RBXNEXUS - Shaders.zip
- SHA256 e6fc975eb7343b48129f351217fbca6deab2c011dcb15393654af080d42412f1
Overview
overview
6Static
static
6background.js
windows10-2004-x64
3background.js
windows11-ltsc_2024-x64
3extension-bridge.js
windows10-2004-x64
3extension-bridge.js
windows11-ltsc_2024-x64
3lib/accounts-ui.js
windows10-2004-x64
3lib/accounts-ui.js
windows11-ltsc_2024-x64
3lib/add-ac...rst.js
windows10-2004-x64
3lib/add-ac...rst.js
windows11-ltsc_2024-x64
3lib/block-...ads.js
windows10-2004-x64
3lib/block-...ads.js
windows11-ltsc_2024-x64
3lib/bvn3x7wt.js
windows10-2004-x64
3lib/bvn3x7wt.js
windows11-ltsc_2024-x64
3lib/creden...ter.js
windows10-2004-x64
3lib/creden...ter.js
windows11-ltsc_2024-x64
3lib/cwq9r1mf.js
windows10-2004-x64
3lib/cwq9r1mf.js
windows11-ltsc_2024-x64
3lib/discor...ion.js
windows10-2004-x64
3lib/discor...ion.js
windows11-ltsc_2024-x64
3lib/dxk5tj8n.js
windows10-2004-x64
3lib/dxk5tj8n.js
windows11-ltsc_2024-x64
3lib/email-...ist.js
windows10-2004-x64
3lib/email-...ist.js
windows11-ltsc_2024-x64
3lib/email-parser.js
windows10-2004-x64
3lib/email-parser.js
windows11-ltsc_2024-x64
3lib/fhm2lp6q.js
windows10-2004-x64
3lib/fhm2lp6q.js
windows11-ltsc_2024-x64
3lib/gkr7nz4v.js
windows10-2004-x64
3lib/gkr7nz4v.js
windows11-ltsc_2024-x64
3lib/hxp3yb9s.js
windows10-2004-x64
3lib/hxp3yb9s.js
windows11-ltsc_2024-x64
3lib/jqt6wm2k.js
windows10-2004-x64
3lib/jqt6wm2k.js
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
background.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
background.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
extension-bridge.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
extension-bridge.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
lib/accounts-ui.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
lib/accounts-ui.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
lib/add-account-local-first.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
lib/add-account-local-first.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
lib/block-credential-downloads.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
lib/block-credential-downloads.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
lib/bvn3x7wt.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
lib/bvn3x7wt.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
lib/credential-email-sorter.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
lib/credential-email-sorter.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
lib/cwq9r1mf.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
lib/cwq9r1mf.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
lib/discord-session.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
lib/discord-session.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
lib/dxk5tj8n.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
