8ef6336fbd5cd04ce43b53d4831147a1f109be80764598cbac287f2d3dddaeb8

Sharing

Copy URL Twitter E-mail

General

Target
Chronos-Nuker-main.zip
Size 60KB
Sample260824-wmg2js1gnf
SHA256 8ef6336fbd5cd04ce43b53d4831147a1f109be80764598cbac287f2d3dddaeb8
MD5 5f3c061daa4dad52299c34dabfb38c18
SHA1 c44ccc7a8b8c8d379ae1bbbdbcce8a129892af0b
SHA512 120e046f1b64f27644656f0fc6263baeee9e7f784be91337995bd75e47e567d09b6397e1186e0f66c08b5a6cd910b7ef97cf33f762fa65d9c7441feae8e0cbb0
SSDEEP 1536:4NwSPL2fckpE9Cg9Fn5o+9vRYyGXct9g845mxDuoG4:SwSock+/RXpt9oGr
TLSH
T123539E150B147CA2C0808FBF7F18078EFB4DF485154EAE766BEC1936DD54B82AB6A58C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Chronos-Nuker-main/src/main.py
- Size 8KB
- SHA256 f5cb3c487c439df9f06030a21f05b9361cb4aabbdf53be595c52692ce6c93896
- MD5 efd1dff3f23e6c55afcb382fa36d52c5
- SHA1 aea9382b8aa97db054f19e87ef8cd73e1b9e8e6a
- SHA512 f074058fc634cba077bae36436604569e3c336ec4e9097c4d0c5dafef1f84ede0cf96c7f4f12674c82c3b6c2f5dd0c30a0a2fea3fe7de4e6490b2835eac4d77c
- SSDEEP 48:Zd1cGu3BoPP1xmk+9O8eUUsfeXNMZiAVvYcaz3BoP2LHbfSp:Zd9mo3bE9O8rUsfedjAVAvo+LHbfSp
- TLSH
  T1F502DD1149103420070FACF54DB6DC6C755A2527C708107877EE8AEC8FBABB1DFA6E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Chronos-Nuker-main/src/utils/DownloadToken.py
- Size 602B
- SHA256 92f6c63e235bea8843379919c24614dfec240506957cd875dcbe8dfceb7d61c5
- MD5 037433437c2073b723598ebf4387fe8c
- SHA1 8451f8d8fa3a6ba84e0517ddb8f44fad40097a4f
- SHA512 927fc0cf4fa3615adb038d87657f39e51606f15d2f71c6019772fc7c1e5b151acc680fb1fac8fe82917b40296651e5c85444f6f9f8ac6c489a9d55fc7194d86b
- TLSH
  T147F047B3005430640B8FC15C0F436008741AF137E95CF029B9D00AFC5ADD312D1B5D42
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Chronos-Nuker-main/src/utils/__pycache__/DownloadToken.cpython-310.pyc
- Size 879B
- SHA256 6d4bd5ad57050773b731ea44608949e5c6c99ba10a030e391a6268cbfb92c533
- MD5 1f4f7367f32adb2dadcdc325d8a9163c
- SHA1 7d74a3ea71a8f6d161eb4ef1aabd856749017979
- SHA512 29d8bbd8bec932b9a0cee8db3cd434a2e8adc82506016a87897ff42936948da6cf2a76fac222b003039b0d3816e6292845ab1af4d32abe37ebf864c4cc6eede5
- TLSH
  T11D11864355825DDAF3B8E23C8F591158A8D635E780ACE1CBA7B849EE68D619380E2843
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Chronos-Nuker-main/src/utils/__pycache__/accountNuker.cpython-310.pyc
- Size 702B
- SHA256 3423ceec0289e99a3ef6e473b5b391a73b6790b8f0707834060cbf1acb480c6d
- MD5 6e6f8657026fa0e48a64af0b978d9544
- SHA1 d0c81990ee5c8045646d05e1fdfebf02c112dcb3
- SHA512 e55edd5cbd5f5082a62d026aa2dfa43eaba4523f725fd92911564f59f912825d7112b3311ef93743c84cebfd71eca698c94b101b18aed08f385fdf3a417423cc
- TLSH
  T13601998396132DE5EB24633492E9113065FB597ACBE2E0A90B48B0BB0EC6EC3CC91500
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Chronos-Nuker-main/src/utils/__pycache__/blockAllFriends.cpython-310.pyc
