17078b66a1bd196fe50ed2f4bdc474b5ec75dd8b73a39374f743b75a8ae0f2bd

Sharing

Copy URL Twitter E-mail

General

Target
client-master.zip
Size 6.7MB
Sample260801-jtyawsfg86
SHA256 17078b66a1bd196fe50ed2f4bdc474b5ec75dd8b73a39374f743b75a8ae0f2bd
MD5 b80d00c30b1fba21200b0c4d51895d37
SHA1 d3d2c389ca1474b26fda12017a378abe15436465
SHA512 78410df2a750eeca3643c0fc19c7f69a42ca482569eaea8322e17a029d8c740c0eae632313835852b7810eca532213b75bb9114b7d2c6941de79597e0d5d1fd8
SSDEEP 196608:57Vof0P+q87gYoH5jOqWSksmxVb3ODdEROBj7Nl:5GK+qwsjxWSyZOKRSL
TLSH
T1F666238A41581C3DDEBB31BEA903D011E778A1C163C77702ECA416BF9D876229B9D36D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  client-master/src/main/kotlin/org/kamiblue/client/plugin/PluginLoader.kt
- Size 2KB
- SHA256 078ff099633a013d757bf9f8faa22b0c7f89917e075f91102ece3c7d9734c8fd
- MD5 a3ea125a980d598b911ec3854a8e36b9
- SHA1 fdeb6b7bcd166cf81a5dbf6329c14b2ad57ca6ab
- SHA512 b2ad13b417e59a7824b1bd70c94e0e5dccbac47f40d964a6b5c6c182683fc1bcd3ff53564456f0cab6921b6cf1e5efdc71ee9eecd9a974a1380c1ecae6dbddc8
- TLSH
  T1D251970BB5F64093152F40EC719B289033A9E25F8618F869BE7C226D9F40D31D5627DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1
- Target
  client-master/src/main/kotlin/org/kamiblue/client/plugin/PluginManager.kt
- Size 6KB
- SHA256 906649b8210c9e85a68f33249a91fd42ca8edda81a7c48863b07d7dd61e6ba47
- MD5 db09ab9475f9deeb4aaa818a4b1bd154
- SHA1 9e2d8e4ee49a47172299de3790efea3517ca63b2
- SHA512 04b9ce5eb3a60bf5850ba85dcec59450ec45efdffff900a5e3f37499d322c7f3e586f66b3f3fe5d08ac43ae435eb9daf5e5cbe5faa81efe9a36aa31536458ca8
- SSDEEP 192:ts7yQHjLdY0SJdDPDGtCkqCsaDJ49VJvSRxnKPkhWCe:yHdYBjD8saVUHPkQ
- TLSH
  T1AED18B0E46ADC0632767E46AA4EE1CD435EAD3671119D803397C521DDFE2CB4C9A2BEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  client-master/src/main/kotlin/org/kamiblue/client/setting/ConfigManager.kt
- Size 1KB
- SHA256 a8ad060fd09cf5f6fcebedae91a096fa000254dbe36fc7c7858775e591ad5d46
- MD5 ffbd136fcaee984bb45f7537b40322c9
- SHA1 4f1beba2059c0f27ec809afc4e1292462a9206b5
- SHA512 d5e915bcbb0644d368cf8c8dce79b6502b7fd09f026e7fd75dcecc0183e598c27a672204171940145d30b26861d07c07515d8881674bcde7cb215624917aa9f5
- TLSH
  T160314B6F84FC9C730293AD28C44BA8347E119FE302099C14B98CB26DDF0AA5495D3F8C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  client-master/src/main/kotlin/org/kamiblue/client/setting/configs/AbstractConfig.kt
- Size 2KB
- SHA256 6e22eb2572ccdd77d4b3af46e0d29320e6719b711e464ef1eb4204fc59b64b1a
- MD5 1febc52ecdd60d160492251f19221392
- SHA1 daee1991d9022458193aaefbe9e130ea394ee347
- SHA512 d9eafe7ef376d6c47134fa95fc4ab4a050efae63a3c81d82002bfff957338324d8e1157ad04381418f4b4ad238ba5be5f518efb2d8778ab95a0554cf5ab19f85
- TLSH
