594b4aca00993938045324d5dd5fdd1c94c898054eb58ed4c664a17f5f647666

Sharing

Copy URL Twitter E-mail

General

Target
(Copy) Zyro-Store-main.rar
Size 18.2MB
Sample260709-cavbkabw3l
SHA256 594b4aca00993938045324d5dd5fdd1c94c898054eb58ed4c664a17f5f647666
MD5 392585bf03b65a54b5d5d73dfb547462
SHA1 9308d1a91c2498b7656ea500bbe2c01f1a91a3d9
SHA512 9dffefb0e74af2fe66b488128e64d7fb0763e528bec21e9ac4d8f12d133993938987a974d8383d745163a9933ae88d27119e8c708859dea750058134c6ccc13e
SSDEEP 393216:OdV5kGapBfxEK3Fj3Fnm9bZAWalQBUtaDi4CVM2B/K5M21VCgBF4jQxHFh:0YGazfJJ0N8Mz0VxIS2fJP5f
TLSH
T14C172289E5F59E2D5E58300FB2E8C1353AF45BC78087C954378C61E9460C4AFFAA4E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  (Copy) Zyro-Store-main.rar
- Size 18.2MB
- SHA256 594b4aca00993938045324d5dd5fdd1c94c898054eb58ed4c664a17f5f647666
- MD5 392585bf03b65a54b5d5d73dfb547462
- SHA1 9308d1a91c2498b7656ea500bbe2c01f1a91a3d9
- SHA512 9dffefb0e74af2fe66b488128e64d7fb0763e528bec21e9ac4d8f12d133993938987a974d8383d745163a9933ae88d27119e8c708859dea750058134c6ccc13e
- SSDEEP 393216:OdV5kGapBfxEK3Fj3Fnm9bZAWalQBUtaDi4CVM2B/K5M21VCgBF4jQxHFh:0YGazfJJ0N8Mz0VxIS2fJP5f
- TLSH
  T14C172289E5F59E2D5E58300FB2E8C1353AF45BC78087C954378C61E9460C4AFFAA4E7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  discord-bot/node_modules/@sapphire/async-queue/dist/cjs/index.cjs
- Size 3KB
- SHA256 0e15dcb6a262573a140951dd3af3af44f7613069cc8fcbbb856ae50df2f5f92e
- MD5 cd2706d6b9343178b0dff091f084edd4
- SHA1 82ab9ab3ebffc3b0fefcc41b37aba1640d5384e9
- SHA512 7ab828922e67f5955f9af9a575f9d116056802ed6f852f47b329b2d3332eac2d1b6f3bba6f9c7ca9833725967327d95000e82b785288eb2c7b463b30f0b4ef4f
- TLSH
  T109813693EBFF22A2D05370F46E4D5042EA7D450E209ACC19721DA1F01F8BB3143A6CB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  discord-bot/node_modules/@sapphire/async-queue/dist/esm/index.mjs
- Size 3KB
- SHA256 62950b66997ef40bee05bb77a82b61d42037ef0e388770a9aae0cacde26f0f68
- MD5 dc04958c3c0f77274ebd7e81a449db0b
- SHA1 1afd119ba13228f8ec3da7cc7e32c758e736397e
- SHA512 4d140e6ed94a861af739e69c405fb07df4090ba1b64055b6a42d40e5c9b121ba8f9d4e3b2f9c8d6e070f62a320d2ae1d478a5073364f4c98d9adb5f066b7ce06
- TLSH
  T1F2812693EBFF22A2D05370F46E4D5042AA7D450E209ACC5C725D61E05F87B3143A5CB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  discord-bot/node_modules/@sapphire/async-queue/dist/iife/index.global.js
- Size 4KB
- SHA256 d6c25bfff20642ade6fbf3707009cd2f2ed0799c110bf4ec1aac236ca4748038
- MD5 6ed805be860b69b7b5538c514c21df48
