ea7dcac43e9462d961469742dc3e3c20d49eddedd9816ef6a052cf284ad95890

Sharing

Copy URL Twitter E-mail

General

Target
whatsapp script.rar
Size 7KB
Sample260813-wthlnavta1
SHA256 ea7dcac43e9462d961469742dc3e3c20d49eddedd9816ef6a052cf284ad95890
MD5 c39076ecd5fb40db8fcb71622d7840ef
SHA1 19325f4355d798b25c88cbec9c9fab17af4ca283
SHA512 277ee77da99fd06ae64a6cd646176b0fb5b194fb9cfffc28ecc97e71f8156049e1e0a3fb65b71eb5dc9127c6046b311d8e853cb5feacd0a2656ee4b3406ba392
SSDEEP 192:sBOloEzIqlr8zJADutVyOr8ysREa9PwP50t:uJEzllr8z2Stbr8ysma9PwP50t
TLSH
T1B4F133F29E15D56AAAA132183075CB00DE4166AD4DA0EE7A5FE450D9EC876CC3F32D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  whatsapp script.rar
- Size 7KB
- SHA256 ea7dcac43e9462d961469742dc3e3c20d49eddedd9816ef6a052cf284ad95890
- MD5 c39076ecd5fb40db8fcb71622d7840ef
- SHA1 19325f4355d798b25c88cbec9c9fab17af4ca283
- SHA512 277ee77da99fd06ae64a6cd646176b0fb5b194fb9cfffc28ecc97e71f8156049e1e0a3fb65b71eb5dc9127c6046b311d8e853cb5feacd0a2656ee4b3406ba392
- SSDEEP 192:sBOloEzIqlr8zJADutVyOr8ysREa9PwP50t:uJEzllr8z2Stbr8ysma9PwP50t
- TLSH
  T1B4F133F29E15D56AAAA132183075CB00DE4166AD4DA0EE7A5FE450D9EC876CC3F32D2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  whatsapp script/Network_Logs/intercepts/packet_capture_443.pcap
- Size 17B
- SHA256 facfb76ab60d83e5ffdc92da0cf14b819a7af62f21746c780cacfeb939cdae90
- MD5 bd728adb887b41a33c34c95901f76f00
- SHA1 d52ed7858ce07b49173ae0fdf5ba674db3d65dcb
- SHA512 6c5c65a59af7ad5a552354404348cc986c0df10b4ceae2ef9dc31005bce35b1e13dbd320b65f626dace3e5b411fc3bbdbb2c82dca66025d15e63dd8339be172d
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral2
- Target
  whatsapp script/Network_Logs/intercepts/pcap_dumps/packet_capture_443.pcap
- Size 27B
- SHA256 71bfbe3624e9386499d24eee6adec0dd92f3bd6a5ce2087c01e4372d6719ca0b
- MD5 e8fe7445a824a2007a98c85f063ca1d0
- SHA1 00f9fafdbeb2b4c945cbe3affe7abf7838c25264
- SHA512 8825b5120d653a64148584f800d0f647454fe51b3406cbcf0fdd8b91eda753edd68e1a243ee264a06f698f35bca3a21d66c256ac3fe200565ff71e3ab95d3f21
- MD5 SHA1 SHA512
Score

