08661ee35342ccc3649c7ec4f40e9c4f576096423ec03cbd999f6cfd125820d8

Sharing

Copy URL Twitter E-mail

General

Target
Mod For Kai Kai Mod.zip
Size 21.6MB
Sample260702-vljcjsfv7r
SHA256 08661ee35342ccc3649c7ec4f40e9c4f576096423ec03cbd999f6cfd125820d8
MD5 fc857fc754f1b38add4e65b1417fb98a
SHA1 55284921a080e5c8044919c0aa68a673748453e0
SHA512 858650705e5cacd8598492c8e519ef8f188157152a02b51513b0b55920c65b1c8fa99d878f5e026c6820a70c776d89123326d5c94105870b389496a5b66acb7d
SSDEEP 393216:F/diPZP24zXreGeCYElic1aHt8oU/WuiOSDeCmeDYZMPkRAOhTVUxMrsqa8bAo:Kg4breGbicEN8V/FiDDeCAMsRAOhVU+9
TLSH
T1383733A3570E4043E5FDB6F06D3C866302EF92AB47F589E24BD67D9164A78040A7C6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Mod For Kai Kai Mod/Kai Mod For Kai.exe
- Size 635KB
- SHA256 923150dc242d553161589abea64a4ad2f618fea5db50526fc4adda544819438c
- MD5 f1c79fc98d62f8a00ea5052d3c29424e
- SHA1 36797f15c165e20dfea75d33bccaade3a99135a3
- SHA512 ac08f92fab351e3536befce29dc5ba55590435e772e5bacc22b289ac290bebc1551910475508806f4ca18b72ee4dd52a99fde91759ac77bb104c1215184ed3f2
- SSDEEP 6144:J/7oYfSHQPWTUg4qAjBn6DoFwXF3PJ8moddZhH:V7qTUaApKxXFfWvr
- TLSH
  T128D43AC1A1B212A9E4169E39D072FE770EBF6E653D1CB6176BD0FD433A731816923812
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/Assembly-CSharp.dll
- Size 72KB
- SHA256 78d7893059b272fd0c9a888b2d1af8515f58270e251f5b1c2e40ff7dbb325776
- MD5 f7cd777f4be8f084608c5b03ee9670bb
- SHA1 815960f03170139812d0ee054f55cbcd410d7e46
- SHA512 835db7ec8d3e7248f23f6a021e75b3da0a6c453ccaf7a55641dfbbc2e47870219264d2838d170170785c7814b4f6b5d1142f3fa2a1d4bbd51f306a1fa06a366b
- SSDEEP 1536:rsPJGoTYEdIx8xLsfQrTR7ZHZaBv56hmXWbsK/4JfQTFzdmpF3:rIqEd2QrTR7/aBvhmbsK/kfQTXmp9
- TLSH
  T1F873171136B80E73E7BF0BFA95A50A44D7FA5247614EE7CC1CD3B8CE1A837464A10A97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/Mono.Security.dll
- Size 303KB
- SHA256 d6b6c2325ec0bc02ebf6bd4f739abf05162aaeb00733d9bc2b7de5a8840949a8
- MD5 99c39a889bbe6d24d93601dfcea54d87
- SHA1 e23357caf279df5407d56b14d4f7a2fe90a0f0f1
- SHA512 a8853f3bdabfa4f24f632621afed6fb23029456bad9d932a75710d000efe3d9c360d8562a82aac8cefa1dfbf2e4e962eb8b8a40dd5a7f25bc4a6f1fa58a08b88
- SSDEEP 6144:vuca+sTOwf+31OE5FXNywY1URfxAzXj5qf:HUi9kgxA
- TLSH
  T14D64592973E8571EE2EE93B9E4B0442586F0B506BDB7EB4E5C8240ED2D43761C901BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.ComponentModel.Composition.dll
- Size 242KB
- SHA256 277c8c0c339050d03dccc69d5c0aa3833d178f5f115e5e5d0bcf54c7ae136740
- MD5 f153c4606ee5eaa766aa05fc1385c883
- SHA1 81b4997a5214a7155300dd0e1adafbb583c6f95d
- SHA512 308f6cdcc07ee58817702be67c3f68211c4a4f0ea56c90b5a4775889aeb2431618e22223f6ab6a30607c3c04ef0bd73512d62bf35ae402c09ae5b8b7908d1482
- SSDEEP 3072:zdpvT15KXwrqrkRixoK47Sr73v/1fLExXEGgDX/EOoRlKPW10QgFLqRRRRRqqS67:zrvTmUTTOoRlKPk5gF3HoJ0XtCea40w
- TLSH
  T190343A1633FC0366E6EF0B78F9B584408BBAB916761AF79C2D8461FD09237949901B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Configuration.dll
- Size 42KB
- SHA256 ee6659e8450d8e09a729ee340322b41097c711627787373273cdb1bab7250ddf
- MD5 485fc73575a1ef2e5738ee46a1bfe7b7
- SHA1 b9f23a367f1e7a20d41ced204d89d1845b462875
- SHA512 23d62862d3956324444e8a7e17bc08a78bdfcb2a98d13e930f51237bc70a6deecb7595f064dfa4be5f65bde4bcc43cb282812fc2bdc2b771aacdbac13139dc21
