Overview

overview

6

Static

static

3

KRLN/Bunif....3.dll

windows7-x64

1

KRLN/Bunif....3.dll

windows10-2004-x64

1

KRLN/KRNL Remake.exe

windows7-x64

6

KRLN/KRNL Remake.exe

windows10-2004-x64

6

KRLN/Visua...ol.dll

windows7-x64

1

KRLN/Visua...ol.dll

windows10-2004-x64

1

KRLN/bin/M...o.html

windows7-x64

3

KRLN/bin/M...o.html

windows10-2004-x64

3

KRLN/bin/M...ain.js

windows7-x64

3

KRLN/bin/M...ain.js

windows10-2004-x64

3

KRLN/bin/M...lua.js

windows7-x64

3

KRLN/bin/M...lua.js

windows10-2004-x64

3

KRLN/bin/M...ain.js

windows7-x64

3

KRLN/bin/M...ain.js

windows10-2004-x64

3

KRLN/bin/M....de.js

windows7-x64

3

KRLN/bin/M....de.js

windows10-2004-x64

3

KRLN/bin/M....es.js

windows7-x64

3

KRLN/bin/M....es.js

windows10-2004-x64

3

KRLN/bin/M....fr.js

windows7-x64

3

KRLN/bin/M....fr.js

windows10-2004-x64

3

KRLN/bin/M....it.js

windows7-x64

3

KRLN/bin/M....it.js

windows10-2004-x64

3

KRLN/bin/M....ja.js

windows7-x64

3

KRLN/bin/M....ja.js

windows10-2004-x64

3

KRLN/bin/M...nls.js

windows7-x64

3

KRLN/bin/M...nls.js

windows10-2004-x64

3

KRLN/bin/M....ko.js

windows7-x64

3

KRLN/bin/M....ko.js

windows10-2004-x64

3

KRLN/bin/M....ru.js

windows7-x64

3

KRLN/bin/M....ru.js

windows10-2004-x64

3

KRLN/bin/M...-cn.js

windows7-x64

3

KRLN/bin/M...-cn.js

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KRLN.zip

  • Size

    3.6MB

  • Sample

    241021-1h6lkayang

  • MD5

    29268f196f39df2bb11029a5a79ba30d

  • SHA1

    a0a9af7e3d4f5158d3a6664dd5cace894ac2fdd9

  • SHA256

    96a2c02c92ab985233d04134b496252530282c745f3a142a359878cacd2a9025

  • SHA512

    04eb37b2ecd7f2b454cb470c45bc4fb38fae2d16189246d5c9ee9a413ad6b33b42eb1f14ee3bcd21d7565ae6c7380f6ca680c18f0285a7857d06332a867dafe5

  • SSDEEP

    98304:y+unxDDcESW42uVdTWjPEG4tRZD+/vlL4zS3yhO59f1m:/uDNqhkPyHh+/vlL4+zT1m

Score
6/10
discoveryexecution

Malware Config

Targets

    • Target

      KRLN/Bunifu_UI_v1.5.3.dll

    • Size

      236KB

    • MD5

      2ecb51ab00c5f340380ecf849291dbcf

    • SHA1

      1a4dffbce2a4ce65495ed79eab42a4da3b660931

    • SHA256

      f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    • SHA512

      e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

    • SSDEEP

      6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG

    Score
    1/10
    behavioral1behavioral2

    • Target

      KRLN/KRNL Remake.exe

    • Size

      506KB

    • MD5

      e827bd09934709f4955b0e7ea4509ae7

    • SHA1

      4c7364758d5891c10fd603cbf104b0e9413ff4b1

    • SHA256

      2ffc609f2556ed208c7aea6e4217c9c1e337e4004c1c0981bf455953d0b8a34e

    • SHA512

      e17d5a319d5e6725297bf95683aad15dd72604c0d70b6bf4a438cb07ac6fec8c5dd42209961f0ebaf14fbd64735569f25092f7df1a50b43bd8c6d121decfa55f