  T18041DB171DE0417D069B18BCC35E0A08B638466B6F35B8A4352DF3F0AF05AE86AF12CD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  client-master/src/main/kotlin/org/kamiblue/client/setting/configs/AbstractMultiConfig.kt
- Size 1KB
- SHA256 06400fdd72eb0cfb96e1f1c5730ada00f6edeb4c483cc54315240c1e8363529d
- MD5 fc0c3dfe3236644316c96d8fa4e62e31
- SHA1 53c5833438740ce214b770e657a8ff3675965742
- SHA512 86970bbcb3500fc1b55b606c91af23e80df263bfb46e363aa9f8f6604330cbb0401ef7fd3a9cf97c0d7549cf49615ea1ffd642f4c448c4166537206187747335
- TLSH
  T18F31DC925CD4001A26D334ECD68845403774427FDE687878B62D93E1AF18EBCA6F4BD4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  client-master/src/main/kotlin/org/kamiblue/client/setting/groups/SettingGroup.kt
- Size 3KB
- SHA256 729a641ca3c3537b89244bb124b03e167bcd0b77c2a1908d1f55b475e2d4768e
- MD5 10e9705b2d8c5f0e92dce5c749ca4758
- SHA1 719e7d71f9e3a3f84e85d9f7ad31b836384e8f6f
- SHA512 2535757c1e5aa1e980a070722fd2ece6a3fdc065551dba9093bb59bbbbc19c3173b3e30e99501c441f030092ec14340169e1d0eb10fa6040a30004c647869cc4
- TLSH
  T14751D05668F560AC234E21B9CA4F534CE320905B073DF8B8756E56F06F09AF847B49D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  client-master/src/main/kotlin/org/kamiblue/client/setting/settings/MutableSetting.kt
- Size 1KB
- SHA256 75d00e59034041ce765d3230199f65b2a2960fa07a94d586b3df2780a18b50e9
- MD5 02a69e55ef18da07b38219bb05241249
- SHA1 e1897a377d3dab3980aea5e3c19b4bace85e22a6
- SHA512 5946eda1eaf1a875fc7e59bfcd12b47d1d57a5ff148d16607683196f3f9d8d21dc9d0c359d12f33cd9236c2dee7ee82516fea9136cfbd050fcc4fe30368c7229
- TLSH
  T1F731A101BED061B55C8E3175591A010127B14117AD36FA993FACAB605F44DB8C5D69EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/BaritoneUtils.kt
- Size 2KB
- SHA256 ba2a4079f0fc54a38bf897b07ced2889b17a8053de7f574a478c2ab77eceed2e
- MD5 0e33bc7f61d56fe660eb55bcaee5fb8e
- SHA1 ba05b4cac73c3d5086c37cbffbafea5491ffbf2e
- SHA512 5004aadf9e190b42f66686ccd0846b75f4cb7754407613b5640c752b8b6067ebca89829dc282907e1ca118e7ea19a48915b5e985ae71af4f3ba6c1263ba51d96
- TLSH
  T1A741B7844F7038A616CA8552BC9578592E19433B0F57B761FC3FE3700F4E61A98B33A5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/Bind.kt
- Size 4KB
- SHA256 2b83acdf916d1f6cebd1f4bad0075159c1431ed401c17ebb5e7d311609076799
- MD5 05d797c4728572950d362880fc772032
- SHA1 448e223c89511b84688f5a056b6c640567c99fae
- SHA512 e6c691fbd2577468e6804626ca95a7c8cf569a1d56bc5e95b2032716ac2aa9e423628e8546fb726e44c5b68f3da24e30b363bb4be3b088bb06af1d5e375d1594
- SSDEEP 96:trODV5v5TETG6PlTkTS6GMT8CTB61bTbCTM1wsKOLaEtDatzu1hlofyfPpP1bPlW:trOh5v5TETG6PlTkTS6GMT8CTB61bTbO
- TLSH
  T12191230751BD98809D42A0659E9681353764C07B9D88BCCCFABDCAAC8F1E02395FF6DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/CircularArray.kt