- Size 841B
- SHA256 60ad612f9f5b1118e6841e13e6bcc35b17a39ebd48761bbfc7253df2f3e0930d
- MD5 b0a0e84bf2777b80664ca2a2c47323ce
- SHA1 432491cab9dc7522aa47feefbb5ff5f69fc6e5a4
- SHA512 cb4c22fd7e4a216847299dbedc0ef428b8c5ffd8da1f0a29cc3269e67f9404d234d41554030f39deed917cfc3bcfaa954560c11baa2d092478e2408bf5309b22
- TLSH
  T1A70112C3C0100E81FB3CD670A548212539E6929347AD62D68798E53F38CCA02A26288E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  Chronos-Nuker-main/src/utils/__pycache__/closeDMs.cpython-310.pyc
- Size 776B
- SHA256 30fdd4a528812880a908ac5f14f206a7c85e53b5007bb4d7eff8f9aeecbbc464
- MD5 421533b39871c8251104f76e3549cb04
- SHA1 d250322a7c7ab45cf3f187427246f542d28d596f
- SHA512 db6ac395f836f0843a801136ee60426ffad0593ce2edf13c1c3985ae68f738060e920516f940b258c40f7307793439e6ec0ca9a4611524367a6597e137c27ca4
- TLSH
  T157016083C1420901F3E8F239AA840F384BCE2213E99E82D987AC909F2848483AA21C04
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  Chronos-Nuker-main/src/utils/__pycache__/common.cpython-310.pyc
- Size 2KB
- SHA256 0adce47274005ac8deba64c9f12fbaf2ca456c1781850f6a4413634d1c58a3f2
- MD5 22b9c8546d9b37e7ade64bdb533b50ab
- SHA1 2d2d3ce78b6c9c02ea2b454cc95a4deb4b2451c0
- SHA512 2de270ffcdc4227f7b1b52e382185d8fb0aa3676223475b79b82bcebf169c8e6965ebd30af2ea553d645a5c8c8cf5bf2dc077d8854428538aad06448c37c6a58
- TLSH
  T15A5174670C009A25FA15B0F98E57D21C82E3536F824474A3FBAE85ACAF863C54911BCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Chronos-Nuker-main/src/utils/__pycache__/createServers.cpython-310.pyc
- Size 741B
- SHA256 fee80e1b905d4fdf21e2a5f81e46e8c2a371a0d96479524a90e52d33441d756b
- MD5 0adaeb97582b74cd6b2565e9617ad086
- SHA1 4b4c34dea5534cd2950fc5905c5fef8f18f5104a
- SHA512 03bc01c4e1eebf4e97a91e03aa2cab2e4291147764415cdcc063140558108feb12efe5078b61d60e643613ab1e7e99c5cfc153a3e407789869a2426a517a8363
- TLSH
  T18301449380106CA0F764A3746659093C8DD642A5178E42E15F0D90EF6CDE4D66A38CC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  Chronos-Nuker-main/src/utils/__pycache__/deleteFriends.cpython-310.pyc
- Size 943B
- SHA256 1814ee676ef808dd51768c38fafbba0e5c3a5a89cd66b08269555ffa4cf408b0
- MD5 56270951af1a58264faa2ad98ba231fc
- SHA1 825ffa355cd95cde1b279f7483e3d22103331878
- SHA512 2fb63e4fbb06c0aab38adcebb5fbd83aeb62c4ceecfe4919886b848e39b7b9db56c905b8962d3ff303ae3ed6b45b02758dc25b8ffa578008ad991dd82ff908a8
- TLSH
  T1A511448382A05F46F39B9271E11D1A3256FE52F9536D018A03FC38BF3DCDA874422C59
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  Chronos-Nuker-main/src/utils/__pycache__/deleteServers.cpython-310.pyc
- Size 875B
- SHA256 561c730b97d55c0b0b8f6c505571137bb518299c38f5b52909f0ac8c558c9f8e
- MD5 b7fd0146b343cc6e6041ad013de4b435
- SHA1 880d011c72cd0b656f840a7f82ef11e2f3af0383
