2d2cde47f79225bd844b4fe99ee8557d7c1a5752092e0e2a48b2f10ba27cb000

Sharing

Copy URL Twitter E-mail

General

Target
Krunker.Civilian.Client-1.1.0-Setup.exe
Size 102.2MB
Sample260724-wy9wpsware
SHA256 2d2cde47f79225bd844b4fe99ee8557d7c1a5752092e0e2a48b2f10ba27cb000
MD5 cda8a912572162e1fe9faeca14c6fd45
SHA1 ec2c6f8433ac6f97e9b7af3e2da55619d15bbc4b
SHA512 ae5233067a1bcee90774a3dda6b4587e5a9dee3cad751112f88e791948fbb69c5d26a2dc07e7f72c1a364155caa965cfc8b5125aaac5d3476b737cea459baef1
SSDEEP 3145728:dmEOdcyiO3kXaWCA69CWIm5KHDoWcGqHNJTPYS/a:AIqkXhp8CZ5DjqHNJT/a
TLSH
T1BB383300099A4B5DDB10E13AEF157ABB628FFE2A5BEC51B4B3D904F219680B74217F35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Krunker.Civilian.Client-1.1.0-Setup.exe
- Size 102.2MB
- SHA256 2d2cde47f79225bd844b4fe99ee8557d7c1a5752092e0e2a48b2f10ba27cb000
- MD5 cda8a912572162e1fe9faeca14c6fd45
- SHA1 ec2c6f8433ac6f97e9b7af3e2da55619d15bbc4b
- SHA512 ae5233067a1bcee90774a3dda6b4587e5a9dee3cad751112f88e791948fbb69c5d26a2dc07e7f72c1a364155caa965cfc8b5125aaac5d3476b737cea459baef1
- SSDEEP 3145728:dmEOdcyiO3kXaWCA69CWIm5KHDoWcGqHNJTPYS/a:AIqkXhp8CZ5DjqHNJT/a
- TLSH
  T1BB383300099A4B5DDB10E13AEF157ABB628FFE2A5BEC51B4B3D904F219680B74217F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 101.5MB
- SHA256 683016fb27e946bb8f1434f88c099b58780368a2631fa20ad194e92b61dbc0a5
- MD5 c53844b11c42a0f4df23b670ed32610c
- SHA1 3de3ab7eb552eb677f243d2ca700802ab0b89cab
- SHA512 a789278934fb7939d9413ea4286d54f9946bdbb83b3840f518da9cb892c30a6e34cb2f7b0e2c1e51583816747b0fba3b867f56b71ac22a4c8642668aa7d44d52
- SSDEEP 3145728:LEOdcyiO3kXaWCA69CWIm5KHDoWcGqHNJTPYS/Y:TIqkXhp8CZ5DjqHNJT/Y
- TLSH
  T171383300099A4B5D5F10F139EE157ABB628FFE2E6BEC51B4B2E904F219680B74217F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  .patched
- Size 57B
- SHA256 3f08ef662c43fb0e6600a971241e2d6ecc8d78c31882f02102c038e3e548bfc4
- MD5 b6a9a211a70e549bfa665470eb98d821
- SHA1 4e1ed5b15ec75a3573df87bc920024846e94e1ca
- SHA512 47a2e677b856f164b8e297ac42fea7bdb43fe0a950e7f93eac8bd4e68c50de18b03b740068778b0039884e233a4ee6f3d1d7731bd9eaa19f86aba6fa2582b55e
- TLSH
  T12C9002D6E1C119A21D140C1417861F1407A71954762C9115A46B54455036643E1995AF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/af.pak
- Size 599KB
- SHA256 e16a85aae42dd387971140f0bcea4ad9c25c5f1d06407e7e46cc549241db0d58
- MD5 411d05115a910e8ea657d4cd5fbe565c
- SHA1 d42e89a1f7cf6a6b4c584bb2255d25254de89a63
- SHA512 a13987529ad4853364e34c6d1759fac4ce029bac5ac69008921e8f42c168b51acd049d744da81d7782818abdebae9da306cb9c55460a33352b169d3fb9a122c2
- SSDEEP 12288:sFBSNPQ6tRGtAd9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nImg02Y:80PftRGtAd9PZRwBgNYChF+plibi4H2h
