c8ea8a8db01dbeaa566fd920a5cd5b87cbabbbf00fbe6d6de289aee6243fa2f5 | Triage

Sharing

General

Target

krnl.rar
Size

40.7MB
Sample

240901-d1f3aszgrl
MD5

9f141d7ec3a49cd6ed72e6131d082e9b
SHA1

3b62250036da9a0823e2beabe8d9a85ba17ea886
SHA256

c8ea8a8db01dbeaa566fd920a5cd5b87cbabbbf00fbe6d6de289aee6243fa2f5
SHA512

030a3d786deb8bd482cea5343cda97b3bcf037b067577f8adc7123977181d51e7a4c7e460bc6759bb0e01c4f0e7c6773b84a07822507991c307a1d04f485c59a
SSDEEP

786432:EF5iu38ScKk6VoB2ZvJE/PvMGFFRD4N+Dup0BLIIE+7KL0XHe:EJ3tcKk4BMFjD4cIIEjIHe

Score

3^/10

discovery execution

Malware Config

Targets

- Target
  
  krnl/krnl/Bunifu_UI_v1.52.dll
- Size
  
  219KB
- MD5
  
  5eca94d909f1ba4c5f3e35ac65a49076
- SHA1
  
  3b9cb69510887117844464a2cc711c06f2c3bd19
- SHA256
  
  de0e530d46c803d85b8aeb6d18816f1b09cb3dafefb5e19fdfa15c9f41e0f474
- SHA512
  
  257a33c748dfb617a7e2892310132fd4abf4384fb09c93a8ac3f609fd91353a4f3e326124ecc63b6041ac87cf4fcc17a8bdca312e0c851acd9c7a182247066ea
- SSDEEP
  
  6144:o1uzZh5rYAuBjtnkbxuzZ7Mg3i3hJtm4Fw2hHQHcHKaPUb:Ku1higb4zZR+9mcHX
Score

1^/10
behavioral1 behavioral2
- Target
  
  krnl/krnl/Monaco/base.txt
- Size
  
  132B
- MD5
  
  0d834904a252e1ab786f9637bef6819f
- SHA1
  
  f8fbbdc4d0c5ebdc4037b32183a7be3027541596
- SHA256
  
  dbe440c5dee6367ebca919886ffe593246e1e52618e4713373000c9fc77c87cc
- SHA512
  
  72a23e1ccacbaabbd65660b57fe4d9c6bf403f35f46bd439c171eb3682c805a387db25ac2206bb9a868b230aba38de38d25bb2102a2bda688ef7ab7ba67a0b42
Score

1^/10
behavioral3 behavioral4
- Target
  
  krnl/krnl/Monaco/debug.log
- Size
  
  152B
- MD5
  
  d856136d3cf5eada5bd7fe5de46861aa
- SHA1
  
  142959cad5044040aa5b01d526c2db2d52fa31da
- SHA256
  
  7babff1a45484ea83af354a3414d5592356866f86286e9b230bc0c38e4f1e307
- SHA512
  
  18ee6bd05b3be630c96e07f725cc94d1c9d5449d7a266054c9b231f10a1b1ea1af75ae499c9bdb79fb6bc9b53358be58dcd46ed6d63dbf210c6f35e54cd58745
Score

1^/10
behavioral5 behavioral6
- Target
  
  krnl/krnl/Monaco/globalns.txt
- Size
  
  220B
- MD5
  
  ba56c14634b7ae6fb585be396acf5f03
- SHA1
  
  8aa4125655cd48073b55c5ea892e5da734220bbc
- SHA256
  
  5cb987e7c87f2f04cdd45f3a474fb2380bbf846534e38f2b485eafc562b7b482
- SHA512
  
  46a904064080fa51e9071e11c44685cdeadf0cdabe5feb038a4a85f2141ef13d46bd0563016ea62e5b1ccb76995c71451f6ba958b5551c31d36231b8f436190f
Score

1^/10
behavioral7 behavioral8
- Target
  
  krnl/krnl/Monaco/vs/base/worker/workerMain.js
- Size
  
  149KB
- MD5
  
  27ead90c7702154755785e0e53398755
- SHA1
  
  86b59485fe6f6ccb1805183fa75062a2ac1c859e
- SHA256
  
  bdf9433692a08851e13dd58504eef19f51bd2ec7241923a68edf5772e0e53af5
- SHA512
  
  6829681575179c90bb7817b17feee60e7d44d8abb15264ab39d7f0edf95dd1d030b99c12b005c753cd786c26ce6f17ff09b058c16f3363596f785e386ef78e82
- SSDEEP
  
  1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  krnl/krnl/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
- Size
  
