General

  • Target

    KRLN.zip

  • Size

    3.6MB

  • MD5

    29268f196f39df2bb11029a5a79ba30d

  • SHA1

    a0a9af7e3d4f5158d3a6664dd5cace894ac2fdd9

  • SHA256

    96a2c02c92ab985233d04134b496252530282c745f3a142a359878cacd2a9025

  • SHA512

    04eb37b2ecd7f2b454cb470c45bc4fb38fae2d16189246d5c9ee9a413ad6b33b42eb1f14ee3bcd21d7565ae6c7380f6ca680c18f0285a7857d06332a867dafe5

  • SSDEEP

    98304:y+unxDDcESW42uVdTWjPEG4tRZD+/vlL4zS3yhO59f1m:/uDNqhkPyHh+/vlL4+zT1m

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • KRLN.zip
    .zip
  • KRLN/Bunifu_UI_v1.5.3.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • KRLN/KRNL Remake.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • KRLN/KRNL Remake.exe.Config
    .xml
  • KRLN/KRNL Remake.pdb
  • KRLN/VisualStudioTabControl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • KRLN/bin/Monaco/Monaco.html
    .js
  • KRLN/bin/Monaco/vs/base/worker/workerMain.js
    .js
  • KRLN/bin/Monaco/vs/basic-languages/lua/lua.js
  • KRLN/bin/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
  • KRLN/bin/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • KRLN/bin/Monaco/vs/editor/editor.main.css
  • KRLN/bin/Monaco/vs/editor/editor.main.js
    .js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.de.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.es.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.fr.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.it.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.ja.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.ko.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.ru.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • KRLN/bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • KRLN/bin/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • KRLN/bin/Monaco/vs/loader.js
    .js
  • KRLN/bin/Xeno.dll
    .dll windows:6 windows x64 arch:x64

    3a1f9d973bff43051a3daf411f707362


    Headers

    Imports

    Exports

    Sections

  • KRLN/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • KRLN/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • KRLN/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • KRLN/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • KRLN/cxapis.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections