Hostile ^92% javascript Download

@zettai-labs/zl-code-windows-x64 0.0.53

AgentTesla infostealer payload detected

“Zettai Labs Code Windows background manager”

.NET embedded PE loader combines screen capture and network control.NET screenshot with WebClient upload

SHA-2561fe620996536481c9040e00f4de11dd19c456d803647f485831bf6af120f3818

URLhttps://registry.npmjs.org/@zettai-labs/zl-code-windows-x64/-/zl-code-windows-x64-0.0.53.tgz

MaleculeK₂(LiMc)O₁₁(C₁₃Co₃Er₁₅I₂AlAs₁₄Dy₂Eu₂P₄Pr₂Xe₂)H₁₀(Cr₂₂Cm₂₅Db₂₂F₁₈Hf₁₀Mg₆Os₃₉Po₂₄TiU₅)Md₇(Bi₂₀Bk₃Pa₆Pt₃Si₄)Th₂

Evidence

Two or more embedded PE headers 0x87d350–0x87d4f0

⋯7 more rows
0x87d3c01984636a00d014000b84636a00101300..cj......cj....
0x87d3d04d5a90000300000004000000ffff0000MZ..............
0x87d3e0b8000000000000004000000000000000........@.......
0x87d3f000000000000000000000000000000000................
0x87d40000000000000000000000000008010000................
⋯15 more rows

Query/set system parameters (string) 0x13a2c56–0x13a2d86

⋯5 more rows
0x13a2ca6eb004c10ed006110ef0061100000003c..L...a...a....<
0x13a2cb653797374656d506172616d6574657273SystemParameters
0x13a2cc6496e666f573e675f5f5f5f50496e766fInfoW>g____PInvo
0x13a2cd66b657c355f30003c436865636b427974ke|5_0.<CheckByt
⋯11 more rows

AssemblyResolve event registration 0x2e72469–0x2e725f9

⋯7 more rows
0x2e724d96c704e616d65546f5265736f6c766500lpNameToResolve.
0x2e724e96164645f417373656d626c795265736fadd_AssemblyReso
0x2e724f96c76650072656d6f76655f417373656dlve.remove_Assem
0x2e72509626c795265736f6c7665004f6e417373blyResolve.OnAss
⋯15 more rows

SPI_SETDESKWALLPAPER constant 0x4766e21–0x4766ef1

⋯3 more rows
0x4766e5145544445534b57414c4c504150455200ETDESKWALLPAPER.
0x4766e615350495f5345544445534b57414c4c50SPI_SETDESKWALLP
0x4766e714150455200574d5f5553455200455252APER.WM_USER.ERR
0x4766e814f525f494e56414c49445f504152414dOR_INVALID_PARAM
⋯7 more rows

GDI StretchBlt raster transfer API 0x4bfcab9–0x4bfcc59

⋯7 more rows
0x4bfcb29506978656c4f66667365744d6f646500PixelOffsetMode.
0x4bfcb39456d6653657453747265746368426c74EmfSetStretchBlt
0x4bfcb494d6f646500576d665365745374726574Mode.WmfSetStret
0x4bfcb596368426c744d6f6465004c696e656172chBltMode.Linear
0x4bfcb694772616469656e744d6f6465006c696eGradientMode.lin
⋯15 more rows

Showing the top 5 files — 7 more files (159 regions) not shown.

No evidence locations were recorded for this file. Raw result