General
- Target bypass_paywalls_clean-latest.xpi
- Size 311KB
- Sample260707-pp6z5aez9l
- SHA256 5c9cffe04fd7729ba3f7303d4e78a7d264a9a313ebb3e1d477fed3bcf2b9762b
Malware Config
Targets
-
- Target bypass_paywalls_clean-latest.xpi
- Size 311KB
- SHA256 5c9cffe04fd7729ba3f7303d4e78a7d264a9a313ebb3e1d477fed3bcf2b9762b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cs_local/contentScript_de.js
- Size 67KB
- SHA256 3c72212fde6d65ed1b3cfabda24386e25482214025b7f0376f2b30f5f0222b8e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cs_local/contentScript_en.js
- Size 265KB
- SHA256 50dd8d22e59b7a194a0c0f9daa9914b21b46a751ded554a16c0ce1e3cf8aa766
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cs_local/contentScript_es.pt.js
- Size 35KB
- SHA256 f99a4b2970537ac133de3a68db9b6a38ea9fa5577cb73f3b528d57ce668d9095
Score3/10 -
- Target cs_local/contentScript_fi.se.js
- Size 5KB
- SHA256 29a1b0004b721ee31068df86cbd6ff07c5ccf62684c22f593d46d908e130902d
Score3/10 -
- Target cs_local/contentScript_fr.js
- Size 85KB
- SHA256 b06b43d1e9a769171bc69e7665b04f447fde555b6b1ad4202074bd6a87d3f4c1
Score3/10 -
- Target cs_local/contentScript_it.js
- Size 13KB
- SHA256 b8b4e95956a5080cdf30fa0e48315df6433a1ec02b2d18107cfac363b7027320
Score3/10 -
- Target cs_local/contentScript_nl.js
- Size 41KB
- SHA256 4243405b277229d4c1cedbc74e8a1c164cd9ffdb975364624ce4d616ef9980c6
Score3/10 -
- Target cs_local/contentScript_pl.js
- Size 4KB
- SHA256 48e65f81b65c32e4b1c447c7ba77df58920921b1c18f5234a0f5cbc9b52c947f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target custom/manifest.json
- Size 1KB
- SHA256 57227d16d7b73915666bf1c87c0852da93b45ac6b680514a0fed5d00ab32cbca
Score3/10 -
- Target custom/sites_custom.json
- Size 64KB
- SHA256 5f00db45ef19b9fc5d728784619d83ee18c219311260db0b1da4807f3950b030
Score3/10 -
- Target lib/purify.min.js
- Size 27KB
- SHA256 dbabb5b205a333ec49c8c09e7fca30ef66df0523bb8bc0fa9ea843841f111dbd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target manifest.json
- Size 29KB
- SHA256 e69760806339249e1809b82e504f21fc9bbfa785e83950de8456f17866c61da4
Score3/10 -
- Target options/clearCookies.js
- Size 1KB
- SHA256 75f472cb82462028e58519c4b851d46729cd63316a052a429f3b291f715c598b
Score3/10 -
- Target options/htmlviewer.js
- Size 24KB
- SHA256 9b94570af945e5b421e9dc331099b4c44ec6537734375ddaa3bb6542b6092cbd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target options/optin/opt-in.css
- Size 111B
- SHA256 8fc53f66e82e6fc21ca549ac90929b27768078496645ba1cdaa50d8c759c745c
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.