094444d4615ffb656a977a2b1ad8d2346d3b8bb4a904bf03dfc238b74b442c57

Sharing

Copy URL Twitter E-mail

General

Target
token-gen-main.zip
Size 9.3MB
Sample260809-n8lymael9t
SHA256 094444d4615ffb656a977a2b1ad8d2346d3b8bb4a904bf03dfc238b74b442c57
MD5 e4f9725a6a3a8866c339ac6b575b0b6f
SHA1 7be7ee4f31efa41ec36c4d583f2fd8d67ca2b792
SHA512 650802aaa5ec5d58948e85190a3d19152f76e1a05d48305b78c912b61a745ba3d55b66734288dd90707f9166b564ba531f17efffbdaa6243a111f6bd30e0a6c7
SSDEEP 196608:27rRmpdA/uCBErbLUWydnJ3E2cXHuYIEiFobXX/82xx76qJ/OfVoseyGIU:41mpd41yAWyDE2ceYINFcNVJ/KoByGT
TLSH
T192A63321C29A3516F415747534AB9B472780A209628ECD0FFF964F90EF76AFC3251E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  token-gen-main/Core/Flow/generator.py
- Size 2KB
- SHA256 df3842abe2ee98505cfa267faeb02032c2aaace9eb7d5084150079f96dfb1ef2
- MD5 8096ef2036a18149f8e87701408df6f7
- SHA1 f43edfe919caa1775d38e54ebe4565f7518f8d83
- SHA512 1b0b76bd4f35f7c55bf82ce39c035b2f4d43f97c3c0bc3f4eaa2162db0149a141934be5112c9f41acdc5a6972a33a50b94e0031e26c5d1e458a9cce368e76bdb
- TLSH
  T168513C15152D20515E87CE1BF453B193AA1BA9431C0C782638FF509E4F69D2477E2EF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  token-gen-main/Core/Flow/solver.py
- Size 3KB
- SHA256 46b70b09c165f6dffd139900d0baf61d649771989eb38c01535bbdabc6e753c4
- MD5 b9533d39abc076cd747f2c0398f65e3d
- SHA1 e9f1cfeba711c9c57010db5463b655f08465765d
- SHA512 f6151bf8c518bbebff76f0e080f69ee332c4fd8ce33377000c0be9baf646bac71e3e36cb27bd0ed5c0797c6e2d841dade28d47ea4b70945b4e8bc56d6ef76e4b
- TLSH
  T1E561F069D46D6843499F982ECEE372427F1379875D0C38147C9C60AC1F1E62A80B5E5C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  token-gen-main/Core/NexusColors/color.py
- Size 2KB
- SHA256 1fc1163e64ff000f7e3bdf24f0b3321d227225b989e59573aa42f52a03cf42eb
- MD5 6254fdd7062be805a20feb19180fcd5c
- SHA1 28dc0ee3411f40dd6347efe1e622e7b965966119
- SHA512 44e5d4343de7407490440005cf059e96aac55107ad8e8782bfae7c6d32f9ba7549f1e7c53b241c3fe7198be1fee46c88cd3bff3a1d7486f6ead8151ec8cd5799
- TLSH
  T13951FC85D2C65D499BC3812C1881CB516AEE6F33E3142B7F7C4D02B82F26BAD59A8078
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  token-gen-main/Core/NexusColors/gradient.py
- Size 2KB
- SHA256 40cc316273358571f16628a855d4b089f69a56207365756c12473ff1c34bf5ff
- MD5 fdfd491a21d4b6a961e6201141912ebb
- SHA1 3a24ea41a0e7db09465f93583d8c6154f0ef72e3
- SHA512 728196cc1612e5c2a251d25399852f0721975b4384161f631e7440e3a3daa11157794cc8e8710da86f43e586b1389bff2024a0f3cacefa3d04369e12c485855b
- TLSH
  T1FA51E105C87B2311EAA781FEC481C3652167A6235D50573438DE81B84F6A75D52F86F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  token-gen-main/Core/accounts/context.py
- Size 3KB
- SHA256 1c573111a69c3682d1ea214cad2d6f02b83784a7b1ad0cff71e724c80f21d134
- MD5 026538757f398bcf9b757fffe0addadb
- SHA1 1d883bd147b6401ad86588bca4b58ba3b4b7f49d
- SHA512 9b8ab032e97c13312de5aeb3a775d5da785d5a4c75e074724267bd76681a9c41e07ce147dd20f71d8bc5351249e8740f0309021832ad84574b18ef88200e7ff4
