7df466253fe04faa0564c07d7d10def1947d9247808b2bb54e7fa0a85a0be387

Sharing

Copy URL Twitter E-mail

General

Target
bloodmoon.zip
Size 2.0MB
Sample260721-2gaceaam9t
SHA256 7df466253fe04faa0564c07d7d10def1947d9247808b2bb54e7fa0a85a0be387
MD5 9a790db2e06c73f4defbf2ac6b898d3a
SHA1 b1c1a97306261e64ec4c0a6abab68cbec2e94b5f
SHA512 986b97b7c1ad404c4331532fc0e12091ed1f83eb5c071ef2125e21023bab9dae780a84f5ca2d6f2cd4eabd736082ea502fa047bc11d4e1af1336b1c0f7d404de
SSDEEP 49152:cdAnCTEGq9JASENyiJ1A9qHVI5mPQfQTYs/nljcT0/Y2kXbqia:cdAnCTq9JASROjVLe8Z/la0ZeHa
TLSH
T165A5331C1300E1B5E623F66FE55E4A8389F16E7B990E04253B53272E83866C57D03BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  modlist.html
- Size 999B
- SHA256 45edf4da2c5c16005aad86142312757ff3c73f57b44866ae81ed375b51b87628
- MD5 8bf83784fe94513b4fefb9357e6585fa
- SHA1 b6cf9af16a2d38171965c7fed24ea0828b4d082e
- SHA512 7fce74d7bf62c2bfe6a036f5645305dee6540f55c5afe69916094efe10256ed8064016356403522dc77a7d9fd0195756464d111bd8c44b7453efb014282bd9cd
- TLSH
  T186110AB36DAE7916362AC17D5034771DD917A5E69A4D0EFBB0A308873BC01C3192405B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  overrides/mods/GlitchCore-forge-1.21.10-21.10.0.4.jar
- Size 111KB
- SHA256 1d5feb7a78f3fae835de879168a712e0c67be8633dbff491f2a795ee2aa1245a
- MD5 2ce4a106b8f7947de204ebd967db4edc
- SHA1 fd0d523b4f09141a4fd33293542f29c7f5b5cef7
- SHA512 84c10e6399a974689cf5dd7cb3869bde7d39f71e6ecd91cd01b91d5ad767242af19b8964d224c7ea5177c3f58bbd942dbff25e52168781cd47ccfc13a9d4a430
- SSDEEP 3072:wyQELs/T7nxjCWuIyrQy2xZschl33WjJ974/M:wnaE7noWuNQy2E7x
- TLSH
  T16FB39D35A48D1E76F6F6023AEB5456423A3A07DCE78A55013CA83DC6E83BB1E4F1164F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  overrides/mods/balm-forge-1.21.10-21.10.11-all.jar
- Size 635KB
- SHA256 870ff8e57ce0c760eb4cedb471d4d5aee93ed8c3f704babd4d344ca32bc248b6
- MD5 8650e6e293cf17cfb852e7902b43423a
- SHA1 b5b702520fc4e6fe63d99327ee91ebc8e6ee2ca0
- SHA512 d30a5514a121d163c94a7f1a041c251a3c11841cfca73b2abfb285d50eb70652862e4b0bc1147932dc8a33e788dbc5930cfc44418b0216ad285c82b4e5950d6d
- SSDEEP 12288:It3WSUM4lNkkyKPEsvck2VpiWc2GfFtnWLcOe1dNXHTrWsHL88KX:ID4TVyKKkMiW4f7h1d5HTrWsHo
- TLSH
  T1FDD49E1D60AF8839D7678339C8316A331E9F2DE8FD3B7E5E38E04909D639042679561B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  overrides/mods/balm-forge-1.21.10-21.10.11-all.jar - Shortcut.lnk
- Size 1KB
- SHA256 7356dd608275d6475852b70dea1e35bf33c41d6a327063af420b3f261b8036af
- MD5 a13e0ca5d94eb9f834d15577964fe306
- SHA1 3d35c11c86e68e67e289c59b5e58666068c46e16
- SHA512 e5b1def7adcb34556919d690aeeab81de7e45a0c2a43fd8da4fc2289482d650ad0a5ac72b288a044114649734b4001bca78a18777bb05b92c2033645e40e47f4
- TLSH
  T1A83101004B760224F5FAC676E8E3B252EBB1BD02AF092F0D018065014520707BDADF7F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  overrides/mods/herobrine_trees-1.0.0-neoforge-1.21.8.jar
- Size 9KB
- SHA256 f155c81f66478fbdf3e250911cb95e48f4e24c0cf27b23a06bc9de420aab9def
- MD5 baf32ee0d48c4c07edfebced9e7cb5b7
- SHA1 66f65c17f836a0785945d1f30b5c7e629f95f965
- SHA512 96329b759602aea71511caf2403e1a15c979f40042c645d88554c38d19db21df8c24d70560677009ce30186d90464689c37055d02164e015d9d7dd18d759dc68
