0d40a26e2c9dd9b1b29115ac2ce7bd5c7337dc01126b63a958012ebefe391ed7

Sharing

Copy URL Twitter E-mail

General

Target
1.16.5 (3).zip
Size 42.7MB
Sample260415-yk52psht8m
SHA256 0d40a26e2c9dd9b1b29115ac2ce7bd5c7337dc01126b63a958012ebefe391ed7
MD5 b8d00001f017a28f4d2be78490783ff3
SHA1 72f664c2273282e69645ada4990968df915d0b21
SHA512 aaaf0b6c34479be8574452459d239cdb01118c193c63229c7bb769c35aaba1adac35ff1ecfbfa7711b5a36bb22fdb77954fa55cf191eecfd4922916a23d8bd43
SSDEEP 786432:9gg7vfhdGodX4M2RDg6i/dm/V4oa1phpzL5zqnb7kUMnNw0JqVAWYBfW6Y68+a:9gAxEo9F2Ji/dc4f7ZL5wb7k5niuqVUg
TLSH
T10BA7332862305A8E8933F93B3556A7E3664057C0AF94FCB2F7509B651F82FF18A64F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  1.16.5 (3).zip
- Size 42.7MB
- SHA256 0d40a26e2c9dd9b1b29115ac2ce7bd5c7337dc01126b63a958012ebefe391ed7
- MD5 b8d00001f017a28f4d2be78490783ff3
- SHA1 72f664c2273282e69645ada4990968df915d0b21
- SHA512 aaaf0b6c34479be8574452459d239cdb01118c193c63229c7bb769c35aaba1adac35ff1ecfbfa7711b5a36bb22fdb77954fa55cf191eecfd4922916a23d8bd43
- SSDEEP 786432:9gg7vfhdGodX4M2RDg6i/dm/V4oa1phpzL5zqnb7kUMnNw0JqVAWYBfW6Y68+a:9gAxEo9F2Ji/dc4f7ZL5wb7k5niuqVUg
- TLSH
  T10BA7332862305A8E8933F93B3556A7E3664057C0AF94FCB2F7509B651F82FF18A64F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  1.16.5/1.16.5.jar
- Size 28.2MB
- SHA256 ed7d94fb6abcd4a7ac3a26346342c798a4315d3f2efbdaf329edf18979ee9925
- MD5 7f62797c44ab935a1671073043dd8765
- SHA1 ac544f421eb2b36f095567a7ab77afb59ca6f3bf
- SHA512 ee01a577e9f4c02943299801d8861b648147cd3412a0fbfa72a5bdb60d6a78ee5ca88a41e2fd04391c32fb68412ad678fbecb98b74ec9d77f86fce0b79f7eb8e
- SSDEEP 786432:yMKDIQcXeoyA2b/Sp7ouLTXmQmWVmPilTSrKZq:yMAI/72bMXmQmWMqlOt
- TLSH
  T1C957E014E8FBAE74E57FE23681760453E5289FBEAC08B1EF757458847EE98C412C3129
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  1.16.5/1.16.5.jar.bak
- Size 16.7MB
- SHA256 00b5ebbc33e95ea88c1ab80601599c9827e9aa861d93ccc2cfcbbfd996e86263
- MD5 a57b9157ff3bb308208e79ef9e19187e
- SHA1 37fd3c903861eeff3bc24b71eed48f828b5269c8
- SHA512 6441757a9a6d429fbfe4f3afca1242f021f6093befd34a7b9175c231c28100a74fe623199ce46ebe15d53b3cbd377fa1c47808a44c4b394bed4f2dc2a6b5852d
- SSDEEP 393216:BXPwq2pAwyg3qRky1lLIBbea9mrvxlmxvcPQ:xz5wygGVlLI9rcxlc0PQ
- TLSH
  T16E07DF18BEB79A15D00F817A42778253E02DDBBE9848E1AF6374C4582DA9EC45703DEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  1.16.5/natives/OpenAL.dll
- Size 1.0MB
- SHA256 1e128050e6ecd9da7a030f76b24d93a1dcb7de55b02d80cd2e2683818e895b5a
- MD5 a21338306c8027ebc459c57db8459777
- SHA1 dc8f7a5704164fe3dff3631c326bab7159a9358d
- SHA512 eb80fc1924985db488175ee87389cf8ce7e851f78370f339a77ff09d7323ce5fee2e63e3562d299a6436a4d5f31cce0194fe2d1c9c4cc47809ba6d3cfb8a47eb
- SSDEEP 24576:Xr0+fjUIVeMqRF/HuYDstAyAS7vUipuBuAEgFpti33Ja:PjF7qRF/HYrZvUnBuAjpti33M
- TLSH
