0b9b00ebc874c1235c26b48d8105960716fa6fae91cda92c5138ac3e8785a7aa

Sharing

Copy URL Twitter E-mail

General

Target
Kingdom App Oficial.exe
Size 75.7MB
Sample260703-sb7laagv7p
SHA256 0b9b00ebc874c1235c26b48d8105960716fa6fae91cda92c5138ac3e8785a7aa
MD5 9636a777d06b4a45a5ad026bc86280f9
SHA1 b0b40d5635b1088e6e27de202e9bcda7e4c9186a
SHA512 ee13f0feffdb0ee2dbb50bfa313c2ebc1b8877cf5c81bb267bd22b580609599908cd87bb8420ae8e6be843992c682c74435469f6771f44af9951942fa246b556
SSDEEP 1572864:yt9IKPg5JwE1Zq/0Xc7fQ+WIV37CtBkWFkQcg2YmS03tWMLna4XFPAX7:yUKY5Jv1ZqsstSBkWm9MicGa4XBAX7
TLSH
T1A108335258498B29EABD6DB41910143246AF6E7EF9ED3C0D3DC5F02338318EA613D79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Kingdom App Oficial.exe
- Size 75.7MB
- SHA256 0b9b00ebc874c1235c26b48d8105960716fa6fae91cda92c5138ac3e8785a7aa
- MD5 9636a777d06b4a45a5ad026bc86280f9
- SHA1 b0b40d5635b1088e6e27de202e9bcda7e4c9186a
- SHA512 ee13f0feffdb0ee2dbb50bfa313c2ebc1b8877cf5c81bb267bd22b580609599908cd87bb8420ae8e6be843992c682c74435469f6771f44af9951942fa246b556
- SSDEEP 1572864:yt9IKPg5JwE1Zq/0Xc7fQ+WIV37CtBkWFkQcg2YmS03tWMLna4XFPAX7:yUKY5Jv1ZqsstSBkWm9MicGa4XBAX7
- TLSH
  T1A108335258498B29EABD6DB41910143246AF6E7EF9ED3C0D3DC5F02338318EA613D79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 75.1MB
- SHA256 23429bfbfc747378a0e6c7fee8f954f086f7b91dca3c98da486b69c57303fbb5
- MD5 ce364bb5b3bc2b7042a59235cc9437cb
- SHA1 8aad7be53e28e29c2c5f75e59cab60103f0449e1
- SHA512 e841c9a8c1b20d8121b1f599a90e7c74f5da01c35a263956332a9d05c6af0e5c53f0d4ba82c796e66d4b98fc7cd9dd8e5ab33f56c7039799c2873d5da1b0a62b
- SSDEEP 1572864:6t9IKPg5JwE1Zq/0Xc7fQ+WIV37CtBkWFkQcg2YmS03tWMLna4XFPAh:6UKY5Jv1ZqsstSBkWm9MicGa4XBAh
- TLSH
  T1C2083323925F877667EE74FC19900273979CF978A4EA280D3A4CF150BC5118B152EAEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  chrome_100_percent.pak
- Size 148KB
- SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
- MD5 83ec43f2af9fc52025f3f807b185d424
- SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
- SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
- SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
- TLSH
  T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  chrome_200_percent.pak
- Size 223KB
- SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
- MD5 dc48a33bd20bfc7cacfc925a84b015b6
- SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
- SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
- SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
- TLSH
  T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  icudtl.dat
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
- MD5 ffd67c1e24cb35dc109a24024b1ba7ec
- SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
- SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
- SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
- TLSH
  T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  locales/af.pak
- Size 520KB
- SHA256 c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7
- MD5 fc32a6b72fc91e1be9c2c9d2ea586ec3
- SHA1 5d439600cff26476d8715b778881f5735356d723
- SHA512 b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250
- SSDEEP 12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
- TLSH
  T1C5B41C0AEB80173D09A076D6BA0846F7FB9CA26CD770B2B6DD9D823105A6EFC117D1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  locales/am.pak
- Size 840KB
- SHA256 49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c
