a693fff41c4e738cfa6b7f0e9bcf51ae341b276b81189fa698f0c0ede4a8a54e

Sharing

Copy URL Twitter E-mail

General

Target
Kiwi X.rar
Size 28.5MB
Sample240107-ybm5jacfgn
SHA256 a693fff41c4e738cfa6b7f0e9bcf51ae341b276b81189fa698f0c0ede4a8a54e
MD5 0aa7defe6f32e1e2e024f62f72178af6
SHA1 d8d318688cbc73faac2adfd8609e110997ee2c68
SHA512 c8e0760d60495a2a9e8e7762132cdeba8ba535effbb58fdfc26fa3fb9b13404f92b7af85b54a185157b43bd5411d2d626048983f02b50cbf9610ce8aad570802
SSDEEP 393216:fvKurZfJU52CyQ59CZpTJFfLMSu3lu15+gsfNncYPpnDTYHN/HKpbQn5pRjq2Y5s:fvvZxky29C5VKY1P3YpD0VH9fFfiXc
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  Kiwi X/DiscordRPC.dll
- Size 79KB
- SHA256 6a18dfc8bdc6030787b5814c76b8663dbe5b8ca469beb65a2ca9f5731fa1906f
- MD5 ad463f573775c43a561ade842c41b0e8
- SHA1 e70e10a18a3ae85cd1ca9be66a7bb46d99ccccd3
- SHA512 0c790e70150148f4cc516cc9abcdf42a5b28a0785a61cd02ab7d59776df25eaeea287c98522d4b3271cae8bf35f98d91049c6474e81cc2745dc32a808832efe0
- SSDEEP 768:Jp+8VvNVQPCNRRUzpEqrK0V2Yct83YVhEbqoL/wDIijcJRM2S0B+mhx9HS4i6E4m:nVvNGP6U1bwueoRPMVo+mhxVS4i60
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Kiwi X/Kiwi X Bootstrapper.exe
- Size 178KB
- SHA256 4d819c0df101498676f943c688edcd812161be8e82fd2a1877b5690cd3679ca9
- MD5 9f07ff71a41d0707a88c679aeead9bc1
- SHA1 4c003b20f81fda703383c3751ac2bdeb41a57987
- SHA512 c1537f0050fd22edcbd5e47bf4c13754a9126ebe897a2be42d45e302e1dbad2da69af0487a3d2eb373184ddb1c682dbef27ddef616faf5f0c19bd566ae767d62
- SSDEEP 768:TIEJncjFwUuDtL1uogdqbYBKuv4+CdQpKEBy0lGtCvvApflHp+jEJOxCjZonIrjs:TmMmKzz3GMIh5
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  Kiwi X/KiwiAPI.dll
- Size 9KB
- SHA256 8229e7d6d60f2d7adcbe6fbf43125bd6db1ddb0ed1ed292abed532c4c59d1772
- MD5 8c77aea0a5007895eaf6a1bf858d1f7a
- SHA1 645b7a55f9aa13ffc8ea9921117df1784311c3d9
- SHA512 e69390824fcb7fe63987170b342a74950278eadae5a36538b95ba24f8d710f28adfb42dc419fd11f2aab3741aa7033624fbe73c5a78432809cc33b1c887b6a76
- SSDEEP 192:vOpRRMVtiAu0K/NTWjhdyFQOwFq19U02LrURyGCO:2pqlu1/xWzjOwFs9f6rDGL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Kiwi X/Microsoft.Web.WebView2.Core.dll
- Size 404KB
- SHA256 48067eff4963d35a62da51364f886adfe266461dcc49689d63af99e8fd38a0e2
- MD5 1475cf2b02eec671df896caa09c987ea
- SHA1 636ae4d95c4c6cb163bc43e65216d7ee95ceacdf
- SHA512 db4ea22771d8895f6fcef4dcd74682c6f6f145cf8336f9b139078f4fa2fa316f87351d1fcada8645e2eb7e0dffa6aad7a21da479d7918b73d1ee301b1fa2843b
- SSDEEP 12288:/AOCXrBI4wf1N2le1gcmK8i7P9pHjRFIEqGIEEIcgCeokpM1SaWLQNZ5tOSQsyuK:42
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  Kiwi X/Microsoft.Web.WebView2.WinForms.dll
- Size 33KB
- SHA256 20118f19f82f2594333aeecd2274d0f57a2655a2feee3050551ab3310ecd3ab0