  20KB
- MD5
  
  649fb0a55b0e0fc9d79e6b7872a14c10
- SHA1
  
  b33619c9dfd65d3f2e5a5fcb767a752123d51607
- SHA256
  
  fcc3026b97068f3d9e1743d36ca26b96ffdbcd2841fa9d804caccc4f249911c8
- SHA512
  
  3fb4b07e9313b69c84f887c9ca0464e4c8d06a98a8f2ad7d0b48452d068bd526004c21633d0279b4b5e17ad882acf8c7e99b4c3e7650be43b495b670a87d0cbd
- SSDEEP
  
  384:cyPJZCcKWPJuCNoSmvcar1PNY6g2HdSjEc3/WD3:DCdCNkvcaQ6x9SjES/W7
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  krnl/krnl/Monaco/vs/language/css/cssMode.js
- Size
  
  21KB
- MD5
  
  40a99739f89d382c92eb26f05a9a4497
- SHA1
  
  30e6c52658f49bf5c6103a95d1c3ed50d71b02f2
- SHA256
  
  d3108af9ffcdad3133345686646cafe3b628ad6b25a3758786b2aa7b7b51809d
- SHA512
  
  9011557bc41865dc6b44495174ea2f27c700e95dabdaa67d8bdd4b798a367a29cea91def2171c5176160f5791d7bfcc2cd65b58db4ded721ed2868e4198049e7
- SSDEEP
  
  384:h1kwG9aih9phed6ZwRVwCs8fTxUfyP0sYrkoJWMGIk8:aQih9pwd6KsuTxUfyFikkWMGC
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  krnl/krnl/Monaco/vs/language/css/cssWorker.js
- Size
  
  489KB
- MD5
  
  152244e2ab4f663141e9466a8282ebe8
- SHA1
  
  e9c0e86fbc108600d3e42a6654c5de073607ddce
- SHA256
  
  288bb68a2c685957b5dc3e5353b1a03dc482b10858059063b99c1549d5fef01c
- SHA512
  
  112039647883a1cdb6a860ce1d2980562222b593508da1ea8c9838b7184e76f72de9eb68d2727ce12c78e3c0be7e85101591df6ebde1e73dcf8c2495c8454855
- SSDEEP
  
  6144:PhKjqIze+tAxt+A7zOM1L0G52ppgGDcoFGPL2gXwiOcFt+oiEipHxJKnVZPUsf:IqkA7zO/pUIPsf
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  krnl/krnl/Monaco/vs/language/html/htmlMode.js
- Size
  
  18KB
- MD5
  
  c944ad9527d22b6ca6c0d54fd0723296
- SHA1
  
  ddfb323ded66de709fa8b05abe0ada931ac9dd43
- SHA256
  
  80d6f099563af129b4deff66f7b9d4dfb27ad0058dcb5b77d927e460022dafee
- SHA512
  
  3a6abb3a15401d28e4926ac008f991b7a19b359c8420d7e5bb6804061b6f82a2bedfb86823862e1ccfbc046e896cb1a5759199f7e723fd7b1b5e6aeb19f92f58
- SSDEEP
  
  192:hA6ZF2Cw7DrFcelxzEKfxmflhyLpYvws8edvt9vKVwZVtDFzp6RMSyotuK1sD5Sv:hJw7DTfAlhCpvedmw+MS+KOD5Sc7Pzo
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  krnl/krnl/Monaco/vs/language/html/htmlWorker.js
- Size
  
  154KB
- MD5
  
  3f5802a91a29e4504d5cd2f10ac280b8
- SHA1
  
  368d01e59eaf25f164ab1d80b7f5d74b625b242d
- SHA256
  
  e80444d8fa519ff86e5c696a40843bc8392b2d3afb83118a2dd92da5497c9212
- SHA512
  
  2f3670227710c291e5e9136b2cac5c70421c2537b86219fe17ed33161136a08f5cb2069822b16a58ce377b6d1a265cf33215a1695bda5a701bae566410ce33e7
- SSDEEP
  
  3072:wNxSv2ym9FNq9m8iktJFu/TgHdcyDnLEOhUm3xSvp:wNxSv2ym9FNimBmFu/TgHdcgnLEOhUmE
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  krnl/krnl/Monaco/vs/language/json/jsonMode.js
- Size
  
  38KB
- MD5
  
  44955b6c43b7aac58492233efeeb70ad
- SHA1
  
  528b1f0d8ebce7a607c008aa66a1d0ecd903d3d3
- SHA256
  
  08af59e449f6c058514bf05c54511ee6ec83934ab9dc3e803257196b2812e8ae
- SHA512
  
  5a86921260ae9f87eb134513809231c9b512200cd2f330df37a098124db0da8c8bcef5dc668875e21328ce9a6c79440811dbbc3371147690c71d31b97745666e
- SSDEEP
  
