fc549f97247d12f853b00e5247a6550f094a08760683a57e0eace8e61fd76264

Sharing

Copy URL Twitter E-mail

General

Target
PollyMC-Continued-9.2.5-Windows-Setup.exe
Size 69.7MB
Sample260813-s7vatstclb
SHA256 fc549f97247d12f853b00e5247a6550f094a08760683a57e0eace8e61fd76264
MD5 bb5409c50efbf0e46a5abd4b5f881cae
SHA1 e4c3ccf1efa73a7d619583c7be31e9154f61dfc1
SHA512 8e89133cac9216b6e013da45f6232b37dcfb7c12944caa142bf5cfd6543f08439fc8b96c2af44df793a9fb4949024ce9346370b8abe2a5785c6af7f0f069105f
SSDEEP 1572864:NKW5TMQhNBM/XWt3lJzK/NlVWzvacjztCHBTiimynHAbuutJoI3TTrIpIH:NKW5lM4zGPCZjhG0iZnHAbV3d3TTrIp8
TLSH
T105F733851721FB02C8117876CB2DCBD4165369065C82E9AAC0E85F0FF8AA6FED55B3D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PollyMC-Continued-9.2.5-Windows-Setup.exe
- Size 69.7MB
- SHA256 fc549f97247d12f853b00e5247a6550f094a08760683a57e0eace8e61fd76264
- MD5 bb5409c50efbf0e46a5abd4b5f881cae
- SHA1 e4c3ccf1efa73a7d619583c7be31e9154f61dfc1
- SHA512 8e89133cac9216b6e013da45f6232b37dcfb7c12944caa142bf5cfd6543f08439fc8b96c2af44df793a9fb4949024ce9346370b8abe2a5785c6af7f0f069105f
- SSDEEP 1572864:NKW5TMQhNBM/XWt3lJzK/NlVWzvacjztCHBTiimynHAbuutJoI3TTrIpIH:NKW5lM4zGPCZjhG0iZnHAbV3d3TTrIp8
- TLSH
  T105F733851721FB02C8117876CB2DCBD4165369065C82E9AAC0E85F0FF8AA6FED55B3D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  bot-server/node_modules/@azure/msal-common/dist/account/ClientInfo.mjs
- Size 1KB
- SHA256 ec78b79332be6034e376d92dadd680a8e78542e6e1b8cc625f06ea251d72af5f
- MD5 5f8de369e2a7e228f78af5428c629a96
- SHA1 92282f6ab524364926fdec4bc9dae21a6924ce8f
- SHA512 bf9cb7d5c6bfc76cdd69348c5947daf360d4252db98793612947eac538469940c434fda1d739ad0f6de632f343078f38ae9a2ccf33114af7c8f834daf6b255b6
- TLSH
  T1713143997B42393396793BA5D223F404D47A1027BD1BBC807A8D998D3F713AA9B3CC40
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  bot-server/node_modules/@azure/msal-common/dist/authority/Authority.mjs
- Size 40KB
- SHA256 7fbf3d673e5f118297e868784f8ee84b6f5179c1ced19cdeea4803a1055c4038
- MD5 3f1c3e1dd00e94df12f4b353ccc2ca36
- SHA1 51b99d8bd2015ea4a04c377d48eb72dbd5336418
- SHA512 de94c33ff1ad18a25b9550c7446b339710e60fe72699d22f364953f2df51006bf4e35e121c1ab757236845fe4784f294b12ce9a6099e7fe9b2f5218b2faa1500
- SSDEEP 768:B7yJxHURzumijfy1AqsHVq1KnzO5l3z4oRnhqiR3kNuc3jVG0ZKDIPghm7ZpAOaa:B76URzumijfRnQ3BqB3BC7gL
- TLSH
  T13A133F8A3786E0176174732D8BCAD222E636721F5601205DBCFC6DE42F32252A676FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  bot-server/node_modules/@azure/msal-common/dist/authority/AuthorityFactory.mjs
- Size 1KB
- SHA256 523770548f46d647d561dad51726c26b177e179d93603579eaf8c9c5475e01cf
- MD5 dccf2d002dc5abc4d785658db8ae20cd
- SHA1 c314f8483ff70d9a84bd4c9e93342a9f845f1c4c
- SHA512 fe18fa65df39fa620fcbcabed3f7b54052ad7cdea8df844d1886df6e5a02f6a9567b799e1ef5f1a84f4ac7112363e71b8a2d24dc60a1e95e2b0c71d0082e394d