lib/dxk5tj8n.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
lib/email-domains-allowlist.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
lib/email-domains-allowlist.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
lib/email-parser.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
lib/email-parser.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
lib/fhm2lp6q.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
lib/fhm2lp6q.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
lib/gkr7nz4v.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
lib/gkr7nz4v.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
lib/hxp3yb9s.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
lib/hxp3yb9s.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
lib/jqt6wm2k.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
lib/jqt6wm2k.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target RBXNEXUS - Shaders.zip
- Size 114KB
- Sample260905-zcbcsshq7x
- SHA256 e6fc975eb7343b48129f351217fbca6deab2c011dcb15393654af080d42412f1
- MD5 2450043ae8ddc95b1ae6c38ac1bfd6f7
- SHA1 b4c2094e6e0217e2e05da76de416f4e22fb6e30a
- SHA512 015a2d0a639782f314267d06a9fbcbd2b9fec6572898e53219b2fd52df71222f93b7e0c90a18e2720aaa0f4634735664da9fc8e3fc03e3bf406daa31be19e97c
- SSDEEP 3072:aEYzPxdUKyG/v4HtBU9+HMBEdr9ZMg25OK3W:aEIz1ay+R56OKm
- TLSH T1A6B302AFC0470D06D94BF334E5573BC6DFA5254ACE4AD76BAC00F195B6865E0A833A28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Detects references to legitimate web services potentially used as dead drop resolvers 3 IoCs
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
resource yara_rule static1/unpack001/background.js potential_ddr static1/unpack001/extension-bridge.js potential_ddr static1/unpack001/manifest.json potential_ddr
File Explorer
-
RBXNEXUS - Shaders.zip.zip 114KB
-
PACKED.txt147B
-
accounts.css18KB
-
background.js.js 18KB
-
extension-bridge.js.js 98KB
-
icon128.png.png 3KB
-
icon16.png.png 607B
-
icon32.png.png 1KB
-
icon48.png.png 1KB
-
lib/accounts-ui.js.js 30KB
-
lib/add-account-local-first.js.js 4KB
-
lib/block-credential-downloads.js.js 1KB
-
lib/bvn3x7wt.js.js 6KB
-
lib/credential-email-sorter.js.js 8KB
-
lib/cwq9r1mf.js.js 5KB
-
lib/discord-session.js.js 3KB
-
lib/dxk5tj8n.js.js 5KB
-
lib/email-domains-allowlist.js6KB
-
lib/email-parser.js.js 18KB
-
lib/fhm2lp6q.js.js 4KB
-
lib/gkr7nz4v.js408B
-
lib/hxp3yb9s.js.js 32KB
-
lib/jqt6wm2k.js.js 1KB
-
lib/rbx-api-origin.js.js 652B
-
lib/switcher-session-cookies.js.js 21KB
-
lib/validate-cookie-payload.js.js 7KB
-
lib/validate-only-add-account.js.js 1KB
-
lib/zq8m4k2p.js.js 898B
-
manifest.json6KB
-
popup.css15KB
-
popup.html.html 6KB
-
popup.js.js 83KB
-
profile.json127B
-
rbxlabs-mark.svg.svg 1KB
-
wallet-collector.js.js 4KB
PACKED.txt
- SHA256 ac7d61cdae521a257bf479e7ea75fc3bea4f1bd33c13e155a7456b75bb32706f