- Size 1KB
- SHA256 4ca8dda05bd555f1f16bebc690b3cb68d6cc43343eecb12d22fbd7d1573e6209
- MD5 f6c9f23a7d3340ec7d45118de8c5b6c1
- SHA1 a77c003b33b6c7a7102c9988c3549758db68236b
- SHA512 875103473a27680d7c8f299ae56b768baf8aaa45009e92afb4fa66358c93db7fcdeccd144a49f52c702799ee0f6b042ddf76c06741a82ceacdeeb8e5153090b0
- TLSH
  T18531EF0F05E0203CBD47733E692C4A525E6E401F080DAE40770D6990BFA5231AAAE7EE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/ConfigUtils.kt
- Size 4KB
- SHA256 3e98b86c6749164983f2f51797638c0516b8930664c201620f3e5fee947802cb
- MD5 5e4a5cb219c5a4b53d6421e38f062375
- SHA1 3f8e8c4dfe95746e69c042eae8df5e6f56d42d90
- SHA512 cbab93119c67f379afd7db0f96d1d843d844bdf2fa2eedfd5be11d32f1e0a4ba9f3c7f208245d7d30bd88630bf2927b8dea463f2f4cbf81f4e5c3133a47f8465
- SSDEEP 96:tbHj1oJAY+txJ/ccM24Fiy93DJzzXy+SZXnExVFVqOoTbsmK3BK5:tbHj1kAY+tPzM24Fd93DJzzXyJZXnEx4
- TLSH
  T12691F38B05E804FF5A83211BD89D0C5AFD724BDB1A966C34B86C71A99F0E97003B5BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/MotionTracker.kt
- Size 5KB
- SHA256 94f268cb41fde6ecef80624f2dca8cbbc48c0d3f93379b768a9a076f7823b9c0
- MD5 6c6818e71d3a3bf2b224bfb9c3245e84
- SHA1 79df1c0d45488bbbde1bfb05a21b91769876fe8a
- SHA512 3cbc6cc60cb3b8aa67a48970ecc9b9f1cc0834e2988d79d2b614fb6642d1b7bf4b7e4c42a95035919bdfd4539608565b1015a37a3fe8821376fa02e6aaf13f62
- SSDEEP 96:t3ooG3uUPUpQVay1NEUQoCydbeac8GFvAkg9WDmPCiPydJmZqhAq4GydJ/GiPohG:t+PUpEaywUtCyJeanG1AkK3yMEAhGy66
- TLSH
  T1CEB1EF9946F11D556A876339B2C98110F7BB84BB2D0A6D4CB94D6230AF49E30CBEB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/MovementUtils.kt
- Size 3KB
- SHA256 650db6edb278928d710ae606d3645af5ba3fe804bf4d2022fd475b2bcc2e329f
- MD5 4d18a2e768c200d58a1ca49dbf3c3af6
- SHA1 69f76c81c22791ab16122857310113402f081dfe
- SHA512 c8e74d43e26c065af8e4b7ea261d6818ea51b1a4507597b96ee00a02ea5639c1908a26109abfef8cf85b2e7a13d3823818a368d579ad5d1aac2fbf94103b7caf
- TLSH
  T17851454A62A73C28A51732385DE3141166BCD16B2F0EAB0CF91CB33CAF494D1865BBD5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/TaskState.kt
- Size 148B
- SHA256 152c1ead74efdc0a995e47705b5c5d3a1d273f66917daf6f7ac00ae899a35e9a
- MD5 b58a26c2f964aab2ba0a4385a206d0b7
- SHA1 169f4d7d1de3048ec5a7ca414bd619917338f68a
- SHA512 0480b4ee7fca7827b0fd4e02dcb4dfcfb6f3e66bd383f459796f312a4e1a370b545421388dd1dea959844092ae9258ce21d1a5679e1dd90ae9448e177e36defe
- TLSH
  T1AFC02B0C00F810B4DD133105D40F406034220013EC0BCB30F40D31199F00B14688DACD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/TimedFlag.kt
- Size 269B
- SHA256 676073724772b4cbda4c17700db505c87525f5a9a234d5f4fb806b73a9927b00
- MD5 ed9d01eebc83ace0a2b6fd4c4bce7351
- SHA1 a988c9e2175ed78b3438e39d38a240f2ae0d591a
