Overview

overview

8

Static

static

1

DiscordTok...ain.py

windows10-2004-x64

8

nopecha/main.py

windows10-2004-x64

3

nopecha/no...und.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...est.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...ook.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...erx.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...cha.js

windows10-2004-x64

3

nopecha/no...ile.js

windows10-2004-x64

3

nopecha/no...ook.js

windows10-2004-x64

3

nopecha/no...der.js

windows10-2004-x64

3

nopecha/no...tor.js

windows10-2004-x64

3

nopecha/no...ate.js

windows10-2004-x64

3

nopecha/no...emo.js

windows10-2004-x64

3

nopecha/no...ate.js

windows10-2004-x64

3

nopecha/no...tup.js

windows10-2004-x64

3

nopecha/no...p.html

windows10-2004-x64

6

nopecha/no...pup.js

windows10-2004-x64

3

nopecha/no...p.html

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    DiscordTokenGen-Capsolver-main.zip
  • Size 489KB
  • Sample260815-1d7castgja
  • SHA256 416a8cd3b5d934246f122e6a516a99027fd05daaed7d0d21cf2af2fe3e799e09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target
      DiscordTokenGen-Capsolver-main/main.py
    • Size 68KB
    • SHA256 f5993ecc99aaeaa413f1c6e9c934e74e31a2a88643d4b59e725d13cb5910cc90
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    credential_accessdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealertrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Uses browser remote debugging

      Can be used to control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    behavioral1
    • Target
      nopecha/main.py
    • Size 30KB
    • SHA256 d715258b18707520d951e445e5d08400e8c043fd13c5bc9b4a73fb7099c03084
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral2
    • Target
      nopecha/nopecha_extension/background.js
    • Size 82KB
    • SHA256 1e5001e337e3ac90b48b51cafca972a4027872ecc1ec7a6bf80fcc504b86f744
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral3
    • Target
      nopecha/nopecha_extension/captcha/awscaptcha.js
    • Size 34KB
    • SHA256 eafaa15b8e63da4690442df94b87ebe55e82910f96371a3051e59bb665d850f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral4
    • Target
      nopecha/nopecha_extension/captcha/funcaptcha.js
    • Size 59KB
    • SHA256 6e92efe7a5ef0211399ef415bb169ba5012857b180c89c886328f90e5e902805
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5
    • Target
      nopecha/nopecha_extension/captcha/geetest.js
    • Size 48KB
    • SHA256 787fff5d3e2e439d23bec2b24c39ee0df46d0ae1cfb2cff5e8992e8f1d478348
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral6
    • Target
      nopecha/nopecha_extension/captcha/hcaptcha.js
    • Size 96KB
    • SHA256 49400205ec7c0867fc4571919ecf5631ac547c54d03c8c94dbc5d73d4ae1e6e2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7
    • Target
      nopecha/nopecha_extension/captcha/hook.js
    • Size 18KB
    • SHA256 030478d1e0b338d0ccc221f91aaaa1b6c431395359c7ad263c672363f8a7f6f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral8
    • Target
      nopecha/nopecha_extension/captcha/lemincaptcha.js
    • Size 83KB
    • SHA256 0be5e406bf333c0c963d5f2e42545287c6962e627dee486988f93a461af804fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral9
    • Target
      nopecha/nopecha_extension/captcha/perimeterx.js
    • Size 22KB
    • SHA256 731d8c25827e5b7c93bc495613f10d61206916cc96377006ed92047b38c600fc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discoveryexecution
    behavioral10
    • Target
      nopecha/nopecha_extension/captcha/recaptcha.js
    • Size 58KB
    • SHA256 3a7d81f278ad619f5489d5a8bb916b8b4ce00da12c58382a639ec37c96e5b402
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11
    • Target
      nopecha/nopecha_extension/captcha/textcaptcha.js
    • Size 36KB
    • SHA256 26c4a169f532460f56d55f4ef1e58d606be1b1964cb0551d71f56578f97c824a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral12
    • Target
      nopecha/nopecha_extension/captcha/turnstile.js
    • Size 22KB
    • SHA256 6d644883f930ff366a558c156d439e8c3b31496cdf94c93a75c57ce0b1841030
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13
    • Target
      nopecha/nopecha_extension/eventhook.js
    • Size 4KB
    • SHA256 b014b9908ca74d48e924d11cdb97faf98dda0f6c69eecb68babdcfba139910a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral14
    • Target
      nopecha/nopecha_extension/eventhook/loader.js
    • Size 14KB
    • SHA256 bf010e0347acb74ef6eb931ff1bbfe27307abbed7ea7a88493e15adf016c5c50
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15
    • Target
      nopecha/nopecha_extension/lib/selector.js
    • Size 8KB
    • SHA256 0c7b3b3676d85e34480eeb2d2d4853ccec0595eecbe71250f1bf8b75e6235cf5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral16
    • Target
      nopecha/nopecha_extension/locate.js
    • Size 42KB
    • SHA256 a86665601d97eb7731c2c0a3626d7d94cc9001ef933d802450b446bdf471d1f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17
    • Target
      nopecha/nopecha_extension/pages/funcaptcha-demo.js
    • Size 66KB
    • SHA256 1af0c8a61cc7bab438ec6a68b1e7cb94e410ae12c7a294fd65b8057e189cae90
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      nopecha/nopecha_extension/pages/integrate.js
    • Size 9KB
    • SHA256 68fa823c2ccd01dc3f4edf2527100f6209bc3fd3b39f73af7a5ac0f8e7c8c595
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19
    • Target
      nopecha/nopecha_extension/pages/setup.js
    • Size 19KB
    • SHA256 1fd9b6f0041e0528e45337627be636e7988bc1afbc3dfcf7b4e4d4fd4c875875
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral20
    • Target
      nopecha/nopecha_extension/popup.html
    • Size 441B
    • SHA256 2ebd43ada254c0b142f3d1c7786024e941fa4270511073d865cf0e20b5fe7ce1
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    persistence

    • Drops desktop.ini file(s)

    behavioral21
    • Target
      nopecha/nopecha_extension/popup.js
    • Size 144KB
    • SHA256 6332bcc3536ef0146b82281c0c4c67d89afe782da6bedb5fce9b4adfb666f96c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral22
    • Target
      nopecha/nopecha_extension/setup.html
    • Size 395B
    • SHA256 e4918eeebd9c7e3051532de4ba5cc4087e133d1a584a57bdd2efc6e350ac2815
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    persistence
    behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Accessibility Features

1
T1546.008

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Modify Authentication Process

1
T1556

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Accessibility Features

1
T1546.008

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Authentication Process

1
T1556

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
1/10

behavioral1

credential_accessdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealertrojan
Score
8/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

discoveryexecution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

persistence
Score
6/10

behavioral22

execution
Score
3/10

behavioral23

persistence
Score
1/10