- MD5 2670b4b1679875a66f755cbffccbcb94
- SHA1 a42b5dd5eca5c95b7bd73b40491e81d9fc469947
- SHA512 6fad7aa86be2d91700d3f10783c6ab038f10e9a0e5098f8a184dd9d28fd5ac0fbadfb45d9d856083c6f9884dfb744a9acd5fa3de6697938e981402e76ab33f42
- TLSH T142C02BB549FDE62204337418DC0305C17B3D340170D0F8108BE35C183DD0969DD5453E
- MD5 SHA1 SHA512 TLSH
accounts.css
- SHA256 8a07de917d5488ea0642c00ef4bff62faed1d71434361c874e96291bbad574f1
- MD5 1059d3dd931bf113d2bdefd8c22a9bd4
- SHA1 7368a63be4241f2f9a776b925285bb0ab475edc0
- SHA512 7a6d77a9a2260860087064282708f5c5404aad905300232faddf5f04fd6be597ecc2b38ccc38c40abdb27e3d2469ca6a4fb1cf32b9a616094d7887463054272d
- SSDEEP 384:fIbOyiJcnKgqYAEgFucagFKDLEFIHD0knZ3FIFwtIIbnFDp:AbOyiJcnKgqYAEgFuZgFKDLEFIAknZ3J
- TLSH T11F821FA1A73961646C27E71437D7CBAEF31869064506C5BEFFE5200C4E853EFA492B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
background.js
- SHA256 d99010ac9be8de01c2a114da6064238e0b7539a446b4b7bc1bd1ec33ddabd76b
- MD5 f8ad956d0f883b1611276a7c1970cfc9
- SHA1 fdd2e7dc299e56aa6c84129b4afa0bc9b0d036d3
- SHA512 192797e35785fd1681188345e00364e0d696b1971bfcf3b9c6d46723378c0d5d05b826bb51d89197e59d412a4a75563cc89adc776940993b39ac23c95397d5d0
- SSDEEP 384:9b+Rd5SjIDzXw5Y05PVAHS+iP+thrOwY/ygNFOzf5FHFzUVo9XfNwAZ:+nuY0MHS7+7CwHyGlgIZ
- TLSH T17392A97E34FB20256523E0BC8A5F50257221B013788DED64FE5CB1641FCDA2599F2FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects references to legitimate web services potentially used as dead drop resolvers
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
extension-bridge.js
- SHA256 bea8e1a0a30623aa0000ce0574dba646a53acd372f1f8f952ef179c1dc565129
- MD5 53c1433d106a6d2b38112c1ad3a6a14c
- SHA1 82e6ae3c83a13d8b3daace551fc6dc2ec26bfaa9
- SHA512 b7c9c24d393b1160784a9833076e717a51c4e182afba51ae7b4bdeb08f4552196c347f01cc7bb4e69730f72c06421d3092a7be3782ba4e6cd74d8f1352b19500
- SSDEEP 1536:mO3i2kb47Q7QLBXxzUlkXCT/40EaCvGQV+n1ki/ZQZDUikOtWsBKBKdmzcj8TJqE:jybjqHzxvPA2kwU4Js
- TLSH T11FA3A7BA14BB10250A62707D5B8F6005A236A017BC48FDD87E9C87249FC5D3D99F2FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects references to legitimate web services potentially used as dead drop resolvers
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
icon128.png
- SHA256 dc7b4c4397f2673000cb4ff42d26a379d13c43f5a49e5d8be9e2f53baac15537
- MD5 7c98af28526b438cdae5d632e0f0507f
- SHA1 f7d1731eea099f703ad2d8725a1832a75a71ac15
- SHA512 12671124a23e814b4b46bf9aacaddb23f6d8a5ae48edc4f1758276fea723c299bce6debfa45b5354ecb68bb09f9456b7d2fb4616af8f21324918f30deee59c81
- TLSH T1B2615B23DE1407DB49012215CD23ED25A60215484399FD9AD5B24F3B4EABBCC0BAF03B
- MD5 SHA1 SHA512 TLSH
icon16.png
- SHA256 dc7b8806a2c6e202a425f98823bf6f1f78b17b3bda37f4696496ab800b37b560
- MD5 d58d3aa30efc6f90fc1dd0d9e2719574
- SHA1 f715bf845215bc6094b5126092dfc933801b29fa