    • SSDEEP

      3072:vfTc9bvGjdh559dJ12QcVXqLRY3pClghBCWyyCzn8sZL3l4gxHC2E+JQLujdX:v8GvL9d2VaLa3pClghtyV8sug5Iu

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

    • Target

      KRLN/VisualStudioTabControl.dll

    • Size

      12KB

    • MD5

      365be8c17e1cce92c530abaf16d4c709

    • SHA1

      a4c1f9cf40408c42a0865806b28c7552b0ba91f0

    • SHA256

      af6815d815f4dfa21bd7ea9c0386b18359363478adc277870cf99577d9f5bba0

    • SHA512

      532f246fc72d9f65936eaf8dc0e77d91b3d0f5070de1f5971d889232b1905a56f1dbccf896a9ebdafe268b9b9d34a91ea78904c92fdcca440e19d77134327c5c

    • SSDEEP

      192:ap9gZJpVFf27JZE/3FaXIDbZHs3eJ/PCYOaPlgORNQEFKfyfPatuBsboFSOIP:S9gD8IDbptJ/7Oa7RNQTfCatumboIFP

    Score
    1/10
    behavioral5behavioral6

    • Target

      KRLN/bin/Monaco/Monaco.html

    • Size

      8KB

    • MD5

      f872d6bb3d3364428db47e8db7050d43

    • SHA1

      09a9e61766c76f85c67a4074c1fe09ff1c52ef50

    • SHA256

      0f4292152a1f55a75e7de8a5def919a7ddacfb9a774fd02c4b82c8fa99715e96

    • SHA512

      b3d13da196123cd0315eace2b779a38353c7f4b5e5c3c2ea9bcb85200aa2bb47778774d77274a86e59508a60076101a39ff6c351f748b824a2c68383293ddfd6

    • SSDEEP

      192:wFJd3PorvFv5puv2tp5keghKtCI2MCTJ3+NLSaPh/WCY/juaajIlB:kd3Poh5pPv5keghuwjNajIlB

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      KRLN/bin/Monaco/vs/base/worker/workerMain.js

    • Size

      149KB

    • MD5

      27ead90c7702154755785e0e53398755

    • SHA1

      86b59485fe6f6ccb1805183fa75062a2ac1c859e

    • SHA256

      bdf9433692a08851e13dd58504eef19f51bd2ec7241923a68edf5772e0e53af5

    • SHA512

      6829681575179c90bb7817b17feee60e7d44d8abb15264ab39d7f0edf95dd1d030b99c12b005c753cd786c26ce6f17ff09b058c16f3363596f785e386ef78e82

    • SSDEEP

      1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      KRLN/bin/Monaco/vs/basic-languages/lua/lua.js

    • Size

      8KB

    • MD5

      9cf08ada63c048e4e38c8816409ed958

    • SHA1

      75a2564071cb1ff7c160d6ed385b9c32ed8a45df

    • SHA256

      c171352021b601d49147f9c8a8b241ca0d8e905f79937164ac824ad2ff3f9ccc

    • SHA512

      636e25d27ecd211b535845c7f7e5b546a5f50ccfa5d321d37fac0a155b6a001047f86bb5e514ee138efb82b88da6c3e4ea3db2a0bcf4918a274c9ff33145dd34

    • SSDEEP

      96:SD3yDUnHWD5dyVLY7SvEFR88iqIZkQBZZMP4etFbhBuMCL8CvcOAtOfxBVkxMZlT:nDGHydyNY7SsfkFedmUtOfxQxjE

    Score
    3/10
    execution
    behavioral11behavioral12

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.js

    • Size

      2.0MB

    • MD5

      9399a8eaa741d04b0ae6566a5ebb8106

    • SHA1

      5646a9d35b773d784ad914417ed861c5cba45e31

    • SHA256

      93d28520c07fbca09e20886087f28797bb7bd0e6cf77400153aab5ae67e3ce18

    • SHA512

      d37ef5a848e371f7db9616a4bf8b5347449abb3e244a5527396756791583cad455802450ceeb88dce39642c47aceaf2be6b95bede23b9ed68b5d4b7b9022b9c8

