3ba15b6e13ec7557b12ef3c78d520d5112d50433b2523087b3731b35068f3b01

Sharing

Copy URL Twitter E-mail

General

Target
ZCode-3.8.1-win-x64.exe
Size 140.7MB
Sample260822-v56besssa1
SHA256 3ba15b6e13ec7557b12ef3c78d520d5112d50433b2523087b3731b35068f3b01
MD5 7dbfcedf8dfd2831ca663b23c98c31b9
SHA1 e146879ea470498802162ffab27cd6640a9a614e
SHA512 7ec71d52a92aa2bb2ddcda6225e58107639412ecd75705a34c7a705c078833038ef632596d265334acd68a33ee733fb64cad6a22815a8d95515bf959eaa4473c
SSDEEP 3145728:8EOcg5NDAgZT2QLh/p7X31iU6Lvd1e63Is6cYSB0iwjf0/vNJ:0/T2QLj7X36Lvi64fCC3jc/vNJ
TLSH
T11D6833DB64705E58D4D8A17DF972058B78E82B006A9AC4B3BB79021F7DED30DAA13C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://npmmirror.com/mirrors/playwright/

Targets

- Target
  ZCode-3.8.1-win-x64.exe
- Size 140.7MB
- SHA256 3ba15b6e13ec7557b12ef3c78d520d5112d50433b2523087b3731b35068f3b01
- MD5 7dbfcedf8dfd2831ca663b23c98c31b9
- SHA1 e146879ea470498802162ffab27cd6640a9a614e
- SHA512 7ec71d52a92aa2bb2ddcda6225e58107639412ecd75705a34c7a705c078833038ef632596d265334acd68a33ee733fb64cad6a22815a8d95515bf959eaa4473c
- SSDEEP 3145728:8EOcg5NDAgZT2QLh/p7X31iU6Lvd1e63Is6cYSB0iwjf0/vNJ:0/T2QLj7X36Lvi64fCC3jc/vNJ
- TLSH
  T11D6833DB64705E58D4D8A17DF972058B78E82B006A9AC4B3BB79021F7DED30DAA13C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 140.0MB
- SHA256 f26ff4ab1e353b43c787436599e58128c28567757b7e95089f1fe36735676b14
- MD5 923de1d769d12a5f4d5b6f3412860f28
- SHA1 1664970d2c8b7deb5b49539b487d30c1940d810e
- SHA512 5bce52538f0069557c60a6a0eea7f4f9c755d9087fa28ace692f88524a572dc08b7193414bd2278551d2a618ea1aaaa7d07d805d7e33d5c84a7182e4573c2690
- SSDEEP 3145728:dOcg5NDAgZT2QLh/p7X31iU6Lvd1e63Is6cYSB0iwjf0/vN0:c/T2QLj7X36Lvi64fCC3jc/vN0
- TLSH
  T1966833EB64701F68D4D8617DF972058BB4E82B016A9AC4B3FB79021B79ED30D9A13C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/glm/packages/android-emulator-plugin/dist/lib/path.js
- Size 617B
- SHA256 f023cbe895a34831d3b6c5657fbf8d0d17d81c95ddbf6fb1001d4d814950c78d
- MD5 94682d76886a639a30717820d87aae78
- SHA1 80b8957d7299cbd4844fe4752c37e6cade8a2d98
- SHA512 d1b623bd549ed1d7e73aad255564a4f2738adbc7e7452705288348528c1e2ec505f925b917d5b48b830a15ed189a51ad109866ebbd9ffe84c9aff1565bc03bf0
- TLSH
  T101F0A25928F37B55C2A2B3D05B1F60082DBDE9873A086A50731C57503F56034E357C6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/glm/packages/android-emulator-plugin/dist/lib/result.js
- Size 600B
- SHA256 a84b9ebcf224544a41225ae1b8d66589b868ff8846ae5ec09b18747bd0d24bb1
- MD5 d8e117db8d0178de3660e71e507eaee3
- SHA1 73ec35fc3fdaf3ccdf2f91603624035b48453527
- SHA512 cb6def6ef36912b8a85c4707f71fc22741c44e2954c23909155ce7cd25151101f708d378acbd6046118b18e81e66bc500feb7563d942202551e890af6f9b5b99
- TLSH
  T120F02B497CF54D00460CB250B25F4588B97CD1479D7CDEE4B27D87620F18834A2B331C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/glm/packages/android-emulator-plugin/dist/lib/run.js
- Size 3KB
- SHA256 6933b9b35e63cd547790222463cf075edcd8fa542355ae5b81edb5fb6f1d9086
- MD5 f066699204fc37df4ec533227b53042d
- SHA1 53e84e5a48ffaa1f0f4ed627ff98e85d12bddaeb
