ec3fc1f07781c0394d71418560add5cc5f42e4879b87f9d6b77e2ebcbbe90576

Sharing

Copy URL Twitter E-mail

General

Target
kilcurrency-10.32-source.zip
Size 22KB
Sample260620-lwf6hafv2w
SHA256 ec3fc1f07781c0394d71418560add5cc5f42e4879b87f9d6b77e2ebcbbe90576
MD5 e1302af1e8d6b7c9ef55e2ac9b17e374
SHA1 ad4141d4388efaa970b9452fc112f8247346c3eb
SHA512 7684853898e311bd1329ff30b4b2129ac2b5e3841e09386ed0f66793cfdbac877a1b03f6b3f103c23e52b1f27f451820897bb6b198d1343d6fc8b0fff45f751c
SSDEEP 384:FXTSHI26+q5hVA2+zp825R0y11mp2VEecgjIdVts5KyOViY2nxrbP5n2qhXaBOx9:fhxeX1q29M9sYyOViY2n5d5T9
TLSH
T1E9A24B3CC108A5F6C53EA57DE42A036E6A739A3E341262D009CC99673747918AF3D93F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  kilcurrency-10.32-source.zip
- Size 22KB
- SHA256 ec3fc1f07781c0394d71418560add5cc5f42e4879b87f9d6b77e2ebcbbe90576
- MD5 e1302af1e8d6b7c9ef55e2ac9b17e374
- SHA1 ad4141d4388efaa970b9452fc112f8247346c3eb
- SHA512 7684853898e311bd1329ff30b4b2129ac2b5e3841e09386ed0f66793cfdbac877a1b03f6b3f103c23e52b1f27f451820897bb6b198d1343d6fc8b0fff45f751c
- SSDEEP 384:FXTSHI26+q5hVA2+zp825R0y11mp2VEecgjIdVts5KyOViY2nxrbP5n2qhXaBOx9:fhxeX1q29M9sYyOViY2n5d5T9
- TLSH
  T1E9A24B3CC108A5F6C53EA57DE42A036E6A739A3E341262D009CC99673747918AF3D93F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  kilcurrency-10.32/pom.xml
- Size 1KB
- SHA256 773ca467d2efcfbafd4c9e98505c6dbf6e70b6c4d6efedd4620d0a3b89cb98d6
- MD5 12c8d38fa32ab61e5127c576626fdf9f
- SHA1 3acfcd3ea8e7d82189b6a5f6be8f0a87b832b441
- SHA512 8e03d316b3c3fbe2cd8c8c68742176e2dd11e71ef1e0bf950afab82671dbf73b039b2eb19e8feae2431a0a3f0e70d062ed932430d18d6b194e589ae5688e1712
- TLSH
  T1A131AF6498FD98B0125509C6D2A29C95AFFA417BD4C98198F0CCB685AF4BCCB4063677
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/KillCurrencyPlugin.java
- Size 3KB
- SHA256 71ac2bf0b0021ecfba443a48e8f44a0c2b26ff90230d743f20f38101ec2d7b10
- MD5 f2fe2229c7e5921891db9145d1ff5c59
- SHA1 c8242b7c759230fba177b0c43dd2599a62a1ce20
- SHA512 17394f6e22cbfaf5205638917db824b592b414f606881e6dc09b33a2eb41c0b0461fc3635a9b0626fe7eb050967a24941702e92acfc0293627601f1a62eebee1
- TLSH
  T13E810E0F1BDA1965907EA0D7FA0E05003937DB0B29DBD4617DAC157D1F828ACA3A5F38
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/command/KillCurrencyCommand.java
- Size 8KB
- SHA256 37336aab64b8705bfa8775ef88b1bbba82a109b9a5be5eca816d0cfb9796481b
- MD5 bfa84f23ac350f7e82eea5761ad3c273
- SHA1 0453d00a1a9519314cc130eb7fd2aa16f751fc6a
- SHA512 cc119e7204788b29496d98a79e7e96b5c339450fdae6813f91313e2702c95baf870e9ccc34875f4f63f444292ddbb78b44677019bf399d6d1d2a43c9984595fe
- SSDEEP 192:nK7kqc2mj39IASQwXLOLSyz9x9rRY9xw837ucWw1+d9x7w/X1VMvtxoBobtj8nCf:Kack0KV9blY9KeS9ZSw1xwobheV33Ehv
- TLSH
  T1AB12320245EB7E264726B115FC063C0EBABE851F962CD96AF61DAC9A1FD08D4D0EC734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/data/DataManager.java
- Size 2KB
- SHA256 4ea04d40c028ce36e74f0aaf8992a3166baa4bce35411d7bfecafd9d478e6e0d
- MD5 93df42e82c74b380f01359e6422bc164
- SHA1 e399f572c781898a251864b3ca98006e02d0b6fc
- SHA512 953399d62727c69dc4b6f499e26dcb2c8f7573e94d714f9a53a25a7ea131298d829df1433b5bb68e3e2d3681aef688e5a906ee0dc920b6cbc0d563f236d8392c
- TLSH