- SHA512 4ba249f2b30e8f976621d1158543c2c0b7923a5136d2cd12143cde061977f8aafbc98e21953ce8675c4855eb93164ec83c44e9510be358b889647e58dda24b1b
- TLSH
  T15BD0A758AED115B6DD0262E9853940672AB14B079C08ECE4385D8114DF00F15D18D3BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/TimerUtils.kt
- Size 986B
- SHA256 60da7b89b48181b905fc28581f0d7da6095d48604519b7a85f4076ccad64fe0a
- MD5 2421edc691a19328f95c96886c12f988
- SHA1 5d1bce6816b3a541f9e221bd28a7963c6ebe9629
- SHA512 72229a3325e180aeb023975357b369bbd23fdd57d353f7d6fed885e7b6caf2e33ab5b93b69f1073da6bd68f73c2cdec3197466e8674e681f7163d731042a4c69
- TLSH
  T1D8119C3B46F11033CA43324B165F78587A79AB4366299D51FDAF33194F8C112C1E15DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/WebUtils.kt
- Size 1KB
- SHA256 c18e8b385e75c79ed44735f640c5432482748a7814f182a09e85c17a66528023
- MD5 1b2bbc3ac576629daf191a3b5c99b062
- SHA1 2ea680dee820d3c844aa1c38a85c3998cda303f7
- SHA512 25b3fc859eb2f87532de0edc8196e1b2f84f89cab7ded71b18d50c9275ef9054044dcc87c5fe1adf526462038efea73d5edd2c5c914d685226860424720d1b04
- TLSH
  T1FF211EAFB8F8205E070330D8C29B6944F2B06B47A610BC90794C96BACFE4690C5C13CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/color/ColorHolder.kt
- Size 2KB
- SHA256 bab9b050f281078a9e13d7c0a9f6ebbcc464b593a78c5fa1402d2ee7e6a31d52
- MD5 ca24d9f936c28e916380e7c15aaa928d
- SHA1 9a70d422e19268fa07b43a401423b3293c988334
- SHA512 8b5fc793c58ed010af88c046a20284cdb77ff2825bab4ac4ece9b78f0533e3f46c7f2a1175182a071e9647e2e8e3cdf87241391910ad418a27974c0266b22cff
- TLSH
  T1D9418BDA3FC2346A2643613E19E99904F558F803650FEC5CBC0E09305F8A69EC7F8DA8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/color/HueCycler.kt
- Size 1KB
- SHA256 8328f8caf53b03206ec0b0a2e97fa8acb470b9f3d6cf59f9a482f495ceb8d1d6
- MD5 2136a3f615698f8ed3e093db1fb0f016
- SHA1 814b0dab3bee13665f8fa5a74cda319a9e8171e8
- SHA512 605cd6964d5b1f21c5abe230d1c7d3221c0a3195499afb3c44ede9d0913ef6acfa28ac181210e942693ebbeccaab3789ba1a8bbb4710c66f6def3a990769eeb4
- TLSH
  T15631B08F5BD51569CF03A03C54BAD92425BAF1A73809AE0D3A1F01208FA55BCC6ED3ED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/combat/CombatUtils.kt
- Size 4KB
- SHA256 cfa5f8af44394ce0f41f8b9fb22871009f3c7371c217965b412e931d5083bd34
- MD5 27726c6fa38d63ca610230b9a109876a
- SHA1 77312322c081047c55e488f37c550dde6921c97d
- SHA512 eddbb6a005147cda665072ea53b4287fa9ee4a5c3251b91aaa0ba62458176e8a362ec682cbc07578d41d4d0c866ce241b7ef9a18b79dffc9e44afc4e3e180760
- SSDEEP 96:tF/J4/Kwv8pG0OPqTyUPBiyigtHf5mimF9RqI0nCNkmNG56Ym24ecwi77Qniw:tZJcUPBiyigtHf5mFqIkCNrNG56qYwiI
- TLSH
  T130A1956B46D026BD2BC37225F88A5464B37C40E71E553F99300C8534AF98E98EAF25A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/combat/SurroundUtils.kt
- Size 1KB
