f53
Score3/10 -
- Target bin/monaco/vs/editor/editor.main.nls.fr.js
- Size 83KB
- SHA256 9b7c1a14b3960b99b678df79ef50713d8b2a61b53a3e40533cf7007653e4f3b8
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/monaco/vs/editor/editor.main.nls.it.js
- Size 78KB
- SHA256 5080d040135141347236deabe17e3bb3136eee2db6f5b0bd172bd43ee5ea1cf3
Score3/10