Overview

overview

3

Static

static

3

ConfigKelmis.exe

windows7-x64

1

ConfigKelmis.exe

windows10-2004-x64

1

Kelmis.exe

windows7-x64

1

Kelmis.exe

windows10-2004-x64

1

Kelmis_Dat...rp.dll

windows7-x64

1

Kelmis_Dat...rp.dll

windows10-2004-x64

1

Kelmis_Dat...ix.dll

windows7-x64

1

Kelmis_Dat...ix.dll

windows10-2004-x64

1

Kelmis_Dat...ty.dll

windows7-x64

1

Kelmis_Dat...ty.dll

windows10-2004-x64

1

Kelmis_Dat...on.dll

windows7-x64

1

Kelmis_Dat...on.dll

windows10-2004-x64

1

Kelmis_Dat...re.dll

windows7-x64

1

Kelmis_Dat...re.dll

windows10-2004-x64

1

Kelmis_Dat...ng.dll

windows7-x64

1

Kelmis_Dat...ng.dll

windows10-2004-x64

1

Kelmis_Dat...ty.dll

windows7-x64

1

Kelmis_Dat...ty.dll

windows10-2004-x64

1

Kelmis_Dat...ml.dll

windows7-x64

1

Kelmis_Dat...ml.dll

windows10-2004-x64

1

Kelmis_Dat...em.dll

windows7-x64

1

Kelmis_Dat...em.dll

windows10-2004-x64

1

Kelmis_Dat...cy.dll

windows7-x64

1

Kelmis_Dat...cy.dll

windows10-2004-x64

1

Kelmis_Dat...ro.dll

windows7-x64

1

Kelmis_Dat...ro.dll

windows10-2004-x64

1

Kelmis_Dat...ne.dll

windows7-x64

1

Kelmis_Dat...ne.dll

windows10-2004-x64

1

Kelmis_Dat...le.dll

windows7-x64

1

Kelmis_Dat...le.dll

windows10-2004-x64

1

Kelmis_Dat...le.dll

windows7-x64

1

Kelmis_Dat...le.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94f58521a28663db3c9b7233fc2939da28a341c0b84e1f69149b796a3f607106.zip.zip

  • Size

    49.7MB

  • Sample

    231107-rsh4ksah88

  • MD5

    17de44045735798a7d4ec0dbb7add0be

  • SHA1

    e6d7a3cd8b39f06eb749a69bd1527f5fb331e3ec

  • SHA256

    0d55b51cbf2074873213381b1de3e94d2f001fdaf9ed6e9cf4f62e90edc72337

  • SHA512

    2b20d56b0789dd9b87e59f427f798e24fc7d36828c44d9080394189c46713f1d8669454cc4f150ae434536903c94f7dfd73cd0c11c041cc614b94e546434dd1d

  • SSDEEP

    786432:S41CiveLrT6prBYmC+J6xAAAXVZznLlAnzHz4vFElOIPRO9R7/ClgTxzXiX:BCseLrGgm4CTznZeyFEYr1cgTxzo

Score
3/10

Malware Config

Targets

    • Target

      ConfigKelmis.exe

    • Size

      311KB

    • MD5

      312e7fd16860a117b87939802296fa16

    • SHA1

      68571b2ab41e8e742cb6db6ee64fffa354d5f07a

    • SHA256

      29bf254ca49d0a1d5291c2f83650de0163183481e6bab1968eef2f98a360560b

    • SHA512

      a4dc7a525d78bc851e9d97342604b6d66848dcb51ae796bd10431ed9a75fef78ceaec5f60099b8a3e5089021c0913f58304eabb47bfb47b6135d3ea8a6d5a999

    • SSDEEP

      6144:s5xvGBxmGX36RT1nQgCyZNBrKmdkF/JUdbfZWgT0PR8IxrnBCUXtXp:iwxmG0dLfIT54Q8ItR

    Score
    1/10
    behavioral1behavioral2

    • Target

      Kelmis.exe

    • Size

      635KB

    • MD5

      dbac498ce1ccb5c0e9397cc2409b7a86

    • SHA1

      c118d9dcc8a511382af5c242e8c10b7637d7b785

    • SHA256

      54da7795fe893bae76bc3fa3d38782612ab312baf3d84127e7bc5f63add24ee6

    • SHA512

      56bddd8510c4553a181278882a533aa3cb8d1d2ebc146f13cf04e01df96b8e7a6ff38538fccbaee7172dfc78eeaf4fb574ecbb438fc892d0cb6dd89bad1771ea