- SHA1 cf04719396feff07b07fabe0abf04c3a8ddc0907
- SHA512 57df505c99195f59237a45ecff2ce02239fad233baf05b4155a41329892f17dd8e177cbf39e5fd5da7af403be29a7e2382bc9af0771f0b37665cdf8005027c8b
- SSDEEP 96:JdW6s/Ks3BV8bNjhDSEHQe0S7iWTCdbTCS13gn+N3+BSXjrFSmtXnFmspeFTKNan:LW6sVuDzZ05ICdXCU3as3fzrMmtXn3g3
- TLSH
  T1B3910497DBFF2222945370B46F4E5042A67D550F205ACC58761DA2F01F8BB2483A9DF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  discord-bot/node_modules/@sapphire/snowflake/dist/cjs/index.cjs
- Size 6KB
- SHA256 6d4e341511469cf3d14ab0113fc26b9762d186887f634424c728873eced7fdfa
- MD5 c09abf54d11df16ee0975d20244f42ce
- SHA1 63dad084fd9da8baee0195b3a13fe282564608d4
- SHA512 de863e4891f2a7b036b13e8cb593fd86a39ffd044bcd24c32af06799d0826007ee5b9c08760135065da2ee9667b7604ec72f306b5c4165d39deefd81714cbd66
- SSDEEP 192:lW6sBwfwRAl2c9NGXJia0aQrlgzglbpiEF3ph4PAK42/OTF:lWLHa2iaGgslbpiM3ORk
- TLSH
  T110E1630739FB12F01413707A260E4153ED8795AFA6E9815978BE13340FA2B71C2797AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  discord-bot/node_modules/@types/node/dns/promises.d.ts
- Size 20KB
- SHA256 56231e3c39a031bfb0afb797690b20ed4537670c93c0318b72d5180833d98b72
- MD5 fc42cc07e05f2299af1265d3c39fae56
- SHA1 17c86c4d97c1d13befcafb22d2814594011b401d
- SHA512 95fabf143dd2563cc7fa82a46c6234e5875ec1fa4976d60ac18aa1d4a6efeac7157f8c23862c44cfcf5b568f35d67bec6f4c370e1ad76275d56fee5280a9a009
- SSDEEP 192:p/q/wh1NfSZvF0Z3hKGxjoTE18UTVhHcom3ca+ttyc3A3svFEHQ5FK/FIRP/AwsM:1/1NKPt8D+0xCLLPiw/tLfmOG9
- TLSH
  T17492A42A06D5332B06627834E64F10CAD719625F2569AC50B8DF9BF40F97FAE777208C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  discord-bot/node_modules/@types/node/domain.d.ts
- Size 7KB
- SHA256 5cc7c39031bfd8b00ad58f32143d59eb6ffc24f5d41a20931269011dccd36c5e
- MD5 9e87c1cb628bc3a7b9ee01df484a14ce
- SHA1 a61fd7b04d776c2decd54db052ef36c74c23017e
- SHA512 167ccc34dcf2f9ee5755687579fb71d0eeb4e1da6e94e66c31b3610322aa79d82695cee9d20e4d5700f396394ea06005d3b218596632e496dba269f5f4cacdf3
- SSDEEP 192:QkbZDatRtfCX2U8TZpspsY2e/sE0eVguf0EwysdVmTGqmaQjT:JNKF8uU8GaIqnnT
- TLSH
  T1FBF1422E66C6137206E3A6BDB34EB0D4E212E1BF13359490B88D43782F5AF3545B66CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  discord-bot/node_modules/@types/node/events.d.ts
- Size 47KB
- SHA256 b0b69c61b0f0ec8ca15db4c8c41f6e77f4cacb784d42bca948f42dea33e8757e
- MD5 bb9b88cc13ab63da1aa31e81a2b69ad1
- SHA1 60b94114c0dcef5b8caaa1f06dabfd6baa09d35c
