Overview
overview
7Static
static
1Bin/Extens...er.exe
windows7-x64
1Bin/Extens...er.exe
windows10-2004-x64
1Nihon.exe
windows7-x64
1Nihon.exe
windows10-2004-x64
7Nihon.exe.xml
windows7-x64
1Nihon.exe.xml
windows10-2004-x64
1Scripts/Aimbot 3.0.js
windows7-x64
1Scripts/Aimbot 3.0.js
windows10-2004-x64
1Scripts/Aimbot.js
windows7-x64
1Scripts/Aimbot.js
windows10-2004-x64
1Scripts/CC Aimbot.js
windows7-x64
1Scripts/CC Aimbot.js
windows10-2004-x64
1Scripts/De... v2.js
windows7-x64
1Scripts/De... v2.js
windows10-2004-x64
1Scripts/De...rer.js
windows7-x64
1Scripts/De...rer.js
windows10-2004-x64
1Scripts/Mad City 2.js
windows7-x64
1Scripts/Mad City 2.js
windows10-2004-x64
1Scripts/Orca Hub.js
windows7-x64
1Scripts/Orca Hub.js
windows10-2004-x64
1Scripts/OxieHub.js
windows7-x64
1Scripts/OxieHub.js
windows10-2004-x64
1Scripts/TopKek V3.js
windows7-x64
1Scripts/TopKek V3.js
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Bin/Extensions/FpsUnlocker.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Bin/Extensions/FpsUnlocker.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Nihon.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Nihon.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Nihon.exe.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Nihon.exe.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Scripts/Aimbot 3.0.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Scripts/Aimbot 3.0.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Scripts/Aimbot.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Scripts/Aimbot.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Scripts/CC Aimbot.js
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Scripts/CC Aimbot.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Scripts/Dex Explorer v2.js
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Scripts/Dex Explorer v2.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Scripts/Dex Explorer.js
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Scripts/Dex Explorer.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Scripts/Mad City 2.js
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Scripts/Mad City 2.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Scripts/Orca Hub.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Scripts/Orca Hub.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Scripts/OxieHub.js
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Scripts/OxieHub.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Scripts/TopKek V3.js
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
Scripts/TopKek V3.js
Resource
win10v2004-20220812-en
General
-
Target
Nihon.zip
-
Size
8.2MB
-
MD5
cad4152b05e892cfba2a62d83772deca
-
SHA1
9628009c467cd774bf154a8a25752880c393f4ee
-
SHA256
c4063131e2c89c9b08d1e18f029e8c7de193456eee7a4e2dced690665359b42c
-
SHA512
35996e302d68b43fa632ac310d4cace867e7fec716ad83a6f66a2ccb84efe88556c085e965824888413c60813111892d62aa0b15bd037e8ba2844eebf7a2c513
-
SSDEEP
196608:0zzvUqihwPrQZF6V26o9VV7wbgohfzfi91WBS5dUXvIdyj0od2:GUJerLs6XnhfzutDywdyK
Malware Config
Signatures
Files
-
Nihon.zip.zip
-
Bin/Extensions/FpsUnlocker.exe.exe windows x64
8a30acffa5d4e68c6f30f1c14d9a5f09
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
GetStdHandle
