8e166daa83b02fa8741dd88508a71e50cbbb268fe419cc55a83645e9fffefddf

Sharing

Copy URL Twitter E-mail

General

Target
Potassium.zip
Size 21.5MB
Sample260731-n5kw6aaa65
SHA256 8e166daa83b02fa8741dd88508a71e50cbbb268fe419cc55a83645e9fffefddf
MD5 e60057150f6e1fa6c4d4390edf510fb9
SHA1 2a2f9d85f9d27eb3b717fb935f4cf6a47b570904
SHA512 a3a586249b6862a7ea6633ae78c480fc49c53cc8055180ea3482db1c225c7f5403cba2d7f94e82d9b142a09deece51bf829b8cfe07f6078e8817eefa3df84ca4
SSDEEP 393216:mLUItXP3Re5zhuoe+j4C8iMcwi42V1jzIM7bcX0nUHlm6TI4XTJx/e7DN0RrivZo:oXPhGoOj4TxJc1YM7oXtmGJTJCh0RriO
TLSH
T13A3733D8B741437FF9E86735386DFB3AB14280810FC662351FA91D2A58B9B4E9E341D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Potassium.zip
- Size 21.5MB
- SHA256 8e166daa83b02fa8741dd88508a71e50cbbb268fe419cc55a83645e9fffefddf
- MD5 e60057150f6e1fa6c4d4390edf510fb9
- SHA1 2a2f9d85f9d27eb3b717fb935f4cf6a47b570904
- SHA512 a3a586249b6862a7ea6633ae78c480fc49c53cc8055180ea3482db1c225c7f5403cba2d7f94e82d9b142a09deece51bf829b8cfe07f6078e8817eefa3df84ca4
- SSDEEP 393216:mLUItXP3Re5zhuoe+j4C8iMcwi42V1jzIM7bcX0nUHlm6TI4XTJx/e7DN0RrivZo:oXPhGoOj4TxJc1YM7oXtmGJTJCh0RriO
- TLSH
  T13A3733D8B741437FF9E86735386DFB3AB14280810FC662351FA91D2A58B9B4E9E341D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Potassium/Potassium.exe
- Size 20.5MB
- SHA256 0c9b8e19e243f57f7c32f83ae16e22aec596036532a16f63c2af55e6c3589431
- MD5 3dc649e17ba8068c513e4cd2848f9085
- SHA1 99ec8e9cac9c3b4fbf17422c0fe1abd9f41566a9
- SHA512 c18c9144210a58752fe3bcca824b8e47f7388b542c3a1d3be37db17e749570ce05fff29428a15fda21a537fad54f04a7f6a38abbb5e03b10d3cfa5bc3cac184c
- SSDEEP 393216:tqzlNIZ37UJ32eivEoxy8e6n7PdDEXEAphVtnIUQSg+MPm5edstLEPvF79Lplt:tqzbS4ce2s7OpERphDto+histLEvF7L
- TLSH
  T1432733D83B9249FBECF2423958799562E26371C70FA5E1BF0BA01D3A1D3B6D84D38254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution spyware stealer
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral3 behavioral4
- Target
  Potassium/WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Potassium/bin/monaco/index.html
- Size 18KB
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH
  T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  Potassium/bin/monaco/vs/base/worker/workerMain.js
- Size 174KB
- SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
- MD5 9ce9e46b6d66d8b2dbcabba577cad2ed
- SHA1 397b0e9e7b2bee37a8444e84bb9788a0bdcb023e
- SHA512 f322ea669fa81397066edef062721ae3dd515b3d61c4ad7bef0db0eb3a53f056da298fd4f761bd3e5d613e6f5803a7c35ed056085ac3b97e06c7bfd47fffad49
- SSDEEP 1536:mi5eQeCEwCP1m9JXKmA1xKzyOQJf9X2K7eM9bWXsUK5QSkSoIMQwr+ZjtQYyeTMO:mHTdkKmA1yyOQJl2K7ns6dZ/RVaNzY
- TLSH
  T1C9044CC53265984353E652F5A07B0107FA38B877680C556CF3A8C9DF2D6A88760BBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes.js
- Size 2KB
- SHA256 9636806a05da6a43937d122e2211e8d2877ed95caaf691f4f079dbaf47e0c6bb
- MD5 c25a7c14fa5635368e75d154c185755b
