70d803ed881730e0305f99a12a211286222d9bf61098b7563026a68629893aab

Sharing

Copy URL Twitter E-mail

General

Target
Nexus-Token-Joiner-main.zip
Size 987KB
Sample260706-b759nacy2p
SHA256 70d803ed881730e0305f99a12a211286222d9bf61098b7563026a68629893aab
MD5 b5ece4e1381d7988b3eb3a0f49535438
SHA1 5e3282cf261bee67ac3d1ae3c5b99aa8e3596d28
SHA512 4f7c8418d8db7bce25638ea2684ab7128fd73e55ad5ab7e8c6e5dd3ffbd97693801d517cbf4991bb7b7b2a1017d5ae98a43a1c331f398fffb7b2f4347cc6a9b4
SSDEEP 24576:OAuV3cxk0jBPjiUirmTVfXAR8h61qtVHhfGVZkz7ifGu2zLKS:OAcG29+hA++qfH0Zkz7iALZ
TLSH
T19F25231097544929C63861BF71E213016218AC61AFB8F9039A1E18B3BD5B37BBF376DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nexus-Token-Joiner-main/Helper/NexusColors/__pycache__/color.cpython-312.pyc
- Size 6KB
- SHA256 ceedc2e5f62088ecc4bed40e5fc730d1dba14d4771baa726b9cc07dcc4384471
- MD5 73eee43fc7a72563422fc27e93cd91dc
- SHA1 564758aba1a2d1b99c5fa50038fc66601a3b0a83
- SHA512 8b4f110da269ca857d15c95c4f36051ac3cbc8c191ec714d6a15c6a29b830c3c120c4ddf06f107fe91fa8babc104f0bd71bae45e9fec7137fd36dc048f2268e2
- SSDEEP 96:AZXxamOCxYxaVeOYitTRxaWKu/cvoR6xa9kHDAPzcUSe0n6eOQ5kooqrUkK:AX1ZaqeOYgTRpKu/cvg6nDNjUqokK
- TLSH
  T1D4D1D884FA458636FCD3F6B904054745635F92ABF1555B2F3C6E006D1F0D598ECBA0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Nexus-Token-Joiner-main/Helper/NexusColors/__pycache__/gradient.cpython-312.pyc
- Size 6KB
- SHA256 46b983df8026945bf6b28fb7c053ee2e3eadd2bbd2f640516f53448cbfa7650c
- MD5 f79dee69fd5c061d1b5493a40813f402
- SHA1 7873384b258581fe9b160185fed0bbf8e768f402
- SHA512 da7fbec2b0cf24ec7c03756e9b6a1021945897739b276fb75a30ff2823f11d1bb6ee8ad3dd82922dc99772f1a00d7b3eea807cdfb9979fb893f3e3002c3587f3
- SSDEEP 96:0ereCN9m2ucTxH6ALDli7yZYyZ7K3wu1EzFZViei8R:zSCN9tP8ALe47o1EzxvR
- TLSH
  T188D1A4C9AB078373F853D4F99490B7AA733B927336A0A72734AE405C3F67161E81529C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Nexus-Token-Joiner-main/Helper/NexusColors/color.py
- Size 3KB
- SHA256 1e9eb9e118c23563ea9024b08f3fde72f66602ea93d35a4bcb4b3ff2d2269737
- MD5 bda14e8898fc209dc0f673a418dc9e81
- SHA1 d512d503a9d844c550fec7781fd1d62994edf63b
- SHA512 70a12de419f645c23f5fcf435fdd961222a6641f26edfd2b3ebbf2a42052f0bd55034e01513468c665ebfeb737e00f6b5109f3da07c4f034ee217da7761df2a5
- TLSH
  T12F81424AD7C91E4956D3447C1482CB617A9E2B67E2152B3E3C9C02BC1F066EDC8F90BC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Nexus-Token-Joiner-main/Helper/NexusColors/gradient.py
- Size 4KB
- SHA256 61cee60b4f23b07498ed42417cfe88a97ee6295194921c349bb3fc1bbcb22904
- MD5 c6915ad2b1d2059bb1869d312c24ca31
- SHA1 77238487334adefcb34841133bcdaab414976c34
- SHA512 454afd9875ae8e2fe34843c283951c2d00f4283e334130f3ce6372590ad66efc3be241c5117c969abd898589e05efa224bd7fb6279236359a62b895a8dc7d0cc
- SSDEEP 48:IOfWaEG29xUtNTqu0EcPYm62S9b6TNwvbP5BN0j/COnvjy+aYyiLoyZAIm1DqIH:IpfG29m2u0EUSF6xm5Hpi7yZYyvRf
- TLSH
  T1D481554AC86E1712EA9784BD8081C358317BA22365B057383CEE41BC0F6A75A91F96B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Nexus-Token-Joiner-main/Helper/Utils/__pycache__/handle_startup.cpython-312.pyc
- Size 14KB
- SHA256 1e07112ea8ae1be9e92a31134a97047a4ef5963f3d32747706a2845039883fdc