- SHA512 99c577de97c985a20b1ba61089ce483e2c2c47509a8f576a97e007e2a722002d0ec4b1119f3e6024b34e4dd8518fec3910410dd19780e6a2c9c9bb2dbd3beaac
- SSDEEP 768:hKwsgetQgFP0BQPZrwwlX44DrvxmZ1TpxZHO9U5zeF8:8bge/P4QPnX/rxmZPxZ5ReF8
- TLSH
  T17923410956D2137220ABA77F274B52CAE23992DF6660D420799E8FF41F0BF5CC5B21C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  discord-bot/node_modules/@types/node/fs.d.ts
- Size 192KB
- SHA256 f96a48183254c00d24575401f1a761b4ce4927d927407e7862a83e06ce5d6964
- MD5 a16940634911ffc477deed3ebed28d98
- SHA1 1f43825c31e54e9e80b98a3edf1d04e1076e639b
- SHA512 db9812171ce74d0cb36291a15080fe5160637f7280a1d03224567cf30541fd4dd48d374323c82c22b841e224aa336bf909c84bdbf1acd46df3d6bd6ca897149b
- SSDEEP 1536:o4PE3Qrg9nIDuzh5B0uH3mf0xm95bMa5LwO9p6RgrTTT/wzpDao2bM/rO1WS+y/W:BPdru6Kao2IOJWd/R
- TLSH
  T1121497066EE62332016336316B5E54C9C128E2AF633455A5B8DDC7B81F0AB3C93F66DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  discord-bot/node_modules/@types/node/fs/promises.d.ts
- Size 55KB
- SHA256 cc25940cfb27aa538e60d465f98bb5068d4d7d33131861ace43f04fe6947d68f
- MD5 58b77cab851527a81c3d193351c0d0dc
- SHA1 e5ec8651a1812fec203dbe3e97738a02e3a3c844
- SHA512 1d81e302e8505824bd935d2e8f298abef014d8df6b16fc3585147aea289bc3dad0b161ba42091d90e4b833041f3fb7a7e325ceaa926c45841142d83887903134
- SSDEEP 768:Rtu0DhHH8VdKYMDbLlFTjdJFYzFzl0UWhy+WYqCzQ68:zHcnKYMDTjShnWhyFE8
- TLSH
  T17843B81B6EDA2332017321747B4E54C9C129E25F23349894B4DD87B82F1AF29B5B76CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  discord-bot/node_modules/@types/node/net.d.ts
- Size 40KB
- SHA256 9451a46a89ed209e2e08329e6cac59f89356eae79a7230f916d8cc38725407c7
- MD5 c87a62e9a5d9f9d496fd5e3e97f49fcb
- SHA1 bdc104e0bd1b751c4c38e10cf3f1050e4bb3be14
- SHA512 6614caad8e70a0889cfe46c05ed4f6363cdf93ea2e1d7c968c449caf6cc6b66d037b06f801db14184f70ce445b2150c72e378d4033cc8f2f28393efc33f3dddb
- SSDEEP 384:+ff36rqLzbldWDSfBAr4AbcvxhUIccOMwcmQVpZi6p/ofG6hr2gFb44qVrAdJ2vS:0LzOohUl0i6ho9ggFc4qdM
- TLSH
  T11713B406ABF2233611B30632171F11C1E318E68F536154B4B99DDAF81F16B9896F73C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  discord-bot/node_modules/@types/node/process.d.ts
- Size 105KB
- SHA256 cf9717ebf9dd23f5f1e55e00545df1edc40ac8a671a034974fb4ff5dfbfaacc4
- MD5 8b15423adcc4b34f4ce3f72d0acf192f
- SHA1 cd9ce471a1c3dc49d21a0fd7c3f8f8cf73cf25fd
- SHA512 4f646fb6f263230ce6a5493248eefe80f4c5195b79449739290397fc12f2926bb76e550a002fca757af398cfc7b88200b0f29f2ac2b354bf8cedc9cd6d92e8d2