- TLSH
  T1C33142C2B352F42AB374332E43C99033E134934D6142188975FD56DC2FA3495C6AAF4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  bot-server/node_modules/@azure/msal-common/dist/authority/AuthorityMetadata.mjs
- Size 6KB
- SHA256 fe501d4e01e00972cde2af11078ddf4177b227c7486b5e4a4d621c0e44f7ff0a
- MD5 4ca3c3cccc4efe285c1e54815f8ba638
- SHA1 6e8b6d60a567cf84d5276995fc413bbc9c7a8c45
- SHA512 debfed73c1dad7a2e13e775fb54f8a0de1dc3595ced613fa385e50dc86c0e67f1e6c465e20181912c53c66df6d970d42ffab515424254433f91ad326d54a1db4
- SSDEEP 192:bEoECrzFYC9+wQCOSyJOuU3rne5uca80k9DuqJD:+CSCwCS/VaILJD
- TLSH
  T11DD1DE576A25C0179264326857E4C205F25D936FE711D98EFEFC2E802F73396B183AAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  bot-server/node_modules/@azure/msal-common/dist/authority/RegionDiscovery.mjs
- Size 5KB
- SHA256 ae0b747664a2a831662ac205cbf103bc0ac28541a36b9f7dc6c534c9afe9f279
- MD5 5cf123ce42780da29172b1f4a386605a
- SHA1 7f12afe40d602dcde5d4a98f87ea9141c60c23a3
- SHA512 2eb772ac7c6daaed2d8b7af4133ddd625a86112ac321d19744cf57136f652d241be204abab5149cb56eb543d03f05f5909450a42578c83b41c67b0ee73dbce86
- SSDEEP 96:b4OZiDeA+TsDOeXYJw4NepNHXcep4qdOep1gk5NsUpANedABmgxYbszM1W4:b54j4E53dj4k5NlOedABf6bPR
- TLSH
  T1B6C1524E6763607A41B023BC960ED060FB75CB07AA45684EFCAC29602FB1528C5A3FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  bot-server/node_modules/@azure/msal-common/dist/cache/CacheManager.mjs
- Size 49KB
- SHA256 9abd4f2241f3a0ca9067648c13cdc3c415240bd31579d8aac749fb15a2edcec1
- MD5 26ba1f2f4f4d883b893c49b86bc81a94
- SHA1 c925dd5df97a6369c216c149be4f45f8fbd4def5
- SHA512 7a84f5506eebacf1860bbe2f1259c5a10c6d3560be39f41447719206925a9c551a20a140d89d7f00acc210f409e2ade7a527bf1d2740803a59d0f063ab86c1eb
- SSDEEP 768:Jn0WTZXDP9OXtgtZqnRoHLrIwXfL3rRcXTYOBlf+paQZSc8tf+hIoDgvXDgGcXpm:NZqnGLP5OaQb5fEzt0
- TLSH
  T17A3363EB67C220139A35B779FB429118F536712B1749618CBCDC69A82F72352C2B7F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  bot-server/node_modules/@azure/msal-common/dist/cache/entities/AccountEntity.mjs
- Size 10KB
- SHA256 f2aa50accdbe792ba36ab6057c7614e05c64bea904894f430529cab388009894
- MD5 553360e604cf72aba245b455caa389a8
- SHA1 49705783a54a8334729ce86c14c0bb6b2a55e03d
- SHA512 c32e84f8f32ba429104794d050b9429affac13377ee6a203c6d62b59ed0539e9801d398ed385fef1c85ddd96e71640a19cab6d5dfe7ac2f793d5c0a753dc91f1
- SSDEEP 192:bYZ8J0trbGgICTu/RctmDcV3q1RFGxlHwBH4nJsdDEGZ8X7B5:MZ86hbG2y/RctmQV3q1Rq24nJsdDEW8/
- TLSH
  T169322FA2278651534F783B78BF26E3ADE1327217DA2654CC74EC9B5D3F3734402A1A92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  bot-server/node_modules/@azure/msal-common/dist/client/AuthorizationCodeClient.mjs
- Size 24KB
- SHA256 8cfc310cd8df5a307a97346161ef0439d4951bd3219fe4489d6b83a5a119cb00
