6c05303b1426f0768be9534450090ea90ca8267cc506f43275ae1e3a77faf7d8

Sharing

Copy URL Twitter E-mail

General

Target
xx.zip
Size 601.0MB
Sample260801-2mtm8shl7y
SHA256 6c05303b1426f0768be9534450090ea90ca8267cc506f43275ae1e3a77faf7d8
MD5 e45c6828cf052f376d9e243598f1eec8
SHA1 3ab922bdcc61d99e81ece15307c9e339ed6d4331
SHA512 4458da93273a2af04363e50124deacf0978057bfb6150837607beffa7c77722c5e667f84cbd4a58352e22cbecdfe71121620501c6ceb47f4707585783ba9abcb
SSDEEP 12582912:md/1d/0d/kd/rRQ+Ufsp4jYANrUd/fd/UpJRj42bjYA0B7d/xd/dJ+tb2rjUjYAZ:rl0p4jbFbjRE2bjbeItb+jUjbLd
TLSH
T163693316F4701605FD13BE30954A6B0A00B614E33E21DEFDFFA09768239B9E86D726D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  xx/Nofall/.gradle/loom-cache/minecraftMaven/net/minecraft/minecraft-merged-fea6d3d88b/1.21.11-net.fabricmc.yarn.1_21_11.1.21.11+build.3-v2/minecraft-merged-fea6d3d88b-1.21.11-net.fabricmc.yarn.1_21_11.1.21.11+build.3-v2.jar
- Size 33.2MB
- SHA256 919acdb1e8420a8bb5efc27104e7c824ba5bf71289c07c5d325bb83662026264
- MD5 7845d3be26896a288715d0cc27b7df51
- SHA1 3d5b4a85511d8559058a271593c14eb48e30cebf
- SHA512 026f6c1efcfe73d6eb62999fdf389c8df5fa0a3f9bc9f526a565a8e7f9ff6916d0f1a931f141aeab8e72ae557ea6a2a74a73a2373e368ec7c68b3301253bc944
- SSDEEP 786432:47qJaG3wxt6U0gWUnVE43VaWhg00q2VvlQK3KBnVfOqHHG2:47V36U0gdnVMQN0qcvlJ6dz3
- TLSH
  T186778D18FAB7A648E50F9E3940E5C243FC35977E5828E1DF612848987EF4CC11B53AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  xx/Nofall/build/devlibs/addon-template-0.1.0-dev.jar
- Size 10KB
- SHA256 74da72b8d158d6b616a8b329706e4fd1aab5b3a6befdd35842270d20c884bc6c
- MD5 ffc192892af4ee9a61e0b774da4eaff2
- SHA1 88bee463e278c8b8eda84acf44878efb488f4ab1
- SHA512 943f549c6caca07070fd0e6488d33e76f4288ad1686bbf4ae1e7e2a3bca7f86faf24cf133e58d8eceecdb8fdedb00bdb4ab9450a28ac1f7d0492bf517079efb4
- SSDEEP 192:fauerjws84A2296PSxqOK3ERaFTbdRtHuAprw:Sueg4R29aSxqOmbb4AK
- TLSH
  T118228D2652F98964E47E8EF0F9CD1047EC3F12ADC64B768B185481E41CF9FA80E4DB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  xx/Nofall/build/libs/Nofall-seperate.jar
- Size 10KB
- SHA256 2bc042ebd6b4355a55c27262cb4ef1a12e4c88ae1d61c15ff360206d229e7891
- MD5 e16fbb48203712d9014022acee8805bb
- SHA1 b090d1b5c4f0361fe5fd848ea694135a5b7628aa
- SHA512 31b46004e56c8ce01e1fa84a6e0fa541f21c41571583d6b79a6ea0649293ad8ebed5574f481c352694b03e3ffb45768024ba93156f20bfdada32a05c80c0b3e0
- SSDEEP 192:2rFTbdRtHuApqOK3ERhau9CV5pgOJTi+PQQWlftt:2Rb4ApqOmq9CV7gOhDPQQWZ
- TLSH