1^/10
behavioral3
- Target
  whatsapp script/Network_Logs/intercepts/session_cookies_dump.json
- Size 28B
- SHA256 45756aea085caef119eb382a67fe246fd8b09b26525ca0e5f398f4e860f9fd51
- MD5 988732232c40eeaf047847a36230bd93
- SHA1 fe2e69e97a6485b07dd2396387f6e2bfb6b3ec3a
- SHA512 32ce20cd48ef0d688dd05346512714523a0cc1185f028fb57d81631f174a502cdf9ee4b838282a1213a2f1539a0074eedcae036e190267a014dd5a2363722181
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral4
- Target
  whatsapp script/WhatsApp_Intercepts/databases/decrypted/msgstore_unpacked.sql
- Size 45B
- SHA256 a69b3b83f38c4c5f5594fd8853b30149b5ee1b152f505cf09cbdc2076dfdc5a9
- MD5 4c28a2d64e5b52d26d2e21dc781b00b0
- SHA1 a1bda4b84b8f432fab0f18444939b01274e7057f
- SHA512 3ee8744ce6686d9538e7b2b0903b561de81b95dcbdefda6a0146cfadeae98f8ed54caebc407f37f3da4096a1c6c4db25ef89194b72b6b51b83976ed9e3f40e39
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5
- Target
  whatsapp script/WhatsApp_Intercepts/databases/encryption_key
- Size 48B
- SHA256 97e4d016a9b6f0e5561608829c35a24d8ed4a688438a2993c1c6777b8d89bac7
- MD5 b5cc35c0fa24d34b9b77774e2cb5f808
- SHA1 6c5e6b8a99bcbba7156c92f54a8fd170a960a015
- SHA512 b32039fec5df8811d8377bcd6ac3228d3ee01ade8e85711e4a549a58da88d916a96b7c025482fb620d237e335f981505dd5b5912e5f3f063d48fcc3fc40edd5a
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral6
- Target
  whatsapp script/WhatsApp_Intercepts/databases/msgstore.db.crypt14
- Size 47B
- SHA256 8a64bfd17342e0a5bf2c48545e36406fa3f3be14b69da1b67d563499403f72ae
- MD5 fe27d137eeb7d819d1bcf566d58cc298
- SHA1 f31edb1cfcb2d129bc3558511cc358a55afe0b63
- SHA512 0c2e1ab33275c548156bf38d06366115e0c2089ca9341e558247a168319e06dcb0acb396d27e3c9c94f884e04461f8762558b9f276a89089f4dff16c5e51a24a
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7
- Target
  whatsapp script/WhatsApp_Intercepts/databases/wa_backup_2026.db
- Size 38B
- SHA256 b4c89575cc6081b3a16c9dccf269d6f5f2c1ef4e97c8a97a1d1877ac78d9b5b2
- MD5 af495ef43f64917f1b729a360b8d9c9c
- SHA1 6d2fc70e1f314e8ad9d416bcdd7ee78c50b86bc2
- SHA512 a5f9eceaf3ab55ff391b3dfec164ed35f968e9852c92170f6d9d238aa7f5d0f5add8fa025b15876119d437484e71298eac1298d0f208ecb56c7879d4a0e89e26
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  whatsapp script/WhatsApp_Intercepts/exports/chats/chat_export_target_alpha.txt
- Size 76B
- SHA256 f7df2b2c4d83523a319399e41e30b845853f6e0b3c0b12b66646e23f3d2cee53
- MD5 f9e32f2cd024d4fe092d7afce6cff217
- SHA1 525cdb39b67dcac0cb6305b9fa6a202809ad473a
- SHA512 971c42e6637226afae45c2bae4858d06c725d68e9b97cd01967031c88a9762d1ff671f50f040eab303cd340a668a31156306af320d731cec579dbe4856e79212
- TLSH
  T104A024141F0C300100D1D10357F03DDD100CFD174F1001041D4D04C1007C105DD440C0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  whatsapp script/WhatsApp_Intercepts/exports/chats/chat_export_target_beta.txt
- Size 71B
- SHA256 99988f822b165c6604a9741bd0c87ab07168cf300d5bf6d763426f204e26e51e
- MD5 a38afa7b0907528d01c5e31d8cff3c83
- SHA1 52a5951bde6ad0f38e42fb4946f88646c2d59886
- SHA512 1bfc68f8bbdc1dc084176a48394c03801031ad538e819fb9bcea7ddf16d4ce44983b9f7d5542a4ab8e9e363329dcf54ef79020c9fc086002317f02e7871d902b
- TLSH
  T1FEA002A3D2796E6592E58D40495E4B04109F7B753779484235DEE8D07408D966A20485
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  whatsapp script/WhatsApp_Intercepts/exports/chats/group_chat_operations.txt
- Size 61B
- SHA256 518a2b7dbc403a4710dd1b460531f42c19282a28c5bac5d9204ac80b6494977d
- MD5 1c2adb809eb96f1ad88610e12ea94556
- SHA1 24419e83de7c8c46c8dcbe0a9213b862af8d4d6a
- SHA512 003597c4222604c2da96e3101a6bf205b69eff49937ca41729ee7e18804d972fca78b0ac846d929e0889b56ffa728689b4713bd8872bb03a2d68411570c045a5
- TLSH
  T166A0021D9F696B445150515570BA076D345C32926A751694B249E58110358057F5C664
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  whatsapp script/WhatsApp_Intercepts/media_dumps/profile_target_raw.png
- Size 41B
- SHA256 9a0600b1d8928e26ebd4fb0c8ee0aa6f6924bb59867b8ac18d106da20332854c
- MD5 a2d229c8ab8257b647f5fecdc6cf6a75
- SHA1 6af849010b6125ff5e82e1432d8439c17d0eb8da
- SHA512 c04c39c2a4c29a83a299789a1f7d3ded7a95e4d67d6b84c440e68ce6dabfc1ba9c9a740fbb741a0c8f3999ec431a452e88c34e8d8cc993a824ce77c608ca52db
- MD5 SHA1 SHA512
Score