    • SSDEEP

      6144:R/7oYfSHQPWTUg41k5lUSfI1ftMgKi7sSRtpMeK33nG5Ofe:t7qTUlC4V

    Score
    1/10
    behavioral3behavioral4

    • Target

      Kelmis_Data/Managed/Assembly-CSharp.dll

    • Size

      495KB

    • MD5

      3d3ccaf5ebaf29929374e40ae1b20161

    • SHA1

      788f3a51b010fa0bc47a2c821047a4b28fb7e5e5

    • SHA256

      da4e8ee7031630d066f3cfa3d0c2bcf2120c27b3845584372cbb4f3b934dcd80

    • SHA512

      d216ad25af9da1d29da938e87d512937fb22775de579a5a0ea3584bbc77e097515c2851a9159132852201c3158d855d57d604f88868bef3c073b50ed5fe4bb56

    • SSDEEP

      6144:Fjij2sq69LqfbOqNJxgbtz9vYQeILZzrDa7X5MD5v5FTVexcoSfHb/:hij2sqTTOxlYQeSZzna7X5E5FVe

    Score
    1/10
    behavioral5behavioral6

    • Target

      Kelmis_Data/Managed/Mono.Posix.dll

    • Size

      207KB

    • MD5

      9dc4df6f4efd948a169b5caf92481a4e

    • SHA1

      bec15cef605f23a6917f34f7c8d5dbb75b17ab8e

    • SHA256

      e1adf3c01930052914db016ba05a88273ebbc783c8c8cac15270be39fa59f7f2

    • SHA512

      0c2e3c2fd0a03e949dce2d7fca492f3a8d33fd4185fed5a2c93b379a4c3ebb4630b6dacdc8c7fa7a5f2a401ed70d04e3663e0c44e61bcb6aad52e6c874bc3efd

    • SSDEEP

      6144:nc9wE0Q11JQ1S+OWMYU7nUXxOvblnsAPetE:nc9wE0Q11JQE+kY15A

    Score
    1/10
    behavioral7behavioral8

    • Target

      Kelmis_Data/Managed/Mono.Security.dll

    • Size

      302KB

    • MD5

      d422f418bae6d87d040c5170008bc1ef

    • SHA1

      65b572e14c6a3c4ad2910fec349523b1dec7a528

    • SHA256

      31ef31f7113dafdcacde925e3a7a25d80577fb457580c550840078a913387ca0

    • SHA512

      3d8a36a8962cc096074db3094e1f6a78d7363e8d7b6b4014508c915fa715c20d6917561123d6b03c476ad334eb193995c774c01fb442cfbb75f1da9096180036

    • SSDEEP

      6144:DJvWNTGENjTzSQfGFzPTzcyaksosrWn95Alq:cmFz9mW

    Score
    1/10
    behavioral10behavioral9

    • Target

      Kelmis_Data/Managed/System.Configuration.dll

    • Size

      122KB

    • MD5

      cff03007bdf625794ab68afed6f465db

    • SHA1

      86c1166a59d1e02bdf52c484fd84d3eac82e0c49

    • SHA256

      82b79e0281faa83253f2f8ecd325c6be7cd3362631c1ddafebfa12e924217242

    • SHA512

      5c1be197892257abf42ac29ecc7af6e5525f012857cbd2931749872c2b1a651d1e84d6c9feb350ce0520bfa6093941822b02fba11d4ab971f5ac69958c2bede4

    • SSDEEP

      3072:iH3xt3GrHyTALVXzA4k8y3Kpn5WJzL0MIexH4+:iH3DcSTSVDMJw

    Score
    1/10
    behavioral11behavioral12

    • Target

      Kelmis_Data/Managed/System.Core.dll

    • Size

      1021KB

    • MD5

      adb867ec841d06936ede8816a1a484e5

    • SHA1

      6d640257e4cbf8b228d57383a42a04efc6e44de5

    • SHA256

      3166717b311fca3f953f5a1f74b34c06a025098da1ad8dac9451a52f0852f3e3

    • SHA512

      24e4b244fd035a34ef3833b3941b2fa9e0735e241e016417550b3536d05d71f76234a168364e950161c31be3259ba0040b61a2ddfd986e4c47a22f8c7a2ee521