    • SSDEEP

      24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f

    Score
    3/10
    execution
    behavioral13behavioral14

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.de.js

    • Size

      36KB

    • MD5

      4d83bc1bced6f773423be6f939472cfe

    • SHA1

      1b42889a7f580df9f7d399c33141d38548143ed1

    • SHA256

      0dee462d5fb231f169f6cbc432465a43fd445c011fe650e29f5fb2bccc31eaae

    • SHA512

      c53d522438767a15b5711099fee0acb62ff21289b62640d1a4823a90c8a7d8836bc932daae477d5188b1ba78c50c581284c4d7379efb532f37d356add97ac8e4

    • SSDEEP

      768:jADv7LbgRyefe80QqYax/mZgb2ET1UZ0IMlYmz7w0hxH1N1Bg93RyFGAIDB7wZ9m:jADDx80QqYax/mmb2YLIEYmz7JhxH10D

    Score
    3/10
    execution
    behavioral15behavioral16

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.es.js

    • Size

      37KB

    • MD5

      b371235f971baa51f58f123f40c4435a

    • SHA1

      843d4a2d214c7d9da650cf4d0c6981ac1dab69c6

    • SHA256

      203ff3591e02eb7b55a591e53919cc337f8dea73e6446fc3493227761c0794ba

    • SHA512

      77d43490f1208dde16b6773551ea983cb2352455178ea0e3d4d4b2f2e05dc406cafae89738001d708b780b58882cf5448eb7a8d1c11aa7b8e87915a390da618a

    • SSDEEP

      384:hwuiA9wZFjNzWZQz7uDlnDEuoKZvGrkEq1EhBR3H6Sg4eUz+JWCHcxS+S9SxS9tf:Y9ZCZQOtDZSj1XJS+S9SxS9tx78teB

    Score
    3/10
    execution
    behavioral17behavioral18

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.fr.js

    • Size

      40KB

    • MD5

      d319e61fc6b357b9a5d8e3bbaa44ce3c

    • SHA1

      b1539b082b2b8290f05dfe17d6fee3d64b2ec244

    • SHA256

      7fde40b2b212d274617232de09452c6cb896e8a3c6b9e0b459f067cd07f31a99

    • SHA512

      6ba80b90242dc55ecfa1678e7f8506ed9add4bf08067b125ba63d42b8e8e4455507a86369f6fac6c9d10565d083e7364d4fc79d62e9bd460fe49957c91f598e6

    • SSDEEP

      768:HlKogi6Q3JbQWxxGmmrHeHPO10xSgGvJ1COIoJoZjbEMO9ms:Hl8KbQwKRavGJoZG

    Score
    3/10
    execution
    behavioral19behavioral20

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.it.js

    • Size

      38KB

    • MD5

      a8855a662eb4d3a771fdab7ba6287def

    • SHA1

      a78b57810ac8e9704e97897c6168f4140d2eadf7

    • SHA256

      f67cec6dbf98c98c834638d20df53c5a770edada7f26ebf6d0b7dfec60f7a4ab

    • SHA512

      1c03f8b243701870d8a17e5565da6c65c3f1d76dfb55c88cf68578a4754434a071565da9147e7c833de588a5907b5ece07e018dec52c79d9b2914c964a48a4b5

    • SSDEEP

      768:4klNUuMam1xYhz2LyXSXBjlHtvnYyjMbRgD5SL2KAqI0UGmGfpspuoeu317K93Ph:5f0SL2KAqKKNpCi