- MD5 3048e7e0a46e7967ed84dcd6878133b8
- SHA1 8b4f7f33fe6e90c603d7e1c63413a28cd4a59a1d
- SHA512 e34b67e6802bd9a218037bfc69f471d13334b6cada06c1688686aa25d03e11d4dff3b502ab02c1e27a52e13c45da306ee2191c80156db06e1687d1b0c2747523
- SSDEEP 192:bc1cc6R1n9kx2Owb58yHYk5jkV06tKqetq2RfRLqpf1IQk5QwUqAySJugHCYhx80:w1s1n9kxI6tneo2axw5KOozj4WF
- TLSH
  T124B22F8323D92126D0361329EF165321F739B2A7315A84B97DFC23CC1F72550926AFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  bot-server/node_modules/@azure/msal-common/dist/client/BaseClient.mjs
- Size 7KB
- SHA256 59575404f485b946f83e655e6711337caaefd630d489ec5fd967edbb6717c4e7
- MD5 fd83fbe0a3b9cee485bd6b4eef66be3c
- SHA1 13691d895281b8ce25b5b01ea56bfe3502bdbb3f
- SHA512 9c46a2e46c831ba313cadd164927ee63cb0d26ea3def272e4e0b542fb6a66d2548617248960e3d0f428e42a7dfb31566d35cace7600eec48c26a9fa53130b1fd
- SSDEEP 96:bPGzcGIqEm4NTyZ4vIG4iDfCvRBxUBjKv4Ud6qZddjcV+xN9QAO/mAp0gIxclpA:bmLMM53UBjKv4UdXdAV+xfTCmAWgIWO
- TLSH
  T1A4F17587179A340755351326EF06A521F1B2935F31CA9069BDFC23AE2FB3140E2ADFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  bot-server/node_modules/@azure/msal-common/dist/client/RefreshTokenClient.mjs
- Size 14KB
- SHA256 7494ce62753f6d04e03e84cc393904dfaca266f3f5ea4fbb043d4034a2cd38f7
- MD5 7e8ee5fb920cb77b35675c6a2dfb0eca
- SHA1 887627757d452edb3f3bfc6a3526c29e0e2c35f7
- SHA512 746a9a0cc5d88a12bfd37a8f2221f085700099b7b4901f4609c5d5962681d217013ea89bb0002dd6a0bed05123492c1c90aa15c76d9e1286c311a0e1950c8d10
- SSDEEP 192:bPbcII9H7VzwDqxD/kY5oaJilR6sAavrx/QyUk5/k9ptiaPqELRLqKhBIJg:TQII9H7VzAMD/4/zx/MtNSEktg
- TLSH
  T1F46222C323CA3522D133136AFE469610E636A34A355D447ABDBC67DC1F76112836BFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  bot-server/node_modules/@azure/msal-common/dist/client/SilentFlowClient.mjs
- Size 7KB
- SHA256 608ec7cda71d1ae44e3aa32203d90bd013dc301c8d24f9bf7c8938e3083573ea
- MD5 121ce44c5eacca0f3ddcc9c51fd9512c
- SHA1 1009534f45c08575fb965b0880bf6c77a684262e
- SHA512 8e125847c0e8ac9939c75f9395935c793cddbe73f3a61eb8aaf0a1466329e20cbe8de98d8c2b7df48d1ca6e37f05879f2626555cb91e4ee8c4d76b7da584e076
- SSDEEP 192:bukS05ODaDj0UGUvG/GHeUFLf1rjcGO1mU//0xKeyFOdsmvWAa:qkDK2jlHvqLUVBc8U1
- TLSH
  T1F2F143C6335A3026E5315B22EE129220F754B11B625D556DBFAC17DC1FB2203C3ABEB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  bot-server/node_modules/@azure/msal-common/dist/request/RequestParameterBuilder.mjs
- Size 14KB
- SHA256 a54b3978636b4c65e00b1a2697593b6fae8b5d95c23eadb9d3ef8dbd5f237b7f
- MD5 7a0947e5420b6b0d97566550d2fe7b3a
- SHA1 d48b6b765bbddb9bd01ab048cddd0d8e9acc9ff2
- SHA512 a40d4c46f376f7d470e7969c6da9492adc8e90e75f51a97e48749215b6db718045b15c7a23cc6a8a6b76a4e72160c32c856ea207cb3f6cd49fed4a6a38c8dac1
- SSDEEP 192:bHWRKV5X24gRKnUzKU+LUzKUjqAL4F45g5w85H2AlgURT62Upji5Aq:KRq5X24gRKSu2T7Vsw85uS6hjih