  T17235E141B6B244E8E5BB8038C563B91BF175744503208EEB57A09A692F77FE11FBB702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  1.16.5/natives/OpenAL32.dll
- Size 982KB
- SHA256 ac63e0bc581a1fd7ac0bd2553a10913e31ff8eedfe356816dfad186c427ca5ba
- MD5 bea36e6601b1b9c5dc85eb66cb438887
- SHA1 aa3fa9446b7c1264e2b463bb53946718e4f8ce82
- SHA512 9f589c418098efc6341a536634e4a59a7fad22af6f83042c101f22da524fd89057d4eeb420986e22a9499a2690938da15203e9dad0e0e57571a800bfeaa418dd
- SSDEEP 12288:oh6tnSOepf4az4/DZMyLt3r4BZ7cgDT2h49aUydbyaQ/0Z0x/5MPYjUdFpti3pxN:ohTzKukl8D2hZpuBuAjgFpti33/NL
- TLSH
  T17225E01078A3C4B2C0E50170A1FCBF6BA97D54A4032598F39BD4697C9EB45C26BF376A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  1.16.5/natives/SAPIWrapper_x64.dll
- Size 83KB
- SHA256 a8b701f1ed640bfc7e842f9bc07dd493fad3284f15bc1fa9dfc15371733d6326
- MD5 214a0bc5ae5882495d94f7779d64b323
- SHA1 c4a293116e7531d950db2d5ea737e61a9912b61d
- SHA512 0da432d50569f753c0c9831b8854732c0e23fb382ef36d17a1d460e8e4c431495ce0358cc658da87d19e39c58230370423a58adabdf3f92a578a2279d84a7e58
- SSDEEP 1536:/0tGA00KTHlHZeCbxnnQOzAGg1wsWjGpRsBQ+8/iJyzfGdc9dlVkloExc:/0tgTTFHZj9nnQOz1I0GpRsBQ+8/iJyZ
- TLSH
  T109834B05B3E410B6E1778A35C8635E19E376F9521671DF6F03A8428E2F637918E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  1.16.5/natives/SAPIWrapper_x86.dll
- Size 70KB
- SHA256 fa69dab9c06f3cdeb8bd7c1b017fb072ba4262682ea21a2e723f00a78f86dc29
- MD5 3d47e750e4ec109d441a427ab8b37614
- SHA1 70e85ab3f880a7c3d5f0a9aae0f65661cb8af5a6
- SHA512 c24579b0ec34bae0533997b3b4511fd3d590fce0d7881e6f6cda3c763437ecf525aabc203a6dbea4b3c912c3d4f989580ffe2021e9c482fa65d3f53117fe4ea5
- SSDEEP 1536:Gw3pkA45KEsgSCd5m89ZqQQ4hxsWXGcd38haRoD:asFwHx1hj38haRG
- TLSH
  T16B635900B5D1D8B1F47E2D390471D6A06A7D78218EE5DDAB3B86066F0F342D1AE36E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  1.16.5/natives/glfw.dll
- Size 347KB
- SHA256 7cc30e89f7fd61ca8532b4ecb9e05598cf426d0a336bc382a128e28b824a8962
- MD5 532f9686b0b55b3d7cf9f6733f29ba28
- SHA1 9d95a8f52cbd48ab87937714eb4fd2129ed10f0a
- SHA512 6e6fe022238e69565fed6cb85fa74b913aed187487da4133a3e14b7eca230bbf5d70c8ab88d02b15e68a0a10549130ff2b0f2eb7d85ef3af8f92218327cfadfc
- SSDEEP 6144:BzJVXAXWofCvG4AnlKVGb8Z7ESBI5yTAdj:BzJVQXW6CvFAlOxzG
- TLSH
  T10374F725B7B2055ACE2B8037C5DFB9229477744C3BE765DF3E5809A43E22FA140A9F24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  1.16.5/natives/glfw32.dll
- Size 326KB
- SHA256 db38ee25b700dd4228f844ad22569c155cc3b13ea3940576832a8a9051acfa05
- MD5 5c7b7a7e9ceedd779ddf531ea58db8e9
- SHA1 b9a18c65931b474a453cca5b20903220975f0fc9
- SHA512 fb5e42cd087776b9fdbc55fc90e2345c7735a9dcf52dc3c9917df344e9b4a84b338e15192a648d480bad27544176ee4430440f3f94c181870708b8bf70906b6a
- SSDEEP 6144:KP2tJ7heVTpbUEazsvJezmofinyAOYTi2O:htiTpYDoJe6SIO
- TLSH