    Score
    3/10
    execution
    behavioral21behavioral22

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.ja.js

    • Size

      41KB

    • MD5

      a1f3c9e940206ca310147d644305a6e1

    • SHA1

      005a8f7023b9d873962c7272203cc0c0d0ccc624

    • SHA256

      ea9f5e8993017f858cd9ee70aac3d7990ca85eaf40a052025e530fb1c300837f

    • SHA512

      f98ad1e4c127c3aa4a4ff2fa7ed2a65b5d32644211679e42d70aae03f9c0af1da7704061c28e95cbb25ad14745b1d086c9a49492119d0f97653a0b817823bc69

    • SSDEEP

      384:hIDtFoY0u0ZAITlMRFG1yu9RwJUcQ8bo6CdXtK+c3YcnI+PjnN3H6Sg4dcRID9Dh:VW6RwJrQNdbc9N1aBDzTG7e2ZLlx/

    Score
    3/10
    execution
    behavioral23behavioral24

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.js

    • Size

      31KB

    • MD5

      74dd2381ddbb5af80ce28aefed3068fc

    • SHA1

      0996dc91842ab20387e08a46f3807a3f77958902

    • SHA256

      fdd9d64ce5284373d1541528d15e2aa8aa3a4adc11b51b3d71d3a3953f8bcc48

    • SHA512

      8841e0823905cf3168f388a7aeaf5edd32d44902035ba2078202193354caf8cd74cb4cab920e455404575739f35e19ea5f3d88eab012c4ebefc0ccb1ed19a46e

    • SSDEEP

      384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb

    Score
    3/10
    execution
    behavioral25behavioral26

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.ko.js

    • Size

      36KB

    • MD5

      9ccf83d22e9a9bfafa2000f366ac47e6

    • SHA1

      be61e121af1a363aa66d875f46e78562a603566e

    • SHA256

      100ca482c015571ed9aad97c2dcc5e266b270a650ce892507443b5d4f32df64f

    • SHA512

      3d68816994abff5c528610733cc729e91d390422c2ee2259dcef3cc4db9a599c1f3800f412259fe2f9a700bf2847b942a253986c011c659868bc9edaae6c2f16

    • SSDEEP

      384:hS67TmO5oU1Yh4XK8ApE6/z2dHDNV1KiAaA+17tDDN3H6Sg4s/zKz8G3uyroDXYd:rmO5oGXrmi1zDB12zKzuyroKcNVk

    Score
    3/10
    execution
    behavioral27behavioral28

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.ru.js

    • Size

      56KB

    • MD5

      fd1aa66906d2b3c0c9b734b17f04d73b

    • SHA1

      299145469d5d5397a42274ccc908c865ebc46cfa

    • SHA256

      fa180f7b77ee252aefe73ba5993fbe7c89f43482358d7fd32e8e2f50b3b21bed

    • SHA512

      235c2ea1806c13dc0b85f06b5c9f2f811bd145968e2a0ad47c3fa1e063d408efc034dca7baf0b91942cc34e995d1274692c5556c2fb875dbb1054157da9c0132

    • SSDEEP

      768:CXH0AKgvFBBK1ED81Z0LVdcan9oUxPr1TPgFuEFYPm/XftWZc:CXHXNtBBK1SLVdcan9oWPgFuEFYPm/d

    Score
    3/10
    execution
    behavioral29behavioral30

    • Target

      KRLN/bin/Monaco/vs/editor/editor.main.nls.zh-cn.js

    • Size

      29KB

    • MD5

      f954ac1091c6d0b640ed5f0abdcd8adb

    • SHA1

      43e0d5e39910d124c384549df0b119ad1ebb12b3

    • SHA256

      ac881e6f56544ed9b8dd4fd8fd8a73f1da864fb8d79d91c45f5a51f923bd5287

    • SHA512

      8aff4877bf97ca29dfd5555fe5078ed3f05ac99c43f12c9b1c4d77ca11b1d040a81e0769c10a46a0bb32f3ffe72ae1a223faf5276d05a11f981aa7677e140c83

    • SSDEEP

      768:FzMPbIhYBG5OcP2WyCzVsEJvjA1agnGMR:F8fcPN8Gw

    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
6/10

behavioral4

Score
6/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10