- TLSH
  T186620E2546C5252394FA23359B2B6258E67C235F395F39B67DEC1BE01F3A7A1C224F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  bot-server/node_modules/@azure/msal-common/src/authority/RegionDiscovery.ts
- Size 7KB
- SHA256 ed4ea7200e14fc4e836f2809cdf9c89d4cc19d25d80ccb1a6f00416aab27945c
- MD5 526e1a3e847297a43a74384bf893b615
- SHA1 6cbf2f0980da17139f894094aca348dd2f54c16e
- SHA512 daef2f8144d1b223d311787d7623067b101a9c602c01000233d50b46219ace01f9630f9d2b29876a1d149c5f0bfbaa931857785e8f6b30e52e7b0138e929730c
- SSDEEP 192:BF6xWO//+CbXmYpdSUUudSnsCov+O9F6b3L:BAxv+CblpX4b
- TLSH
  T18BE1340A57B7517641A112AC8E0EE4903775C6473E46AC5EFCEC2B502F8257CD1A33F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  bot-server/node_modules/@azure/msal-common/src/cache/CacheManager.ts
- Size 63KB
- SHA256 df03c8f8226b3431c6411eecaf58fd8fe78e8f1f32b18e43bd4490da29a8b94e
- MD5 bdfa7cbeb537c285e71d987ff0852f06
- SHA1 525a62abc86786c933983e66f6eb345d95be9264
- SHA512 db6e7502a0f25a52b837d2518824738a0b28f0d8a4257d8fec6869f88d7e62cd85a4a762fb8e8490858ca8acf104915beb080aed7adc5c3c989d85762f2be0a9
- SSDEEP 768:EPQqqji0PyDmwKU4JgOsNNXu8QaXhj82qR0bW0ohfXt8o0g2cAjy1Bj8N+p8jGxb:OyiBs2qRl0Lak8WnkGt3y
- TLSH
  T1EF5363D667E311125A536478FFDEA108E124B01B1B8DB99CBDCC3EA85F16366C6B3390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  bot-server/node_modules/@azure/msal-common/src/cache/entities/AccountEntity.ts
- Size 12KB
- SHA256 766fed016898251bb04011283cc7b7ea5d0275f391373490cf9c62a4a185b58e
- MD5 1cf4b7ddf2758b55b0b08344f76790b9
- SHA1 e9410c580e152c95af9f461523d9e6001aab7140
- SHA512 93f26a40c31e8bbe581a7163bb67c75a02bde474b499fe642940ee5c26e8057bd4668d28468efde6b6bdeccfa6a128d348fd2e34b99fc6e40762468bc8a9f3ba
- SSDEEP 384:O/X5bVRd7ugAQcTqdG3744txnUg84nbmFMU47h:O/zRd79cv3744tRUg5nBth
- TLSH
  T18E421F8127E741535F982D68BF6AF39C9121B1079E2AA8DCB9CC975C6F3B34C02B5193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  bot-server/node_modules/@azure/msal-common/src/client/AuthorizationCodeClient.ts
- Size 29KB
- SHA256 b87ddc4d0ff128a1683d6b2757055671eafa5c1cfda1baf4318db7f38867c8c4
- MD5 2a6e4715a3033fb63be3cb001553279e
- SHA1 e1bec5e35e9ace5995c5fce8385a7e57c35dca1d
- SHA512 16b34d676dbaca23b0da5a3dafc200e4dd52a952f3609d68a357550964814dfa782baad8d1da810ce24efc98cb2d98014cbdc000cb0f5ccffe0c1da3ff30a03d
- SSDEEP 384:AMUQOf2bTCOZjpdI1MH4p1hmLvn/lvqt09ifluidOT/V:AMUQ3bxgZqi8T/V
- TLSH
  T133D2428223E91122D067166DEF5BA3216338B247394E98793DEC23CC1F47574D27ABAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  bot-server/node_modules/@azure/msal-common/src/client/BaseClient.ts
- Size 10KB
- SHA256 04603b78448d46f3bc276a9cca0f93e2df444244415e2718ff7f20d202690c79
- MD5 264505609136180cf9b8bbc950f949d9
- SHA1 2f08e52f286266ecc861a9a4dd71a9523f590f72
