Overview

overview

8

Static

static

3

OpXOyuApWK...um.exe

windows10-2004-x64

8

OpXOyuApWK...ed.exe

windows10-2004-x64

8

OpXOyuApWK...er.dll

windows10-2004-x64

1

OpXOyuApWK...ec.lnk

windows10-2004-x64

3

OpXOyuApWK...er.exe

windows10-2004-x64

1

OpXOyuApWK...um.dll

windows10-2004-x64

1

OpXOyuApWK...um.exe

windows10-2004-x64

5

OpXOyuApWK...x.html

windows10-2004-x64

3

OpXOyuApWK...ain.js

windows10-2004-x64

3

OpXOyuApWK...tes.js

windows10-2004-x64

3

OpXOyuApWK...ase.js

windows10-2004-x64

3

OpXOyuApWK...ses.js

windows10-2004-x64

3

OpXOyuApWK...del.js

windows10-2004-x64

3

OpXOyuApWK...num.js

windows10-2004-x64

3

OpXOyuApWK...tem.js

windows10-2004-x64

3

OpXOyuApWK...ums.js

windows10-2004-x64

3

OpXOyuApWK...nce.js

windows10-2004-x64

3

OpXOyuApWK...nal.js

windows10-2004-x64

3

OpXOyuApWK...ace.js

windows10-2004-x64

3

OpXOyuApWK...ons.js

windows10-2004-x64

3

OpXOyuApWK...rds.js

windows10-2004-x64

3

OpXOyuApWK...ypt.js

windows10-2004-x64

3

OpXOyuApWK...ath.js

windows10-2004-x64

3

OpXOyuApWK...oth.js

windows10-2004-x64

3

OpXOyuApWK...gex.js

windows10-2004-x64

3

OpXOyuApWK...ask.js

windows10-2004-x64

3

OpXOyuApWK...les.js

windows10-2004-x64

3

OpXOyuApWK...pes.js

windows10-2004-x64

3

OpXOyuApWK...ets.js

windows10-2004-x64

3

OpXOyuApWK...ets.js

windows10-2004-x64

3

OpXOyuApWK...ain.js

windows10-2004-x64

3

OpXOyuApWK....de.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    OpXOyuApWKTlFzrV (2).rar
  • Size 66.6MB
  • Sample260720-bpna5ady5x
  • SHA256 86ba82362241c99cfbca70af1506812966c495729f1cc7e5d07c14fc7973ab21
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Targets

    • Target
      OpXOyuApWKTlFzrV (2)/Potassium.exe
    • Size 74.9MB
    • SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discovery