  768:ghT0rpM0GwBsUWdD5Sw7NibC2FyGf5Zot3OYoHAymtVoQvafg+HfNc75eEWAdy0h:gyM0GwBeD5jhiA3B7VjIQfdy0h
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  krnl/krnl/Monaco/vs/language/json/jsonWorker.js
- Size
  
  99KB
- MD5
  
  61e9b732bedc39b547804ac7e8897aab
- SHA1
  
  187cba5fbd9c31257119dde24a28573b4973ef5c
- SHA256
  
  7c6d37bb341cf59335f6a3e5e336d0de863124fa40a8f9b5f29d8da07891b649
- SHA512
  
  200e32143bbcda809b0003298aa561ebb27509d309168de81ad8529476ab64caee0502b9fe0b513469c21b82edb421b642183a250d2ba4d65c74ba4c1cbe39dc
- SSDEEP
  
  1536:rIAGGhzNFVAg0Edqq6L05i4Xw9dA+IKFt:cRyzNFV5jXOA+IKT
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  krnl/krnl/Monaco/vs/language/typescript/lib/typescriptServices.js
- Size
  
  1.6MB
- MD5
  
  0a1a293455f5451ba11e07386ea62d4f
- SHA1
  
  d6a43c68812a3dcddc2973db3f2dd8a6b0e45f1e
- SHA256
  
  90e98063c644749a948edd5a7801f7b00c554e3189fe7c2811926b01eaf1b41f
- SHA512
  
  1674e2ad75c53f99475743618ec59d90ce8eb262131c15daead963ecb847cb70278a6d4608c66710c3cd5e92e03b5552a05401b6b008184dbf892683b27ca34a
- SSDEEP
  
  49152:G6qR6wZ7g2oZNDR3Oy4mtYsT2ACKRRrcLHd5:W61/4mTy
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  krnl/krnl/Monaco/vs/language/typescript/tsMode.js
- Size
  
  19KB
- MD5
  
  8c1a82479c380d2b2c6b096e12ee9632
- SHA1
  
  78e429dd4a9279267679423ddb0b6d06c11172ac
- SHA256
  
  70957c5ede2834adf1b5bc264e119f82b4e8e6c169fc8ff140d637d1c5287bd9
- SHA512
  
  409c8724ecfa045a7563b5c142ef0a107bffe126140bcbe5202dad59b9ba5ec0db91c74c77d5a60be92110b9d0c942fac61a782ee30a4288774f547f303e1c4a
- SSDEEP
  
  384:hgFzm27hrrEZAmdHpjHenNvaOm/6xS1oTEXx3KjFRMqxRh2l3eBVq1A8WKm3d5vp:2FyHhzHenNvaF6xCoSx3KjFqqxL21eBp
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  krnl/krnl/Monaco/vs/language/typescript/tsWorker.js
- Size
  
  1.7MB
- MD5
  
  1e0047691c3637ad1e0da62023ba0e0d
- SHA1
  
  64902c923c2194e007bc727f7ea4f30b3a796dab
- SHA256
  
  2ccc6b6b1b5d884fe8df3e7b2f2bacca0c4529b68bbfe3c547fcc74f204cc5d1
- SHA512
  
  c1bef7bfd60acfcfb206b9631f8a730b787e94101d519d157d346d8377104d1302c0e9853ba2db944d63f03b181511950b9ea25dd21e41f40b4aeba4bc44c0c8
- SSDEEP
  
  24576:pQIJc020hIvUjQQ0s2oI4Q0s2oI4QIJc020hIvUjQQ0s2oI4Q0s2oIq:Qo3MfgfHo3Mfgfq
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  krnl/krnl/Newtonsoft.Json.xml
- Size
  
  489KB
- MD5
  
  edea00514ddedc60736475ebb6d7e8d0
- SHA1
  
  9941062bc3a62bc6bbe4be9fd2c3817d769312b3
- SHA256
  
  2c3fafc94275ffb1b5f37891c452285e1fe7797cf02371def687627903dc4fde
- SHA512
  
  ddb912ef462e052f50db8903f5d2c8eddfe8fd1a14b635862b499b751ca5027f2c0098b6ac1c285acf52665c33ab70dec3435bd4c7bfb3387add65d4e3b443eb
- SSDEEP
  
  6144:/Gkf3fW1Nt0/IhSBVIeR0R+CRFo9Tt82mafmKj+spjoqoyO185QyMYFLsgfl4:6
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32