- MD5 e0c0a175875fe04c01c7606efc083d24
- SHA1 15cea393a6cc1cbd619303d78eef6948f05710f6
- SHA512 3fe18007d138b39707007a98b95781619f892aa5163f74c600c930c6284f4219c2a6714d25a104eabb98f763fdc481ab26ddddd1bd4010ca1630b5d8fc4e2994
- SSDEEP 24576:odRToH2hTCNRysrxQH9hjN3fpzvh51muMXqVFq+XG/6WxLP5Y:M5z
- TLSH
  T15D05BA547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  locales/ar.pak
- Size 921KB
- SHA256 817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc
- MD5 480baf1a6d7fdb28a105180bd5791388
- SHA1 9556fabb0744eaa5eb17c93a5375f31b5315d7a5
- SHA512 24853a554509eb069b04dea588ac154d5dfb2601cff8f1575d9f83e8b1fc787fc723c65d952028e1ecd2eecf406226ed8b5eb07a1bec58efce4673e5d97d4e18
- SSDEEP 12288:NSi92W+BUC/+/RxNEhugvPUzumJkOCSn5KNp5QpnSEqt:7wWYK5aQi
- TLSH
  T163158AE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  locales/bg.pak
- Size 959KB
- SHA256 f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83
- MD5 d9d3b4d420be9277d69584a3c0b5080a
- SHA1 285a094979b739c4455e3790968d33ca4d466146
- SHA512 388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803
- SSDEEP 24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
- TLSH
  T1722524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  locales/bn.pak
- Size 1.2MB
- SHA256 5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d
- MD5 f22d531de1ef474d9839c96e22a06277
- SHA1 9b12fcf37966444273451d9859e20a3c4a4be1f1
- SHA512 86f9958450e6d4fddca876c7bbc87d154d17fd6e8c002cef98a97c5d265f215c2d8e32c9cbcdad5a28361419877367cd959cbcc24eb77229cd982df0a8a2c8af
- SSDEEP 3072:LEcoGqGB2le1abaCb6Ew/0WySZISox22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T5F:LjJfa56/0zDgpCOXqB+iBbD5YqNP
- TLSH
  T18F45DE209C6E81B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  locales/ca.pak
- Size 584KB
- SHA256 bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89
- MD5 d042acc4d9f540c737480d25488ad68b
- SHA1 a3a59a5baab008eb1d24693bcaf551fe1248c4fd
- SHA512 0e11225f2362770d10a387c56ffacba75c2bf1607da7df576e0a09ff0254736f825e5e4f5b055171d62c46d6a7f7e33548e9147d26bdf8113576cae9a5e0849c
- SSDEEP 12288:Ogqbr7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8v:OjRVoiL6qhgMNxgQh5vfScs
- TLSH
  T14ED4F8239FC93B6744D3320AFB46C257F48CA9847B06D254F4AE1B1622CCA9CC677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  locales/cs.pak
- Size 602KB
- SHA256 db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1
- MD5 319f34edd53fd08e79e5f443aec8e098
- SHA1 c98bdb5c6c1cc1b1581648ab8498b8079aac85ad
- SHA512 619b4365a4c7c620f09d472a5a5c1d984095ff6b03627333e8a0688b2f21e138ff50b6a3d5efbee67beeddd377ee47202b4607c69a6b76aeaa5fdddf28aaf0ca
- SSDEEP 6144:6KHOO0BmicuIsgyha94N85AKh6mARAO52C+TH/NOnbJSBXq8QS:fOEA1glC85AK0P52C+TH/NObJS9
- TLSH
  T166D4491EEEA26435588002487FBE4228BD5E83540B2EB9BB6CCF9C91217577E8FF4D54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  locales/da.pak
- Size 545KB
- SHA256 e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04
- MD5 7db5f17d66731b076727181f7f66d867
- SHA1 82ab8e705a0eaa73c20bad139467d193379f82a0
- SHA512 fc1809fb53ea2f5e57b3814a8a7323b96cca724de2528ec39544c51525b5a4df611701712242f910f23628e68cd45fe3bc9ddf519d4b908965cc56f6f9450a3f
- SSDEEP 6144:IEBnngPFn32fJMoRzVsh5OsmZE1seDrcwlQJWJwgKobwmPaHLV5bpkUdRi3jd45k:IEBn4tGfKmArYbp5bpfdNm
- TLSH
  T17FC46B4BCC9C732F89AA0764F3118EA7EB5D543CC684264FA5D8943A09CFD6097BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32