- SHA512 b443f9c608a78bc6f67049182cb37c6fe007d3515447d6211f240ff00fb10ecb1b457c302ec904328cd74453ed43d29cff060fa14fae61b8d7ebcdd97d3a056f
- TLSH
  T1AD118643DA824C87F38B63B1E2681B374BEE817952AC50C716ACB0AF3CC554B8537448
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  Chronos-Nuker-main/src/utils/__pycache__/deleteWebhook.cpython-310.pyc
- Size 525B
- SHA256 11a7434a68a66bc8dc3808ac9866b4857c36c0ea8b6815192a910b95c5a51bd3
- MD5 cffedbbcb7e283125342ae43bcb3ed6f
- SHA1 270c1652ca1ccf952aab82536b839662906bf646
- SHA512 6ed8c178454f19a3fc67c6be10bfbd44f29a133252286101a50c8d3c2921d7e1191ba1c171f18ae01ac91213d64f87cb1f9cc882f6f39a5609b87e4647fc7d13
- TLSH
  T15BF054C317880CB4E3A4C271CB9900666CDD5732405C9ED1078D757B2CC0AE3403CB48
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  Chronos-Nuker-main/src/utils/__pycache__/fuckAccount.cpython-310.pyc
- Size 854B
- SHA256 e8f1a3c1d4b9f60bf3597f5d9dbabb41e1b621d8ab086c1e869fe41138ce1897
- MD5 6d6ebc9c24ed94c3b9000e534f79a1e5
- SHA1 ca230838f83d09467a92ffed4016cedc24f12af0
- SHA512 a5447f6f0055a735a07d720ca5685565fa68bdb06f0a2860b0e3feb566e4e03478ab544f6a4e7666cc9920dce6269f7c8d12aba01924242ae7c1d5d77db696b8
- TLSH
  T166018A0214912DA5FF345370D57D123D55DA12B9D6B551711A7CA07F19CC1FDD42DC82
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  Chronos-Nuker-main/src/utils/__pycache__/getAllFriends.cpython-310.pyc
- Size 829B
- SHA256 3fa2a9ebaec242d36c27eeec8bbc946f8a9d81cd453e33c6d1dd6af30771ab24
- MD5 2903f048ec997f713c4bd1e05c65a8e6
- SHA1 17ecc0edfe57ef33c78b11444a619f4dbdebcb3f
- SHA512 6ce7348b3801bd096fb5126c45a6469e9ba82ece7889976f282505995fa0413782f4a4f9545da6c8d83c7210db00a12570e9bb56c3b675eec88e120812a5ca78
- TLSH
  T1330170C394540FE4F3ACD234ADD62A3D38EB42D1437D25EA0BE9116B2DCE7C28924C88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  Chronos-Nuker-main/src/utils/__pycache__/hypesquadChanger.cpython-310.pyc
- Size 708B
- SHA256 cdde8b0993991f658a99354ecf142723b357ce54f084aefd42c843000a0346b4
- MD5 664b5cf2b6d621c66d26e7e107435631
- SHA1 0e6ebead7c77b1d7e867236381c24e7d79f03adc
- SHA512 a7df541e2c60584024be5f4d2ac9d740016125caad770b43754ead8c66257f4e8bcaab8c8b6d7630591967079dfbb6279e8dc497cac34ef01957b648b37bc806
- TLSH
  T12D01FE92D9015C30E6797230E78007341EFE31FBD81D2457266C4047085ADAEC26A70A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  Chronos-Nuker-main/src/utils/__pycache__/leaveServer.cpython-310.pyc
- Size 901B
- SHA256 69b18d523aa9406cfa953d38f03dc16ba88ea8407f1ecfd2852ada0cf23e9403
- MD5 8c2ff9258497ef7ff6c6194718b510fa
- SHA1 64b2ba62b6ad92a455a82fe0b6e870df23765189
- SHA512 41f7de0c9ba2d7ba5b95d5c00b680a7dcdf818dd84d376df8d956a5d836f6b267ea71491781dde90e1bcc603c09d79f40bdbe72faa991feb7ae7d13e1dc86b8f
- TLSH
  T1BC118A43C5520D56F38AD170612826266BCD3695469C00C757ED70FF2CC9D578133898