    • SSDEEP

      12288:nDQR1+Dy+BcB5Qud7DfVsL9KVI36owJKbYdB54wkHXdt:Qn+BE5jVsEWIWYdB5

    Score
    1/10
    behavioral13behavioral14

    • Target

      Kelmis_Data/Managed/System.Drawing.dll

    • Size

      586KB

    • MD5

      510e18d64827f314e96ad00cd7ba3de9

    • SHA1

      dfce03403072475291a61e7930b0a2a110d4738a

    • SHA256

      405a1529a2fdb2a63fc3e85769ed384a745e06598eb653f7d9ee43e7d355b9f1

    • SHA512

      0b9d09eece2338a9eadeb5903fdf4f65b97e494b287631026bf6da1b3c7c20d43772981de2328d014f650fadb0d76d38444a30ba336756d2b15172653b7de53a

    • SSDEEP

      6144:vcDW1iUg2l/k2x4SmLXa0T272EBxhbBFqfOoqDBJsCYCMVgKPafdPX8cHsl6WvOo:piUl/kjSmLXaRBv8pgCalvo6Wsqd

    Score
    1/10
    behavioral15behavioral16

    • Target

      Kelmis_Data/Managed/System.Security.dll

    • Size

      180KB

    • MD5

      8b949897448f7360ebd20695ba4f2749

    • SHA1

      2a1f39bc6adf327523b18f28c32b7f0ffce6a53d

    • SHA256

      8834af112c5378dcc365ddf5bf750a190743954a7920e342c44345944728de54

    • SHA512

      18ba29ec1e9e257ff7d970b3f2414da333a397086447bf6f2eb2cb5c24df5f594b2c091f4c9892e367ae6077dc4555f7f698900105c61d4dcd5c3ad882c5160c

    • SSDEEP

      3072:1r8JG/QlTReXnVzW72nDLR1RNdxz9nI/K6ZoedXHpnZQeU1GGeEebgUKFzODhSKE:1r8JpeXnVzW72nDLhZz9J4oQJZQeBGeJ

    Score
    1/10
    behavioral17behavioral18

    • Target

      Kelmis_Data/Managed/System.Xml.dll

    • Size

      3.0MB

    • MD5

      6e801d54700741cfd3909d7db4596098

    • SHA1

      1a07b1e32fd37e006aa8c72c9c968a80914255ec

    • SHA256

      c135fcfa907dfe45b134bd89c85374c8de1619effa2da4badefabb1efed9f569

    • SHA512

      5fb0ddf5b902ab532ae589d0ed57b024d799bee1c3863bca163c78a93c7bf0859f584c20b32b8f7eaad2a7f7cc2cbf2c936b844bdaec0a8a3721d84260a70e0f

    • SSDEEP

      49152:ZsYTcCgwYbmuLn+0zZAHHyPYAs38PRN5H7UPM:mWcCgwYiuL+0V

    Score
    1/10
    behavioral19behavioral20

    • Target

      Kelmis_Data/Managed/System.dll

    • Size

      2.6MB

    • MD5

      3cc9faa68b909cf499f3e3f4938afb24

    • SHA1

      e71182c771fa7399dc479b18702a6d71857767b2

    • SHA256

      cb0e3eb53401790152e1215d562e800f3a290cc83ea03a3cbadc3a286b7da847

    • SHA512

      c733567ec424971429ac3c90890b4eb7a2ec1ea35966c41c3f650e1c253478d5ce074ef5863102f4fc4bb5fe12c7cfc73cc137cec8a9e4d9931a26ac200c885c

    • SSDEEP

      24576:S84uIETJMErQVL4oQNBP2XWJvkx2w0+1msgO/2d12X27DDmlOBFkvQzbVcoyGgU:S1Ee3VMoQNBFxkcS/47DalOBFkvQzZc