- TLSH
  T141D41A0AEB91173D09A07697FB0845B7FB5DA26CC770B2BADDA982310966DFC10BD0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  locales/am.pak
- Size 971KB
- SHA256 03fa71456bbb5e88694a519adc8f8ec9ebfdaaf4ecd8f381343f15a1805e3afb
- MD5 308ab1908d52d28abe8b24464fe87932
- SHA1 589652c6631d35c75145e866bd4e1bd8807ba511
- SHA512 f90aafd1f84cf5ef9cd9da8a5895a79e5c578fe79e0af0bea9a0e72f4f15d93ff89da12c3ccb94a6b0c9fc3f30777d738fd132da250b4f1f1401bad727feaa1a
- SSDEEP 24576:DhJTx1X5t7hTCKPyaEVxsxHjnwvxehz+dIXV6sciy4VdeZtP9oPYOH+:Dho
- TLSH
  T126259A547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 e952c3a544f0b91cf26e91c8c7a763755cca9591aa915a9d3e63a6cf6daacf6a
- MD5 b935c7b5d6dfd3d38f83e19aa54dc347
- SHA1 a176593bac89f323633aae88bdc4582fb7cd9922
- SHA512 c587ef4a945c0bff07a3b006b5d3129d83cb746c658bf3242c4c21ece44dca6f612fb34e5e091ee1f9842d4ce0393abe9409baaac30d67f30355651b42554b50
- SSDEEP 12288:cwug4BndpLFB62Ga9mwj3o0oC5v4UGPEk82/SLZNj6EuDb6NPz:cwu2Er
- TLSH
  T151358BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 889c68ea8206027dcebd1835884eff52f53c59dfb00fa112c43a2fbb87083ce7
- MD5 29b2a61caf2359cc199abd73b1e3b5e5
- SHA1 f5544ae9be0a3a6109cbe799817488d56693bf97
- SHA512 2da43202ac57258cad0711ef6e62dfbb724dc93569fc63c140bfa2e8f0b4dcb1e1c28a3329c87416ae20d549c8032aecb36172de917e09fc79c2cadc16a66524
- SSDEEP 24576:CBZjpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDNiJw74uOVnaJcuSMQ:YjpWclYLYAmUUPVb6nNo7j373ZKmy3pt
- TLSH
  T1C93525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 1b3cb0d1ac1627b51b3a208f3f29864bf415bff3d1d0d5a8b84e7ae4ab2455b4
- MD5 b7afebd1d2e061a3e4344b2d0399a39c
- SHA1 01a8f4a891830e1d7386ff37aab124c76436c1a3
- SHA512 1321225bce9bcb938baee4a395a614fe336b747b4991304a6a93ab3f13ce3873c25cd0963f3f031ea9ee6ff1b1544ec8dedd5823af9021620ba92f4a347c71ee
- SSDEEP 3072:8ad9I5bJbm2k5vCXik1HJvIGB7AlUVOlm2COUzhZygYfj8tRq+vyQZWUBbXUOQS1:8a34i2I6/1pvLFAayQZWUBbFwdTM
- TLSH
  T1B965EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A15938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  locales/ca.pak
- Size 675KB
- SHA256 5da35ba1fb3132d4725bb32d1b1c2a5703ac86effb7ef294470b73887e27b663
- MD5 27cb284465711680b09e7661f512d779
- SHA1 b3cd7d9c445cd5c04ef506e31a7be69c3f67dd28
- SHA512 be518bddea2e9db8d4bf660c7e6fe2f8a2a4df1a6bf82e15033dd32064069941b342cf7c654af1baac727151f9af54804af15cb3ce0675e6c65653a9dc989b85
- SSDEEP 12288:hszZex6C4L77IO4yCiX761pFa8H5PsFBN3Mw2juwwPR9zejm0t3l76FTZKmwCRYt:WzZ06CO0wlpLn618IM0ahfilziQ
- TLSH
  T1B4E4F7239BC93B7704D2330EFB46C257B48CA9847A16D254F4AE1B1622CCADCD673AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/default_app.asar