  T10951541311DB0C22823671AA65CE50726D3F7B5B60AAF5A0F42F3570BF46C5892F6F1A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/listener/CurrencyListener.java
- Size 5KB
- SHA256 b9505560e128f31372b4caedba25a392a4e65d39db9d69da06272ed435a39679
- MD5 a2c7c7faa83eb6a2aab0801c7f199d8d
- SHA1 5d4a121aba870e738b1ac77d8dd5a171fc7cb09d
- SHA512 c19ffe31d52dd1e3ab10b6a8d8da3b29afa889e848bf91f82ec45947442f04a43a956cebde9286447db2e6b37b37a17444fb71fcc7466ab67655f1884d8d7eeb
- SSDEEP 96:Y5z4UpZQdlSaeUKrIitODu1hnnADfIhoKPOPOgXIE++cCJXHYt5PfeoDKXmL:Y4IidlSN/tODuTEf8oPPOgYJDCOtxfeA
- TLSH
  T193C1952916EF1893873AB26C738643A773278267809DEB42FC1D66557F0D32E2079F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/listener/PvPManagerHook.java
- Size 2KB
- SHA256 249a8539724319dd4236158c6e462d950bb45c2fc1a1c631b105763ff516c705
- MD5 39ed34e3676a4c1c196734ad35c14bae
- SHA1 0237479df64a780c6e03b9760900e2d44733d802
- SHA512 1c5c92c783965cdac44810f301eabf5ec9ac146bc4d7a94751e273a539058125c73ea2a4b416c8791289527136b5d568348b4d4159576eb61e04b1d885f1165b
- TLSH
  T15D51210B05DE4D93029FA39EFB4410D1B17685EB1A4EE150FD7D5EA81F4292D02B6F09
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/papi/KillCurrencyExpansion.java
- Size 1KB
- SHA256 76257935f39960d942f52c6c1c69c1859e7fce28ea20974e7b639c8c95daeda2
- MD5 28e658e49cb4a3d11b8f8485077c7b47
- SHA1 203e5d4613a213c6c9730d70023acdd81ab53022
- SHA512 06a60d0999aea33651a27125e65eda98e0f14e8a7d8de88369cd1605e40d7cf46245ccd107a9c341caa0655e7e1a7acb603a78626a7723016badc4817c43c4d0
- TLSH
  T1C021B189BAC9C162423870C4A88860E2763B6F4B796EF2D5F67C1E227F4065CA171626
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  kilcurrency-10.32/src/main/java/de/tim/killcurrency/shop/TraderManager.java
- Size 41KB
- SHA256 819c1e1117b95174d1548ec85b289a786e8f4ad22e00c5abc18180071f1ae32b
- MD5 aaa0da67a3435e2feb9e8b937fe8c0c7
- SHA1 fba56330f5fa895aa57f5572a9b932824834a8e5
- SHA512 e932b5e9ccff75fcb6ea1c80b273e9f7e56f8042ffa88a71326b5c238c27366d39cb2007d35f8bb2fc6ff52fc89fe8fc11dfc155a6aea868a4a021fe450ef946
- SSDEEP 768:S2AfHT8Nj6MUA8ml8qgj9INdDpHBJl4fH12mCBmaiykLlNFqPHTKo80fz90ZkeLn:S2APT8Nj6MUA8ml8qo9INdDdBJlSH8m9
- TLSH
  T1A413B58F15E72921463BF06CEF875005FA39889B922EEB50BD6D47482FC846E83F5B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  kilcurrency-10.32/src/main/resources/config.yml
- Size 660B
- SHA256 a0046e06806a0c82e3d6f1f3a08fc5ad3f4c06e0bc236da75c603fb2781721f2
- MD5 6565c51629478a7cebd76ec4ba45a979
- SHA1 da438e949880316b882b1588e0e8536b7aea7879
- SHA512 a21be3554d9046b9e74bd21c30d8a439aab0d72483a0c9357cf58617d6ac1d5dc53b2546c819e1e3da546ed94798f1fc6811740e5783f877a096375e5abf4e62
- TLSH
  T156012D0E938BB4785F6EE128993EB0C2F35C591AF07929306098A00AB2EC63C80085A2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  kilcurrency-10.32/src/main/resources/plugin.yml
- Size 568B
- SHA256 af4b09c2f6d1e4ad5c934e7779a8e15d38272d9afc64c0d6e88792bad2e3e424
- MD5 9eecdcdb3299a909e063b730811f3932
- SHA1 682ea206ab086c1d2d937b4d66592b26e71d72d4
- SHA512 1e5fa99f798741c84ef17d3ceff950b6345283d85da64e041b83a8ce8969bf1b1f07c6d5aaf676f62c4491da7795e9d339bae6b21db78dc330a3bc051590d700
- TLSH
  T172F046094E42B2F4D63A80462C258D0B33321F0BF1B3699475EC294C1B866DEC9B65BA
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22