e52efc013d78a5a8d1602c52dc7d6a875892bbba59fa8eeac8d234a9cc19245e

Sharing

Copy URL Twitter E-mail

General

Target
Quirifys.Krunker.Cheats.installer.1.0.2.exe
Size 99.7MB
Sample260731-x2xk8azbph
SHA256 e52efc013d78a5a8d1602c52dc7d6a875892bbba59fa8eeac8d234a9cc19245e
MD5 eeadbeba388c5826b3542a272ada7650
SHA1 12aafff239f6b80163d04741de682a0589a8a837
SHA512 4e5bc2113245eeab69ac990bf714d46b97e5e9c611183f14996b325eee3da62fdff3cd1e5d66a4cea2a41f45af6b886ca9624d9c3ff4ab64755013f75275264d
SSDEEP 3145728:zdLRykHE6XQO90AUfN1gij5k8TmnDbKb5e75mJl0lXL:1QkHhF0Aq/NTmve5e7UJl0lL
TLSH
T1E7383345D7C6E6CEE6B97D71481583BDE6A3A3AF31192235C80A1099FBCE6817F21F10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Quirifys.Krunker.Cheats.installer.1.0.2.exe
- Size 99.7MB
- SHA256 e52efc013d78a5a8d1602c52dc7d6a875892bbba59fa8eeac8d234a9cc19245e
- MD5 eeadbeba388c5826b3542a272ada7650
- SHA1 12aafff239f6b80163d04741de682a0589a8a837
- SHA512 4e5bc2113245eeab69ac990bf714d46b97e5e9c611183f14996b325eee3da62fdff3cd1e5d66a4cea2a41f45af6b886ca9624d9c3ff4ab64755013f75275264d
- SSDEEP 3145728:zdLRykHE6XQO90AUfN1gij5k8TmnDbKb5e75mJl0lXL:1QkHhF0Aq/NTmve5e7UJl0lL
- TLSH
  T1E7383345D7C6E6CEE6B97D71481583BDE6A3A3AF31192235C80A1099FBCE6817F21F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence phishing ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 98.9MB
- SHA256 33cf0e16a903c2ce7a98c9e1469a979f109412462bac2b42959c4c80fbf80ba2
- MD5 e899fe2cbd04049bd18c77aab787522d
- SHA1 26ce6144897cb68415eff207a49442de3dd59c9e
- SHA512 145313d53960a7b77178106aabda17ece72db3f51449704369396261e3fb653c10ba2611daaf3d1e8dda0bb1402dd3f1516e1f36b8f5f6d13b8c98f0540b9154
- SSDEEP 3145728:vLRykHE6XQO90AUfN1gij5k8TmnDbKb5e75mJl0lX9:TQkHhF0Aq/NTmve5e7UJl0l9
- TLSH
  T193383345E7C6E5CEE7B97971180583ADE6A353AF71193235C80A10AAFBCE6C17B21F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral7
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  locales/af.pak
- Size 599KB
- SHA256 e16a85aae42dd387971140f0bcea4ad9c25c5f1d06407e7e46cc549241db0d58
- MD5 411d05115a910e8ea657d4cd5fbe565c
- SHA1 d42e89a1f7cf6a6b4c584bb2255d25254de89a63
- SHA512 a13987529ad4853364e34c6d1759fac4ce029bac5ac69008921e8f42c168b51acd049d744da81d7782818abdebae9da306cb9c55460a33352b169d3fb9a122c2
- SSDEEP 12288:sFBSNPQ6tRGtAd9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nImg02Y:80PftRGtAd9PZRwBgNYChF+plibi4H2h
- TLSH
  T141D41A0AEB91173D09A07697FB0845B7FB5DA26CC770B2BADDA982310966DFC10BD0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/am.pak
- Size 971KB
- SHA256 03fa71456bbb5e88694a519adc8f8ec9ebfdaaf4ecd8f381343f15a1805e3afb
- MD5 308ab1908d52d28abe8b24464fe87932
- SHA1 589652c6631d35c75145e866bd4e1bd8807ba511