- MD5 096a04a47429b4257f0b532b7c04494b
- SHA1 dffee7c8579d5976a735270628f067bc7fb430a2
- SHA512 e6970d8ee6c5f91f3e1b54fbc09bbcb2bc4128451e3db30ea2a738e6c090c4f12efe9b0976c1f8476f58713ad508bde6f3525eb29a85696839854b8dea626644
- SSDEEP 192:Z0KNYIMsKBBSJyfR7CHy5mRpOOyOax6Sw7QQ3n53n7BHt5l8/zCmOdr:t9MsKSgRZ5mRhyrf0QQ353Nx86r
- TLSH
  T1F662C786DB97C137FD50F2B0AC9A37CB67B502B8F600830765FBC0286C5A631B99658C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Nexus-Token-Joiner-main/Helper/Utils/__pycache__/intro.cpython-312.pyc
- Size 24KB
- SHA256 37bb902b133d35afca095cea5213744065b5d116fec626d11c2e4e01be19ceed
- MD5 2e2de188de987f318ea0469408bda24b
- SHA1 0bd3e5e261bfa4235a7133eef7c7aced9982ae86
- SHA512 430cf2eb2955e17def6c9a79aeca118ea1564bf77957f933522892744bb016a3ef3c2022192c8bc71f880de1bf7eeb9bffced14d09e242de9c83f4daadbac9f8
- SSDEEP 384:TDQxtIYdjvauyCmhA85rw8Sbdq3+Qxymuqwtvk1zTuamqWQda32lqB4CJJT7h:fWS4eXqB4Wdt
- TLSH
  T1BDB2B3F11585D102CD24B9F1279BE7DD2F622B15A62AA4BEB77DAFD7E7010C82803C09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Nexus-Token-Joiner-main/Helper/Utils/__pycache__/logging.cpython-312.pyc
- Size 3KB
- SHA256 3f88ee2bb5a8e12be6a766f2cac0ba5c49e7c3fae2305edb69a812d0d88d4f2e
- MD5 50e95528af563cd998f5a0f096057d4d
- SHA1 c4746a96ba98d85963acac09e7adaab95f3b009d
- SHA512 50fce9be0ffe395a259e08f873d8db3c3d0c2150546acc22e692b23b63c5342316681d8d3ebfb73659e7dc35a4afab5f096860e1679a1f586b5cc0a4d12a9781
- TLSH
  T1E67197DC9716823AF816F4FAC8D9275722F38455BBA1C2073A2FE03A3F4D052646349D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Nexus-Token-Joiner-main/Helper/Utils/__pycache__/safe.cpython-312.pyc
- Size 1KB
- SHA256 194c6fcab447efbde87c08b29261d2626af110966cbcc94808304cd9b54f0c61
- MD5 310d9a8d8cbe17fc7dcc75bcf1f793b8
- SHA1 cbd2e42f1ca8da2a1e52f0f3356037eacc8af987
- SHA512 68f054746ca591ee65e2b2b21982a93771fe63b2933642165b0757c72d2529dddaf60789a9a9e226d2850c50e43cc10085e646ac5ba4705187d0611aaafc7f8a
- TLSH
  T17531525677A1C573F859147090A2A7E666B0D4F8770053D77B2F807E2EAA1219C7484D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Nexus-Token-Joiner-main/Helper/Utils/__pycache__/utils.cpython-312.pyc
- Size 31KB
- SHA256 8aa87abcc20d4fd45eafe953b0ee9af55fb1ac071bb7977e32d28c0ed1c25656
- MD5 c38711aa63a5dcd86903e43d4fa68504
- SHA1 a5741bb8f3fadebd962cc300ef1e35c59c961e73
- SHA512 62699a5505717ee75a54c7514ee76123010eb9ab37b379dd4ea03500eacee0e64bcea1a3ecf7780161aa993526619be3024476d65bb41b0b1de7363019949932
- SSDEEP 768:XCT4lhnzhMU1Ko5SICForsh+7iW3hebFG5m:0cMU1x5bW+7iW3heL
- TLSH
  T10CE21822F643D132F9D1F1B4486E178DF76AA423F261831338BE406C6F8796898B65DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Nexus-Token-Joiner-main/Helper/Utils/handle_startup.py
- Size 8KB
- SHA256 1f87d177a0409773073eac7786c7f15f3fa4e4611cdc91f1824a6d99c1c4f650
- MD5 60463478b18927fa24228093ed363f9e
- SHA1 f98a7d3ebdab6b04980ad418c30d4c9df17a6c2a
- SHA512 a91f9c9e17d6c5a6e1419600cad2c7a510a845905582e0084f3b1e59ab691690aa50f4495040ff09d883164c8f6eed0838671db8e622283b9a56928d3f3036aa
- SSDEEP 192:V4YlaBKlXZ0aQuyuQ0CqfLbk/Lt9CiY4k:V458lXZ0aQACqfLbWCiY4k
- TLSH