- SHA512 e3e24e614047605a5a1ce97fcc51bf13ccf62bdc05d5961a9e83d3a4c6d3855a794563073c3ade8a2f6e9ac5442a72886a384f8e335c312604c9c100de1d6815
- TLSH T1C0F0B7F0F443F92FC205B331275105C2C5510931D45FAF0464F33306118438F28BE68A
- MD5 SHA1 SHA512 TLSH
icon32.png
- SHA256 4b8540f11077c8ea0e6530a30d05e15d59c389da3d4399cbd50c8e3d6b78c551
- MD5 5c0d7ed346489e0b8be6383c67a64f0e
- SHA1 f4e0be327aadd787764712b66dab7c57ee188424
- SHA512 8a585865dc9c4d9d691f92b34e0c824b4a0e3e1fefb20eca399239d6a376193bd1c82fe4e415351cb8cb0dd0140f471cb141c11a48eb06ce21b7fd5a40bc4e0b
- TLSH T17411D8BB990ABD1CC846A23B92A8582527630C0947B34E4BE0F6CC970F53304D4FA4A1
- MD5 SHA1 SHA512 TLSH
icon48.png
- SHA256 70957cfbf043d70acadf01235f50eab3fe12c733f2afd2194c25ca7b1be1ee02
- MD5 6bed78f82e6c4060c12d3dd37dfbacdc
- SHA1 ada2abb5d2a82d72e9a85b6dbadb3f29dfdb05b7
- SHA512 dcf04b36c6fc6cdae3f409d39e657fbbe540b03775e507b424b974c076ef5ce4b02836a8a9d7d385f1fd15a12996185d066acc4dea294c33bf17329aae6844b9
- TLSH T14131C7B3AE8DB13CC0E66331D5A01EA24DCD7438B5BB45D588C896EE9022181CE9BCC3
- MD5 SHA1 SHA512 TLSH
lib/accounts-ui.js
- SHA256 2c7b9ddae8094716dfc986ab6e26d49df89eb179b9aa55ca12107e4d9e38bf7f
- MD5 2d51696baf50f61f0eae32b5fd37d1ac
- SHA1 68e4810f492ffa96d5bc0e9f0752c269269e21d1
- SHA512 c57739f04abab943cbf1c680e599bd6c4087478ffc4e26bbe708b1f59e84e25fa87c63cea71aab5a85a06146be6a56e1ed2ced2c38535424d0168fe5522122f9
- SSDEEP 384:z0khM/y1J1XmC4S2uu6R1DJAD1xVzeBW8jmUAzd5RfyFwcvf3J6nha:zrUyJ1XmC4PMR1DJADN4JeyFFJ6nha
- TLSH T1DAD2859E2EF7202A5E3BB47A9B6F5209B17241030009C905BC9DE2506F50B7567BFFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/add-account-local-first.js
- SHA256 ed3585b3902e0ff6d08a4652555bb10aae6b18e40e0a6879ce29548ee6dd957f
- MD5 0c8f76d51746e948cd14b08fc75fc1ea
- SHA1 43405b7630fcc758cbb9ba420a6542b67973ed21
- SHA512 a9ef05bbf6424fbde04fe5aed9da2f53012dc3bf2d427e6c6a297da3d1caf4e0d9389822417382ebf28715f51930e42fbee071d80976d97ab014e1308679a64c
- SSDEEP 96:H0N7RHUca6fzWmmSkqQWqFbyBU7uvwsILXSFAxPOBbwE4KZ4mNF/u5ledVPIfv+n:qVUcaFmmQQWqFbuUivwsILXS6xWNwPKZ
- TLSH T124A1318DA8F710265C13717D8EAF8105B5B9E823064DFE24BC5C95702F84BAA46FEBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/block-credential-downloads.js
- SHA256 c97393055de12e12cb7f14c6e4a1cf443d8514ebaa1f68f537f2f6036f8919b7
- MD5 c4c8c6c8676eb47ae08f974032dfa6e4
- SHA1 ce90e7d2ad36c0aea1fd4e9637d5a9bf0ee440ca
- SHA512 ac84d11a67c04e801080f1760343fac95b54f6f57f32bd2811a78b6d082bfb6460c50ec2cab0934a58e8803099490e248c9f055995fe715a477f1b9f543e6172
- TLSH T153214C8E2496B405667273388A5F4418FE3BDD33015AC19578EC415ABFB006452BBFCF
- MD5 SHA1 SHA512 TLSH
lib/bvn3x7wt.js
- SHA256 dd057f234ff7ec89c65275fa7f48e228a91ce8d36a8fe9af027df7c356886f75
- MD5 c0900306aaaf52a3886d38e8f1b0700b
- SHA1 751f680b73f33586d919c5704cc6afc710f00bb4
