2549dc59bbb8703d4ce2021aecf27eaf2c2bda45ecf25554b36e96e2c8352d7d

Sharing

Copy URL Twitter E-mail

General

Target
Blurry's Java PvP 2.1 (Beta 4) (2).mcaddon
Size 741KB
Sample260422-qstdwaby8t
SHA256 2549dc59bbb8703d4ce2021aecf27eaf2c2bda45ecf25554b36e96e2c8352d7d
MD5 cac360900f755217fdd3709ce4035ec1
SHA1 e4693e46cd230497d8304efe64119cffbdf3a2bc
SHA512 fb7262839b3b675d4ba0ba876d34fc203b2251c34e7f6d0d131e60a33004b167c1105d805ce2e506da2e67d5289fcdb465491edf0fdfc364233e03a72aea21fa
SSDEEP 12288:VUd+tWnU4z6b5nhG/rEKy32tsrDXeuKaZShD0cvDIXUdBFBtEw+jlTBxmvo:2d+tWU4z6zCwKV1L0cvgUdBtEw+xTZ
TLSH
T1D2F4F137C8C23486CF4FB5BC564F92EB99979B188C9058076B218B083D0E5DE6736ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BP/scripts/engine/config.js
- Size 53KB
- SHA256 c93215ddc1e2d4932d0e6d5305fd20ee91bae1c2a1e2758d62e6ebb60b71ed11
- MD5 8c8d20bc2dd197adc7cce3ba21f5246c
- SHA1 45c10ddf01ed63ef88b2c3fa48f0182d313e0e15
- SHA512 00dea9526567d0b4869ce7735c5364376c74f326e1c22ec54ff62a8388056683fb2af261aa085f05b3c3cac3944ef8a8af0d4545ddec3f71d6f25562bac7e3e7
- SSDEEP 1536:YZc03dbEIMISiZe1rHgHN2eE2GVB1/EXhUM/ijAp89Rj4V6n4iXxlXISZ0mNl9k7:klEJRAepAHbEBV7EXiMqk814VvihlX7G
- TLSH
  T148334E67E9AA1091B2B192704BA6B515FC2906034279D330F7DEFF1C1FBD2884365F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  BP/scripts/engine/cooldown.js
- Size 1KB
- SHA256 c88d0f066459c4c52c75b5089dd5685c803654cb9a83b535527839ca800f171d
- MD5 007ec1224a11439ef97384a55ca40970
- SHA1 c0328a6ec1422fde9fd61b41417f49049bd6d833
- SHA512 c4406234aaae262342d85363adf2bffd408d27ebe236783e68195a1d06f533ace80673a8a7bac8d9869af639c744640c633e0e243df5e211e2faf28d407a60b2
- TLSH
  T1572103B265E0A116DA7741D4470A682EFA3A310336449644FE6ED32E7F1D02493FEEAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  BP/scripts/engine/damage.js
- Size 6KB
- SHA256 3b4b3cc44bb6ace545f154efbb99d604d8f7a01752c53b65624fd65b43b65bfa
- MD5 4b96e6d5797d9a035ed43e2320420bb2
- SHA1 37fd002fc50aa31dee3ad621865f05d52bcc045b
- SHA512 4e98ff991f7e16e9627d40820de6daceade97d5d85dd8cc45200301a2694c4be5d7d70a41eaaf9126203d39d99c0303777bcdd2102070506c3783434697df513
- SSDEEP 96:Lm3nZI75qe+Z6qgLkJM3F5r9w5zW+h3m3JBG8tIR0Wb5EQk3eKQOFpQ6VBa:E5zW+h3m3JNt004rk3eKQmQ6VBa
- TLSH
  T193D1879197213E2E103AB7793B9E4011F636D80B26C55298BE7C951C3FB24249376EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  BP/scripts/engine/hit.js
- Size 12KB
- SHA256 83844dfb16fa570f678d3c724802123cd096b9f806ff6bf4135741842bd2f795
- MD5 2867a41b312da111d88681e148952f9c
- SHA1 11569a68773deebdcbba80e2a6ffba4b75ebfa4c
- SHA512 af6174ff2406ca3ee27b6cc4b6ea0ebd1f7390cc2977889c0754721782849115dcd6613c8714583b83935cd9cdfc12d4df8c29780b5d151d969dc8d8b3d804ff
- SSDEEP 192:lSI2yR1cznz24COZX2colzVf4Hr8fuvUfhgqGd:lSe1cznz2iqzVf6wmvUfhKd
- TLSH
  T184425226539425B519B5D3BD6FE9A065FB3EC042264352E4F9CC8248BF7806CC1B2E6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  BP/scripts/engine/hud.js
- Size 14KB
- SHA256 e614001f09fa46887417d8d71adcaee82bfabb9ac7849856240bd90d94b1fd84
- MD5 c89c6354cfd3720d3015b29fe83974bc