- SHA512 f90aafd1f84cf5ef9cd9da8a5895a79e5c578fe79e0af0bea9a0e72f4f15d93ff89da12c3ccb94a6b0c9fc3f30777d738fd132da250b4f1f1401bad727feaa1a
- SSDEEP 24576:DhJTx1X5t7hTCKPyaEVxsxHjnwvxehz+dIXV6sciy4VdeZtP9oPYOH+:Dho
- TLSH
  T126259A547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 e952c3a544f0b91cf26e91c8c7a763755cca9591aa915a9d3e63a6cf6daacf6a
- MD5 b935c7b5d6dfd3d38f83e19aa54dc347
- SHA1 a176593bac89f323633aae88bdc4582fb7cd9922
- SHA512 c587ef4a945c0bff07a3b006b5d3129d83cb746c658bf3242c4c21ece44dca6f612fb34e5e091ee1f9842d4ce0393abe9409baaac30d67f30355651b42554b50
- SSDEEP 12288:cwug4BndpLFB62Ga9mwj3o0oC5v4UGPEk82/SLZNj6EuDb6NPz:cwu2Er
- TLSH
  T151358BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 889c68ea8206027dcebd1835884eff52f53c59dfb00fa112c43a2fbb87083ce7
- MD5 29b2a61caf2359cc199abd73b1e3b5e5
- SHA1 f5544ae9be0a3a6109cbe799817488d56693bf97
- SHA512 2da43202ac57258cad0711ef6e62dfbb724dc93569fc63c140bfa2e8f0b4dcb1e1c28a3329c87416ae20d549c8032aecb36172de917e09fc79c2cadc16a66524
- SSDEEP 24576:CBZjpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDNiJw74uOVnaJcuSMQ:YjpWclYLYAmUUPVb6nNo7j373ZKmy3pt
- TLSH
  T1C93525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 1b3cb0d1ac1627b51b3a208f3f29864bf415bff3d1d0d5a8b84e7ae4ab2455b4
- MD5 b7afebd1d2e061a3e4344b2d0399a39c
- SHA1 01a8f4a891830e1d7386ff37aab124c76436c1a3
- SHA512 1321225bce9bcb938baee4a395a614fe336b747b4991304a6a93ab3f13ce3873c25cd0963f3f031ea9ee6ff1b1544ec8dedd5823af9021620ba92f4a347c71ee
- SSDEEP 3072:8ad9I5bJbm2k5vCXik1HJvIGB7AlUVOlm2COUzhZygYfj8tRq+vyQZWUBbXUOQS1:8a34i2I6/1pvLFAayQZWUBbFwdTM
- TLSH
  T1B965EF209C6E81B6A8C5CDC9434C6370C523AE9B9B61F74DDC17A15938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  locales/ca.pak
- Size 675KB
- SHA256 5da35ba1fb3132d4725bb32d1b1c2a5703ac86effb7ef294470b73887e27b663
- MD5 27cb284465711680b09e7661f512d779
- SHA1 b3cd7d9c445cd5c04ef506e31a7be69c3f67dd28
- SHA512 be518bddea2e9db8d4bf660c7e6fe2f8a2a4df1a6bf82e15033dd32064069941b342cf7c654af1baac727151f9af54804af15cb3ce0675e6c65653a9dc989b85
- SSDEEP 12288:hszZex6C4L77IO4yCiX761pFa8H5PsFBN3Mw2juwwPR9zejm0t3l76FTZKmwCRYt:WzZ06CO0wlpLn618IM0ahfilziQ
- TLSH
  T1B4E4F7239BC93B7704D2330EFB46C257B48CA9847A16D254F4AE1B1622CCADCD673AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  locales/cs.pak
- Size 701KB
- SHA256 0d6a7d8bb08c1c6b8a4735fb364bf7b81b66797e48ea34ef06f78c9d87d15f26
- MD5 4b488c0beb8ce3fb673d8c707e318f8d
- SHA1 c017c430463eea4073c9f2d5a79b133c1cede2cd
- SHA512 20a0d2447b5e338aa4a3b46868fc5f5112420ccaad7cb0d3430eca288af47742744062a0db5b295f869e421cff8c427cc8593514715bc10c3ba7c094f5305e34
- SSDEEP 6144:u/GB0eic2GSTEXtFefunUW5A1SBJAxM0zBXiZ8OvJSBsx8QJ:u/GWVc2XTqnUW5A1AGzBXiZ8OvJSa
- TLSH
