455327cde805c299d5a16603419e106853db5b9257dfb85e44eb7f4ec4d99de5

Sharing

Copy URL Twitter E-mail

General

Target
node-gyp-13.0.1.tgz
Size 452KB
Sample260723-fwfl3s1fkd
SHA256 455327cde805c299d5a16603419e106853db5b9257dfb85e44eb7f4ec4d99de5
MD5 fd4a027a5149ab06ff89d44852bfe6c6
SHA1 ac7be7930de3ab3acaa8bd6b0c06d177d623f10e
SHA512 a623abd12d74ab2e531c1faae4176a9283b1eb95cbfed8d3314022b77bdc88f369fac9d33819c6ba7587d51cfb5d95317f64fdb85adf4ff4f2e3e682df23deca
SSDEEP 12288:w47n6g1+2CycTszuOWt1fDxZzzqV4HSm1HLY+R:hnP1+2CW1WTxZXqV4yAT
TLSH
T145A4236BEC1792E479E98DB253FAEAD8356255EE31523E711CF1BC980580F90BA33C11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  package/CHANGELOG.md
- Size 122KB
- SHA256 5232eb3400d341a041199151affe98101701f5f3bdb62d54006362dda759bb59
- MD5 daf8ee00f8e421076b962428aeb1a635
- SHA1 2bc365300f19762f58f015f90d21fa81b654e26d
- SHA512 151fe7f4441c86b27c71430da8dc78ca4e2e9b22a16a0618919de2ad76a0d2e8766da034e6d672290b70da70801010992736dfb633277bbaacc9feec1aff4f97
- SSDEEP 1536:E2vVFl67G6e+j1zrcj00h6J5umPKPuwEXLDvj//AORuMAVbQe5K2J5o4D850Jizc:VvVmS65j1zrIwiGt2J5o4DA00Q
- TLSH
  T176C372FB464654860F5318D398A9A1D59ABBCDD9EDC5C4C8C03230ABD84E472CEEF89D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  package/README.md
- Size 11KB
- SHA256 8568d536740ff7054615c0140f8a4e4aeb37979b87e3cbab9e5f0e8624ddc830
- MD5 cb928e866e94e7eb47483903c8b79355
- SHA1 dabb4dc338ec5b3d370f7d432e73547cc3b6731b
- SHA512 420a541960166f3e229ef9d474279bb163c1422eb7b48db59b9e24672692a9082bc826c2b433abe5a106af830d8005a9dfcdf9111781ad316d31157d6df9801a
- SSDEEP 192:qwDpxZ5TuHD9mrpqNelevdZGyLniMVxyS/fWGGzsZ1E1HjL0uDYG2uzOP:qwDpxDYSpOewFhWg/fWvzqE1HjL0uDYJ
- TLSH
  T1EF42D62F1D4866731B52C687E20F17E6FB3692FE12625058B47D4068B346AB2C1FF1DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  package/bin/node-gyp.js
- Size 3KB
- SHA256 733bdbf2080c31a67d94cb8f7123110f44b0a3e2be24b8e575754af550eee6bf
- MD5 7da8cdf99308db4223f500918e2a3ec7
- SHA1 1ed8ebaae9615dfd5f0b32376d15100ad0d7d7be
- SHA512 6f37b62de2ce06e3859825f97327c84db505f234b8ca9375885653850a755033b841956c966ccee659cd7ffcf52b56ee4a39ecfe6653f7ac3ed3307ce2a09fb5
- TLSH
  T1A071421897FE1233178325DE740D2405F6BA818223249A74BFEDA764FF8167807A7EE5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery execution antivm
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  package/eslint.config.js
- Size 58B
- SHA256 44f2ae8aadd8d676a4ce2ac98a6d779aca5f1f1c507b9965b534ea0004a81283
- MD5 41be888aabfa9b666c9aac9ed14cdbc6
- SHA1 e7cd19309764787f80aec057fab6d14c35db3720
- SHA512 65701fa4c0714c198e3ea8d9adb67c77a9f4a0ccf55f9c565b8bb18564e6ba6cd5bd9e540d0c3d57913f87a4413277ad0c16bc6a36c2f69e3b8b28e3d4558e3d
- TLSH
  T128A0024A11B9B68B16654080D2A4A487BAC1D070404451668A5CEE954044D8E17A29A9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  package/gyp/docs/Hacking.md
- Size 1KB
- SHA256 35732810f1ba9366f2b5c9d776e2041cc983d3f43866317aa4c09ed2a017ac20
- MD5 24462589b506f201789821527b1ff1d3
- SHA1 a2e2316b43e79e38b7dadb05aa56242c6ccb1700
- SHA512 e03f2fea2efb760a1048fa70b767051130d6f7cf45aaf423837a7bd3039ee2aaa1906425f750501b7ea0cc57d1a949ced4924562a580d474c1658e94230bea65
- TLSH
  T15321210A61892738B6D00136775FB1E9D3AD91EA5724413E4D7E463CA29203F43B27D2
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  package/gyp/gyp
- Size 240B
- SHA256 38e8b886cf06fe7cec4d89634fd2850891706308e2bbbc0556b3d299bd6a7993
- MD5 e59b12333255202a298daa1c3557940a
- SHA1 eedffc4ec86c7a01539fd6487780f1fbffdbfdee