- MD5 e6a6ac113347b3f8a12c8417984a751a
- SHA1 5f3acbe03cf04c13def8f043c26bb6726d8bc722
- SHA512 f0c28bc0fdf9db3e6866a24ef7dbd9226f8b6f8e61cbdb251dec1cc66b7b7616ef8f5b5d45ad60241e36a351d26fca49378e3689daee7f800076f568f0806c7d
- SSDEEP 768:XTFzTl1XWYTFePHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6Lsub4Oz3qLXA153:XTFPHXUPHZDgcE05P4JjrnawSosu71Jb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Kiwi X/Microsoft.Web.WebView2.Wpf.dll
- Size 38KB
- SHA256 277a57bd954aba3d99005632a2c9d8edfc70a7c902e6d46446a69e2ece8ac85c
- MD5 411ff5a99f51b076f9fe7bdd43dccb52
- SHA1 23ac0eeb9f31b4ead95a7c830b4a927a53add366
- SHA512 b6c80829fe84c41d6959d84e4f1f1a30d9b9bdcaba09ff77c1d19907138641f2b86abc875580d172716f9885743d7dd960b2ba8d33588920ad4e1f31cd987c10
- SSDEEP 768:szXGuETke7fYBCn1K8wDP/ryEH0mBO4JjrDXh2jUfUPLkq7FKKa5/Bi/hGvoAb0s:GX0t7CC1K8wDP/ryEH0mBO4JjrDXaUfj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  Kiwi X/Monaco/Monaco.html
- Size 6KB
- SHA256 c652c0edfd59d5644044049f723ad2d915685dfdb1ddf6841da498ca969eb12e
- MD5 ec05dbe07ad593f3c4eccc68d22c4558
- SHA1 7ab2bd63a8c0a421e27f2fa214c28ada9489a546
- SHA512 df2e364a22b263e00133ba7e0e667a9db3a0fa5d3a6fac3c44a1c9d78ef4ba694b742eb04031e67c5d305c427efe11ca5c8fe89d9e5152f1b32ed4580dcae538
- SSDEEP 192:wEod3PorvGym0Qp5keghKcCI2MCTJ3+NLSaPh/WCY/jt:ud3PoLTw5keghHwjt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  Kiwi X/Monaco/vs/base/worker/workerMain.js
- Size 149KB
- SHA256 bdf9433692a08851e13dd58504eef19f51bd2ec7241923a68edf5772e0e53af5
- MD5 27ead90c7702154755785e0e53398755
- SHA1 86b59485fe6f6ccb1805183fa75062a2ac1c859e
- SHA512 6829681575179c90bb7817b17feee60e7d44d8abb15264ab39d7f0edf95dd1d030b99c12b005c753cd786c26ce6f17ff09b058c16f3363596f785e386ef78e82
- SSDEEP 1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Kiwi X/Monaco/vs/basic-languages/bat/bat.js
- Size 2KB
- SHA256 9bca42394fe8922fec24b768eeb8ce04692de6fad82f9052d5b7e70f5c6b0f40
- MD5 4cb475399c4490eea41982dcd6d9653e
- SHA1 fc97d57206ff7fa1c89ff0fc9f6e2f04a20ea185
- SHA512 27eefe83cf38a7d784414d99b472f6fcd7e595691eb0f368254ba1f71aaf702840b62bf232c30c515a8fada234699fefeef496c0c24669cc158cb567227e4783
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  Kiwi X/Monaco/vs/basic-languages/coffee/coffee.js
- Size 3KB
- SHA256 e706c9f8e5c5a0cb01b2f4e4879ec34a050d6eb2a8840284eb7badd9d78099f9
- MD5 9d0c4ac1691eed0a480c3e9246490d29
- SHA1 38258864fd070c35cec6b68715d58771df9fe3e1
- SHA512 437a703607a9f0cb96ffb56312d149b95f596290591d14098c36d978b2e1fdba3c3712c9099923bc0a709c5c0ebd7eea868f63dfbcc69cdf5a9325b8a67006b6
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  Kiwi X/Monaco/vs/basic-languages/cpp/cpp.js
- Size 5KB