- SSDEEP 384:SC2yuMNMMZJN56g8mKo/hjp0r4ourMVSzciDqnjdiaFg9/Ses93HE7LDaXTSv/fx:SyP1Sm3ScrMdWgdVl93kZAarx2ZJt5
- TLSH
  T1781363253BA3CA7FC84A4775F88381345BBDC3252557EB46E16D7C38585B3A8C2533A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Core.dll
- Size 1.0MB
- SHA256 c43b351e7aef5d8beaee8cd1f8411b8e3065bcca2eeba3d87c85a28a6b61fc7c
- MD5 50a0364d2fce85c8867c660a014e950d
- SHA1 8b735ee130185a9815eaf0c38eedb925785b4431
- SHA512 d788347d7354a03f920befef6a19020451e449aab57c9761368b3fda837606f597f1db83f39c82faff459613646b3dd8a62bc446a76f38021ef76cf9baf9cf4a
- SSDEEP 12288:3HJ2eJWqejMiMRDm3l2fo+5HcXILaRbm57iNC/UB1658S0d5kcowul:3HFGoqCUXA0decowul
- TLSH
  T18325384133EC972BD2FF7B7AA430023957B1F866A77BD38F112091A99C627448C917A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Data.dll
- Size 1.9MB
- SHA256 428bcf3136d0c81680e4558d775066e26b0bca181218254f0a5df81917f33a9e
- MD5 34cc95171394ff19b78c59dc055e8bea
- SHA1 c3495afd367af019947f2419cf57acf1800e448e
- SHA512 09cfb22137bfe0ae69509d94e824ec043fa5d4268f1859659d369de1ce406dca411bdf01328eb83b5fa7ffac1a9f67e82c1a8f13d4d5b3364f6f4f033d527977
- SSDEEP 24576:vetFgYwMkru3rrFdx0dkR9VUJLdaD7y7X5bLid1EB8Bo6Dpc:YFLwirZ0CUJL4f1EB8Bjp
- TLSH
  T1CA95170037EC9A1AE5FF2B30B47505216BF6FC46AB76D39E2544962E1C63B508C727A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Diagnostics.StackTrace.dll
- Size 6KB
- SHA256 3976202cec800bda6a3e7c2154d7859a9a1f09712d0046af9b28095210b41f2f
- MD5 7527c5f87c15ba2d9f8fd30920aeacbf
- SHA1 463d8763d79a3934046821dac63c94c0eacaf1fa
- SHA512 8066511f8745cbded77176374f2744e899c0ab43309c0986d1fb8c1bd0cb6b71506ba550df2e278890599e204a848891c32a864cd0dd71df240d0c765e3f957e
- SSDEEP 96:G5SzrdBy6UFfVGJfFPlcqxvtVvPNOCua5fpbe1xa0:G5QfnUF9GBFPl9xFV8CFTe18
- TLSH
  T133D1BA20EBF042B3ECFB07746CBF57115574B9C49DA3AF6A2144821DFC66A915A32B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Drawing.dll
- Size 180KB
- SHA256 d541ffa3416bbdce87a69ac86620f1d5a0f10c8871319a5253d1c03447130172
- MD5 59ce616258d643c89f8834ce81e246c3
- SHA1 39cb92f63b094d47c854221f7bb767611ae73dab
- SHA512 063ee951d5f4967da540259bb0a73414efb65e0477fe896403c84248e68c39a3d9b924354c81348bce79cdab54e38121c3b51dc8b16c7031fc282fa980d54b8a
- SSDEEP 3072:FigawrUmay+yV3XOe3QpYbh+q+FR3F7lx:s2VnOppYbh9ixl
- TLSH
  T1D504F90867A5B61EE827C639F46081306730EE556693E3CF98583F18597BBEC83273D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.EnterpriseServices.dll
- Size 32KB
- SHA256 cb78a3a585d52b20fdddb45cab1b556447d45c8de2607d45c695a0c602b6312d
- MD5 4237b2f1a6fb5dfa1bcc81524869637f
- SHA1 6cd78b7e840a1835392cbdb6c28122f20f9e5f2d
- SHA512 81ce9abef9e1d974b4d4c91956f0daabffa96426b0a2241fe41558c5bd5970a57e8f01720f4ddf35b9fa38635772979a320f466cb9ee3142503c5261eef78e14
- SSDEEP 768:9FDPgwXPjXVB1SeXbtjfLWifV1jmadK/wDS1ubnPkQK:9RPgwXPjXVB1vXbIifbm8KoS1urPkQ
- TLSH
  T139E2D5769BB1CE6ECC476336FD63023423F4C3087637EF17A605A96A1D877AD8222584
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Globalization.Extensions.dll
- Size 6KB
- SHA256 fa4fa215c523156bcec0208613d5b9f220a25ee6be34a86d13c09e1ed339208c
- MD5 9277ad8c78b47083274c941bb9d425e9
- SHA1 641d51c1c30e75e5fb77f1af67578124cdf5d950