  T1B9326D136E99C22EE40F09F298CA85C7B83D17A5814AA18F154551E41DF1F9B1F0AFDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  xx/Nofall/build/loom-cache/remapped_working/remapped.meteordevelopment-meteor-client-4c864f1d-1.21.11-SNAPSHOT-sources.jar
- Size 1.9MB
- SHA256 21fddd66703afc1a7e179f77492842f1d9fb3443e0f5dd7fd46ada524feedb04
- MD5 665d604131c502cf91e96e0b3106e543
- SHA1 8be99a06b4cc9d169c072ed6c70b5ea028407c20
- SHA512 8068cd4387498e22d930e207b8328c0b27eef58d70ba11557e5b55b5c0274acbf72f93c8a01e6d8c4b8bc6fbeda025472b9cd20a4cd7a98050af1eb05218e7b1
- SSDEEP 49152:9X0/nr8CIfvY/cN0Q+ce3khYEKJISKrzDxnrFMgBa:EQCcv5c/2SKrv1g
- TLSH
  T17F95BF14EF5E4071E8D6EF36C0D1E192B8B6EE2D0127E1632999048F8C69E508B7FF95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  xx/Nofall/gradle/wrapper/gradle-wrapper.jar
- Size 44KB
- SHA256 423cb469ccc0ecc31f0e4e1c309976198ccb734cdcbb7029d4bda0f18f57e8d9
- MD5 d8be57db030da6258d1e707f6380128d
- SHA1 4f81e6618c7d31dec2c9501c2d4580996abc66b9
- SHA512 e72dcfb45f44de17ea1a5ac41a3127cf34de7991fad770e572414661286602310046a0f7cdda837abe7fb0bda61694c433c06069cfb7963058bad145ed31806c
- SSDEEP 768:u51l1wtkVXniNmh/umyHpZYLoUo2qiAkw0uU8gqAsuCWYNeS:mSMXiNmpyPKg2qiAVXbgqALQcS
- TLSH
  T19C23CF756C18994AC043463B116387429B31932D0A8CDA7F4FF8624DDFD16BB9B2736E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral10 behavioral9
- Target
  xx/Nofall/gradlew
- Size 8KB
- SHA256 5901fd800994ef6b176e86345b1c980ea8918e1c557e06967fef8fffd555a49d
- MD5 b60a94c7e112b22b5f03b88ba3566178
- SHA1 05c8080eb5767ece35b344da35c33fc133074516
- SHA512 854b7f843e820681c3f723665251313d5c938fe930326a79cc0621f154a1698ce74b6e0369681569c3e5358796e9b7154311c8c312c3431ff33fc460c8297a09
- SSDEEP 192:NxJQ/XHl1ktOXWOmIzNyhpWFk2M72R3XS5cjRE3LZFq:NXQ/DktJOmYNyhpn2XR3REbZFq
- TLSH
  T1BE02D86357862374037102B66E5EF4EAE32162BF2F53251C789C920C273675AA1F399D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  xx/Nofall/gradlew.bat
- Size 2KB
- SHA256 fedad02c18e266ec094995a5751b7fe1eb6e74f66bf75db64fae2e50eb22c234
- MD5 e828135c17650a1ef9e5214fb75a23fe
- SHA1 483bdee17a45112d5b6521203afbf43073a8d4f6
- SHA512 73dd6183a87f476eb5fba5a62fe97fe8083f1a3889b52eed26a1d556fe64226a9f1128c81c486d90dfbdb88effe69ef3aadbb1b007439e2ab8e0e37a048adf34
- TLSH
  T1885165BB7B4742761FBC27967E1C4982B213A2662F4FA30CB45F850D313174A51C2E9B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Loads dropped DLL
behavioral15 behavioral16
- Target
  xx/Nofall/run/.fabric/processedMods/appleskin-3.0.8+mc1.21.11-64b5720b4b825f21.jar