  T1AD64C52577A2452BDE6B0433D6CEF961187FB05C3BDB64EF7F9409A83D20EE140A4A25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  1.16.5/natives/jemalloc.dll
- Size 248KB
- SHA256 b147a3cc1fce8a514a558a030fe647a4a91761769eedec1c1ca2be1cd712a9e8
- MD5 cdcaa2d4874a0aaab526c52e1fff2fea
- SHA1 8a6eb00b934da6c97b0dc9d2dc321843076c8987
- SHA512 270ae883818c2cea891c3efae717aa3f455c902721ad80441b0f2b28e58bf9aeba67bb1fb65d76f20d09a4c937a089ee1018439b3815b9fcdb7d7fdcce704853
- SSDEEP 6144:5ISPvZG+86Mzlpb2mnk5uIXhy3hKT4W5i6wb:5n86MppbkxwKMb
- TLSH
  T177446C56B3D60C78DCA38039C9474B0AD3F2BD550722EBDF06A40A69AF6B7D0A53E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  1.16.5/natives/jemalloc32.dll
- Size 191KB
- SHA256 7270b1d189c68d3fb655411d0e7002bc9b131328b3cff726946e8fe16fe5b09a
- MD5 93aeb5ec9f94134784373f370d295a61
- SHA1 0d3c5c4d18d9a60501bce1f586684cd2fc5c466f
- SHA512 2e79b858977c6d39e4380cbee3d70b01d4d47c4291f2af6f510f222f29cca53e2de68d6c6b0cf030eb43fb60ab8807756fadae59a8583f69d0f734f9bbe6453f
- SSDEEP 3072:dREMI0SsPaw8FtirHatxHkeaoPg2UYsCMGUd5liXSE0RM:PbPawm0utRaoP1dX6M
- TLSH
  T17814AE42B583C072F75F163885BA9B726F3E96004766D9D793DC4CB49E501C3AB3AE0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  1.16.5/natives/lwjgl.dll
- Size 439KB
- SHA256 207fcf6f27e60600772d202f52ba00edcd085048da30523d3ac03092dd30f873
- MD5 310adc26c92b020fb6d2944092d81312
- SHA1 d01410449d2402a952e9a6063699f1868196883f
- SHA512 db4c6f1c8accea57ad395be51f3fd673cd5577b955ea5051ffd2269c1fa62437e18753104499ecd0af954fd5fc6a9478a13f499f68dc1e12295823f7120ede2d
- SSDEEP 6144:02gUXvUg6HVz/8rCkEZK+rY1ELoR18+D:02gUXvUnF/m8VNkR3
- TLSH
  T127A457216E23868CE8EF633E605344426A7B78544B0351CB5BAB9A5BD51A3F0D3F2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  1.16.5/natives/lwjgl32.dll
- Size 419KB
- SHA256 8c9490c5267a615bf0d90a84066628791a453aa30abbe86a8424281b8cdbfc79
- MD5 b8ea778d75b1150ec0eec59d764e57cd
- SHA1 a7aa4fbaa375fd39c4cb8eabeef45b44d5848bcb
- SHA512 38e10e2cca2079dace6c4f1089d453844cf2b9eb65b0cd01800b478bfcc6117098366ef8547af71fc13d619574ac879ff259698c2d45023ca4a9214616f33495
- SSDEEP 6144:7s1xf0LNGSd4e1uakLRm8KMbh23nuR+BF2QTX/MhV7:7af0LjDlk88K4yho7
- TLSH
  T1B39451103F62C26CEDEB723B2196442A2B3FBC541B0214CB97A3591AD56E3E097F2D75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  1.16.5/natives/lwjgl_opengl.dll
- Size 333KB
- SHA256 92aec0f2b142a56ad8f361919ee0e6b387c92269efc9645071db6561ae9b6324
- MD5 780ed18868c28c0c249379982ea3297a
- SHA1 8e9836dd0d1691356db654aa02533ad80e9bf52c
- SHA512 430136fa22df4753c460ba4f3bfe18f9be1b1d0f0b59deedb9d5ba1e1db54ae5da3a74c3951eb59ae0b8760b5b6806373a76811c5b6f69f18bd966978f5d0e1f
- SSDEEP 3072:4LVyef0be4PP+OI7RSW3Dm/W99vMdvBAoF/5OZX2lh2mH3+F5Tye:MVrQnXrW3iWCaZeO
- TLSH
  T149740157EF93C5A9EE1A353F84810275A12CB4A1471456C3630DBA8AB9CF3F442F3EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  1.16.5/natives/lwjgl_opengl32.dll
