Overview

overview

8

Static

static

3

KinitoPET-...in.zip

windows11-21h2-x64

8

KinitoPET-...al.png

windows11-21h2-x64

3

KinitoPET-...l2.png

windows11-21h2-x64

3

KinitoPET-...it.mp3

windows11-21h2-x64

6

KinitoPET-...on.exe

windows11-21h2-x64

1

KinitoPET-...te.dll

windows11-21h2-x64

3

KinitoPET-.../1.png

windows11-21h2-x64

3

KinitoPET-...10.png

windows11-21h2-x64

3

KinitoPET-.../2.png

windows11-21h2-x64

3

KinitoPET-.../3.png

windows11-21h2-x64

3

KinitoPET-.../4.png

windows11-21h2-x64

3

KinitoPET-.../5.png

windows11-21h2-x64

3

KinitoPET-.../6.png

windows11-21h2-x64

3

KinitoPET-.../7.png

windows11-21h2-x64

3

KinitoPET-.../8.png

windows11-21h2-x64

3

KinitoPET-.../9.png

windows11-21h2-x64

3

KinitoPET-...ep.png

windows11-21h2-x64

3

KinitoPET-...p1.png

windows11-21h2-x64

3

KinitoPET-...p2.png

windows11-21h2-x64

3

KinitoPET-...p3.png

windows11-21h2-x64

3

KinitoPET-...ng.mp3

windows11-21h2-x64

6

KinitoPET-...ng.mp3

windows11-21h2-x64

6

KinitoPET-...rf.mp3

windows11-21h2-x64

1

KinitoPET-...ng.png

windows11-21h2-x64

3

KinitoPET-...g2.png

windows11-21h2-x64

3

KinitoPET-...er.mp3

windows11-21h2-x64

6

KinitoPET-...ne.mp3

windows11-21h2-x64

6

KinitoPET-...sh.mp3

windows11-21h2-x64

6

KinitoPET-...ito.py

windows11-21h2-x64

3

KinitoPET-...DME.md

windows11-21h2-x64

3

KinitoPET-...pi.exe

windows11-21h2-x64

7

KinitoPET-...ua.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    KinitoPET-Python-Virtual-Assistant-main.zip
  • Size 3.3MB
  • Sample240402-ppdnkshg9s
  • SHA256 8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitdiscoveryexploitpersistence

Malware Config

Targets

    • Target
      KinitoPET-Python-Virtual-Assistant-main.zip
    • Size 3.3MB
    • SHA256 8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    bootkitdiscoveryexploitpersistence