- SHA256 729bd6fc12799a161181c7aeb8d52f64088873622aed9cd6df99c75fb26a2442
- MD5 4ba3fd05d46398a6b239f48d86826df9
- SHA1 69a6255a084f678fa38d76e2ebb8be9be61e0e95
- SHA512 013d4cd559b01d5f6fa16a93660f61c588bcc5131450ebe9b496dc85f9cc2a680d090482be8e6ae3f1e6ee8df252609b2278357c4f291f6a7468687ee6504e61
- TLSH
  T19031FE4604F5716B5543611C8D823A68B17C893B1B0AFBD4B47CC93AFF1E8928E572C9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/ESPRenderer.kt
- Size 4KB
- SHA256 a896fc176a8b033b0fe2614c592aa6418ea1e537b650667011ffd980e4f2ab08
- MD5 6a8184b2d7e53b2880d59d8e9f363b76
- SHA1 39b5431902d1661bc11cb260d75cad732ff03f81
- SHA512 fd3a5c247a892b3efe788985a800cef794937650d778a7214710b378576eb88de9af4e69729ea4e7a60664fae5e488d3aa2b13d6079df8845ad728977585514c
- SSDEEP 96:tSH24ooGZXKKgUcYzt419j1ZfDyqakhfdlqXwC4DWiYhQ9v:t3XKKgd+Qjb+wOX74DPYK9v
- TLSH
  T1A891305BC9F125069743B22DF8AE5458A3749A974B9C5EC8BE0E02398F45078C3DC7ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/ProjectionUtils.kt
- Size 3KB
- SHA256 7f88bea2ad37bcc3c840d4beee50e2e8bdadbbcde641e5088d8ffd8bb9eff9d4
- MD5 9895bece4745de8bd5313c6c42d9753f
- SHA1 eb3fff44fa423a2c2e41bbf60f7ccb1a730bb0fd
- SHA512 6e414ecebc239df1a8392afcccc77d3c379bbaa23c66a7a0841c43629c9a7784f9f51cf08d8f0a95e79ed167fe900ca8ec23e127c171da0af6a16eb9c2726a80
- TLSH
  T15F81EE95D6843CA59F07812BD0A68D056979E0E75E0B882C360C85249F46973CBFBBEB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/ShaderHelper.kt
- Size 2KB
- SHA256 5fbc68f661498aa53375968d4d280014f392dc44736bdf98e6309cea7e37ce06
- MD5 6e7bc5346b7238aa95a9d49efcb02fcf
- SHA1 3dfdf50b3b9fa91129bd071e58082cbc77f9388e
- SHA512 e095b74b7b9d54ec523d00430eb3d6fad2cf898ad44294cdb6afa55a354286d2ace48fb9b03cd2621c598faaa69c5ac0d72584af3173e75d05d4530e29969eca
- TLSH
  T1B5510F8B99F4213C2357215BE81E9D9A28B5C0BB37461DD8380C4D2EAFE08C4E769B58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/font/FontGlyphs.kt
- Size 8KB
- SHA256 ee038f1771130828149d45cd5c7a9e7f0d412b3f18c6c15a544745b2d324261c
- MD5 2e94bc214a65202abd0c6f45737a75fc
- SHA1 26812d8395263eddb4984692d857ff6d2ffc8323
- SHA512 35b8d2bf4e81c5d42b983f1831d5ef1e1f5f37a4c1e6d09135c42373f547d981c1d76682b26793d66cea34d683c1bf2f44be96496705b7342c6ab7790b605a14
- SSDEEP 192:tFHUq5mtmDD83f3rSe+xzmIIavyxIxNrAU0hZBSCVwa3a6:5Om3OvrP+xzmrY9uSCbq6
- TLSH
  T12502D82126A626D239171A6D7D8727CC70FCC55B3A2BDA4C344D321C4F929AAD3B8FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/font/GlyphChunk.kt
- Size 873B
- SHA256 4508445ded185be4eb0ab4a0c7bba898d28ae401bd4bf31d102899ca54087eda
- MD5 478874cb5b6a240e378f057e34778aa0
- SHA1 4fb342c281122a52ec14ac43c4f4edc6c18bcae3
- SHA512 e2b2e0620307442aa55c061c6b9f866b4f2c4a4ef56177ff1ebf1408217f6e7c3cd5fa5e0ecab123fef723544d6a7e8e13569293b6ba2f0652c6dade769e48da