- Size 187KB
- SHA256 f79fba0b656fa8ac7910ec6726d5644fe24b59b757cf69c6ee12f17e8aaaa5ff
- MD5 71bd6481c97fa554145fea6977309b57
- SHA1 2c0add2909313cce30eb40f6ad861295ad91767e
- SHA512 817953c26544810a9492bb51cb1fd7e3f06d60e01e11e0cd523d94ab03174f7ee5c2aceb5920c2ed03ec68bd5b80a48dda720ff54848d6a9aa083ca330be80ce
- SSDEEP 3072:AdMW5p4UoGClBlmm0onic6RIylvTfEaWFooz4NFgRN9lkRjdPM+fzqo2fSKQ33Y:AIzljMfcjsT+ok4bGQPlLN2fEI
- TLSH
  T1E7149F0829C11914FB2B217C56A2C352FEB7B56CE3306567897D2257ACA1B21DE33FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  xx/Nofall/run/.fabric/processedMods/bypass-0.1.8-sky-baseline-64b5720b4b825f21.jar
- Size 32KB
- SHA256 f3968b1e8523b71d61da9eead00bbff09a0aa36d49fd92ee3b4a6d41c4358bd4
- MD5 cd302dc41d5518cf0d55d91c87537643
- SHA1 d4c99757190fd97ccd85cc4f2900e1b5da3b4bac
- SHA512 3af1a79fd96e7df31aedc28a5a40b886baa59d2d367343f8f50be44da10511953c0569b4dd275fd0db7a29c0d5548c7bb00193ed327203525a4c2333daddff7a
- SSDEEP 768:uxB9WLgMKv5EfhbfxK6C05VMT/Qh+fZiDEonjh:uxSLgl5UbfxX7h+fZi7h
- TLSH
  T12CE28D142B9A6B24F55E533DC2A0CB0BBC35E63CC3A1554706DC9AE29DA87C5CE53ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  xx/Nofall/run/.fabric/processedMods/com_github_oryxel1_cubeconverter-5b4fce77c4-f53fdd8720337f10.jar
- Size 64KB
- SHA256 cc2c414f9005b01b249b6b092ffe24dc349882b345b84877845fe1fca8e9d002
- MD5 bfcd7f31a205cdff1b5b375f94f1251f
- SHA1 5114596d70d12a2788f9812a647e890f2a4653e7
- SHA512 e951f0df0859bd8b10882a17f0ec8fe71146500916ff72a155d9d8a07c0176ee2c578d893d26fb13a4b14b00d18b03e38464688bcfd4e6e3fc7db96c5d60dab3
- SSDEEP 1536:Q8vGsYrFfvl6zxGUX71nl/SZrlqVQmOnlxSV:QLhZUXZnBSkQ7/SV
- TLSH
  T1D4537C20A6516A20F703973A6351D706FE2881DEC3F17256245E27EAEDAEFC0CE53B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  xx/Nofall/run/.fabric/processedMods/com_google_code_gson_gson-2.13.2-39837084d2a8f48a.jar
- Size 301KB
- SHA256 a6cf075252deb40a4cb1d4edb6db89b9315ead0bf5e09a93e444b9c8e45f5b9e
- MD5 be0bade7defc2e718b8a5c9d83630de7
- SHA1 269b9af2ad3fc2c7a5dea7fc450650129547aefc
- SHA512 877ff31efd76077dae995c978ab42a23fb78b452f514f66810c7345a420ce51b603333aa74478da068e62d971d53c50718a6c224ac1afca790eff794a771e837
- SSDEEP 6144:8HS/2732ZYxpLibPhPG2Rm8OlNBLlIOPH2WLPGpq1VQuKFTeK6Rmgj:8J2Zuib5PtXgNBL5x4yVZ6j6Rmk
- TLSH
  T113649E63FA869A4DF70F8639A0448602BD74E0DD9769A40F16AD21960CE3F44DF27FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  xx/Nofall/run/.fabric/processedMods/com_google_errorprone_error_pronions-2.41.0-504ecfcc3a85585e.jar