- Size 316KB
- SHA256 8fc4d3f3c0e0a7114f0caec7f2e734fec7e7294ab33696f1557a01e86c0ff128
- MD5 68b37c18052fb770e77477e1e53a3428
- SHA1 2e0fe073b23ab972af00025097efcfcb446d927f
- SHA512 bd49a00e8e162f1c501649f71fc0a73ca72b7a433a654ab4dd19703d75f7575f195efba9bda1f2f9246f171a0e562972024cf65135c4f774adccb8c10e031561
- SSDEEP 6144:hET0PjEp8p1PWjIe9Oz+0zHWIXYtrR9A5:CWlWF92
- TLSH
  T13264BD579F23C935EEA7B6391081247E720DAE501B486AD7610C2987B0FD6ECC7F3A64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  1.16.5/natives/lwjgl_stb.dll
- Size 488KB
- SHA256 64b424ce5142ce23b43e2e2bc5cc8543add7c0037a151b279e4e17aa7f7600a0
- MD5 236817b9ba4f101e25518f1158b7691f
- SHA1 8b047fb3f6c31946fe33157e7912ac31595cd3b8
- SHA512 bc5624cc4b08f75247ff6c53f737be9938199273a45065a8fb05b6057aa7bbd1a39a1b59adb86d952a2680080dbb1ef3483a8e054029f0bf62395e0c551dbe9c
- SSDEEP 12288:kJ3JRsrmLj3DyaVfBrWFWplDFRWeotDqR:UngmLTDyaVJrWQXDFgeUqR
- TLSH
  T110B48D19F9F345EDE43B543C90A6691BF53630980320CAFB4680CB6E6F62FE15A76724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  1.16.5/natives/lwjgl_stb32.dll
- Size 432KB
- SHA256 1907bb0e022628fc624d7c3b002e9b79e056d789d6c7578f7f046ea414ac16d5
- MD5 a0e616c8b75575f45497864d650005ec
- SHA1 1c28819763f77cbb4593a95b1cbb0999f136695d
- SHA512 04cba7e7fb2c87cf5f4a9ab6f68eb0f6e8d32c3841a0a68505d7b612f1a52387b423069fc3732036c5cbabc8e933c429f6d8820ad3d50b293d0fb2a06de3c83f
- SSDEEP 6144:e9HIdmzLf0gDa0lhSSwGEZ5FIh/wqdmJsUWcZEfupWGhAOcsxz:6HI0Lf0SxlhSxG6gwYFUWVfIhKgz
- TLSH
  T15B948E41B8B3C1F5E89A30B070AD769F252D3698472CC5FB53C01D1DA9B4AE15EF3AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  1.16.5/natives/lwjgl_tinyfd.dll
- Size 209KB
- SHA256 696a87865bf27f2cb9bc866e6d75e1a4ee3e8c469180cb9f8ebb90a2af876d10
- MD5 5dc7452c51330beb7a178d7093cdac49
- SHA1 ec0fd8007afba6697d5b3b8249b5be27096a0ce8
- SHA512 a671123d7ea2f5dd2f307e19627b456b7a1fe62920c64cb08fdcc4be5f0ba017c5b72a0e9ba428fa5996a82584e039818bc41051b7e883d70252b69926f82716
- SSDEEP 3072:7+Oyz6WBIDhWW3gDYP1EKvqotQZGXNKSMYghpYCS1DQmdJQFACZ1sai3Uzz2KC:7+zxShWW3gDYtC7cXfMY63S1ag/bK
- TLSH
  T176247C5577E514B8EDA79238CCA35503D272781A0730DB9F03B48679AF2F7A0993EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  1.16.5/natives/lwjgl_tinyfd32.dll
- Size 178KB
- SHA256 432b6f80da7799b582178996575953da2eddfbff6bfef3202724eb4f85a10ffc
- MD5 ae277b62653af1bdbb27b73ea98970bb
- SHA1 079540a19727772f056cd80535e9645a674190b4
- SHA512 37bf032cb8249973953a8f190e97c664dc99f83b232997bffd0fd677e3913ed2961fd9c116f64ee04c45d9e0e62e200bd814f95929d62d16a1b5eddffa351f19
- SSDEEP 3072:6R4pzFYxU7Y1YEdDv7WB8Y8FLhYwBJ+2FBP1AUbUsPZnk7SWzs7yZu/SjXXQKzR:oyzFztEd/FY8FFYwC2LNAuPZkzsj/J
- TLSH
  T17A046C5278D1C079EABF263818B5D6B30A3DB9201F70D9CF6394597D1F600D0AA39B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19