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  Chronos-Nuker-main/src/utils/__pycache__/load.cpython-310.pyc
- Size 538B
- SHA256 414b392c86597915c2edf5ce7bc1246e0461c1eae5844dae79d36c6b73f99c4d
- MD5 a00a922c8ba4de9786e0ce0bf0f3936e
- SHA1 da2e3c7b6c23e96757c63b97a526202ecf7e8201
- SHA512 26a502e9b0336dfcfe0153e269b0fb51f225eaa4cf883693fa6fe0b3113bf5b9823a407e5a2dbc884fc629bf57407da43dcefe1d7c69d0999e106347b9807408
- TLSH
  T1CBF00ED246020AC9F92EF7386A714129C9A161B9EC4E559387088BBA8C5D2924861E42
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  Chronos-Nuker-main/src/utils/__pycache__/loginWithToken.cpython-310.pyc
- Size 906B
- SHA256 47f4ca7826f27998fd314f050b50d9a89bc5bdeb7df808cd99a6661eecb67080
- MD5 4b33e7a0ba5c5d68fb6c1194c21a3d25
- SHA1 9a1ff5e9b2a6f928e4b5d118d89c46d99c62de15
- SHA512 bf90db33c901b785fc452565b4f8656863d6b3e92579bd3b590bab43e32dd61a8d23df015c452cebbc5ee6bcf8e2673cfc7df50c6562bc6c6bd5f1dad150cdc8
- TLSH
  T1A2117AC508265860F237E87805F7021D17726127416FC81336BCB3DD9F866C558E2DC8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  Chronos-Nuker-main/src/utils/__pycache__/massDM.cpython-310.pyc
- Size 914B
- SHA256 32455849619017085174c0c5a4365264b2a1f340cb28870c458df31066dc7177
- MD5 8b3b5ea437ede5fefa3e0ff8cbeaa811
- SHA1 e8c34ef4500e2c8128363bf195fa5c652a341f16
- SHA512 8774c4997eb3fb4fde66d8d00caa354248c5d11fad716a651a95b4b7349cc73c0fb1f161b4aa6dd5173a2d7c89222e2b63e56f2e6cc3680b243baac463a208c0
- TLSH
  T10F112F83CC024951F3D7F732649525384EDE2265DADD808B16BC10BE2CCC493C866E88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  Chronos-Nuker-main/src/utils/__pycache__/tokenInfo.cpython-310.pyc
- Size 1KB
- SHA256 7f09633c4ad585507b8fa36a4ddd9bff8abe9910812bda51291959f9c7946ffe
- MD5 c132a11ec49b78d217f7861ce055d3e7
- SHA1 02dbc5405b07ced5d04cc37836d81c27dc828f66
- SHA512 e55e4e0eb331eb55a6dd15fcb2f7538c33e3813d3096bd9a14a9d2ca9e7f59317e5d1fb57f0b025f906fb4dfaf2917973269f055faf4ebdc1a49cf784914ee5b
- TLSH
  T1732137A3454458C7F276BB3511A616C92CDD51F188DE135C385D614B0FCF6CB956740C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  Chronos-Nuker-main/src/utils/accountNuker.py
- Size 735B
- SHA256 d9e80f65a485078b90cf6564766f0eed90bb6bddad6d6b8ca1f8034007ad76f7
- MD5 97f6746e8614f130e89fa8a5334929b9
- SHA1 2c28ebfe3939cd47e6344dab5c4efd3f78af7f82
- SHA512 9f3568683bd2918b3789b5325038453aa3d22ebbcc1541c2eaa404a09b6fe7b6269728666ff8f8a908a3ba78bf46dd6d4f603889d68babbb2abd233620dcb86c
- TLSH
  T11A01E2160353399103BFCEA2D751302A2BB52B465F6864A8A5C4B3F60FCCF91C787A60
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  Chronos-Nuker-main/src/utils/blockAllFriends.py
- Size 658B
- SHA256 500b8cc5a5c81eac18ba2ad07194d26cc097b97532b2ba8d200c60c73c764d2e
- MD5 05f5033bdb8d4e9a841595aed7622f46
- SHA1 47efb06b6f81886c7d32a7f1d19bf44ce8742535