1^/10
behavioral12
- Target
  whatsapp script/WhatsApp_Intercepts/media_dumps/voice_notes/note_segment_01.opus
- Size 39B
- SHA256 b6f0f80d4c7b1f24515c8b00b26e58a915f7f9adda6f87d21934292deedcb8cb
- MD5 66cc1e4accb35aac68bae195a4be21b8
- SHA1 19c8add0d290f190ecdac0865c6e3f0653ad4eca
- SHA512 7587669eddcfad570434cb8e0ec0efcf6003f395c10f5fe5ec7a82a27376e378dcca36adfe0fa99845f5ec0b5434738528554460c4784c0e06be1f73bb8af895
- MD5 SHA1 SHA512
Score

1^/10
behavioral13
- Target
  whatsapp script/WhatsApp_Intercepts/media_dumps/voice_notes/note_segment_02.opus
- Size 39B
- SHA256 b6f0f80d4c7b1f24515c8b00b26e58a915f7f9adda6f87d21934292deedcb8cb
- MD5 66cc1e4accb35aac68bae195a4be21b8
- SHA1 19c8add0d290f190ecdac0865c6e3f0653ad4eca
- SHA512 7587669eddcfad570434cb8e0ec0efcf6003f395c10f5fe5ec7a82a27376e378dcca36adfe0fa99845f5ec0b5434738528554460c4784c0e06be1f73bb8af895
- MD5 SHA1 SHA512
Score

1^/10
behavioral14
- Target
  whatsapp script/_System_Configs/config_backup.ini
- Size 37B
- SHA256 f35474308714e07c654774da58a4f75110e48b855121c40bbde3e135f79347de
- MD5 e52a7bf90981b7290347f9eea6180365
- SHA1 20c90073631866559d82d6838bb4f814c8732aa6
- SHA512 1e46c8222e6da4f6b0a61ff6fb3ca07b0bb2f365bb6b3a800ac8329c4c1ec1df95228accc64969f4f851254c4e2217216c1343698006121601ac973e8b9564a6
- MD5 SHA1 SHA512
Score

1^/10
behavioral15
- Target
  whatsapp script/_System_Configs/dumps/memory_dump_core0.bin
- Size 20B
- SHA256 3d4fe9c1b68df00857ae79e04ece926454411ffdd2390b62592a19aae1c6a3b0
- MD5 10fba0268b3b1a855372beb07ae339b2
- SHA1 9f706f28d28dcfa01412c2195f9c0ea4b2754971
- SHA512 3b570d370b411e930399b883951a3ef97d378317e8e4f8831c5871bd22a299e0bbdedc57412473118d5f99e7dced4021099b2ef62bd42d626aeef0d3c0ef6642
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  whatsapp script/_System_Configs/error_log_34A.txt
- Size 32B
- SHA256 5a31679a86533d247138b917648037ed738cd454dca6844364fd3bcd9b3d3423
- MD5 43a1c0e3b4560d40cea0ee2137c67f55
- SHA1 263c3a7d588e2cdc513ee48c7daef734fbde12e8
- SHA512 f382e4e44555140f48e92ea6603916f41e3008b842e9b661db710b3300eb42e5aaffbc2d55c98ed07314cc605ef223f96602c131239b34a6d45cfcf63c40f267
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  whatsapp script/_System_Configs/error_log_34B.txt
- Size 45B
- SHA256 cf178cf513bb42569d803a7eaca0c0201fecddbda0febea99ac9301a37ff7e19
- MD5 dc4f23e9b20d6667018706d326237bc4
- SHA1 d6124200345ed0e39ae4fd1a0c4da11e829e3ab3
- SHA512 6f8d5ed73f1f27fc403412f183e8e721b39b873b73d97ba9edfe3e8a4e615125134b99cf0a5b3012bff025f57f983b00b1c705d6e0eb2ee922b5b7f8bfa420f8
- MD5 SHA1 SHA512
Score