- SHA1 af57aee84832dd5c4bac944498c9cacc16369ff4
- SHA512 3c40a0b433810955756f3b137a52a098d77a39ace743d94023fb5cc8672eb8a37e4caeab9e13a6a31c401a1a0586b197958c93607b3b2ab97f58f56e3a9776eb
- SSDEEP 384:gQw8x947TJOhRnNdbm7pwZ49y46R9UeK3jBqLovRXp90:M8x947T4N/7sjBqLopp90
- TLSH
  T1E552A522136466560AF062B487525029F632A37367069186F77EC92D3FFC42983FDEF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  BP/scripts/engine/icons.js
- Size 6KB
- SHA256 4f8f419751ab12a2b52450e772032b07784e95a78555f931a2f76e939ebd80f9
- MD5 c943ad1480f91ceaf49749ac93fb7f9e
- SHA1 0a1fdd45e0f8de772475b8c2bacae3bad23b63ed
- SHA512 201cb5f20afb19736ebb9ce845680fd3db38768afbb96f61f88db443cee5c43ed31876df3bfc922c8373b6e0ed8691b0648cb1b7d07f4791e22fdaa6f5112349
- SSDEEP 96:LuIBjfoUkaS6twR4xsExBWkVBzM2R3fQpS+HngHXZp3P+AJ/CJ8JWbPfJeJR+/Ie:dBzoogW/WEhRvPf5g
- TLSH
  T1DFE1CECEA64B1A8D03F107B71866BDEAC1C917ABF49498067467814C0FFA4119F229FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  BP/scripts/engine/itemSystem.js
- Size 10KB
- SHA256 b74f6114a6ba7ee59f8e6b2b6785b749131710a45341a9aa8eef62bb3393a822
- MD5 ea2557fccbf9415334cb2232a7559cc0
- SHA1 d556e7176ba730d16914a6e27cee80dec2ee7a38
- SHA512 abdc1b8931cbab89c2bf1ae8ec5d6d3b877f045256273c028ec074be47fce3a84ab0514e6450153df2645a2de755987e34d19261032571af8e8791538f2a2c00
- SSDEEP 192:Lgp0HB0z0X0m0P0Z030U080w0/0T0j0x0s0sjYzxKKuFhLg+chQge6FGQ8fD7kNF:Ep0H4XnhLg+FDo
- TLSH
  T19522751143401646F139B7F91BA71011FA75A29FF40287B0FD9C8A6C2FBE8198276E7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  BP/scripts/engine/knockback.js
- Size 8KB
- SHA256 0549089544d8ce9021e78956201b7846745b3ef7b8c555f7d75c1e1e07359a5a
- MD5 7102de7caa87f4cfafdc437800386c22
- SHA1 5738a401b65c0fe62df69e9ae498e0dad15f273a
- SHA512 6ad22c354f0518e6a6fb5a59b16eaa21e1f08ddac7d122114e8a490b76fb53c5610c65141ab73e5ed756ffd49c4590845fb09fdacbb9856e4b24456732d79e85
- SSDEEP 96:Lm30cdk9INp5DoOgG9FR9z1Q9Bie9aJMKI9FeC9j0E3IEC8tUfbFCmFqNc:isMqiHWaO8E84cn
- TLSH
  T1160201B5B2F5A1208075AAAC0B95E3D4F36C845BF10192B8BD6C426F7FBD0184275F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  BP/scripts/engine/offhand.js
- Size 9KB
- SHA256 a80099f06ba4ba61f77657623d683829ab388cd817f47f545afe3098bfc9a2ef
- MD5 58abce9a19a180dc394337cb6abd35d1
- SHA1 17861814e3f558ce40fb28c439012f42c09ab4a4
- SHA512 47d9fb51d1b68676ea2bbe9e75e36fcff1957909783cf2b11b6c556aed1ce7a79708994160d7f77bb5cda1c62921a8534bc49827f37d5d77b3f0263b30c01878
- SSDEEP 192:iHCgn0IrvSFQC9YsMylD6hg+S6E3k9kqbD6hg+TYlHYGFqA:iivIeFyi6hg+S6E3k9/f6hg+Ul4Gr
- TLSH
  T15C12531B817615DA547AD3A466086012F3635FFF6165C78FF1BEA50C2F61284023AF7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  BP/scripts/engine/runInterval.js
- Size 1KB
- SHA256 66334b1ca99737e96e227fc2699e203531d13edd185fda1d8500f75bd7f394c6
- MD5 5fb41432ea2f0faad4f4d8e2541c488c
- SHA1 62de3c9a173ea2b54d74cb1e22753223dc482a17
- SHA512 49f07810a02647dbf3514d5ae9f79082e673c7a79712cd7cb4c451adc5366a4bdfe772607fbb7986fbbe4dca405dfa418d3422ee61f02659d1f5c09949d6cf3f
- TLSH