- SSDEEP 1536:/xGZXJtepLbxjQnT58bdLX7BYWYMB+s5CB+s5h9:5MU9cnT5GdLX7aps57s5h9
- TLSH
  T1E5B3D70A99DE433500E75A753F4E00D3EBEA915F1734A874B8AED3BC2F05F68427529A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  discord-bot/node_modules/@types/node/readline.d.ts
- Size 21KB
- SHA256 af4ab0aa8908fc9a655bb833d3bc28e117c4f0e1038c5a891546158beb25accb
- MD5 7b4e5d13e05610ffc07feb992a8a4079
- SHA1 cfb425e73b63dfa02e8ec0618f90621ef70ad031
- SHA512 bf7ddbdcf03e47c74d3e7033fb2cc2c9e159184d29affa727589aeb2079f6783e0e3fe703d8a664c25d7f06b8982b8811415bee6598c0ecb10f662e80ec9b701
- SSDEEP 384:umqf5KCHyBf+IGdXIL/WZrh9KXEcrlZnCvjh:QxvH5IGKjW5h9KXD7nCd
- TLSH
  T172A2A41B9DFF2332155314B5238F51D1D18EA02F2B269864B8FDC67C1F8AB98C23A6C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  discord-bot/node_modules/@types/node/sqlite.d.ts
- Size 45KB
- SHA256 f64deb26664af64dc274637343bde8d82f930c77af05a412c7d310b77207a448
- MD5 599ffacade481f10418395d03b2104ef
- SHA1 c63fac89e2ce7bbc0f803c70679d47f7c9713c92
- SHA512 25e31297d36f9b806656c0d270e2c0783fcc7248cee6885c6be24c7db9273dfbb525862737e9b8e65ebf4463044f95182328fb27cd5d47a36b57100c511e63b7
- SSDEEP 768:osxtv/rvKI9xgO+6MQm8CLWbjCNvMxEVT+yf9Z:osLjKhQm8CLWbjChNVio
- TLSH
  T14E23717B3AD6233105A704A0536E61D0E62EE55FB33194D4BCADC37C1F11F29A2BB689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  discord-bot/node_modules/@types/node/stream.d.ts
- Size 85KB
- SHA256 ed4f674fc8c0c993cc7e145069ac44129e03519b910c62be206a0cc777bdc60b
- MD5 8c655914a83c9b51a1b8c97988426093
- SHA1 5d3e9f3eca1d4b62bc1e91f0eb183adc04ee3268
- SHA512 ce94c468feee92840704e81090016cedbed63ecfd919a2ee1d99f04f543ae32ec9f6965bf710f5d83d850d8ba809451ee32c3e2cd22c05d56d737cfe59677613
- SSDEEP 768:b7BPcJJHWh0yhhrw+dsayyr83VdSlbIlAAJbx8Zvl60yN3A:b7BPc3HWhHh1w+yaR8KMwZw93A
- TLSH
  T14683B81A2FD3336200929675578A47C7D318E72F0A649874B48DDEB81F09F9CC6B2BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  discord-bot/node_modules/@types/node/stream/promises.d.ts
- Size 7KB
- SHA256 f1c93e046fb3d9b7f8249629f4b63dc068dd839b824dd0aa39a5e68476dc9420
- MD5 904f58cfe9014af29ebd557c47d002d8
- SHA1 97573d0561c839835780657c23d81e6d5785426a
- SHA512 2c9d35e3a0bf81783b890527c76552b0baabe9a2791f7eb1dbd459a7b357749b1ba509ead4bb327f6f0fe934fb993df30ee48b9fcf095714c6d9cfc4802a6c0c
- SSDEEP 192:E0IIy7cxzjSM9BoZL3o+i6jmvoSDrMfdjENiTPTXcTXzHFAEK:lpjKiF08K
- TLSH
  T1B7E1EE1A5CD215D200E310728BEA0289C166CD2F0DC56C55F6AECFB5AF24B1EF7B5626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32