- Size 108KB
- SHA256 06d4a28be095a80eff94dbd18edcfac5b5805e1b5538e0fb7cee7c7ae81db76a
- MD5 b77337fb8603878f51166531d417cc81
- SHA1 7633d1649735b8a3b223ff4a31940b3ac9ac4799
- SHA512 85a307d774ddfb658956263919ed12cbdf64f4e6d8db7222fb827548c5345427193bfe273aa30ad537ad0b4ea40c1c66e88fa3f6d6fe4a81caf9c871dd2560b9
- SSDEEP 3072:ZWHxvTvFRWrjXxs8xbKNkCeF1SBRbFdPQrZsH0L5uRD:ZWHd5R4XxRYmS7orZsH0L8
- TLSH
  T1B6B3E19112F60231D86B4AFE9FAF16267A39241732CDD0C4722D87609FE15D6A5E3BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 0816235deb8764dd6e53ac8bd4591f94a973562255e3b7a44acb442a56d1dfcb
- MD5 4834422a580c5506d112218eb1b8265c
- SHA1 cc599f906b03b91f8bfef35341db9d02289af4f0
- SHA512 f5d7474a5500065b970daba36d6c168870d9fb6c901a21e380b143502620303a4ada7cedae11806d4d68bd90d92ff43b890c06bd9ca5f2e8b8afdbae2c1e7364
- SSDEEP 49152:+vJJy103jVZcR07vHbVjRqKsOYW2ZYSlErVVLJlsRM6JpXgCGbeekeAdcbfDOYLn:+vJJxSq7ZOxAHsq5
- TLSH
  T1DF464803F69681D9C06DD5788B5BA633F632F8804B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 905KB
- SHA256 a7d415701eb855ea434d5c680a7239a0bb0629df590bf01bba1c4e82a44e5cf7
- MD5 68242bb3b83d1f8b7778333de95f99d0
- SHA1 1060e98bcf2740e951d0fbd9ee465028e70bc9e5
- SHA512 8dfc0be5e23cc6aae3b71538bf61ba6866ea06728ffe8c1773b7fb6d6ce24bec68eb61a0a01d2514f8f9370b6a5d6b6483f9b7336988a4307606719d6553e463
- SSDEEP 24576:EKrksRkS6nM5E+VOUH6Z5WzcADYsHkDn6g3P0zAk76oOH3RJ:rrksSSL9OUH6Z5WzcADYsHkDn6g3P0zE
- TLSH
  T1EC156D22DA648A69D6B6C074D9D18A0389F174812322B9CF07B817147F6EFF42B7DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109
- MD5 52ff52eee3b944b862c11c268a02c196
- SHA1 8d041966e6fba10aa5e10ce5dc1dc5175f11b2fe
- SHA512 2861ae5a06f8413810947c08994f4c0da54a1acee8c4df72cd8b03a9503b26e5512809f8d70fd584239b04a651e7329a701bf7ddcee2dec2c2e14d05ae74f220
- SSDEEP 48:EWQsvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvW:ER4N4S/992/zDmrkVIe1ULo2K
- TLSH
  T105E3BFF256769258E29113445BB4394CEABF7F8A1A209893DE72FE56DAFF134448C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall Krunker Civilian Client.exe
- Size 222KB
- SHA256 b474a4a08fd236a4a834c97eef05f50bf5be8cc928e67f4b3ee9ad8264067f44
- MD5 5f68d2bf04a1d743b091a012978ee6c0
- SHA1 e074cacfefa2281969d580dd76860b63178ef6a6
- SHA512 d5033905913056236af182060b1ae0e2e581be5b009e911be6dcf7d6a571d80fb3cac25df53462997b656b7dcd688e9c5597f3afcb833c48afbc1f6d8332b3c8
- SSDEEP 6144:g740IXkl60/vcqD3gbx2Ua8T2t0EyL+yaF:6Ge60ncqD3gICLRKJF
- TLSH
  T15E24122277B0C963E5E74B714BA417B74ABAB41119784F037BA5176C38A3AE0DC1F362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32