  T171023D1A8DFB1C024A73413E6C45C7A1FA27552792A017547EAE01DCCFBC2268BF25BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Nexus-Token-Joiner-main/Helper/Utils/intro.py
- Size 19KB
- SHA256 9be699e228d6f4ef99709fdf02d7c77f47b2239611d7d53562b81a31a46b40bd
- MD5 83b951fbf79d502488ddbc6ab441d40e
- SHA1 c4146d236e5e51ab75954314daf62d062e2d4231
- SHA512 2afb1777b389ef1b25e11fb2714e526c298e48d987c0d6ebc32768f1717675ebf7aa2f7e0ffa55ebe8ab10c530e48cbd2b3298077e8c0af3610f487e3a64f847
- SSDEEP 384:JPcj+45AzICzsrh6TxrJY9bNmpw7lKSwLa4ZcHAzZrh9Cfr9PD:Jk6IzlD
- TLSH
  T13C92CA722C64A161AC26F9F1AB3FFA2EDB9195CED14F48B0767C0FCDE3A6101852D845
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Nexus-Token-Joiner-main/Helper/Utils/js_log.py
- Size 310B
- SHA256 ee4bcef3a4dc0ce3de6e388169e1e19211b9f483e8ebb146abebbf5d10bb850c
- MD5 84f6ad798ae3f51e49d853b93fd94d1a
- SHA1 739ec79f8dd4f2068638540c1f42dfb51a4aac7b
- SHA512 d603e280b6aaf79681d38137bd8511dfba1f5b918b07e356fddd43681a72a464cdfe1dc6e2d710a2b7a19b86531e090838fa2289ee955b4ef96cafcdb2591aaf
- TLSH
  T1A3E02B1C04110C17D81791C5721362D442EF7172F2006A2F759C423E9F60153C524699
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Nexus-Token-Joiner-main/Helper/Utils/logging.py
- Size 2KB
- SHA256 af4f30afca3286a60ebaa538e86912eff8839f2ca795d8929764e55fd1b543a8
- MD5 dc177c6953b873e7d2b2ed2311a553a7
- SHA1 ee74502873cf0065380351087d52115dfaf45fb2
- SHA512 221b013e48d5b5db5e8e459e991279532a3dea6cc82f0fd7960be28dbada780080c545ff5ef48ccd837052bceaf831ca590a8cc89cd9f5c6cf21063662162d04
- TLSH
  T12741F30BCC6A0C0B9673C0AE640593F4F57B22137794A613397D82BD5F342568AB956D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Nexus-Token-Joiner-main/Helper/Utils/utils.py
- Size 24KB
- SHA256 eeaabc895c323341fae5420233308d751219bff756dd62546a734e3eae9ebf14
- MD5 29e9f826bc76a72c8712893e010f803e
- SHA1 777873bf7b1502b83b3425613c32bd79cb81a085
- SHA512 28d528f50709d8096fb6517bda5097bb59163f9b5b25acf1dd9933b07fc456bbb00cecca8a8ab577b38af9433c6c836224c94ca72aeda3e4354c577ff39c69b5
- SSDEEP 384:ttmpBT2ubXP7KxJglsEEL9ipui3nl/xCsSDTCA9MiPufIfOEUh94:t4X5iQFxp6xHVUhK
- TLSH
  T1D2B2C833DC07683382B2826DD95AC659F32A731B51630413BDBC41AC1F7582AD6F69ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Nexus-Token-Joiner-main/Helper/__init__.py
- Size 598B
- SHA256 b45c03364009cef7061e0863ece600592d5278eb3aedcee255db7570c7abdf70
- MD5 d810bc92d288b77e820cbbd19811d4e9
- SHA1 a9ce6a508329cc739648a22a64bd76bbfba0c78c
- SHA512 8383279fa81be5bbf64f9ed8f88d15b9682f792d2e261e9652a6403f2b2a541cc4e5dd3c181cc4a270cdb495ecc2c7ccfe3065947f49a3b96e30f9bd25e67bdb
- TLSH
  T150F0461B743F2E35A1BDF69AE17FD230037214B05F6564291A38E7BC33C0150896C49D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Nexus-Token-Joiner-main/Helper/__pycache__/__init__.cpython-312.pyc
- Size 998B
- SHA256 567cbeedade60e3c3ef9cde1f50d920524cafd100e3b16c0967843dc218958ce
- MD5 d2f560ee2ad8de03fbb9b10aa2293495
- SHA1 4eaff240d8dd95fd19da53eb199d98854cca55fb
- SHA512 47d30e40f27459b7a47e0195ce177dae3ba5058fd507d5b54dac5115ccfd4eb227aa9f4ef5a0a044d49cef09ddf017b80892d2966924a588ba85532a7d9e42b1
- TLSH
  T11A11CE53391E697AED06F63AE172B68462304E8456E425201F3CC14D1A18194C3E988B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32