  T1A1E4492EEEA36425584002487FBE4128BD5EC3140B6EE5AB7CCF9D912575B7E8EF0D48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar
- Size 13.7MB
- SHA256 e919950004a38cabc5d91916575df218860c74983cf1ea4a732ad2a071e8468c
- MD5 68b955f2004a84396351c79e6b1110b1
- SHA1 5c1642ba6c807dbab780c0a7b1dc9556db7637fc
- SHA512 262020309d7ee41063da1ea8fb590ac9335cd798970974c2414727237c3d5c79e7edb67e0d154adef41ce4fd5ef8d207174b852876dc01fd407a32498f9422e5
- SSDEEP 98304:3OCDyRYvjcWJGrL3IfrlJHIOhaM74vH3IfrlJHIOhaM74vt:F3cWJGrLmrHha84fmrHha84V
- TLSH
  T185E67524B9532259C03AA33BC63D5578F6B00A1F2545C13A7AAC9E851F39D2B43DCEE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 dc150d40c7ca24dc1d132990bdefa1168e3af5244e8c6e5e84a7d3f2ae20ead4
- MD5 359fd81c0889714c61406ab616bb4671
- SHA1 31d028960208b08a270fa97842d7f3c4afb8995a
- SHA512 f4efc87d2dc37bf2f72e2af7e855612e1d3ea1a60f90521fdc34911197dbe3bc4f518f96c5397d0f87c3cebf40e9fe700883ad0b6aa2ea79581f5a3a05db2358
- SSDEEP 49152:8Z8LrIVVMgjlR2tLwDfXKr+9UbQ0hPBkWGurGIqbDX6B/y85eJfXwGzuQctlELcz:8GIVPqrBwiyh0thdoYIaD
- TLSH
  T147463803F28681D9C06DD6B9875FA623F631F8844B2276DF56A00F192E6AFE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 908KB
- SHA256 db1ca92ddd19d5e02cf336a781c3770a9cead750c4cab780898f174f41d598d1
- MD5 e5b348d2bb53cb6fecd1114fdad9c9c7
- SHA1 9bbd296358829b922816767d3b5452f576566e2a
- SHA512 9a67b53a10c9af530a24f19c0e76e84c352edaa644bf59aa503fcdacf28c34f5683194e92c6cbcdc8e11df5aa108c34520fa78f70b7e14525c16dfd60ed23f58
- SSDEEP 24576:SXIXgOa/C3B7xke6i9uY1sFSH6Z5WzcADYsHkDn6g3P0zAk76oOHQfWx:Yi1aq3BtkpfFSH6Z5WzcADYsHkDn6g3Q
- TLSH
  T188156D12DA64CA79D67A8074D8D14A0389F074821723BACF17B817147F6AFF42B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109
- MD5 52ff52eee3b944b862c11c268a02c196
- SHA1 8d041966e6fba10aa5e10ce5dc1dc5175f11b2fe
- SHA512 2861ae5a06f8413810947c08994f4c0da54a1acee8c4df72cd8b03a9503b26e5512809f8d70fd584239b04a651e7329a701bf7ddcee2dec2c2e14d05ae74f220
- SSDEEP 48:EWQsvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvW:ER4N4S/992/zDmrkVIe1ULo2K
- TLSH
  T105E3BFF256769258E29113445BB4394CEABF7F8A1A209893DE72FE56DAFF134448C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $R0/Uninstall Quirifys Krunker Launcher.exe
- Size 292KB
- SHA256 249f2cfa051ebe5968693546586a239a97005c9f46978f6267231478fd6b38e8
- MD5 32f69931e1af35cf67722fd1bd40b3a2
- SHA1 ba34a5bcc35d17b0f4767835c6bd361c4435d4e9
- SHA512 2315178859ac8496be398ba0fb9ff18bc700a0c0748184a65ecd3343e0b4328642a95357c1adb93c5863966266b940fe5c3c11726d83a0763dd76c4c079031e4
- SSDEEP 6144:8740IYYZgVg/z9rqi6zKlnZ53gmZFf27m2Ua8T2t0EyL+yaJ:+MzZqiX4mv2lCLRKJJ
- TLSH
  T10B541220AB90DBA3E8BB8F3087BA53A709B9F42114285F532F85674D3C57755FC0C692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32