- TLSH
  T13B51AC2860156E60EEEB8C6BCD93E553636E1C43594D1925F57D02D8AF02A24C2F3DEF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral10 behavioral9
- Target
  token-gen-main/Core/accounts/factory.py
- Size 2KB
- SHA256 b79f7b5747c3a345d18e45fbfa58dd2819a1d5ccffc8b0ec98e62785d3a384e8
- MD5 c5d88c6b0d9cb948ec1f22a771ce3c9b
- SHA1 daaa0bfef0761b2e75d109dfb9317ff21ba5a8fd
- SHA512 3280c11ecef359b46702beb64bc467200c772840b579a96acaf2a7b8fa0031d840d5a459542be4e4089d2894dbd3f9ba69129426fec5494663e3c21e211a0229
- TLSH
  T11151DD21419C2C21465B863FBC1667836B376A635D1E683438FC215C4FCCF199BF4EAA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  token-gen-main/Core/communication/mail/base.py
- Size 1KB
- SHA256 5ffd975c4d10b9b1117037b62acadde290376e36b0a0be5f1c4bdc631ba22ac1
- MD5 a091ef4a5fec0925fb0f56ef8f07fc6b
- SHA1 8df2f021b404bde59f9468c7ea18015f45156481
- SHA512 5c4b7fa23025077661cf877ceac4ee906d1f6063b894d0bc8781a21d7a287144c689d0ccb4890dee8318bad608312ec12b7bd4f1a807e082c743f1832b14cfc2
- TLSH
  T1AC21141305179C0287DAC53549AD9280773F75130D0A2C21FCBC51AC1F67A75C6F159A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  token-gen-main/Core/communication/mail/factory.py
- Size 848B
- SHA256 20fa71f00a9435c5c169d9d6c07190a1780b40875dedc680bccaee77806b9142
- MD5 b095818b1c4e38e76f44e216e333a31e
- SHA1 3195da99f0865ce2fe9d0bc3a53fb6e453fba98e
- SHA512 82fc438c181a02bba573d3bb163ca4fbe9a39b9206780c9cb02b9d01a12679ed39c4bd594702328aa90ffdea8a541336529d0bb510bb8c2e4e034825eb5d6b43
- TLSH
  T1E5014512C9BE9802838F8D393C96B4639A1E6B4B0D18690530FE20AE6F17D50DE68CCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  token-gen-main/Core/communication/mail/providers/cybertemp.py
- Size 2KB
- SHA256 1f7e3c75360cce26d26a08c1a7e5184cdf7049007bb307c8ab251994d9f4034f
- MD5 4abf0bafbc89c977be56b615195df4e5
- SHA1 1b9e88374eddc9e4e0a7144ce3c05cebc45c000f
- SHA512 dd107495b1daf37f2092da579f900c33b699e152520f3b4d99bf7c0ff38937ece351599b88363b7e14ef0cd75e811231a81fa4931837028ff218795dfcb564fb
- TLSH
  T10151331BCD526403C2C7C0687CB542436926A8030D9D2E397CECA2AD3F69536E5F8B8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  token-gen-main/Core/communication/mail/providers/zeromail.py
- Size 5KB
- SHA256 c9156d38bdb971fca8cc1c2f6877cbc36c4ce772b0e4e737ace779efe59a0f4b
- MD5 90525f8feb55707af5abcb007dde291d
- SHA1 a8f42c2661be41781fa83b468d40bcb4ef69a403
- SHA512 b144c72d7406272881e6b6cc2076d6781a98f6f7a4330028b867f3217f9289ff04129ed52566365ba309e26949737775e16a558f77147425917d7204c9ed6e1c
- SSDEEP 48:ndqqVw5qopD/4DcsDZiPjigXw1CQ94H8s/w1hv/uumcw1t2mWFo8doNcW/QH1EY7:ndbVwwzyjiJzshEmdqKRSB9
- TLSH
  T195C1BB5B8D453802C2D7C06CBCA930436626B803191C2A357DEC53AD3F59666EEB5F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  token-gen-main/Core/communication/mail/verify.py
- Size 1KB
- SHA256 11bfd552c293eb3653b17a0ddca0df9d5f9efcec2c6b97318f7beeed34624774
- MD5 b710bda32c710c4359260c8af61e42f0