- SHA512 6f5463f2b459a26c379f2ad7d50f19d4d84666f409d5e97a46c1d9199fd344a8ea5fe09721783a8618120d639ee3944e1a06934256bf4893df54fee94b7edd9d
- TLSH
  T1830123C300902442E70C85226C052A2233ABA803175B643972FD47BD2F8D656A206888
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  Chronos-Nuker-main/src/utils/closeDMs.py
- Size 603B
- SHA256 8c7e1d202624b532bda2f356a6f248fe30ce0f6f696cd9709dc0d3fdd464158c
- MD5 5718b706c751fdccfaa55a7782cf99dc
- SHA1 7ae30359e987a4024bc6fb8267bd6b7ba72dba86
- SHA512 4e9429cd25b31eb7737dcc085d326d307b8d9a42b62935a4237fc51657d4590499309c24ed70d4b8deea5955f141cfb97ed3d60f93dcf294a1712005fc4d9d8d
- TLSH
  T1ACF04182C0C03403A36DA5A5BCC4AB152B8FF71BEC953038B6CC1AED4BD0093E017E48
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  Chronos-Nuker-main/src/utils/common.py
- Size 3KB
- SHA256 7d557fd0389465b48a001e8c1621de1c1549048d49bb6f9c94662a17b73c165b
- MD5 011468cb8b97634c555b58d5c315435f
- SHA1 469c526897135a003a20d84e3b1b45e4f2cdbe3c
- SHA512 9979b39f14bfebaf9a53f5ad3fab25a12a22bf141af40ac9876e5c0a0f0f43b1cc217af52aa99a5bb8c63fc35c51fbb3b393ad8f67ecf58f44cf21cd50d0596f
- TLSH
  T189710DA76C016962534B64BADD47E01422E3563FCA453831BB9C87AC8FC57E90237BED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  Chronos-Nuker-main/src/utils/createServers.py
- Size 490B
- SHA256 a1e5861f76bcc760ad050d6b1faef70c71fb114baa514211bcabc83118db1f48
- MD5 4061d40767ba5864fc373411ae9df462
- SHA1 ebe61a474dfc33f0d3b641de246a341e1d198d1a
- SHA512 8c29a26d7a22d6b42383095734c1d93ecd3a88fe575e61b979b21416cc20ff085f3d1a16ec4b99bdc73765ff9d8cc91cca0e5724f99e27ccfd7b9d5a2654a795
- TLSH
  T1C7F09E57409038658F0E07795D431A157FEA691FB65CA0707EED4AAD4FC02220399E18
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  Chronos-Nuker-main/src/utils/deleteFriends.py
- Size 733B
- SHA256 2230b8df215b0e4185351272b025017e43860a9a46da7b3caf5d11a280d3e72e
- MD5 7f2156d5736d53bbadb297b513fe42fd
- SHA1 2a4e86bb9f4fca947caeecca15eb7e744c322a11
- SHA512 f01900bf69279283c074a89e62ea1d9ebc070f4567a5d6aa135a7edae0c7fa240d1534072df235c3bcaf0af4c136f5465399dd1b8d67cd05c3fcd4358e6f0266
- TLSH
  T1B401FE0204B13A22DB0F453BC51B042B327B7E9A674C652936FC7A7D2FC86A1D023CD8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  Chronos-Nuker-main/src/utils/deleteServers.py
- Size 643B
- SHA256 7d56b2ccd59fdd59ada2e45d0685cacdbc6ee6b0e68e506bdd15cd81c9ebab36
- MD5 803f3a4587a4eac077c87846a555a5d2
- SHA1 f7a065f44df71146d06e6afeef166329811f60ac
- SHA512 b3cc3dd3ec80296cecbe82b761aeb7082f1b31c27ec7d7b3a0aaa2546ee7b7e118f35e0ad0884124520ad272b08315d44fc3f24046ccf7b9de28420e5be338dc
- TLSH
  T1E6F0AC6385513033974E91AFCE214A1B375F7936559C20F63CEC99EE2FC1662803A884
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  Chronos-Nuker-main/src/utils/deleteWebhook.py
- Size 257B
- SHA256 9819d329e733d1f33d8a7391b787bd63a40563f0586b28f24440497896162593