GetProcessId
CreateMutexA
Sleep
GetLastError
CloseHandle
ReadProcessMemory
GetExitCodeProcess
Process32First
K32EnumProcessModulesEx
OpenProcess
CreateToolhelp32Snapshot
K32GetModuleFileNameExA
QueryFullProcessImageNameA
Process32Next
K32GetModuleInformation
IsWow64Process
VirtualQueryEx
GetCurrentProcess
SetConsoleTitleA
TerminateThread
FreeConsole
CreateThread
GetConsoleWindow
GetConsoleScreenBufferInfo
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileSizeEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
AllocConsole
WriteProcessMemory
HeapFree
HeapAlloc
WriteFile
GetModuleFileNameW
GetModuleHandleExW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
SetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
ExitProcess
RtlUnwind
user32
GetWindowTextA
MessageBoxA
EnumWindows
IsWindowVisible
GetSystemMenu
GetMessageA
CheckMenuRadioItem
DispatchMessageA
LoadCursorA
CreatePopupMenu
TrackPopupMenu
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
AppendMenuA
CheckMenuItem
PostQuitMessage
EnableMenuItem
RegisterClassExA
SetForegroundWindow
GetCursorPos
GetWindowThreadProcessId
gdi32
GetStockObject
shell32
ShellExecuteA
Shell_NotifyIconA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
Sections
.text Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Nihon.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Nihon.exe.config.xml
-
Scripts/Aimbot 3.0.txt.js
-
Scripts/Aimbot.txt.js
-
Scripts/Alt+Print.txt
-
Scripts/Arsenal Kill All.txt
-
Scripts/Arsenal.txt
-
Scripts/ArsenalHitboxExtender.txt
-
Scripts/BRM5 Tp.txt
-
Scripts/Bacon Hub.txt
-
Scripts/BloxBurg.txt
-
Scripts/BloxHunt.txt
-
Scripts/Boys And Girls Hangout Gun.txt
-
Scripts/Btools.txt
-
Scripts/Build And Boat For Treasure.txt
-
Scripts/CBROKillAll.txt
-
Scripts/CC Aimbot V2.txt
-
Scripts/CC Aimbot.txt.js
-
Scripts/CMD-X.txt
-
Scripts/CTRL+Del.txt
-
Scripts/Click TP Tool.txt
-
Scripts/Coco Hub.txt
-
Scripts/CocoHub.txt
-
Scripts/Dark Hub.txt
-
Scripts/Dex Explorer v2.txt.js
-
Scripts/Dex Explorer.txt.js
-
Scripts/DexV1.txt
-
Scripts/DexV4.txt
-
Scripts/DivineSisters.txt
-
Scripts/EclipseMM2.txt
-
Scripts/FPSBoost.txt
-
Scripts/Fathom Hub.txt
-
Scripts/Flee The Facility.txt
-
Scripts/Full Bright.txt
-
Scripts/Function Benchmark.txt
-
Scripts/Globals Script.txt
-
Scripts/Infinite Jump.txt
-
Scripts/Infinite Yield.txt
-
Scripts/Invisible Fling.txt
-
Scripts/Jailbreak.txt
-
Scripts/Kraken Hub.txt
-
Scripts/LucidityMM2.txt
-
Scripts/MM2.txt
-
Scripts/MM2Autofarm.txt
-
Scripts/Mad City 2.txt.js
-
Scripts/Mad City GUI.txt
-
Scripts/Mad City.txt
-
Scripts/Mad Emotes.txt
-
Scripts/MeepCity Plus.txt
-
Scripts/MheeHub.txt
-
Scripts/Murder Mystery 2.txt
-
Scripts/Natural Disaster Survival.lua
-
Scripts/NoClip.txt
-
Scripts/NoClipKeybind.txt
-
Scripts/OpFinality.txt
-
Scripts/Orca Hub.txt.js
-
Scripts/Ori Hub.txt
-
Scripts/Owl Hub.txt
-
Scripts/OxieHub.txt.js
-
Scripts/Phantom Forces.txt
-
Scripts/Prison Life.txt
-
Scripts/Prisonware.txt
-
Scripts/Remote Spy.txt
-
Scripts/Reviz Admin.txt
-
Scripts/SharkBite.txt
-
Scripts/Simple BloxBurg Auto Farm.txt
-
Scripts/TopKek V3.txt.js
-
Scripts/UnitClassifiedGUI.txt
-
Scripts/ViiPer Hub.txt
-
Scripts/Walk On Walls.txt
-
Scripts/ZyrexHub.txt
-
Scripts/oofNotoriety.txt
-
Workspace/Script.nlua