- SHA512 b23f798613d79055ca79f118cc938b7e269d1a0a316a8022103e40970251f61d85c3f8fe7892f52bbf4e028a9b04d6d871f862e6ddda02ec04708deae912d579
- TLSH
  T19FD095951082002547844256DE89741CD64E5631A57731D7F53042057031D3DD0F159B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  package/gyp/gyp.bat
- Size 201B
- SHA256 77bf45e8c077df03d65e6c076920f24bee04752e29bcb21b63d3622fffe84f10
- MD5 962ac97ba2737832f3233916d7c56494
- SHA1 2aba80f0187605b8eaca0015060d5cb06a50cf31
- SHA512 cd7cd6619223fbdfea5118397431be7a26a3dfc1e6d653d40460c29fb1cf1f99662d6621149764aaa347092c9cbf4ffcee37415d6862821a5cee5b51ce8da777
- TLSH
  T11BD023BD047710770B5144123203A10C930DD160923752D77B20B20C3421C3D909798B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  package/gyp/gyp_main.py
- Size 1KB
- SHA256 80eb0a1948230c832f17bf99f31a8729d54044d80469cfe0fecace69e7ab66a6
- MD5 9f08def9387aa291440c6fc001a5ef7b
- SHA1 b53770908c24113a62bcf40e8ef86f7279332b4f
- SHA512 a4ca3d942e8bde33e0956e7a6e368a0685d960c1941bc8a3439d4696a7c0c7f250a5b790a6e546b7672c5482e23961d8479f6b2c7b1b9955653d083a219edc02
- TLSH
  T1A921448AD558B070C3B3E3365501B09517887D33DB479879BDED8624BF9643880705BA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  package/gyp/pylib/gyp/MSVSNew.py
- Size 12KB
- SHA256 30ab60341a68288aff8c8f8ae82709d55c631a3041b16a621cf677b7acbd99c1
- MD5 977b62f920eaba3e79d8de7bee13b1c9
- SHA1 5beff3cec157bed8dd348f6af8bd6fe3684b4260
- SHA512 4f70f339e99e56133fc9427904a5b3913836a41bc60148f745df01c0ad69ee71771d05ae3f1710e1dafa2c453c25c83994e7eb8aa2b2c0a7b1504e3e239f7086
- SSDEEP 192:QbsQiXEXPOjxRWn4PNHw9F6Yf5Qtbscw2r/sJd:QbzXPAXEpF6YCtsc7/sX
- TLSH
  T1C6527117DD89A62A6393CE2644967C13F72ED157D67510383CECB1182F0296982BECEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  package/gyp/pylib/gyp/MSVSProject.py
- Size 6KB
- SHA256 c7e611ab14306def936c6dc47304b0f44d053c1e1f701081edff16659108313a
- MD5 9be68cdaeb46d2c2cfc91245fe4d1496
- SHA1 8ed4598f930970569120abb86af36b752fb06bf8
- SHA512 c998e6e4337aecf0217b31e89a155c525da42ddb879fc6bcfa6db3974dc9b3fba29ee8da6f722d5b2a83d408dc899c1954bd78d30c029426223c79f930336718
- SSDEEP 96:QbnZj4zplrcGuzsiS+8Yp+uI+d+JyJOlBaPsSpOmnWmVnD/Hs5wsTv+:Qbn+Yzs6pptLbJbPsSPbDPs5w
- TLSH
  T193E1DD1BDC545D23E313CE6794E3A862E62AC68B9629117478BCD01C2F1883582DEDEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  package/gyp/pylib/gyp/MSVSSettings.py
- Size 44KB
- SHA256 13c9006c1af1bf40389eadbb1f303221544a37bcb4615be8e3d227856c40280c
- MD5 6df97263934bb0988da0867741bb72ac
- SHA1 61cb7887ae1665aeecd0bd38597f228a4ff3fd66
- SHA512 a53839b438fc2a66d5345c92f44435083d4760a8b94b19cca0685d725ab9043abe928cdfb4219fddeed897edf34c6997d7bf9b6cca1feb95af62dabd07fc5dfc
- SSDEEP 768:QdhrCv/F7TdGXmtjOmKKZj4lOIcxM/MPkkM99WqtWz3Hg4Tv:qtFX2jOLk7Pxxg3tWTjv
- TLSH
  T15C238737B5481B2C248394B2ADE95551D728C193043124797FEC69DC8F1FAAC23F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  package/gyp/pylib/gyp/MSVSSettings_test.py
- Size 72KB
- SHA256 8c30d346ac54fb1d2a5f15a2f91be068336f490e1e5b648de7a5dba9eaade742
- MD5 c42b11ccaf99fb9bb5a1f30e6b452ab3
- SHA1 aaa8fd399ca5dc8aa64dd84eed49563c61df8ddc
- SHA512 f54e8326eb5e76cb21f18b070c6e6fc19faad16716e3f243658a2329a7a7d09cb46aae4e2a8341651622c143076e6e901888d978b371d559b802a5991014c0d5
- SSDEEP 768:omKp9X/dW5ojv0XNXY2TXGTPGXmrS4T8ZWOd7jJsXABH+OcRXwJHxP94QkZ/4Xv3:idW5oj4XvVXcsYlXmsXsrX/XH
- TLSH
  T1E273EE5EE8165E6351CA608839B90C0B612091734C453819BBDC59CD6FAE92F22F7FBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Python

T1059.006

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32