- MD5 52733f28fdde5f3dba24ee7f6e5d681d
- SHA1 4db5a993d1e53f649759f17309ef69da81c7f333
- SHA512 aae12348197d39598aa43a7fbbc641b61e7b13ae5e774c515627861df0c39a86d337a0679a552601b3e7d7504ad5dc84fef6e6cfac30dd6a48e5362185eca3f6
- TLSH
  T1D1D02B0307A0302447DF815A8F401105791E6E2F5658A03534C86EBC4FCD112419DA64
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  Chronos-Nuker-main/src/utils/fuckAccount.py
- Size 711B
- SHA256 c62f497dfad365a105895c7ff270b3e52ac985a28f2cc2fe69a7ad3418213607
- MD5 9c733aef0c386f80dfcc250ef3a7eb69
- SHA1 afbade5a41d2339bb4b973a2a580f2afaab9fd4a
- SHA512 bcaaa27f793fc9f9d59dff5a0c1a5ffbde460bde3aa69c7d50601b23a3603bd4a9f38ea73d65bfdbd2333098e13841629bbf71f1c40afccafa8bebacbef5a69f
- TLSH
  T18201025610E2202C0F9F527F8D4E990527DA2117AC9C7836B8ED0A6C0FCC668C0E4FF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  Chronos-Nuker-main/src/utils/getAllFriends.py
- Size 582B
- SHA256 f4599ae7d0e31e0b0c204c4e077c433354e440965a837c85b32e630ba563829d
- MD5 8aacd233257445c0e9a4c86199841823
- SHA1 291244d604d28b4cdad0b91619fde912b7980348
- SHA512 bd044057a48cfbb996632e333b4655a73e8f452c0e28fd031c60d5bccd02dce2d26b513fc69f58951b4933308a0e0a31d026fdb2f1a05922f34fbd2d6370d004
- TLSH
  T1EFF0E183005016149B0B4626EE462551377F5D67779C703479EC56FD1FC91A2C705E6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  Chronos-Nuker-main/src/utils/hypesquadChanger.py
- Size 499B
- SHA256 677557789034f37cb1648599a85e5ee82a233d1872ab741f800912b62e1302e4
- MD5 97acd4ddcba45b84178af614c1dfd9dd
- SHA1 2298d9809811abeadbfe371f3ea349bea724dadf
- SHA512 6fa1c55122f32f6641cfbd43238a55573d699abf348ceaa899335a6d03a80cab9cc7193dd59a61bfeacae4e12b8e85dd27f334a6731bc4e186b6badd0857f2f3
- TLSH
  T1D0F09717C821B529472B8066DE665C31AFB680ABEF0E34357CBC81584F49F6DC76074A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  Chronos-Nuker-main/src/utils/leaveServer.py
- Size 707B
- SHA256 78bcc06e056966cd520eb5b0c81bb87bddc99cf9f0b5416cbf21c4a526ef6ac4
- MD5 bfbca2d1e3d22d287b5a4126c9130ea3
- SHA1 7a91b1e9dcc1ced89768ffb94600487cce5d57a1
- SHA512 65c56b6488365d4a6c5f058e63484dc3e0901126354f9297ca238507a4163d36e2850c52742500f682b942219ce6463ff490b3b9be7b9a5ff85fe97fc73f7364
- TLSH
  T1ED019E22C0513032974E846ECD364A1B375B691B994C24B678EC59EE2FC16648073894
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  Chronos-Nuker-main/src/utils/massDM.py
- Size 731B
- SHA256 fcd4c07fe7e783501ae481a08d848f184be1fad9e7d5ebcdca2aef86a875bfe2
- MD5 8363a87d367950f2575eea576f0663de
- SHA1 9deb0b1cb3c8419c6e452088a1aa45d9029d6c78
- SHA512 526e8f09d700eb267b00257467a4cad43d4e17a8f7f269414c79594e923d61c62c87a9f047487ae593e8cfe6badf6b4d2ea1a058b05a7d497012a17ecf0cdfd7
- TLSH
  T1A8014E42E0213622E30FE1B5C8AA5015264FBB2FEA0A703838EC06BC8FE4112D0F3E50
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32