- Size 21KB
- SHA256 71f0100dd39e9b70122a84b77bf15ab101e9259579d0541f41008fdfcb14cd98
- MD5 9c04ee4ee6afe399f60f40aca848be34
- SHA1 4e6e65f7dc313134e16c12cedc0b05ecfb7790a5
- SHA512 5a45a44e70ffad92941bcb479f1ebb798ed305a391ddfda655b16aa48fe55f78e82f240186c63719c2b538acf9829bf199cc6ff1e21746c9f78ebc905d605300
- SSDEEP 384:A+Wa677Ht921fBAw5O3A4h/1UP32pOhRWyesBZ7Q+s:Ava677NGqNQ4h/eDEg1s
- TLSH
  T1F2A2859ABAC5673EFD0B4A3925A88346BD34E45C233D24475EAD20A40CD0F59DF47ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  xx/Nofall/run/.fabric/processedMods/com_nikoverflow_api-1.0.0-ed0b305539297b46.jar
- Size 6KB
- SHA256 098307b7eb46acf9fdb779a24260254b9bbbcab6257078e20542eb30ccf521d2
- MD5 a5e405a6f43ff8cf22ed1d690acc0846
- SHA1 97c10eda4308cea9f1a84cdd66ae16c8008e08a5
- SHA512 dd3602b3b9f3fc75d1b2762f7fa938c968bfc321f72d0787f208f5eadd1548056aa11d8415e1dfbe55aed56d36285df0280417ad60067c6bb6f9674ac5dc4c9b
- SSDEEP 192:x+x74GiEhzv00ss+pEqQ5e7KFqlaQlznQIRugqwiBwKTfs3zNEqQZaQanQA:x+x74GiEhzv5psE3b4n/ViBwKTfqREPe
- TLSH
  T199D1117156E69209F4075675738BD30EFAE690A8B3771006B87C08ED5BC1F449F23BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  xx/Nofall/run/.fabric/processedMods/com_seedfinding_mc_biome-1.171.1-8c0cb22ac2a15754.jar
- Size 169KB
- SHA256 efa3d6122127ab01d07e78e600f88cbc11039d68a509cc5d85f1b4f4fcfb87d0
- MD5 61887cc37fd70d8cf87aeadc8444f7d1
- SHA1 f5d3196502258390a54d6b95103f27538eb0faa8
- SHA512 bf6213fdf8f2fd54d6eb4d5df645db376cd0b14bd43444c212949346c58b92bebae2b14af34d95226991dca4b05122abbad5aeca2f81486136e4e2153e4345a0
- SSDEEP 3072:NB9j1qVjJJF9Z3n9dw8nPTY0nqCjZeT4eOg2EGt3l/J:NB9uJJFnX9dwI8yZ0lN+NJ
- TLSH
  T1EC049E232E95D219F68743358723F312FC6486BD83216497B4DD2EA75C60B90DE1BBCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  xx/Nofall/run/.fabric/processedMods/com_seedfinding_mc_core-1.210.0-10995e0da5d38a18.jar
- Size 199KB
- SHA256 f59ef7a37abd4f5e91d7f4c3ecb37a4f37ff1aaf1c98037a8b0792d66bcac2ca
- MD5 e3cde77e0dd8964fc11219ee5520a794
- SHA1 a20ce3a892322dd0b05ba2b9bdd2930f7d393e71
- SHA512 693e98342d98a1d6e43f06ab53680cc946f5ebcece71b5a6044c2267c94f287baa76ebbbdaea33dd1eaa8451e97be1031b6c957b60a01c86beb2e1818e0851cd
- SSDEEP 3072:GIKXrruhflKWCjtsdhTbowBcuMw9+1j7BTbNpXj1/pUnxYWHEKWXdcasg/TAxWf6:GIKbrMM6dJROul0jNHNx1/CHETmPCUxl
- TLSH
  T1AA14CF73ADC5D2BEF9870235C68793426825DFA9E32195A709FC25618D907D0E80BFCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Network Service Discovery

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32