- SHA512 056dc0e7a9770466a179d6f353d8097f6a19063729dee6a4e246b29e3055c92e7c0fd4f09cfda84fa462aeaa6ab9efd68035d78e1fa6a4b1896134653eb0e93f
- SSDEEP 192:QGQvbwGJySNu2yFoZh/vzvdIcraqQ1yxO+edYRfXuk7:QGQj3DRnJQEVX7
- TLSH
  T11B32954347AA21029422019BDF4BF61171B1534F39CAB46CBEEC13AEAFC71A5D3AD355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  bot-server/node_modules/@azure/msal-common/src/client/RefreshTokenClient.ts
- Size 17KB
- SHA256 41146471a0cf9c4093c2b4e28eba4f979487bec999e4c368f78c69ee8b659439
- MD5 d8a472901764b6bdfd2b94ef8c2b5cdc
- SHA1 5fda3ec928cebb4de6a54ccd7ac076a16ad4587e
- SHA512 1aadafece0d15015c124dfa1a4778157cf3ae1c0e36f2930cbbf72bfdfa087b4c11225d52517e219b4a34667b54194ae61a304499821bef0af2a459124c6db76
- SSDEEP 384:nqOvmtPIfC1Rk98ASDFDN8AXBMm3/agp6/TFuY697:nqbtQ98ASDZrh3/a817
- TLSH
  T1F7821E8357D92422E05306ADEE46A7112631A24B3C5E68397DFC23EC5F4B135D3BB798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  bot-server/node_modules/@azure/msal-common/src/client/SilentFlowClient.ts
- Size 9KB
- SHA256 1f0cfd2471d42819250cc08a72c38c74703daba817c36c13c5220a00368e3b9f
- MD5 ee149e3624736da5d37dd3e1e3cbbd00
- SHA1 3f7d4bda2e7b3873e3496b222760e56b8cb97e76
- SHA512 78baf99d0f95c8f94502fb4dd0f37b15a65af293ddab0e4414c3701147c62e56f083568c41e3fc81a39acb9e09cd7e4fe7a2c9d3138cfdd46914f49533d78f61
- SSDEEP 192:wt44L5eW/gYXODUD+BUtUqyH/RzR2Usr5OhOtp64oVJy7W/epy/+O3cpvPg5:wt4cbKk++ibpIUM5Ob4AV
- TLSH
  T1F612668663EA2422E4134E669E46B3513760710B195D6C2C7FDC07DC5F87227C7AB6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  bot-server/node_modules/@azure/msal-common/src/request/RequestParameterBuilder.ts
- Size 17KB
- SHA256 21e43fcdf6ffb7886231d8e0975bc86e8eb1e61ab8fe75154f59811b9fa8926d
- MD5 ab25d8ea6c0af20dc34dd7e233ca6492
- SHA1 d2e8cfffb5f0e12489bb887786f5c80f5bb00661
- SHA512 96abf07c9f13c0d82813b2e1201f5fbb3deec3fc8e338e233b9e32c35c727495a6ae6c594df0a4267a5075aa495a8c38549058d4fb96b1ce5d2dc502aaa55683
- SSDEEP 384:PDh4JkjLvQ6JXNExmyFq8XzSm4Mmi0xwg2B8:6kjLvQ6JXNQLFq8jV1Sxr2q
- TLSH
  T1CB82DD1426E60412E8E712299F6BB0449238624F395E7CEA7EDD0BE05F4FFB99335360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  bot-server/node_modules/@azure/msal-common/src/request/RequestValidator.ts
- Size 2KB
- SHA256 e1b0f51efaa40e474f5266ccd129fc42a6480e670a9f9844caf2a1bd0c5dfd9c
- MD5 ab0cdd5e6445165892b6cd5689e51bf3
- SHA1 82480f4a6062e6fcb06497f4b1df242cdb75b0a7
- SHA512 7a5086da806d41ac6fa7188ce95e23cbe8feff3f0397ed0f79ba91d01871775dbaf01088565b398053a33dd4daea13c4289d651367effc948bafe7d417139d01
- TLSH
  T132516856AEE1A523280A233FABDDD2509474B38B212E3C68FEDE27148FD47D2871D15C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  bot-server/node_modules/@azure/msal-common/src/request/ScopeSet.ts
- Size 7KB