1^/10
behavioral18
- Target
  whatsapp script/_System_Configs/temp_session.dat
- Size 26B
- SHA256 72826a7999c843daf775bc83484fbbffc558b667178ffeed4c8583b5bb8d6d45
- MD5 164537701672555195d22ac5381d99bf
- SHA1 c495f6e39d4c6a84806ae6f364d25d4f21b6d327
- SHA512 81d011588d6d78722752a2e54f31cd9c929433ff3da5bf6be6005fe2fcd5460a5d2720d33c910d938877676ac67fcc24a295c344ea2d32cd7a560f79c2e6d27e
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  whatsapp script/bin/debug/core_tool.exe
- Size 42B
- SHA256 67ef618d904a99b84041163a56e0ce5d4869f5112c095d9b5c9f3c3ce50797d4
- MD5 adbb37ca1c6f79d601590e6a4a765ff9
- SHA1 ea106e2f6c1204acdcd4dedceabe2268b4f7db6e
- SHA512 7a59096d4e87f8314d0e885a4dd543dc5ded6bdfb6b44b798d6edde8c4d21020ef09f4a1d963d8ab32d1b41221da87bcaee5c6ba72ac47d10c09eb56921a6503
- MD5 SHA1 SHA512
Score

1^/10
behavioral20
- Target
  whatsapp script/bin/debug/lib_crypt.dll
- Size 23B
- SHA256 3260759ce6e42c10163fb4db4e7deef90e2ae0046d4a9ce452210662e58e8d17
- MD5 1824d9baefd8326b8e8b623c58bb1afd
- SHA1 510dfbe65c7f9b4bc903000cf84948daad6d634f
- SHA512 81506e68737c6d71419444a1c6a7157e0d4116bfcbf0173e54023f285a4ec00b5710a51e377144ff2b1b3c931e52efbcd19924360cfc1b836d53529a8dba6bed
- MD5 SHA1 SHA512
Score

1^/10
behavioral21
- Target
  whatsapp script/bin/debug/net_helper.dll
- Size 21B
- SHA256 81022eeabead1b0305669141665682c86b015fed85f42cc16a232e1f69c11c5c
- MD5 6a753709688618fbe444c4d9e2871cdb
- SHA1 f370b89c3a12b9e725d500baf1cafb9e5414c557
- SHA512 a4006c8f09f7e66d04f0601790cb4b910fa084344ec20adb964cf4a013234839311fec5d4dd45081fedb7842493d371aabf648c70acdfb1b55af9a0610e85d15
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  whatsapp script/build/logs/build_error.log
- Size 39B
- SHA256 f7e3924077ce405805d5015c179477be81597c2e6557a45f1e12fce78daf12a4
- MD5 2f855d9eab75724c26a2ff6064da2aae
- SHA1 421c62e4f5c23bd79ad4fb4cb11d60b2b793c853
- SHA512 d8e77346fce84677b8824a00076a9f14cb5dd3546f8c5182eb760ea9a7c0b42373bc738fb3e80606667b29f850e84aaef81fe5a2c96c75afe88e47010b3cb56e
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  whatsapp script/build/logs/session.log
- Size 43B
- SHA256 868f51f582bbf4d81db48ec6a7abef1d87fd57e430ab17fe7045fb3c86344c61
- MD5 7cdbf8bd340b621a3abdb331b77828f0
- SHA1 33f2a7964b7ae874cf087e52329812f18584ca7a
- SHA512 3bdb9f9c8e51ec16d611689c30886e2d69e91e9b9a5a1d5c39390ca6b7b21ff6e4c868b2771ead76530782fa433f72b08401614a1c48424fd1185e424f8d2669
- MD5 SHA1 SHA512
Score