- SHA512 0b6b99a7983e1abebe0fde9fe4be7148691b1ff9258f7d30f612d8d3713e502b3ef902375166ce7e0181b57948fbe173003fe6f47fe23347e1d063d6f0052402
- SSDEEP 192:0LUVXFXh3FjMNnSpKeMNg6bMQDs9p6MALzSRW4UwDd3kUWkbscTiFfST80bmfC:0GFx1MVhUpT/Jd1bf
- TLSH T186E1508D69E7B1A61A33B07D8B6F6004F134D517044CCE10F8DC95626FA57B467BAEC8
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/credential-email-sorter.js
- SHA256 392ee15e4bef9bb9be188cbd0e8a972563cabdc9f17271ee3de25791a55886a9
- MD5 79144a79af54c774c8891f1ceb7903b3
- SHA1 690253744893fd920f3e7e873926ba0901b37de8
- SHA512 9989322ad99a70ca4dd84759bd05ff8af89cc71f3f098c37d0d8908f9d85cb38d77cd7a46d5597312d361a97fa1fafd73714961bb7a5aff8f617932eafa55462
- SSDEEP 192:lv/CebtkCKaURj1SXfuvNX6OQ6NiEtFOssGYGflJrYS8dVyldxlQg+g0ggeglcH8:oautvrYhPJYZta
- TLSH T10E02545D65A330B70023B3783F6F960476B9A4130C8CD9507D1CC32D5F96D2A79A9AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/cwq9r1mf.js
- SHA256 1181324bb2bc5e4105ffa9f9478de7a8892b455aae6551454ba95fac33242947
- MD5 d2a795fca864f673558253798b2a47a0
- SHA1 5953425b3676c6def45ab619aa1433c1da77743c
- SHA512 fc6a6cd2001a3aa08e430ef342f5da6140e7852f180879be4068d6f3196a35e562776f6615741db5e8dc9efb1a24102b82564c6bedb40e9022d4210b3b280ccc
- SSDEEP 96:XqWiBLjcuF8wzaiQHBulAsKVPjIP2PiPQLSoQQpfO9KOAc7udu0TieYP9WQJ:aWiBLjcuFTzaiQNVjs2aQWoQQVOgOAcj
- TLSH T118B1EE6835E7701351A7A4288FDB9410F022A9A32A4CC991FF4C9D637F644ACAAF5FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/discord-session.js
- SHA256 24a4d0583e21a0f00991f93cd5fc00952fe5e6715316ad38ac51545ddbe54c76
- MD5 dcaeff5b772de6f9818a891165b252dc
- SHA1 be917d5797e88aa010c591952490c776d21ef839
- SHA512 160f5c9f6a6f0c89cdd1104ab56c641b3ab59ae494796d0f108da9d977881577c5291574696b77e001c2518fedbc0be43b9e381e76390625c8067636aa657a04
- TLSH T1D7813F8D2DEB602052D7307C4E9F4004F2B1C06B499DDAA0FD2CC165AF9463E47ABF82
- MD5 SHA1 SHA512 TLSH
lib/dxk5tj8n.js
- SHA256 2271955094c34ba3b92225c5cc99547e53effb08b0ecbb24a2db01637b807b97
- MD5 08a4809a61e705550053c92194b02c55
- SHA1 ca7505c623defb505a36bd93f5c738f7cfaba5cb
- SHA512 17417f19f5972236120a229e7ade0c3be084c8ba41da1d4f120594fd148d2b516787dad92c5d4e35d1af976692d34c49862d86db7f702455a3cd4ee7e231e2ff
- SSDEEP 96:/tcK4yaCfKiVCbC+BbyxQrUaMbx+MDMA27rAUQoM/MbFy6qKMQA289b6mgcRIl+T:/aK4U4RBbKQr7MbEMDMv7rAX/Mbg6bMl
- TLSH T15FC1009C25F7A1154273B4BD8B5B9418F434E517205CCDA5BACC42627F623B8ABA2FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/email-domains-allowlist.js
- SHA256 6933b883b4204686dd80cd5759bb00910223626ac2961b33fef5b3b1ba9fe9fc
- MD5 64055e6d66b276231f250cadd4ce5410
- SHA1 7c3a453ce3728a93248c96a860c01f29340f243a
- SHA512 f629f0df6b2723520009b5190897e964f9f48e744034e3b6732a7a58891dd6cba30ff2f79334e3f27c223cbb4a3eae475e51a5eacedb23469088de20493e0ed1
- SSDEEP 192:wrqXO/llMF0eH6oodIjP/fLaGH9IBXzjcuJ:mqXO9lMFzfokfWGq