- SHA256 ae2ef8bfb83fcd708bf3ed32d5c2ce240497352cadd4a02ff43263defb6038b7
- MD5 a26fc8499a8b789ec566c6787915effb
- SHA1 1f86ac11940a49fb6b2e18eed99848524f5da5fc
- SHA512 3d3c21cdc697f2f9eb6897ef7d10c3997b3ae096650d76f7714ba1e5ce59c882fab5a643abf24d73feea6fb08cf8f772d73b0a44336b74d51752971464d2d9a5
- SSDEEP 192:ORHdropkF+GGfl8IIh1ZMWTPTp7+3Gy8/gap+nMgbSCagXXG5VV28cEx5wSkANFW:sRI8ZBDPu7Y4XGG55
- TLSH
  T15FF1110F26E7265691522EBA9FCE4000EF10530B716A75B8BFDD17BA4F42624C7FC654
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  bot-server/node_modules/@azure/msal-common/src/response/ResponseHandler.ts
- Size 28KB
- SHA256 6a01caa9cb73f83222860f0b6d58f07da1e5b152c62f9d9075dd0e5f5c9c96cc
- MD5 715aa786ffe72f2c8d34c7c84ff6d13f
- SHA1 77a7063a66095c49a27612081c6d74392e160b51
- SHA512 17a86ecc122e606936a1258e1590f7d09a3af5fcb4a28a61c6164c884927ccda745c028619e73d40a9da8ea00f09fd0dd32dfe4c82e0f4c5e3104aa68bbdd2d2
- SSDEEP 192:KL9QG9jVNnLVczFrA2HB76PCg0RzhkYYcVK1xZ46JrCieSpqCaW4X2wJzpTIWQwg:KQGtRwZ1B76PCqcCu2wJtSTP+AS+xdz
- TLSH
  T1C0D241854FA600139A5244A59F8B7525732870072F5DF8AC3FCC02D92F8E21E8AF73E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  bot-server/node_modules/@azure/msal-common/src/telemetry/performance/PerformanceClient.ts
- Size 30KB
- SHA256 581a198e1a4f2282a2a5437d18ac828cb0716aeb10d12626274b5b10e3b01208
- MD5 7b5de5546490d3ed3de99b60999cb001
- SHA1 0437e2dcc568305ddb305310ff361e66e6c9c35b
- SHA512 9fe9fa4f7894a599ce63eabb1688ac8f18adf7ab2abf768ed31bfe48ee2dd468f22348f0bcf4703c835f5d647e56a1c9473026a162dc07c0e96371a810ef4890
- SSDEEP 384:0V3qZTpO9udnSYfr1RZc9LwMEWhC2GLqGVq2GS:Y3cJn7fZguWBGLN
- TLSH
  T128D22284D3E60017A86B527D4BCB6001733C92C76971985EF9ED3F682F86525E3F2B98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  bot-server/node_modules/@azure/msal-common/src/telemetry/server/ServerTelemetryManager.ts
- Size 12KB
- SHA256 55705a8be965cba0bf33030b49db2564b5d8db19ead808450fab00754737113b
- MD5 342f99ac56fea871848c092b568a863f
- SHA1 e18d88e782ae1bd1f137b80c2a92253702b24ed0
- SHA512 f5023f716c56755e4afd3ea410951ba16243799924a2d573b986afdf6ecd1e162bbc3735dd38bd0c021725864a837adb6cf920800b004fd8ef62a18601d279ba
- SSDEEP 192:ORHEAFAc3mWyuJCUiV+zMMnWlPtY/0nKEokWkHGbDxg8P/PxRS+VrnBo6LVZ2jU:ORHEFiCaWlPtYyxFmbRP///VZ+U
- TLSH
  T1E1421E4A1BF31007A969513B8E3BC290A360651B7E68F47DBFCD07122F4564DEBA17B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  bot-server/node_modules/@azure/msal-common/src/url/UrlString.ts
- Size 6KB
- SHA256 af273550dc3fbcc3e5e0228dc0c5161ad3e2ea744ec822263cff3ec48845b74f
- MD5 2a929227f37b5dc4b9bcc506351e573d
- SHA1 4dc1c73f1bc5fd562cef37ea06fce4b33170ba4e
- SHA512 af09e1f6e2d4f56353660f3ad1d413ceb959b77cfb812ffe80bdf8ee522d759e20a5318203ac209456acdd941291e48977cbbd9b6487c127cb28a42508ff7176