1^/10
behavioral24
- Target
  whatsapp script/config.ini
- Size 50B
- SHA256 4745204e891c865e1e692c8fd4ef39e3b5589a9095a2e1468e0af9742002ab8e
- MD5 b3fd57692b541338faf2e0b47e910ca5
- SHA1 308ca8400e9e49c691f12ecd93c183fe7b3de93d
- SHA512 8ccc1c90364093b0420b350df26436659856bb475d39239e2f952fc93ba77a282a64fe9b132b766a5517e117f8d3a0f7d48d7b3cb8b0443863b0a66a48154f92
- TLSH
  T168900250252941180124140BA95556D6410202860B4E0114615554E489240D7C690924
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25
- Target
  whatsapp script/docs/technical/target_info.txt
- Size 45B
- SHA256 3a2b663465cfefd2bb12a358a858bd031fb0ee80a2561b722522285fa16e440f
- MD5 14af2053c7d1e4ee4c1e24a532b4274e
- SHA1 9991d671dad1dd15dba92c0faf3c3e1f059fce8f
- SHA512 fbb3f637b77373b8ee41863674edac0d667a295f6df3ae180029fe548aa7e3322ee0e10bb6b0a870a360df70ba3829d8bb0769a082dc94c2e31ebc915fadd6c1
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  whatsapp script/executor.py.lnk
- Size 1KB
- SHA256 14e3c3ad21c7b0907bf566aff3cc55fc00a0f1463e760390360b54209f269524
- MD5 10e52246f1a17916dfd2f5d28583cf06
- SHA1 be90e009ff9a6965ec33def759ad2d01c238aaee
- SHA512 c676d6c23714ac93fdcfcde85da9ab029710228902553cd7e765294c9c376e641390df9cf745ec3be5f7979b6c4f8035f1b9e58217c929d95bdd79362607e40d
- TLSH
  T16E411F6323B04F23E63B9BB582F9B2C58624BC74FD45C30EA958918E1861448D838F4B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27
- Target
  whatsapp script/scripts/automation/build_all.bat
- Size 63B
- SHA256 bd87fec1de635c6aa83eb9c509e9dd171e3f7cc699a8e40728dcd44c9a691a08
- MD5 c3b996f10db54736e588b2fc15b07aad
- SHA1 5060fe3dae07d02f60b93619fe78457ca11b1dea
- SHA512 5575163c8a4b8c674161a1605a18afa02456cbcdfaf2c6ba0d34150ec6d29c621b14d3547b4b21fb898cd3708d9dc90eb6265006067d01cf3a0a7548b2a2bf1e
- TLSH
  T130A0021AEC647127FB511850A3D51E43724E458783D459A1190545B80D5F64464AC6E3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  whatsapp script/src/auth/whatsapp_api/connector.py
- Size 53B
- SHA256 c1818ec71bd3d8b0fd31d66413980bdfaf44b6e3e49eb8cb5974e98a7ebde3e7
- MD5 0507e9478421a235db5670aca7c2c529
- SHA1 1f06b96b1c314a79fc6d738407908922c5ee54a0
- SHA512 84276e3aa3e8552542fbeeeb09e97aac43d796025afb406ce9bff6d75efeeda3e80b78add869f27a3fb32b9ad2f609c0c191b2d73be789a7da1f981829969387
- TLSH
  T100900296DDB2445962B709A004A00431A11596005701800346806E625427B4804E1141
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  whatsapp script/src/auth/whatsapp_api/data_cache.tmp
- Size 32B
- SHA256 c5a0c66b76bff04530a7e09ce4f9d7dd44223e222fc95e2048f8873d299f8619
- MD5 194f7acc855b87ed735f0940023704ea
- SHA1 fda8717cc296c9ff46c05fcef6947dd57f7f5773
- SHA512 050f7e94a50329db5ec58255c2739c90a62ec7ee60eb4f8d1916afbc896eb6e2d7b6468e49fd21a74021fedfcdb96c0a22e605573f063e5ed3c239f029a9dd4f
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  whatsapp script/src/auth/whatsapp_api/decrypt.js
- Size 44B
- SHA256 c52cdf5fd00956b4dc5eae02d3dbc126e8e24e70c08bd8bee3ed248c947ebaae
- MD5 ca509e685e7035dedb97a0a30a186f71
- SHA1 60ed075ee78ba66c5d3b38f9a67090168f967b09
- SHA512 36b8975a3ba5c92971c53de694aebc3bcccd729e9a380153840ddc2bf39cbc64080ab423025418cec9d992357be06bb3eccb84f07c92317016d684abde679037
- MD5 SHA1 SHA512
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  whatsapp script/src/auth/whatsapp_api/main.cpp
- Size 22B
- SHA256 c015d60a8473c3bd686b1d9d75e214ba320aef3f487580684275c82613ffe95b
- MD5 b1add633f3ac6b18441acbefcc90c785
- SHA1 19cdab859e1c3e5f9da3b36e88274a4139ea5be7
- SHA512 9ede9fbe67f6c7cc18c03182e7b5cceb97d3f47bc3cf4cf6e068ad298ac5f64a29dc52203dd2df7c0ca001fde7e0cdbc1797e669e772048b55f4020c902f751e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32