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1
    • Target
      OpXOyuApWKTlFzrV (2)/Potassium_patched.exe
    • Size 31.1MB
    • SHA256 b60dba7a7e5d8f0efc002ad1cb289271a19c2699f339d049bb2cf7797aca4354
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral2
    • Target
      OpXOyuApWKTlFzrV (2)/WebView2Loader.dll
    • Size 156KB
    • SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      OpXOyuApWKTlFzrV (2)/autoexec.lnk
    • Size 2KB
    • SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral4
    • Target
      OpXOyuApWKTlFzrV (2)/bin/Decompiler.exe
    • Size 1.4MB
    • SHA256 756d5a64b46a92b7e5c182ef505099242ab1024f7b9b790bb4ad6b36b9ce44af
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      OpXOyuApWKTlFzrV (2)/bin/Potassium.dll
    • Size 9.8MB
    • SHA256 e79dbdc895d229f5fe6aa3c13f3bb2cda276070f5bbab35cf0549a284944f7b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      OpXOyuApWKTlFzrV (2)/bin/Potassium.exe
    • Size 14.1MB
    • SHA256 b1d56988692f04708cd81acf57067750bf66db8402f7a322b1cf51611ff05a9e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/index.html
    • Size 18KB
    • SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral8
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/base/worker/workerMain.js
    • Size 174KB
    • SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral9
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes.js
    • Size 2KB
    • SHA256 9636806a05da6a43937d122e2211e8d2877ed95caaf691f4f079dbaf47e0c6bb
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral10
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/base.js
    • Size 521B
    • SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral11
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
    • Size 33KB
    • SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral12
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
    • Size 11KB
    • SHA256 573e821c40792e10d2dab59ee3483e2482379241c94b2b98ec5fb098556e3e89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
    • Size 594B
    • SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral14
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
    • Size 1KB
    • SHA256 f7ada012dcc309b7c1cd272d1a81657b0ddb3d51521e682116522099285d525e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral15
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
    • Size 777KB
    • SHA256 799c0657b0ab027c3ec0794e8934bed4a4a8e7f063dcae47783a7f32fbeda25c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral16
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
    • Size 16KB
    • SHA256 807dd6d35bf5fffcd4de4aa4ed1800716223a6fe014077f23f2f652ac86d2a31
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
    • Size 1KB
    • SHA256 660f088e8da6e3c7c16ff4df184a92fe96c2b2ffb8c3b3411f30b68d93723dba
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
    • Size 12KB
    • SHA256 251d21959744760aa1e79274b7a9fad433fd42b2d3fb4783f56f0b070d06cf8e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/functions.js
    • Size 10KB
    • SHA256 269c81ad08e8302bbd3bfc1463e2a4d5c263a20894536a913501bb36df26a196
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral20
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/keywords.js
    • Size 428B
    • SHA256 3f4ae1c666488bb398eae05c6ef9fdcf2e6c126f9b2510e6eee43a8d64d21325
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/crypt.js
    • Size 8KB
    • SHA256 9e289fc56914e2cab79b923edaa9d3f9abd135cd8b4d1bb32a6878e0d295c935
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral22
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/math.js
    • Size 12KB
    • SHA256 619973aa7da2c2bc8a34b121245bf083c3e90b1b9cca9d8961dd2d07885f7588
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/oth.js
    • Size 3KB
    • SHA256 591623b820322f0796422da44be24b18e84dd3839d653d2e38418fe52efa706a
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral24
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/regex.js
    • Size 1KB
    • SHA256 6633c331759b3a6f9b0ff27911ea123f0aa2c0d0fdd37b566678ef1820d55211
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral25
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/task.js
    • Size 2KB
    • SHA256 6cb2b2065771052a1941a6a9b35c6843ceb969ea9fd3c2c2cfc09576401fb26f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral26
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/modules.js
    • Size 904B
    • SHA256 23130da74b1fe70272eeb8d6f25d87da4f2c60b05c6cb7a231c7b4e3c7bd8990
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/params/DrawingTypes.js
    • Size 4KB
    • SHA256 12d1a59f76c3608cd3fdbecb04c5ab72902e7a9b75ae40eda196d3d129f54301
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral28
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/snippets.js
    • Size 1KB
    • SHA256 9b8838acacd8610567b65dbb65981586cb4e23ba1ab8623bc285dda454b813b9
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/snippets.js
    • Size 12KB
    • SHA256 943ce614749f67dffe97b2afb88f3c76fd91545c4100a0e649d45e9fc9b98a03
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral30
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/editor/editor.main.js
    • Size 2.4MB
    • SHA256 f9ffe3e01f9bf58ab25b37da98eaf5e80f6e37f9347e663bf249d3a6190a28ca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral31
    • Target
      OpXOyuApWKTlFzrV (2)/bin/monaco/vs/editor/editor.main.nls.de.js
    • Size 76KB
    • SHA256 217aad6fe9cc93483f3423bd790c1d840b1aba274439b7c8ec34b5d14811eed7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Modify Authentication Process

1
T1556

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Authentication Process

1
T1556

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

4
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

System Time Discovery

1
T1124

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

pyinstaller
Score
3/10

behavioral1

discovery
Score
8/10

behavioral2

collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer
Score
8/10

behavioral3

Score
1/10

behavioral4

execution
Score
3/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
5/10

behavioral8

discovery
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10