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/KinitoNormal.png
    • Size 5KB
    • SHA256 39ac3e378886e4e9997d088aa8448ad8f849e8d529acb3ffb57516bad77d82d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral2
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/KinitoNormal2.png
    • Size 5KB
    • SHA256 88c31125e72b9a2eaa9c2cc583c1b4a84c76ae3e24bda4daf13765007b65888f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/NewBeginningsPoemEdit.mp3
    • Size 642KB
    • SHA256 c3ba0be555dc858856700997715ba87032ee68f887f25d44da6178ae47282d45
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral4
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Programs/balcon.exe
    • Size 1.2MB
    • SHA256 2ec1945187eeb07aa27052db2e60139bbeb3bf81f8ba549c4a2360363ab4338e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Programs/libsamplerate.dll
    • Size 128KB
    • SHA256 01bb04ec2d815ce30a5b4d9edcada479461d3de31c78532468c398bc4c328505
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral6
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/1.png
    • Size 18KB
    • SHA256 fabd27e031633e7cf497b1dd9e2cbba3a4ae98b7744f36a4db48f3b33592095c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/10.png
    • Size 16KB
    • SHA256 af2fa99c9dcd286b90657236fdde6c1a232ff22828522acddf64e0209f1c7f1c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral8
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/2.png
    • Size 17KB
    • SHA256 f1f8294b4582ea900e56f784f7d7d6ee007f37cb973805e8bbc9d1bf24546976
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral9
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/3.png
    • Size 33KB
    • SHA256 d509436190c6c866357c78bd8022ace18a0d8654f250e17c209ccfb5028e8ffb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/4.png
    • Size 28KB
    • SHA256 20009dcfd6433acf2d743e169751a3215b65cbc0fd23a07001857f73d98fbee7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/5.png
    • Size 21KB
    • SHA256 30734d511a1c6fb0074ea7462e88d3e59c8379205496b9d6f7875296d8855abf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral12
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/6.png
    • Size 16KB
    • SHA256 67bd979d88fa8b12e9e4fa07194934ada8fc3a7a731e6b72ee48b7a544f1d3d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/7.png
    • Size 15KB
    • SHA256 aeb393e9eb2f43190e406c7e3a4bbdbebee65ecde750b1cf9d9c7e6dce8ba6b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral14
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/8.png
    • Size 12KB
    • SHA256 8fe6464de8d61ab49bc3eae49841616c2c48d52d25b2d25f9ba1d1d318c33621
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/SecretImages/9.png
    • Size 12KB
    • SHA256 0a63b27b6bceab3fb699bcd9b29d57026b5c0a42de12783558b2c56f278bfa40
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral16
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Sleep.png
    • Size 8KB
    • SHA256 d9713f0951c0d86aa1e08387f3981cab317401c0b7c9f8c0e315eed76edebfaa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Sleep1.png
    • Size 9KB
    • SHA256 2e5c249637261d94829c7a401f3f2c1b59efcc5f577715bd6de345136ee85cee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral18
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Sleep2.png
    • Size 9KB
    • SHA256 82114f440cf9c41e4c72d592fda3829fae8dc444233168021ca8d1b917e86406
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral19
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Sleep3.png
    • Size 9KB
    • SHA256 4ce7e3208d8745d0fab801c09a03f2ca5ed6e2008de5d49d8e389dc398d31d89
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral20
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/StartTalking.mp3
    • Size 4KB
    • SHA256 29cd6ba81774486f70ce59375bd499a361f018914888dc50c0c57121019063b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/StopTalking.mp3
    • Size 6KB
    • SHA256 01cea86512d34217363c1fc63f6313b69bf47158b39d10d3a8848f9b8f2ad53f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral22
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Surf.mp3
    • Size 16KB
    • SHA256 0b1306e5992aa0a87f4a76ac46fb7bfa60a8025071204385875bba5536752c7a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Thinking.png
    • Size 8KB
    • SHA256 0d76cf17e39e28331331095ea2a892276a5c56229be42905483e72fdaaf05624
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral24
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Thinking2.png
    • Size 8KB
    • SHA256 2b77747340671d46e2abe70eacef4f69270c53a9fd9ff3cbfa3bf8eb38f2448f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral25
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Timer.mp3
    • Size 69KB
    • SHA256 cc94cd99b9ddbb564d01123c6f6d68c207a41cfe5d08268bdce6a2586c0de63a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral26
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/TinyTune.mp3
    • Size 20KB
    • SHA256 7085e4b12ebf87ce54ad58ae83ef408b5be737584b93b1273406549ff85b00a1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral27
    • Target
      KinitoPET-Python-Virtual-Assistant-main/GameAssets/Woosh.mp3
    • Size 16KB
    • SHA256 ba708905a9052e94a98ca1190fecb6582a165691e96a29965debd6321ddd15ec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral28
    • Target
      KinitoPET-Python-Virtual-Assistant-main/Kinito.py
    • Size 39KB
    • SHA256 4a10afda7531078148fd68455724bb9f95557f467aa5740be66fc4aa0bee8eef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral29
    • Target
      KinitoPET-Python-Virtual-Assistant-main/README.md
    • Size 175B
    • SHA256 9e99eaf3ab94586004f996017758fe4ac9ae810107d4f2f235c8eee63ce44cd4
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral30
    • Target
      KinitoPET-Python-Virtual-Assistant-main/spchapi.exe
    • Size 824KB
    • SHA256 8955ee03217bc2539e2f80e58f51d30aa97e7512d96592f098133c8036e363dd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Loads dropped DLL

    behavioral31
    • Target
      KinitoPET-Python-Virtual-Assistant-main/tv_enua.exe
    • Size 997KB
    • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoverypersistence

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoveryexploitpersistence
Score
8/10

behavioral2

Score
3/10

behavioral3

Score
3/10

behavioral4

Score
6/10

behavioral5

Score
1/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
6/10

behavioral22

Score
6/10

behavioral23

Score
1/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
6/10

behavioral27

Score
6/10

behavioral28

Score
6/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
7/10

behavioral32

discoverypersistence
Score
8/10