- SHA512 09fc324c4506d0600dd96f03f8cfc6400b56734f0d429b3fe9d08631f33b79231afefc31d0ede19908375a3174c3cbc42896f0ce555b82fd82e3edd3560f0032
- SSDEEP 96:L4ggaqpBVwEwAgzixv1EWeOARPtcRQKRWen0R/0c:2l3gWxKWBARPCRpRWen0R/P
- TLSH
  T147C19671A7B44226EEB78B35BCBF9281567ABA50AD23E2AF5400414D6C072084732F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.IO.Compression.FileSystem.dll
- Size 22KB
- SHA256 5c72525f420b08eac29c948b690e945165fa493503a524693c16c5c3ec9bf75c
- MD5 e7ed238da93a2fad2d8d33e65edcfbf4
- SHA1 68e117a1e794813c163351f94dacb0aecaac1767
- SHA512 b2f4a3f20317cf6492c0f01e6cee918d48d6723de2a5f9f47697d1ee81e6d67a4ded023ac6179296d33743b8532a794a7784b9c5ecb324d3e4cd715f96ea85e0
- SSDEEP 384:2930DrKcLQhPZcNgndNzytVTl0RRbli3ESmMadMMtDBEb/gYFf0B7a:m0D1Lhs6oe6
- TLSH
  T1C4A2A524D3E84329F2FB5BB5A8F6558646B27903EF36D79C2886135D0C32B444A23B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.IO.Compression.dll
- Size 96KB
- SHA256 70c4c421e7c061e8ec2b5e3520bda954362807fc36ed3d061a71f7623f029fd1
- MD5 c45f6bd18b4376496f2aa73f232d3d94
- SHA1 999208d66ed3eaa70205d8f261ea33af271bc6cc
- SHA512 980c9954635e4949c3d7ad3e02e010ac4da90b082d461e4849635a58f8691cff87940e7142cd05b588af8d1b7aaeb3c7a8d041cb6896c65997bb2563aee5b95e
- SSDEEP 1536:tVYlTkwzl46ORXHNopHEJo5JK1/E9ITZOBLOTX8YHujjHs67b:tVYZH5460XNopgo5JK1s9NCTXlHuXTP
- TLSH
  T1E5A33A1463F84757F2FB2BB898B1158207B6BD53EA3EDB8D2D1464EE1C62B408861773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Net.Http.dll
- Size 112KB
- SHA256 da4ccdbdab851b383678b0e451027516ae11e60ecbec39c11aa461a40d72441f
- MD5 43ffb06c772ab7cca445e3d247fb4d3e
- SHA1 fbd71df2c2a6f1b4efe4e45d4f10e7a82c2e1999
- SHA512 a29ddfced121bab7222a2e1848db9cab4ff2a81f813d557e5e09346fc1077ec4e7a35ca2a470c673d8b8e162a92461a2fd6615ae243f1bc1539e73190a222a60
- SSDEEP 1536:pRfx2tSFNT2MqE17jh1hYg0CPa3sCSBjM4OeP9az/XRPb4nQ/7BY:pZZ3quXKACSBjM4Oskz/XRPb4n01Y
- TLSH
  T11DB35A188BEC8B2AD79F9BBCF4B0215987B5E507B517EBCD6C4865F91403380AD017AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Numerics.dll
- Size 111KB
- SHA256 d93a812e8ad838fbac39e1d41c170c93ccb5c5434b225201c9b466d5aaa4c05c
- MD5 7ac82decdf0ccee417ee9c335ba36bd9
- SHA1 261998eca40c2626e40683a97dbcf96565323edd
- SHA512 58294c6eb428cb0c77afbb0095bd9a1b5b15f26c1462b82cc3bd80b4e4767e2024bb30d56102342226b90324707cef34611e0296be00b2dfd70882464aecfb26
- SSDEEP 1536:1tbXi3q2X2T+jc5o9SQMhhuiVEptn+igiqW0NzN9CXI0pVzDtPrXpNPRGHLd9cW:23qKc5oEhzVKtfg7W0NXlG3tPrnQ/
- TLSH
  T1ECB31B6C5FEC8A42DBEE4EFCD8605D1BF624B0139673E3FA184C59B01927B9A6405783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Mod For Kai Kai Mod/Kai Mod For Kai_Data/Managed/System.Runtime.Serialization.Xml.dll
- Size 7KB
- SHA256 09b820905f030e05f88160fe19a2369213da2cbce1f28fa75cd8daab1d6c6c4f
- MD5 edded5c2c55a85822d7af665728e30a7
- SHA1 897a10b5c59412fa01468003474fc84c50196d41
- SHA512 b92a646c4585b686ef03d367b96ac5f124c16f8a6dec1097d89fc9ae25894c40cb437a5d98b4e07db1ef1314941c49cb94db987d2cabe19d8b1ee9d0ac33d639
- SSDEEP 192:DoDTEelH0QcXAcu5H8HWv6xkJ0MuENeqB8:cDTvlH0QX18HVk2MuEHB8
- TLSH
  T13BE1A422F7D8D626EAAB4B355CFBC6112372F6054A37D79B2244101FA8932905B12B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32