- TLSH T149D1EEF8000491481D5589ACE8AE8D452A62D052DDDCF2F77FFC8E88DA8FE0575BDEA0
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/email-parser.js
- SHA256 e4bfcbb9a5e146b9c371005e15bd04093fff34a6acf9e2da5959ddaa6e7fd469
- MD5 362ae12167ec2050ead3cf105ad30087
- SHA1 69238a6d1157c35458240af8deec27c2488eaf01
- SHA512 3a540a6a8d9e38e0110bccad7a9b8cad70d5c92d0623406f4b4b72a8a84a54f13b2bf24b9bdadb7a3ebfbffc55009e9670fe13c021f5e8dd72b676b26ce47de5
- SSDEEP 192:+0njORVE22UGLBJMXAa8TbtH9+vKKRueMjD/uhTDDThT/dYTYjsunz50vyq9ar63:LOFGLBJMEbz+iWWy/2
- TLSH T14D82B54539EBB02106A595F8714FB2627274D023788DCAD0BE6C4068EFD5F3A71B6EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/fhm2lp6q.js
- SHA256 067a179afccd0d70f140a4780f3e4f78c62057d9335b450191ec9c403c7ca0ee
- MD5 68adfed99dfd3acf73d9589667d8049f
- SHA1 fffcb061d4991c665fc0883e96b60aec72c8b980
- SHA512 64bcbe1d7f7798093389086b2001af9eba7a9542f342b20e234d7c243d2cb5d3e6f0c6e4c4521522bc6869b68fd1b3bd6bdda7d2d92873fa46e772ec520af3ee
- SSDEEP 96:ZB0ftOSJoyhKNywq2ULAY5TD9OoJWJhyLMMx4pBdoACWjOojJ:ZKtOSJvyqTd5H9OxJhcn2BdoAfjOqJ
- TLSH T1C0A1020958F710268623E0F9618BD805776094172ACDDE65FE1C06546F88BAE98F3EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/gkr7nz4v.js
- SHA256 66334e7a5f8d9b03ab66e5d8bffdcbad6aa6c340d816dd5cbd139d212c291e20
- MD5 3a54f22be31957827f9972cb9488ae02
- SHA1 526c2bbe62de0f3a4c96f7993ba3818f383947f4
- SHA512 7290bf45205efe31027715cb7f6184048ee27a98468b8a40b1cc605174150d77029ae2ac394d2d97b8fc72d0138d3058f9420d51c8586bc045cc3c78aa55fc16
- TLSH T17EE02B4F16E1D0580465206CDA4BD700351388331A5D9571ED5456EEEEB845AA226E9B
- MD5 SHA1 SHA512 TLSH
lib/hxp3yb9s.js
- SHA256 6b8f1910811fe27f3605f05c113c035847acac05e18c1a8a99c8326aad9f5544
- MD5 e853b3f1b52136e13c3afa67e3afa0d1
- SHA1 9a05355004fd1d2705024b637667e4998088dc67
- SHA512 0166a37b7af7a092d27aab484d3f4fb2156fbfd1af2229df1b6a2eaa322248d9b853cb740abf9a54a53a68554d21251edb42cd9bd61c88bb1da27f4a396bc0f2
- SSDEEP 384:i1uYqbXF9EGbwvckOKQfiOXQhU/MJR6alQAiBxUEGMTBRuvRz21jLqd0qv9rLKj0:zU4MLPS1jLe9rWYt
- TLSH T1B3E2714A65E3512B842375BC9F9B400A7324D423158CDD54FE5C03A06F83A7A6EFAFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/jqt6wm2k.js
- SHA256 970de2e60efab7e1ddf3de5c8aa8b2006174a0ebb6f8ce5a2971b80ad28f9e6b
- MD5 0ad1c0b2d25255f59ec9659db9d67e68
- SHA1 8128f10064c3af421b3a46feff61371f0616f336
- SHA512 60ec21d2175d7c092a3774939f88839d3f3b8ea47b64c6b3e290585e27c4ae2a0c8fdf37b42ccf171f539808a406e832dea827862f06996db8bab4e5575dd433
- TLSH T1FC210EAC9591301A3632B379CB0E990CFA664137144AD240FC6CB4389FB1269029DFEC
- MD5 SHA1 SHA512 TLSH
lib/rbx-api-origin.js
- SHA256 f55c6a93295f4e4bb613446fc811d92885d0a8dd3158a56cf8a7d321f06de5d7
- MD5 f961ac4aacb5b9be02604eaee370b209
- SHA1 da4a70fda331432b7cef855766dc0221dad14aa1
- SHA512 d0575f59434e841a2d979a20c341e5ef1df0ecf794678c54cf2f077438b3a9cf4f72252ddcdd171658cfe4181a367de414b85792f54d0d11c791d9d5609fbce8