- SSDEEP 96:RDy/QLjI5p2dfmjOpFBWSoi9XPaPJRVg4SyyrKTDm2OLH0WaqeHCjNLL662+1:LgmOjOdFaPJ3g4S/rSDm2OT0diRP11
- TLSH
  T177E1745875F276130716026B8FABA593E2B662875679FCACFD8D13801F85B34C6752C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  bot-server/node_modules/@azure/msal-common/src/utils/FunctionWrappers.ts
- Size 3KB
- SHA256 66cdad68a5684b6518abf50c59db4c0f9853518059f02a617b945b13174be472
- MD5 e3bd8a9bd86aa1a6eb34ab2e9f8ba37a
- SHA1 8da72aa4a0250dcc96091d0303db40d7d7c8b02d
- SHA512 266020ec8a406b5e65e6d80b6ff08c5be91e3d60c32cb4a29e094b922041c7b8ac43de9b3ecac6e79f2b9933bc4c42ef4c209a8178014d7268c76622b104924c
- TLSH
  T12881148267A322275437A23757474340332550E7299B9CBCF6CC3F183F4A66C97A67D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  bot-server/node_modules/@azure/msal-common/src/utils/ProtocolUtils.ts
- Size 3KB
- SHA256 334fc9366894f21457dcf27ad3a485dc6bf1b1ba67cf7f8cc1bd9307f17a6b59
- MD5 335002699954f82dfab5a9f024018327
- SHA1 aea780623428dea2af25ac6b22651aeb422d8418
- SHA512 741305745f8ab5ab4b53e970e59f44d7320b9e8ec9d13adb10cc6eb98de1bc355ea5cb2c3293844b294a5b42e510ad8d5369fcb5d345dfe97519611a1798834f
- TLSH
  T1D47132522AF1522BEEE11442869FC298CC06B11B3625FEA4BEDDC6490F13125863CF46
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  bot-server/node_modules/@azure/msal-common/src/utils/StringUtils.ts
- Size 2KB
- SHA256 07bdb27b4649dd3e3dccda08f2902d60968d3e9a902d55b2de073d843c6b8195
- MD5 72e0a9fee9533529e4adbb27027d03ee
- SHA1 391b4d67e0d62dd56d66c26879c70ddf0a778bd5
- SHA512 b7263552d7da31753bff848ab7b069e4ea0fa0a7eed2192fabc099cf229dbdec17ab5e8547a742508845b297e06803b1f5b19014ef6c73263768accb00a4cbde
- TLSH
  T19E51325528F120020EB3642997CEA065E167916B327DB8E4FDDE3FB01F05E3A86746D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  bot-server/node_modules/@azure/msal-common/src/utils/TimeUtils.ts
- Size 1KB
- SHA256 03b15ce41ed9abf9be0abec183ace1efa54ca05dccaaf99ae42624195cfc329b
- MD5 ae68a6b87081fe09270038cbf89ddef3
- SHA1 eb262883440789f758e6601f8a5ac74a794032f0
- SHA512 0cf255ffa930f0c1dc58d8e2bfb319e6059133464f692fe065020766c0195a9067ab85289f9818e2d63cbd200a1989888fd408e377e0d1debf62f9c2cf4b9330
- TLSH
  T17B21D2173BA132164311797B432FF1B637284262321F659D608EEAB06F1F054D7B78D4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  bot-server/node_modules/@azure/msal-common/src/utils/UrlUtils.ts
- Size 1KB
- SHA256 508d3659004b96e30a5a38f44279dc6fa2c824c6c208e8b600e8a30279950854
- MD5 6fd312a1b6452a49742024c789f95126
- SHA1 18603f02f655d9cfa24a98fb5c1f2d7eeec856ef
- SHA512 53a80caf79034718d2eeaa9a0dd46e9897daa1cf1616f23bb4942eb0b82eaf427867f6e226f3c70f78146b4b02aa28f3fee1acd2a532aff8ce50ad3999e23af7
- TLSH
  T12131F2887E939A1273618AB4CA5E1882721C0413137CE6F1FEDE4A146FCB678CE75F42
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32