- SHA512 93ee5ad67f0c3df447449fb1b77603f529268f9d00c8592dd45fdd910f49315736a307bfbe6deefc472fda1eb7472c597d4c0ae9a6a8429bb966bb45e8c0f70c
- TLSH
  T12B511D4E31FB65262273743843ABE42273680107E869C9A4BE0EC6112F9946CC7F27D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/glm/packages/android-emulator-plugin/dist/mcp/server.d.ts
- Size 103B
- SHA256 e5e5db7f25c4bf6c983e1086693d111d7bf5c4d12f91c956ac86b5cc10e99f8e
- MD5 44d709230f054d5af0cec1824c639d61
- SHA1 9c576e4b15e45df5768c55551a5f24c49dae194f
- SHA512 27d042d8840d59122cd8f957b0594d54e720bc36e67a3a0abbe4537a298e8c1f5ea0b0b9fd0233f05078ed5402f73b46052f341fac13e55d827251ae1e284316
- TLSH
  T194B0120EF9FC287FF8110D3B710E064602A860B5B61D19092242584B4030646764683D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/glm/packages/android-emulator-plugin/dist/mcp/server.js
- Size 1.1MB
- SHA256 687f66643bb7b8d8e49732e8672e04b289397010f8cf995042b72ca298f01c6b
- MD5 630fb223012c9214b74e97557fd907da
- SHA1 dbd9abc60e4d3daf79d06fd71e4952ee24011b1d
- SHA512 a55efe9e36495ae1840ca13551182e77e77aab66336d585e490485d86b5417296a75a4be24cf7b965fb2a7a3053340010fbad017c8a7c8735ad0e9ddd4b6b392
- SSDEEP 6144:8WyZZxKv1vq7S5xle8u85JJL8/jLOgTqusRk/HhEuaBLMIh7Zyc8Acq3gR3YHVj7:DiExBbtZyjAcqwR3UDpWlau4
- TLSH
  T1CB45948A76F350110A9360B8E97B900AB62458037528F9B4FFDC42946FCD92D96F3BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery execution antivm
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  resources/glm/packages/android-emulator-plugin/dist/providers/app.js
- Size 2KB
- SHA256 039260fd4edc3181671deac5b791329badfffe069bc2827321c30887328a5b64
- MD5 54e1304aa6f72455a89f06e9beca7683
- SHA1 958827ce0a45af1df18515b4a790c331b27fd22c
- SHA512 499afbc44f46e399a73de7430503d3382dbc9e206b5ff21f5326656ae54957c768e5e054cb0ca9fec2df2950d3d3ac352311c878e8fdd79fc9a0f3d20212c932
- TLSH
  T11341D21FB6B75A2245DF34743F97A041533251073AD99CC8B3AC8B40AF5A02A9F65E9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/glm/packages/android-emulator-plugin/dist/providers/avd.js
- Size 6KB
- SHA256 f6e0a5399e1adafda5398e89439f9a3f71d6d468b41ee3f608ed84a6edb36c39
- MD5 2a5e546687e6745419300e2fca3fc6fa
- SHA1 d01a579343020963c2e68c8eb8156dd4c620b28c
- SHA512 1d1079c8df69bdd1bee73c27b50dddf8d8e817ada6fda9e68b2d456f40911ac79b036735f9df553c302a7af3d124fcf146a3a9c3540ccb34695559260fc06308
- SSDEEP 192:vdF64vBDMpYPspCKMp6jzpp6UW/EA7nGJiLsD7VtxQ/NY9QzMF/T6XXk8lROC:vdhLs7nzplMEAwWp0TYdnb
- TLSH
  T1E1E1634662FB2B5446BB30B96F6BA0056738511B79C4DCC0B65C92403FCA4798BF5BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/glm/packages/android-emulator-plugin/dist/providers/build.js
- Size 4KB
- SHA256 c7bf7392b6931be091715d334b3529288ee836928305ceb3a6c9132ceaeadd1b
- MD5 8bd2311fe2763bdee42e34fb90651483
- SHA1 5ada34f17b2d9c027b7e9150db78dde7e1f64fe9
- SHA512 3a248287b6608ef5006f02a0c62e3be99280d3c136cef5bbb0b6000f0332c3f389ad8b53c513b18b4af23e9c5fe5d9a6c699ae11bf009249e90406f7caa44b7b
- SSDEEP 96:GuKZVfV4+vrXTOKPt2V0PakIWeAK7s72EzRg/R/uhlGUPhbErgZMT5V0MC/43R5e:yNhtmk4fC2EyMYUPFEUZMTsMCQ3RP7xO
- TLSH
  T1BE91534660F72A1496A775B9A96F5050B6B951272EC4F8B4725C83882F1D03CC7F2FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32