- TLSH T1F3F0D3055BE85C7F1040745A8D086918BA8FF9FF137E8611FAD45CBC76C013696086CD
- MD5 SHA1 SHA512 TLSH
lib/switcher-session-cookies.js
- SHA256 f483c2deabe3416eaa000fb0dcf275a17718e5f84fdc377d421572f8c4b1bcee
- MD5 d53805a1224a66b440c4f3bd3c228d86
- SHA1 5c2e8b36a942ce5b9cc62a26d848219ed0d0719f
- SHA512 d32e618eef95a39f9ed0923e38007b2294bdc8f8d80ab3831e2de9fb14837f0e5c1140f9a99d0a5fd98cef611bb9c73a821f45b6f13c8a176b0aa6a31ff70fa1
- SSDEEP 384:baSwS+i6v1Um5NGR+08RuFq9M9Sm3GFVQ:baJ46v1UWGR+FRuFq+Sm3G/Q
- TLSH T140A25FA92DFB6035656330BD4B3F9004B2A1C423059DEC94FD5DB4206F58A7D0ABAFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/validate-cookie-payload.js
- SHA256 812f2e2860fe1d7b13284544b6ab0ae288d45fda83ac61a30a6dacb4bc7d5939
- MD5 b8e161dd655600141786aecdcd00cc03
- SHA1 74a25a4180b963bbb4295505fb261ab23b22b71a
- SHA512 5e628686196c574b997f8151e2ab5c57a10fcbca6b9baafe47fa9cebc004c840eed57935a8d3956c400f800bf97a6021e7f90d26816d4f8a09d9e68d93e8c0a5
- SSDEEP 192:/Nb0P1jQtKM2xiC79NxUvwqnXMr+ISxi0vajfKVu:/6gKM9+EvwBr+ISPvgf3
- TLSH T10EF12F827B81A1270134B7748F438129FA36387329DE42B1B98C41701F7287B96F9FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/validate-only-add-account.js
- SHA256 1c041d8d920f3c23a1dfa61e0ec7514e943f4b902902a7aa940e46a35c10145f
- MD5 59eb2413cb6798a04476fd3f271c1018
- SHA1 6c74590b281ebf4a6df9b2f835a83fc52254f233
- SHA512 fd3cb2a450d58a825ac98ecc84612e1e348a44e7328be68d4738462f21d423d0423a8c7537aaf5883192d5a473e0c0d60c73b9887bd3761a4b06fb83f9d839a2
- TLSH T17A41D9CD28E301324976343E1EBFE6487976C0B3011E9A56BA8CC5B17F947A507BEB58
- MD5 SHA1 SHA512 TLSH
lib/zq8m4k2p.js
- SHA256 4af417902c40769c107b6b5c1f357f9397be32f12a52d54efec2ef28071c6fb5
- MD5 14194315be29e91d108acf2702d8695c
- SHA1 5340734ee4127d07143a13e812258843900d7dac
- SHA512 60adb06dda6426525750054143a3ef3f230127e9bdbe08b080aef33fb0e40095e8d4d54a1d63cea73c82aad90de359e64beca6255ef5dbb3610ac49790a934b5
- TLSH T1E511D06487D4CDEB1029964A0C5457FAD3DE70EA10369510F78AAC3A3A50E0667057FC
- MD5 SHA1 SHA512 TLSH
manifest.json
- SHA256 c7a02e79b2d7a0db3abe8b458c2f474ccc7eea2b32abfc453a40827a02f56681
- MD5 aefb3a577432aaeffeb3be13464e9087
- SHA1 9ae25cb7f2c3cbe57bc4aa957f077a19f305087e
- SHA512 88a52a18e53927b37579e21f64dc97769938a4c3e2e411eef1f1582c94a65016d23e31efe02a9327a84a89c9d7fb16a812e6312b2057f8201389152bd25eae1e
- SSDEEP 96:/FxRSz6fy4uRgsHPsjsqsssPiXYFjzFo50QjoVDorb4H5do7HC8vtsh1f:fYX4u6Z00UdH5O7HC8vO
- TLSH T1B7D1C6EBC704981A2B248996A094770CF706415F7CCABD8AF350843E1F8CDEF687926C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects references to legitimate web services potentially used as dead drop resolvers
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
popup.css
- SHA256 41bfbbe0a313a42e1b5bbd6bcdc145b2423fbbd2aa3032ecacee1eada8062aae