  T17321E16592C24121E73282EA958288359372001937416958FBCE6935BF9E43C87F367E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  BP/scripts/engine/saturation.js
- Size 2KB
- SHA256 9a5cdaa73c1ecda4cf443f0093f6922b26ed7d9006191287eb08a35a1777b413
- MD5 7e758a15ab12a5d42db9100870f93148
- SHA1 10052939d08fa7fad18542770ee4278b847d30eb
- SHA512 9435c5969fcabf682a250426f0dca9bc9934daadbf254f0bc996eb6d15fa2ed115436fcc251bc8d760d7f1d7ca902eb235ad05271016985cbe30101561623825
- TLSH
  T16C5113361191A5A081EBB3E80713143BB9B351297B4BC2C1BA5E611C3F9B26CC671FF6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  BP/scripts/engine/shield.js
- Size 11KB
- SHA256 4720741e0760e9bf6866a5945619ae6299f6b6bc72623fac3bc7afffef51941f
- MD5 9894031a8c65188fea38e864950ea3d5
- SHA1 a27fcfe7a9c52ded62de7e7f3b96cea006fecabf
- SHA512 138023824523e0c02cb668a34c5d441a3ac8d5e7b4154830b031fb632728af32267e7f3710a491149421be689dc668e6a4479d1f7183957952acc1e1d36b0ba8
- SSDEEP 192:L5yWem1XJXxZMZ43Zh+SkpEBYESo1tZC3CpPDSXEAx9OvPvuQgPUymKlWF3A:tzx1sXD9yPvufUytqA
- TLSH
  T1B0324153439160E9FAB1D3B62FAA6425EB72D0E3300387E0FB4C45161F79085A36ADBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  BP/scripts/engine/states.js
- Size 3KB
- SHA256 90e11c7d57bf63e4032a0c585ce89cb4efb52dc29af3805f36b063d41555d0ec
- MD5 4cea737fa9834c3cdee26b228c3948ac
- SHA1 2af75f7ea3b56ecfd2540cc6cf4d0999daa44781
- SHA512 9c463032666f098c99cac0c5bf9dc12d3ee331be495ee1807f7d431310125d3f1cde5b96e6193daf019fe9b280530ada3313dfe6c1a6a805b19a2d6477f67dc0
- TLSH
  T1AA810FA10082716A8AB192F1C75E9025FE72551637071790F46E633C2F6D2B583BDEBE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  BP/scripts/extra/bow_ding.js
- Size 587B
- SHA256 f290437ffc8b011a149342f58615a06b6c05292568c67d01e5b2df0be686c3b4
- MD5 243612e918682d2cde11b24795574f46
- SHA1 bf9e652622230ae773877a1366cfeeeff80435f4
- SHA512 d0fbc17566d14ea48963d4b789c6fa97201d0c44c2625c05d105cdcd18b56a77c15e489cce104ea149e4e724ebfb00758ea00d35078d565bd208c9407cf0db2e
- TLSH
  T198F0AC758AD7392953B1EB3C4AB40818F2BAC19B920192B3FA2828143FEC2042031D69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  BP/scripts/extra/crystals.js
- Size 342B
- SHA256 1cd8f354ce9d10cf05c0c0b5d82ae240ca41827e57867c58f186718af7bb18bf
- MD5 19945b73ae654c242b980d075fdc93b6
- SHA1 824f5e2ca211b9cc252d461deb9fe9a2103e3057
- SHA512 fbbf3766966e47ab835493eb7a08d46aa59329882b6a5e65f798218e06a431705fcb06f8fe363c7dbaddc66b10921816b4a69cf5db03c19e53347b6dbf343a13
- TLSH
  T16BE07D0717C22A290226F33CEFBA490AFF3581B76A0204D576EC0E34BFE15501311FA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  BP/scripts/extra/netherite_wind_charges.js
- Size 977B
- SHA256 e5f0f1cfde14a1d50c3ee040c5026d1188192bc22ee9f72fdab721b440a4eca8
- MD5 ed4bfaa50639c6c963c4dbf310c86b76
- SHA1 6debd6dfb0c3d51fede8a36a8deb47f380261a67
- SHA512 46b170186b4e420ebc7f5ba2eb3add3bf3e7892046f6427091faf8608310bc2455af021289d045132422cb6980437edb14c7605f0c8cbeb53251050d70eb3117
- TLSH
  T16C11215B51E13421897587A4CF3289A5F177416BF041E2B8FBBE85283FAA40DC222D5F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32