- SHA1 dcdcdbd05115311a0929390b82b6c5c2b029aedc
- SHA512 3a6b15608fcc48f78a6442fff4fe7781603ceeb7b8bb06f2c6546f821be2cb824612dd5d143bdecfa4de33a3f1f5723d2f643d4d7de2ec2d1bca3fc1ba5eb44d
- TLSH
  T184517096B7CE6BAF598C33ECE4778406A69FE5336116883DFE0C90C410D3119A2E89F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/base.js
- Size 521B
- SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
- MD5 29e50887a6f1c445e0f63bed73eefb83
- SHA1 b8e006b9ad14bb6012497e164d9a4f926e2d568d
- SHA512 16cc7fd8b5641d347a6a9e8542a6ab29d71a432dfb2f72dae05b21b274d92208ec7c5a9ad1ba313658f3a68aebd9edc3d0bcbf07a03d0f16eae95568f175dbf4
- TLSH
  T1CCF0976BF78F30CA1E474385A73AC1495C6EDC32D2322035F51CEAA94488C2923468AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
- Size 33KB
- SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
- MD5 fabe9b3ec7774eb374f18709ab41c8c0
- SHA1 de6c19413ef008000357bccea90faf0d23ccf605
- SHA512 d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9
- SSDEEP 768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW
- TLSH
  T1E2E231E7F38C3593199B4784A27EC68539BEF6BDE4F10079782C5608079481933AB67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
- Size 11KB
- SHA256 573e821c40792e10d2dab59ee3483e2482379241c94b2b98ec5fb098556e3e89
- MD5 f2adca6e8020236f5e86b8e6aced6806
- SHA1 1f77dc5554c3ad94a78b693d1bd8fb859138de03
- SHA512 040fbb8bdcb58ecd2fbea318ba661efde39f96ac2e3aa751caed100e1b4a8941916b8a9bcc6335ff76875d558a2994866069f50f88beda76b7f09f258fe670c1
- SSDEEP 192:AJCfeXBM5iG6zUMmYmr6QMlr4qLYFQjG6AcE103aNd9xZAqGQ2qFARewPxHFTX0:9feXB2iG6zUMmYmr6QM54qLYFQjG6AcQ
- TLSH
  T14D42ABF7F38D799719438786AB3DDA842E2ED938D93240B8F70C6615248C959232619F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
- Size 594B
- SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
- MD5 4d0ec8edaec389b1eba92c1d18676f09
- SHA1 6eafd8ed47700b9a2ff1e10dd7468e50fab1bf6d
- SHA512 d4c7655d7db8d4f7d4bb2d0add36bef916caf291b2855785685a3e812279369848ce081ac6fb5cc869fb827653a4a1f874273af17bee67987e3c3a441ad368e8
- TLSH
  T10AF0EBBBBF0B3697060B63C8AB3DD740192DC831C4624425F20C5B6040C0C2772360F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
- Size 1KB
- SHA256 f7ada012dcc309b7c1cd272d1a81657b0ddb3d51521e682116522099285d525e
- MD5 09bbad4c05be7ab76cc3c5ef4fa9ddc0
- SHA1 a38cb372349a2420619e2fb629f0912500dc1064
- SHA512 40b753d8e97ba46be9fe4241dbe892bdeb62c902ea088d68ee7ea5ce0506d51b16f7105355a6b5360363c80d98b0f644b7a7ea2b4262210f24870368a2629c44
- TLSH
  T1AB21EBF3FB8E304B1D028785573CDB011C2FD834C87210B9F108A67090C9D42225B29B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
- Size 777KB
- SHA256 799c0657b0ab027c3ec0794e8934bed4a4a8e7f063dcae47783a7f32fbeda25c
- MD5 b1e41317d3ffe843032f5eb6f74806a9
- SHA1 506f617da8d8093ed58cfda68e0d60e1aa2ed08d
- SHA512 fb538a73935fd41b9f2ba9f6ddcdfe066f6f672d5dfe682dad301cae3392a93405fd35ee61126e9889e14f71c51e11cdecb4e20d213ba91b34801ec5b89ce02a
