General

  • Target

    KRNL.zip

  • Size

    20.0MB

  • MD5

    e28690cb2e62d65356eb198d61e48fd3

  • SHA1

    db711e924eb594f683eab59b51929619716ed775

  • SHA256

    fce6fa89970199da0247aa18f35681841db3090fc3e6d306a12b046f171932b0

  • SHA512

    d5e1a0332b3a1b03d768530e8162a204407d16ff5062c5f935f359d93a8e52767acc7ce7a9365610e2d6c2117f295c8792e1a02141302edf05eada2550485ce9

  • SSDEEP

    393216:5adokR/KPTsEGFgHsPsaATnHznfQejkT1PyB28JxmvrDsh6:5l1PeFgHwA3fQees28nmf

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Embeds OpenSSL 2 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

Files

  • KRNL.zip
    .zip
  • KRNL/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • KRNL/FastColoredTextBox.xml
    .xml
  • KRNL/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • KRNL/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/KRNL.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • KRNL/KRNL.exe.config
  • KRNL/KRNL.pdb
  • KRNL/Microsoft.Bcl.AsyncInterfaces.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/Microsoft.Bcl.AsyncInterfaces.xml
    .xml
  • KRNL/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/Newtonsoft.Json.xml
    .xml
  • KRNL/System.Buffers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.Buffers.xml
  • KRNL/System.CodeDom.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.CodeDom.xml
  • KRNL/System.Memory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.Memory.xml
  • KRNL/System.Numerics.Vectors.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.Numerics.Vectors.xml
  • KRNL/System.Runtime.CompilerServices.Unsafe.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.Runtime.CompilerServices.Unsafe.xml
  • KRNL/System.Threading.Tasks.Extensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.Threading.Tasks.Extensions.xml
  • KRNL/System.ValueTuple.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KRNL/System.ValueTuple.xml
    .xml
  • KRNL/Zeno.dll
    .dll windows:6 windows x64 arch:x64

    884b6766290b5f82a69fe5373715ef3f


    Headers

    Imports

    Exports

    Sections

  • KRNL/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    942c95c90660298c72e7ffe4c75ec2c1


    Headers

    Imports

    Exports

    Sections

  • KRNL/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • KRNL/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • KRNL/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • KRNL/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • KRNL/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • KRNL/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • KRNL/workspace/Speed Hub X
  • KRNL/workspace/Voidz_ZombieAttack/504035427.txt
  • KRNL/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • KRNL/zenoapi.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • KRNL/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections