6d159c73f78d9289ec9004c5f8f4bee621561552d78f140a1f984ad9fb4c1b6d

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.VisualStudio.Services.VSIXPackage
Size 370KB
Sample260717-pmxzfabs4j
SHA256 6d159c73f78d9289ec9004c5f8f4bee621561552d78f140a1f984ad9fb4c1b6d
MD5 0197015cf0ccd207f255579bac19c167
SHA1 a4da7d00425e3560d85a6a8aa23503936ce9d0ca
SHA512 624f02993958ce636783acacba061f9b229495178d6c6f48905618cc029cb55cbb0d3a6a7968dde5ca5b33c581b9bfda580df9da5baa4423344d97d5b6c15406
SSDEEP 6144:s/5Xvyyug/FhwYb9q5PKAcpBdW1YhBxOKr20EDyMPVRiZhGwepRYZ:sxXKZgdNq5EpG1iOKC0EnHiZEwcYZ
TLSH
T18D842286F2CDD824F9E08173CDE5D445CC724AC5A6A942C98B0AF6B448CA39E0797D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  extension/dist/main.js
- Size 1.1MB
- SHA256 721e4fe0aa9069a6d31d78d92afbdaf6fac45ed9728efa03748aaa79a9d4ff18
- MD5 e4da529316943fb5b65bc0abf9dedb4d
- SHA1 f292d45b215461873a61cdad3ccaddc374c411c9
- SHA512 faf0a55e0389331ef48078a6d169888b1fa08a83c6bb062325b3aefc736e3beac209a9ccf03b4888194fb0033ba4907ea11ffac25b1eb6f46b097ee2087df16d
- SSDEEP 12288:SUwuzHJZW6c8s/984+bqPtdti1EK4fNZPOGJSy0arEFwir9:6oHONOwPtdtpNFOGJSyuFwix
- TLSH
  T111454AB1B2E2787203E381D594761002F77C1927750C88A8F76CDCD7AAA58C9A777B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  extension/dist/scripts/connectionReport.sh
- Size 3KB
- SHA256 0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9
- MD5 e63a6b9fe2e06e153be6ad315e7a64cf
- SHA1 461f36d036b4e32dec3e6d9c7b84188639509855
- SHA512 41bf050e5c40ca9f850efb560444cab644685fa8dcc1599bf73e7a1ac77d6c51fd1fe1ec9eb54f65ed718801a072e9ceeecdd78de983b3eb5b89b85df90acb8f
- TLSH
  T170710D96B8405CB1100BC479A5A36020BB36430F15116C2D7C2EE879AF357E8A3EE7EA
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  extension/dist/scripts/launchSSHAskpass.bat
- Size 123B
- SHA256 1165658cec3aad2f3e9b16cc63e47c9b44f764a79586fbeff78ba8c80e5f8fce
- MD5 a519e2864689d90b69c562a228d2db8d
- SHA1 3067e859a9c96c4198d165c1d07679b3d9ed0aea
- SHA512 5854307c9477dc609feb7909a520460f4a916920f93abb3306b57ab6b62c4ef7c65a2e9fd854704991dd14af9543b9de49145d21bfc3489e1de6bd34e52ddff3
- TLSH
  T1D7B02B8C8100A6C925200AA29CD00C514BFCB1CC2A4CA42240D08C4020151402B83889
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  extension/dist/scripts/launchSSHAskpass.sh
- Size 92B
- SHA256 d27ec501f86584c39b132a026f41d4ec220b2e74d257e36608d66c9a6d7fe259
- MD5 af143c9ad2dab4f3bbfb2f1b36699d12
- SHA1 959c143d798df2c97676c65e3c07f48b82bd2120
- SHA512 bf13f281ba22cd812c91e3c231cd8fa423c57e90451ba633f6cf16bf804ae5128410200e316e5e21608f993677eadba73f76ec25b2fd9e7df7fa8c6cf79ae78f
- TLSH
  T167B012CE4251CDCF3C5838704CD00C344D6D92C4055801335262C4963828120F7131C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  extension/dist/scripts/remoteServer.js
- Size 9KB
- SHA256 7830933a776b87d774d68e629944b6beab2b11128488e8348286c8fb69e85182
- MD5 b8a57bc213706a9c539f7b41cb23993c
- SHA1 4772a95b143d6a1bf58f14943ec8517c1383dddb
- SHA512 1278375a16f14ce28f9fc692744ea51b4c02aa79e58f73655e39df0a71580c767762fd15abd9661fa9234175c702923785e2c3c6915292f139692337ff606b85
- SSDEEP 192:vCE628mj+0jJuOWD04aj/kzk+JYNylJtFf341:vFB1dJuT04aj8zk+aNylJtF/s
- TLSH
  T18C12D949F9CA202A13F721B1507F4117B6A6AA34A3149C60E927C5D63EF8C1DF2637B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  extension/dist/scripts/sshAskClient.js
- Size 1KB
- SHA256 8f315c9a71b206dd1fec88e6fb49e70b78f625bbb6b55a6901b5c5b81324d046
- MD5 f3943fa9413ce7b51be9b261dbe4b5d7
- SHA1 010d5f2cdef61d1aa5974f8e16c74b70c4a9ef7a
- SHA512 87ca23b3b9d18ffcb18ba659b17fa35346adec4a6bc43b426796e6bc4d6cb25143423bddc2bcdb04fd296c1ca2ba751b7240a6e2613f8a9c66942ddc05d28bf1
- TLSH
  T1B3212E8389495A15239B36F5DC0B8522FAE7DB3023109D31720096DD3EE0D64E31339A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  extension/dist/scripts/terminateProcess.sh
- Size 212B
- SHA256 3a059155d6e35d0fc28732681f4420549772411f0117f38cc36efffc787311a5
- MD5 8b0ea5e655d3276ad896fc515014548e
- SHA1 332e34520fda0de66efba0518306c6765eb14fec
- SHA512 52be9f537d047305d29d37225fcd007825f82bd1ec4e9457ef34245528f9d31d4fda95e7e685553b2bd871b9e3fd4446c68deeedcdfa7c82e02bd2dfb25cc364
- TLSH
  T124D0220C7C6A8FB27B413021C6A3830E27CB12A1487E3C0C1AD23838B420390F06E0F8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  extension/media/trafficGraph.html
- Size 1KB
- SHA256 acc3c14e259a3892f1fa4972dc9b93c870c47eb0f581eb42b2a4ffc2ea982173
- MD5 9269bec0e9e9d6e8d5c8778bdac50013
- SHA1 2f11350ab129533b821852dd9b27707b54598b15
- SHA512 c05f56f38a0c21c8f5a0e032df986df87786426df9c91e793e3a21ef9b6d65e7bf92c14c049109ad805b08d776b2004b14d10412d7a50cddd25d94f92da49fe0
- TLSH
  T18B21026548F0512A14E091953DB1924F2FC1EE07D98B418871FD46D54FC3EC6CE8B089
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  extension/media/trafficGraph.js
- Size 2KB
- SHA256 277297d9d630c41e4515d77e0e5859395982427acd4a34bef4053e12ab195915
- MD5 ef0322257ffdec95e5a30fd826278647
- SHA1 7f0a9deb268e25f1de0c9c48f36ec9609d1327ba
- SHA512 a3da2ea271ebb3e51103c554277282326f5f8f1e9bb8226b3e6876d1ad4371729a245c44450bcabf9e76816ad661b78f778a089933c8beadc94c8534989ca70f
- TLSH
  T1B351C8D272B1A82ED116C2890C5CC3816369CC723A47964F753C4EF9AC15E46716BB73
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24