- SSDEEP 6144:0XUmTfyptLD/yxnbDh+hIAKVwhWppLTl+ExT3dsX34hAhbAhQ9qhjLmWhXXu:wVyx
- TLSH
  T136058CF7B78D6A4B2C07934AB63DCB04393EE6B4DC2254BDB65C7B2075CC901126369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
- Size 16KB
- SHA256 807dd6d35bf5fffcd4de4aa4ed1800716223a6fe014077f23f2f652ac86d2a31
- MD5 430fa91891107d6f1f3c3392dde9ff4d
- SHA1 5d42ebec7a7c3f5e5b7eb074c38572345e33c1c1
- SHA512 22011409e428216a619ca085ce8e034dc6bc3a8f9de27fb4f2e3dd6b8aa8cc7aa3b02508af816137f646ca1fa96e083a832e68bd8c8b016bfd7a3674d532a875
- SSDEEP 384:pFcCsgQgj6bPo2nv5CYR8/+qvPNEzH+AK6/NBA8K/tQsdz6FKRjrDcWYUeih+hrA:pFcCXQgj6bPo2nv5CYR8/+qvPNEzH+Ak
- TLSH
  T10E72DEFBF34D36A71D4B4281EB3DEE46261FC67CD83201B0BB5C6A15164885623A785F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
- Size 7KB
- SHA256 17b72f11f227d6261e44b0bf49d6cdc4ed88cef93c68384ba73f7550d9614d99
- MD5 6cf31f5ac3af68e878bf565c9ed6404c
- SHA1 afaa8bf2c9326ebe8658566fe6296a075d49e23c
- SHA512 0fff9572888be7dfcb792c53b006a6f4b8328d6522b971f5cb8fe9b0ce17ba9f82b6ae0a78d56cf585121a9a62772e70b03227074bb4683a52617f46c52202d2
- SSDEEP 96:AqiyuRkcbZjRZ7AiQnRztu6W6cEY4Ef+YepYk6JY3g6RtqYnFNYlyecYqzGRpYSY:AJye3VNZ7/QRvcKEe9fg6zSyz2585
- TLSH
  T167F142FFB34D726A18434381AF3EEE863A3EC438E87356B5B45C5128458C92533A799D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
- Size 1KB
- SHA256 660f088e8da6e3c7c16ff4df184a92fe96c2b2ffb8c3b3411f30b68d93723dba
- MD5 c41248fefc16d5e096019eace4e8ec90
- SHA1 e22931bf5fefeb7a5fc4ce7770283328e588241a
- SHA512 98f6a1367b4be1da50d1a257e726b9c1a66ae22cb8e2d1439b1dd0b4ba4d5a7e22340b165b489911d0a8603fb5c827c7ae43d89daf10dde34352a21304265a4d
- TLSH
  T11621F0ABF3CE7456234701C69F3BC9492B3DDC7083220610B15C99A088B4699A6439DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
- Size 6KB
- SHA256 60a9fa2721d16f3162f5701b7ada27de313794b97047cc7bba25f82859e4c75e
- MD5 1b0977e0af22c275e5f7df15de461932
- SHA1 2fe9b8a3910fbf4187247dea7402baa402764210
- SHA512 8aceee740df28fdd7e28abb3b42617eca70b33756f5b414366019fead5f94f716f3fde34e3600642a6c12b7ae5904b1700332a1a3a5c20c3f5f4d609652384b6
- SSDEEP 192:AJDF/h+8NpUG1mQqJfL/3x78ONlzN1eFqT:MFJ+EpB1ifL/JNoFy
- TLSH
  T19ED164B6F6EE26F1187A024AAE3B894036D9B3BC94EC7068B7DC541D53CDD2C131607A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  Potassium/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
- Size 12KB
- SHA256 251d21959744760aa1e79274b7a9fad433fd42b2d3fb4783f56f0b070d06cf8e
- MD5 b965d0ffcb61fec7f70f4f28a44e9982
- SHA1 2a4c47087318178698368ff06fef670155bdfc53
- SHA512 9da1ea797cbaba01c92dc7a68a586ceed6048565de1b8e40074a76666a8ac1df910a91c547abd5a2f8882686ed5d2cf1079cb47d626eaaf478da74b037d06af6
- SSDEEP 384:XQazTbBakPYkrvL9Li9ZV7+RSC1LQS7FihmJVPMp1TQElbvvQeTRmvhQ:XQazTbBakPhrvL9Li9ZViRp1LQS7Fihx
- TLSH
  T14D5265F7F34C364A1853C382AF3EEF41782EC93DD9339178B64CAA096148915276799E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32