    Score
    1/10
    behavioral21behavioral22

    • Target

      Kelmis_Data/Managed/Unity.Analytics.DataPrivacy.dll

    • Size

      7KB

    • MD5

      4bb1d47604b810bf4b6985b225f783dc

    • SHA1

      aff634e3f127121848a7de85e0bb4075ab1291cf

    • SHA256

      afba57ef51987104acfa63b9bab191c599bb9c0ac9af2164ae1fefa6caba5b0d

    • SHA512

      b6a0f9f8f3ce4b22fd9ec152c83cc338fa18a19c2808c6c456d6988af702c05f2e14984e9aa4df76d8ff2c6a0230960ae463534ff6d99b1bbc3d2f43568f63a0

    • SSDEEP

      192:n4jrB9xA86/3byrgcLG1RFqRr4o0Hya98:n4jrB9xAN/3bMLWRFqB45D98

    Score
    1/10
    behavioral23behavioral24

    • Target

      Kelmis_Data/Managed/Unity.TextMeshPro.dll

    • Size

      324KB

    • MD5

      14dd9bf7d20125b3f166ed904c4a7302

    • SHA1

      f446e2102507cd0b2658f604f61f5cf2a82b00bd

    • SHA256

      6ee239b48311cc8e457b14d4434a206e098628cc700674449717195b6d496577

    • SHA512

      35816665a2075d2c11a375c8af4313ac807334449e3e0e142fe02927020469b196ad3b9f7aa99b1293b683cfb801899acab41c085c6f3f8a3973af006dc9a7a0

    • SSDEEP

      6144:XD4QCffE+WVUupXlazdm6c74hTsTXFYEe329ZFZTaLLuDwK60yOJ7i:XD4Qws+WVUup+/hTsTXFYhsFMXui

    Score
    1/10
    behavioral25behavioral26

    • Target

      Kelmis_Data/Managed/Unity.Timeline.dll

    • Size

      102KB

    • MD5

      e1692f92c25385912d9a8bb35fc09da8

    • SHA1

      0dff53e837dcb4c8cfd80e685a84d721e7b780f1

    • SHA256

      82800464fd6f29ea86f100515157199d6033a1c4e73af17ad466d1bd85749262

    • SHA512

      c623603d01acdf56d88dcca6d1d50006b1dd3f6f59c5a3984181cc7d91f08cbc369e1a7571210f47e4323b45e8c7f82d0bcb87029603971557e32211557fa52f

    • SSDEEP

      1536:AQaoIVW+N7v8ts455b4rjremZ2zkCMyeNUIaM75L19ciMtZ9SB3krYqXQ+7:AQSW+NTas4/QB2QHyC75TuZ9

    Score
    1/10
    behavioral27behavioral28

    • Target

      Kelmis_Data/Managed/UnityEngine.AIModule.dll

    • Size

      41KB

    • MD5

      6dde798e18b9209d2423f0d5e6ccb13d

    • SHA1

      3e013a1d4fc3048756aa4a20107063706588e430

    • SHA256

      a72e36573b83f66febdddb01c6ae19013c63d464b58a3c485faf99f7f8078d0c

    • SHA512

      37e8e9c4c82c970282962ccf7274ab0140c3495a8c3b9af50877fe68609cc2ecb686cdbdb7d5820a15172300e135104dfe5030e03c29c36675462b9c4abfefe7

    • SSDEEP

      768:nOOi8kBuEqxRDV99U79VxxivcqqPMKOMyBrRFPJNKkquaZhs6eKItGu0keHOy0hy:OoUDK7FxiH4LtGu0ZHOy0hy

    Score
    1/10
    behavioral29behavioral30

    • Target

      Kelmis_Data/Managed/UnityEngine.ARModule.dll

    • Size

      12KB

    • MD5

      287664afeae25d1a170160970e65e4aa

    • SHA1

      4882c0842e2b7529428c9fdb3280a059dd96aeae

    • SHA256

      b9459526ca9ce9bf6e60bf949d49d46ab829b152966b6eee8aeccf5b177ccae5

    • SHA512

      09582b89df28ca0bfb259f9685dbd5d826926c2e3066dbd5e3e66d1b61b8df10d5e3f3e28fa1b49165d2fb000530532df37ec96762d0b51df2a3addaf92d457e

    • SSDEEP

      192:OlDLtyjv0zkUcc4UiMAbYyHxjPRXFa7fBHkTycpDcjO8s:ZvAkbUiU2xjPVFalHkTy0cjO8

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks