Overview

overview

10

Static

static

3

JJSploit_8...up.exe

windows11-21h2-x64

10

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

JJSploit.dll

windows11-21h2-x64

1

JJSploit.exe

windows11-21h2-x64

6

libcrypto-3-x64.dll

windows11-21h2-x64

1

libssl-3-x64.dll

windows11-21h2-x64

1

resources/...bot.js

windows11-21h2-x64

3

resources/...lip.js

windows11-21h2-x64

3

uninstall.exe

windows11-21h2-x64

7

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

xxhash.dll

windows11-21h2-x64

1

zstd.dll

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JJSploit_8.4.1_x64-setup.exe

  • Size

    6.0MB

  • Sample

    240913-xvm37stgmg

  • MD5

    6818667184b5932f3e4f554ed1075fe8

  • SHA1

    59a7a5715bf48d4346eaa4a5ce93a87e15adac71

  • SHA256

    fe43c0daebace84ed84884b877150d609199c13d0ba9254d35a0d305f4f42440

  • SHA512

    4b3a900472b204134d8c9f0ca82b78390ae92557594ed65c514c79664e82fcb9f587fed8a790cee1b6497eb616c4d4dcdcbb5d19de1c6fde01223dadfbd9f665

  • SSDEEP

    98304:hvalq0dd99Dq3NpHBJr0ouJTSZoaSnVgMzB3xxiBx49q5kQFOTW7nVCU+Osgnt6o:hS7d3InhJr0ouRIobnVgMz79AKCeOKrU

Score
10/10
discoveryexecution

Malware Config

Targets

    • Target

      JJSploit_8.4.1_x64-setup.exe

    • Size

      6.0MB

    • MD5

      6818667184b5932f3e4f554ed1075fe8

    • SHA1

      59a7a5715bf48d4346eaa4a5ce93a87e15adac71

    • SHA256

      fe43c0daebace84ed84884b877150d609199c13d0ba9254d35a0d305f4f42440

    • SHA512

      4b3a900472b204134d8c9f0ca82b78390ae92557594ed65c514c79664e82fcb9f587fed8a790cee1b6497eb616c4d4dcdcbb5d19de1c6fde01223dadfbd9f665

    • SSDEEP

      98304:hvalq0dd99Dq3NpHBJr0ouJTSZoaSnVgMzB3xxiBx49q5kQFOTW7nVCU+Osgnt6o:hS7d3InhJr0ouRIobnVgMz79AKCeOKrU

    Score
    10/10
    discovery

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      15KB

    • MD5

      ee68463fed225c5c98d800bdbd205598

    • SHA1

      306364af624de3028e2078c4d8c234fa497bd723

    • SHA256

      419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

    • SHA512

      b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

    • SSDEEP

      384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij

    Score
    3/10
    discovery
    behavioral2

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      d070f3275df715bf3708beff2c6c307d

    • SHA1

      93d3725801e07303e9727c4369e19fd139e69023

    • SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

    • SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • SSDEEP

      96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI

    Score
    3/10
    discovery
    behavioral3

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral4

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      6c3f8c94d0727894d706940a8a980543

    • SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    • SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    • SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    • SSDEEP

      96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

    Score
    3/10
    discovery
    behavioral5

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      8def0196223484f8aed4106148dd3f08

    • SHA1

      e0fc0951deb0e5e741df10328f95c7d6678ad3aa

    • SHA256

      c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

    • SHA512

      9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

    • SSDEEP

      768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q

    Score
    3/10
    discovery
    behavioral6

    • Target

      JJSploit.dll

    • Size

      917KB

    • MD5

      bab4ba8054e72fad860ec73e71621cf8

    • SHA1

      f74e7eec682a462e84aca555074ec8d3b6ff9ee3

    • SHA256

      ae154641180eea7abf177bc6317e6dce2da9f94eb654b0f16ffa7b0125dc1299

    • SHA512

      9d9b23e9e2d88e5ba85bd6998ffe1c2e0f63417ac7407888e1dd531cfde11f87ffc3c6f5ae5b2fbb72a0bc2e4de3f2311fae11ea8bd60f7952681e5702fe488f

    • SSDEEP

      12288:xTAzUBUDh2aRLEuoVKUZhLs/0cUoaR0tdqKVbB+qbZQeN4KkCJF:xMhDAaNE1RabUoaR0XqacqOeN4KkiF

    Score
    1/10
    behavioral7

    • Target

      JJSploit.exe

    • Size

      10.4MB

    • MD5

      b3d9dd590aca552fa889ada909282a72

    • SHA1

      5e7344ee001b4cf541f539f1c3ddc4cbcd39bdc6

    • SHA256

      601a6721f634bf8c81633679f9692b3396d091cfde58e9f84b9065e0c0ce5528

    • SHA512

      59a9e131b16dd93d31684b78ccdd114fc90ff447f537d5e73fed41bd18698747d1971a214b79ba5402bcb8ae5d4452ca998377e90e4f2e168c595717c831f815