- SHA1 d5ff7ad8150b7d2807d9ae756098e4b91541c2ec
- SHA512 c3ab1e00c7efa4f7e57c5cecf5ba2088df41385116f5be78d04c983a2a6f7595bfdb5fd69031eaeb5a478a87d85e5dcc596dbde268d91dd2a962184408df4218
- TLSH
  T1C341E1128C105A3287D7CCB98806912233773C47165C9823B9BD52F42F45A39D7B2DEE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  token-gen-main/Core/communication/phone/base.py
- Size 517B
- SHA256 bd68a4f6c2738f7cb598881a445b2798aaca7ee3191809120f19fbb89b8baa2b
- MD5 8988077cc616ee39861f6fbf30f9d4c9
- SHA1 e1d477779ab61a2876151294cf2dfba3e3da6b55
- SHA512 3d73169f547790e6f3ec050b99cd998aecdb1c19bba867b5e2322d1a9d9220117e4178f75c6e0922e853f4510a8fe64afb2467cc566f31f0264b9f9b68f850ee
- TLSH
  T1A1F05907436BA86084EDC621413C4566132D5AE3EF0E1625B8BE73509F2B930A2A1CA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  token-gen-main/Core/communication/phone/factory.py
- Size 611B
- SHA256 7ec80603645fb984c86625f47f7f748a748d3efcd7a265bf2dabeb28760da2d2
- MD5 2bf60f8f7705a44052de4d5ad97006fe
- SHA1 42f9323f805c64c11cea8709a8ad998448c9ba70
- SHA512 57bd55f31cadb7ec38c841ecdb10f058e38d1c1fb4d753d0459c5182959c65ea8f0149c66a45458f733b29d4e2ba0584bcbbacc760455580c485cd98c8b09c57
- TLSH
  T1C4F0224356AF9802E7578F37A862B4822E271F830C1D281134FD664F2F12E14DB15E98
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  token-gen-main/Core/communication/phone/providers/onlinesim.py
- Size 2KB
- SHA256 22013b15098c21e878aae1f3fd2abbe1e01975e3f1b5b12aa46c7749f9be2692
- MD5 57c42de50ac3ea96baadf34c427e7183
- SHA1 d064239a9a6607801fd1edf113c42f3ce5dc2aec
- SHA512 f9923280ef801697e690808628b915920f59064a9500cd7e3e1bd666be4cb86b4899a196114b43fb17a7fe2b93b3e3711a5465c70fc5cf5f5196ab8235bdf619
- TLSH
  T185510E5D89B25C06C2D745B95CAE6263261AED432D4C3D343CAC12CC3F1A936D0F9A8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  token-gen-main/Core/communication/phone/verify.py
- Size 5KB
- SHA256 d81209419d879c400e74f8626305f5b1de09e66b3f12068de4d6897399668c82
- MD5 47c99406f06d52ac96b8e153585ece07
- SHA1 569c08e15981f611459a0d93a52cb151de871e57
- SHA512 245eba60e3a57702fe8fd6525b7fc5cd5ad02a45e19f4e17fdc1bffb752c1a37fcc631200bfd84a289cae5cbaaf7733305be4d9487e5d1b6486362f7edde5afb
- SSDEEP 48:f+/rYXkXodxM7dxchL0vjxMxUXodx7PedddKx7FDwYXpCX2ZnT90UmHWXjNl9Ujp:f+/wkvSs3RKJ8X2DG2RWhQSQj4
- TLSH
  T149B13F29AA9918228B93C439D8726546332FFC07DF0C98267CFD914A2F2521963D4DCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  token-gen-main/Core/discord/headers.py
- Size 4KB
- SHA256 a8bd7597da998dce0daf7d4db7eb8459759d1fdb8bea18cad66b0774ec952747
- MD5 df930635ae9ba47acdb6392dc24af105
- SHA1 5c5159b886bf1ff320843f8cd3db8d46d5428969
- SHA512 fb7eca6d86624dfd0c1e20b68425fd04f54fa183b30358867b1389f84163cbce575d4e92c26183a1ea7886011d501fa9fa4e86cccb4c36b6067452bbe497956b
- SSDEEP 48:NqHSCUx/xCODUzG50hwZIMXOLx3Gryg+9SgJOKoiT5illCo8:gB0FAzspFs/d9
- TLSH
  T1EE915262D1654C376243889A988F2457673D1047AE59782D7AAC631C0FCC82FD1F2EEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32