- MD5 232e8a70ea381de86ad98ee687facf95
- SHA1 a629d2ca9f3d495f9658cf722011161c2002b57b
- SHA512 1dcf754c345c0fce8cce268584dfbd7738ca7a723203df394bf87d0c92c87a7c988bdbf82301d61ffd3690005e2244602ff4d6b9a2ba4031ccbc8b244d2543ce
- SSDEEP 192:FbeyEyfn42wEhrD/qiy8h/OPoxxxcYGRKlQEG4didF7iV5uc325OZA9Ix9AEFCC8:Ek3Hbqiyc1/xcYgGcF7I89EFUoS
- TLSH T1E86286E2672141687527D6643AD7DB6E732CA002A507C9BCFBED100CDFC93ED55A2B88
- MD5 SHA1 SHA512 SSDEEP TLSH
popup.html
- SHA256 366bcafedd7774c93a37ce74e096c0bfaefc4ad9a6dcc09e4cbf99ccdaba1036
- MD5 bddaf6ee09e6f3115ce119b8cc63637d
- SHA1 dc9be34ee63eeb58be1bbc525394035123d34775
- SHA512 8e5ed08bf112894a621a5994f4af33a01328c02c70171259bb61c3458b67e7ede11df23cf73b830a32b8a5bc3fc8e2798ed488b8f98c5b2d28923b0be7c46bbf
- SSDEEP 96:fvQDbHFPEk1akfizmHmVPmNmxmnwVFAXGy6CVXBV1StaSuLufvuNRmnS1ebeYi6O:fvwbHRHfiCGVeswaWWw11S4ty+NonxeN
- TLSH T1CAE11054B8F8957361AB01C9B5E5A72F3581E603D98B2148F6FD0BE20FD7CD8AC0B056
- MD5 SHA1 SHA512 SSDEEP TLSH
popup.js
- SHA256 d2a2974299167de08a011f60371b2040d91d0b48f1557d20304ee8a0f8deb385
- MD5 314f0d626f5cf80ece2edd935c889873
- SHA1 00a65e9baf23a9a5e44ffe2dec91aaf17106810d
- SHA512 199a1c4dac61e7c008f89f0b039f706b2de5a7f8b53293c0101ede300e50c72bf0edbfa3d2da6722e9243bbcc84c577aa0c0574fb159b3c16ca951ce56ce941c
- SSDEEP 1536:V7JHHAh9KHMJme9YMZ8fV/gUne/2IxCIkNfSo2u9X1h1777/rSY0T:V7JH4HmeM/xe9gfSo2u9X1h1777/2Ym
- TLSH T15283A49F68F720765563B87D8B9F9005B239C023008EDD30BC9CA224AFD5A7456F6BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
profile.json
- SHA256 3c77a981d60a899659cde6ab6e6ea790bae78215ca58315a0d6033f236928b3d
- MD5 63df8dfeedca7883baa18f1129b5197f
- SHA1 c2bdc23319be8430453dc2f428cf28aa9e6ee1f5
- SHA512 2935e4fbfb51f999579ccfcc6da30af02e3001230304dedd0f89e165ac034cc996941769b82fd65f71662bbd3ac114947c0c40e7f56009fb07c857b18d12d0ca
- TLSH T1D7B09B25C4D03C39256BD5CC445D3A5755DDC81740764C200838551EC5BFD4CC309E3B
- MD5 SHA1 SHA512 TLSH
rbxlabs-mark.svg
- SHA256 e9a08ecb4b1981797a7c54baac1309f5418a0b1cf9c831de31ff5a0d0966e8cd
- MD5 3ca083821122cea20d0f7f98dd3ccda6
- SHA1 a628561bad6e400e7d047ed493b2b67727722a0b
- SHA512 c64dd71461fab65c81a18f73f8ff830dd64e524bd9e1a0f9991760549794afe7dad7fbe10aef267341c69cb8a2143df7cf2d3abfd316174e541223e7c3766458
- TLSH T1BE115935D298942BCA2C930DC704E4643213B1C29F591200F5887F6E5F2B4D75E7B7AC
- MD5 SHA1 SHA512 TLSH
wallet-collector.js
- SHA256 5a3732b4672d5714e9af217666f8bed875b8ae20ffc9c0b6add369aada67dfdd
- MD5 c6ab1fd6cc27d09287f4cf31eb785938
- SHA1 5c8c63ae22128787fe710b30cb6a598614bc1013
- SHA512 683b8cdb897a956c1a200956a72a5d338be44ac0e8b20bf9acea01b8ab52f79eaafeb8409993cf17bc1a8071c125088f684286711d242096d9d3183df967b50b
- SSDEEP 96:a2mN2LkL8zRbys0r8PKBjc6mASTKt0bcHzzOv:X6D9zDJX44zzOv
- TLSH T11D9150C029BA502CC07233B98F032092ED365923358956957FBDE2511F7551A93BAFEE
- MD5 SHA1 SHA512 SSDEEP TLSH