- SSDEEP 96:sUAhcbIHHq+YOP6t/jBBQ6DVwk1yfuHD85mr9GSwir7m7D+s3oIUZy7VkliJadJ:sUAhc/9OP6t/HYgDHxGNMW6vsYiS
- TLSH
  T13A12E964B176C84BDA765F799F940833382C1FAF4B177D3B9410A42E7E7226C16AB8C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  overrides/mods/scarecrowsterritory-1.1.11-forge-mc1.21.10.jar
- Size 278KB
- SHA256 97d53f496e84747d44b421c9016ac87f3d2ce3982ef4c4422ca11cc842669668
- MD5 be5fe0f9617e4f808a8bcea231d4ccef
- SHA1 3c14e3b131ec6fda1fff672484c8f1c9aa625025
- SHA512 caae200bc9200bf12b2de15a89095f6512a4430a1775e3c8d3aec74deb24b6292376d8ec1ac60b77a15bfde60aa0c015cb40c1d7644422073e363034ba91e738
- SSDEEP 6144:SW5yFIhBXL/6eUhvEsKC5YdaFCh4JcWOFMDIBBJsz1GEE4Rp:SsEIfbSelC5n5JcWUMDI5sztE4/
- TLSH
  T184549E1236E734ACCA2A69786901F4A31A8E0B1FC4397D67635B8711F4FBCD4136DA2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  overrides/mods/scarycaves_v2.6.3.jar
- Size 5KB
- SHA256 beda76f1a9b86df29aff3944505c3b49cec51ddc711e257ddf52ecc43b82ab37
- MD5 cd1cc9f4018646daeedd6d677c15ec8a
- SHA1 09f27126f033b438c4b9a13f857d8a860c15b6f5
- SHA512 bae92d194281d7ecea8e77a20b74148a951b60b1a0e2561d21b58d5f598d0e3a9fdb602608aef17f02b3f24e20e89f45960f33dcc37fc5e00806546225fc63e3
- SSDEEP 96:UbJbEi0/Wf/YkaHkUfHP+v1VE6wayLMTEwDPbqpiaO1n6R:0JbEMVGv+v1G3aGMVDjqpiRn6R
- TLSH
  T1A3B14BF637BE919DE37F10B92D23A503E1390D2E22953B4F59549CC41993A08ED0AE5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  overrides/mods/spookydoors-forge-1.21.10-21.10.1.jar
- Size 257KB
- SHA256 782a26bb4e38c5862c65ff932dab4608785f01e9d294551703b92951acba126d
- MD5 c610c60b9b7cc27101ee2915bd22abf4
- SHA1 1d23b74ce9bebe4f170a8017734971b5879f553f
- SHA512 befdd7c9434e569980d83e762096b6b63b60d3a197d416eaaf304cd694cc3529706ee29bd8fbec870b9f7d4639e64f7d0acc406542c5431653a777ac4547135c
- SSDEEP 6144:l7fWPJiTBjthOxKh650PSagASORKNVRXiA6/okT:l7ePkTBjtsch6KPsAfKNVRXiA6wkT
- TLSH
  T19344BF47D3BE4D47C62E077C9C2A0A43E6890B7AD64DF1BB71F2E406986BF8055C5B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  overrides/mods/supermartijn642configlib-1.1.8-forge-mc1.21.6.jar
- Size 203KB
- SHA256 35f5f7338fb4a1acefd45a45a745947bf479089fd08129012d6fc066ccde8584
- MD5 a587d74c0870729c44142bd09d0b9d5a
- SHA1 40788240978892cceaa23ff191e5114f00a97ef8
- SHA512 f7d90428bfa8aecc9e1d95730c20ffe89726e95d79a22ae846716849b18f557b5afe2e02c41cdefe5ce3188764f95672d78fb494c7855c24f78c75e1961f00f9
- SSDEEP 3072:3ESnfACCjFVsf2I3R8F7611FGITpFvZ6wvPOnT9pIVsSI56YW4fs8fVxfanR8xNS:pfAvji2I0763Fhpn3PgGFxY7HX4yrS
- TLSH
  T1C214021BD29DC277E9339E33C06D65E53CEC06BEAE07246FA5D1278715AD888A34460F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  overrides/mods/supermartijn642corelib-1.1.20-forge-mc1.21.10-all.jar
- Size 767KB
- SHA256 8bf202040d13625867ab6dc937fc3437a20fe1fe5fb38e87a1d546bc97078e22
- MD5 ff053dcaf35b394f7e0bc5a799d509c4
- SHA1 e7255d02e14ddf17fce57f7648579d2842d2d27c
- SHA512 3517c5b266aa89f0dce8d1bc3c03f9fee42654dbd6e742a6e2ceebde6a89db6628e009dc4b0d67c5af512e44fa0970ab6a9db71711e29b27823f6e0403e31db3
- SSDEEP 12288:2sMqny7/e2A8j1Ag++80TdgAqSAwvacLyV8zxCmRIxPEKWSibW59FoHNk9S:nE7BvhzJ3PvHLSiCrEKWIFKmS
- TLSH
  T1AAF40237A5CC9235D633EFB7D1182693301D2C68FB87A09F5CD488C7E9A9D84A391927
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20