- SHA256 a7c2bea7ca3d9e203a3a286735945fe010c8f4f8d46620386ee8befc6a78b32b
- MD5 0a16509e6cd0155fb622e785cfe976c7
- SHA1 7afa7f823191c43d7a4bdd7d91577495de62c21a
- SHA512 2cbc48cb10c467561c6a84f59405e9c2f864640b3a21e6fe5cd14ad1a7ca5667b766b3c0511df26f28205dd17338a878bd1164a4f5875235a73214f3e4aeb49d
- SSDEEP 96:hFDMgRs/rbV1+gqVV1+/LVb9ZRC2seM6jjz13MwVcEghhb6Yw76wGcmvRBNIs:hZGrTOcVv5M61h8hSeiYL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  Kiwi X/Monaco/vs/basic-languages/csharp/csharp.js
- Size 4KB
- SHA256 6b3be9a86ee8e3202f51745d94d24cc1eefbcf7d9e6d94fbaf70146b084e835f
- MD5 f8f841d13c9220e15dcd6bc386b37ba2
- SHA1 2b8b7003820d19ed83afde98c845db5e3d5753f8
- SHA512 0b167865b8d7847792c80144e83bdf33655db6ecc0934bb3290f8b5793fee8168aeaf9d74b3541a9424c4f180aad496c2d8710e3847a5bf9d4b2c960ddea4ae5
- SSDEEP 96:hFDMgRsVx+rbV1+gqGV1+hmQuq1cBh8b7gj8/pLxb6J994wGcKU7dYIkI:hZi+rTtPsRXpw9SiKUJGI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  Kiwi X/Monaco/vs/basic-languages/csp/csp.js
- Size 1KB
- SHA256 4b5a5d7d50986b86b00833447e097c0f01a4388ce1765b48e7e371d06e3a4789
- MD5 22ada25d590811dcff4e5f5d698e583b
- SHA1 c43d4846967d5037ef05b102e49d1fbc54e45fbc
- SHA512 c8373ea0b78114f82e8bf027473f72ada0d8acd51623152a0072111d8b3b7d5ac310a1cc510c4e4cd2e97a7686db3c87b2da675fc910898bd11108e4b50ed189
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  Kiwi X/Monaco/vs/basic-languages/css/css.js
- Size 4KB
- SHA256 bd331fd3bd2c37b0c3150035325f163ac9266bf6d942310764815e676d856d91
- MD5 49ad30f1151cfd7a74677fdc6dd13da9
- SHA1 286d47f0a4cfa26da2e4d1f1317a8c87000bb5fc
- SHA512 7337706bfd5bd54938da0fba35e97f8e5780491c04b58d43fc6d905bd2dca92897f1ed8d48e42665f166da7684cc6e29a63ae73f8d3779a9feb97c397a642f0d
- SSDEEP 96:hFDMgRsozIq+q17qcq6V1+/aMj1cqTroIrqjKf8O3lzXY0Jc:hZzzv9VmjoOf8O39XbJc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  Kiwi X/Monaco/vs/basic-languages/dockerfile/dockerfile.js
- Size 2KB
- SHA256 65b86fc54e9b35d6cb84f01dfb905680dbcad6605757de1d6bca84e3029889af
- MD5 e32de981bdaf75e6ffb8fe40bc955a68
- SHA1 bef1af7b26ea01c987c7a6295bb7192d83a32068
- SHA512 a3eadd8c1389dff6c2c6e595efff69be3a573d01e4e16b8e4a8b28f63e4c48c9c439b5dd93666d81d703d1c6b5bf927cc8e47d04af270128095f0d579407c2f4
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  Kiwi X/Monaco/vs/basic-languages/fsharp/fsharp.js
- Size 3KB
- SHA256 1390079babc117d3f376735780d98f409f317eb4628d17106642c6933ea1da7f
- MD5 de122b3bc44a8714f386dc80282dcb12
- SHA1 06888a9b616993e9af9797cec64c6d419065f2cb
- SHA512 ab48f2e5bfa6ea0024530141bb5d35b9090ee0254a3e8f8b86fa36cc8c2fca8000a3caafcfffc1d83e21c488e1f1990c91f537290b54fbbca1d3c7be090dfba5
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32