    • SSDEEP

      98304:Y8IRb5LYIiHue/DN/1mGs0ITIEC3+a99bUHpMSr7uIMC4gCI3D7:YXmIy1Gs9bUr7hMwD7

    Score
    6/10
    discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral8

    • Target

      libcrypto-3-x64.dll

    • Size

      4.5MB

    • MD5

      a9c1f7ca15c65c139bc9d4bf57df2e1e

    • SHA1

      1b1377139a6b289d43a6b1161cd1089ffc817cf9

    • SHA256

      03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116

    • SHA512

      97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073

    • SSDEEP

      98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC

    Score
    1/10
    behavioral9

    • Target

      libssl-3-x64.dll

    • Size

      802KB

    • MD5

      51b0d5f42a82f6fa8739b403e9b8b81c

    • SHA1

      75968c157628bb7aca9b5f2331f7a0c9a1d28865

    • SHA256

      0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b

    • SHA512

      94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814

    • SSDEEP

      12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S

    Score
    1/10
    behavioral10

    • Target

      resources/luascripts/general/aimbot.lua

    • Size

      80KB

    • MD5

      54bcd5aeabefcf23be6cd1c2a96ceea7

    • SHA1

      82e5906ed450085146a56df499c9239a66f9bfce

    • SHA256

      c7e9f86ae5fe8787b3e690e13b463b00fe5d56aff2c1ed029c64183aec48db34

    • SHA512

      ca52d63420acd2aa9b704554f79dbe039266a3a0ba1165e9d16d8259665c82d8c91ee97b6a0bcdff524677bedb86a7d91012363a60188807dcc02faa4a8d6372

    • SSDEEP

      1536:vKnVOB5LmvK0d9DQ2JjYhOFW3ajLCSCtWT0y:voO92HFW+LCSM6

    Score
    3/10
    execution
    behavioral11

    • Target

      resources/luascripts/general/noclip.lua

    • Size

      1KB

    • MD5

      d6a6ee15ae62c9922ebfa6db81263288

    • SHA1

      0e3526210d72a9a4da4591095ad797933a02b7a3

    • SHA256

      9f4efc279d94977f92bd52165dfda141a43aff9149e044ed44742f7ef39cfe4f

    • SHA512

      c1faea983c3b6bd7372195a65184c2a93d9703dff06aebbe62d05c731866cb325f85afa915334e5f49f1bdf38fe91e3df86c7eb0913a215b6b1764fb3d2b17bf

    Score
    3/10
    execution
    behavioral12

    • Target

      uninstall.exe

    • Size

      74KB

    • MD5

      fdf00717b4f5176657ac0e62f99703ce

    • SHA1

      403031d95efec48693e5183755125a6b9f22b5c2

    • SHA256

      7bcbd9bab2c8fc7e34e621a5b1f5cd20afde316d06b4a555de203fe76e1a1301

    • SHA512

      3a3559a82565a7597a218fdd88a364608a4e22d87ce43ed78073f0adb648d4d3e829f0a07e5a9a0106225cac0265ce45939492ce1af7e0cab2cc8bab6b72c4cd

    • SSDEEP

      1536:XmsAYBdTU9fEAIS2PEtuugdLeAyNxi7GlSK8KPKVfJcql:WfY/TU9fE9PEtuuceA7sS3pVfWql

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral13

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      68b287f4067ba013e34a1339afdb1ea8

    • SHA1

      45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    • SHA256

      18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    • SHA512

      06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    • SSDEEP

      48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L

    Score
    3/10
    discovery
    behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral15

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      8def0196223484f8aed4106148dd3f08

    • SHA1

      e0fc0951deb0e5e741df10328f95c7d6678ad3aa

    • SHA256

      c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

    • SHA512

      9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

    • SSDEEP

      768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q

    Score
    3/10
    discovery
    behavioral16

    • Target

      xxhash.dll

    • Size

      46KB

    • MD5

      249a5f6ca047df2a2f802782696c7f80

    • SHA1

      6a1d96be0f497d689fb55de70284af83cac61f52

    • SHA256

      2828e3014c3283caeb1b00d14145a42f4e347e7f547b40634540394892265671

    • SHA512

      d2d0b6ba2ec95c33609d98788e5a4cce382d93721ea5dea61cde3f4c065b06530a0b01ae4909f7883a81d55529a36cb6a5820aa2afc320b5761f6f59a3a45f1f

    • SSDEEP

      768:zziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3QimeSyygGz1K:zziR74kgDn2rDRuIrN5mAvgbTgi3SylI

    Score
    1/10
    behavioral17

    • Target

      zstd.dll

    • Size

      638KB

    • MD5

      21dfe873f6ed38f2f713ecd43ad1ba41

    • SHA1

      7648cb043587da0e85743f9da8dca8be621ccdf0

    • SHA256

      2a2d63c48b6b3ac7768231ade30122c94a0a33e62e5d2725e11c95b3194aa997

    • SHA512

      67b4f976f3511387ce2a4743e2281ac88533bd204d4e07a5c6751f0ec30a3463dfabcda18103a632541ec2a8b7b937806121e21e44959411c39106e22b739919

    • SSDEEP

      6144:XbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4eTTzp:XbauYGT5BYMxjDHMk0petRCEyb9emHW

    Score
    1/10
    behavioral18

MITRE ATT&CK Enterprise v15

Tasks