- TLSH
  T1E311CE9159EEB1E72EA3042C9A414211327015AF6E1DFCC9B34C22B40F81D389BB5BA8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/font/KamiFontRenderer.kt
- Size 10KB
- SHA256 dd133c1c5ee44d0bcfc7c98aa4aa7349f673787f053fc257b5a0e6368add1b16
- MD5 61474d5dce688bb9b930a3a741c95c39
- SHA1 e27f3bf367c46beb21595ddcaa71a3003b9f4505
- SHA512 f3a235ab27c51fe63f9748cb0bf4f3d9c7a00fe772a1e4f53550e4df9bd811e6a9cb913b0daef2085a23f390cf5ad4100dd5a6881b9d0312fbcc6f592ef7aaa3
- SSDEEP 192:t4Hs2/eemtmDD83f3rSt9cwRBdb6G5MsYoo6q1vooovLylcKFygAHCbKt6ib:rRm3OvrAL5M0DLkN1AHCbKtD
- TLSH
  T1FB22C54566A6233A8A13961DC84E5C84B71E926B370FAE0C3C3E12254FAC82C85FCFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/font/TextComponent.kt
- Size 6KB
- SHA256 606b1667d8e479dec9f5db974558766282b8f58e0f0985b1207f5302e49beb0f
- MD5 a736a10d3bf81dfbe2b7763e15136467
- SHA1 c19bcca8b3fde90a7faf3b94cede65e348efdb4d
- SHA512 f3f9f44715dda0856f0e2ce4459491a1717b4e4fbcb8b298f771286fad9e4e8c7ed52ae0feeb4a2afb2dedef2e41711efe8b08672e481b4811c7e5fa1bfe1bb3
- SSDEEP 192:tF/KnxIu5Hz/JClNJX+lIn7hhdNcOadDYEEELzLl8igb:Wxhc9hPva6EL3U
- TLSH
  T12ED1520474FD0630D987205EB6DA242C7775938F6E69ADB47DBC40680FA09AD83F86F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/graphics/texture/TextureUtils.kt
- Size 2KB
- SHA256 175e4f299c99dd859ec76d4eb62abd51f65f53d41c487120978e4c7ca8371a1f
- MD5 882702636d582d2f034315843dbd3041
- SHA1 30c625fe0eadaba5a6e908d80082dc88fcf45d98
- SHA512 7a8898fd8a48ece98104ac818873d7f6b179397f447451de0588fbd8d77442bbefc759ce963bfef9571f343a5de6ef590c24551cefb5a3ab43a8a63751ca9c1c
- TLSH
  T15041F1275F3720D8AB03202B7CD40ECD76A6C8A39B4B4B08758C6A780F547A4DA357A6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/math/RotationUtils.kt
- Size 3KB
- SHA256 90ee2eaeb567cd5c5d50332073a2410c552cd7d5b674dc75da1cef3611cccc33
- MD5 b46faee02f7e2777f8c4c58c3a53ed9a
- SHA1 5e2db98df6553d85ca66107fe1cb61c049cc6d2e
- SHA512 48077cc26163e46b4eaf14ec5adcc1ec75dba11c3bde44824fb6016d26cdc1049b76bd0cf6c5431651d956a0c3acac748bed73c08e5c60790ff35e8fc2ec4d8b
- TLSH
  T1F1618A96B4D550648E43F7AD62BA41C4E17C28F7190B954CBA0DA4B48F8A570CF5AB8C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/threads/BackgroundScope.kt
- Size 1KB
- SHA256 e6684c4f3a5f668b28952e8471e2e57c0a64ef6d02c26f8b27dc5a91685827b9
- MD5 f5374908be83483c9c96e887bd2d9bca
- SHA1 f0b11d1411cd9174e9c6241fd5892a5f8b1b3fce
- SHA512 e179b166f4d352e12f9c5ed9a3408352af14dd50349fb0d932d309194c2430dd798bd5746316e31a7334310aa79b9f2b7b3d3e8f297bd49193662e1bd715031b
- TLSH
  T11721AC59C7E008593B032875889B11B25E298307C00DDE49BE2DF312BF6903686FA629
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  client-master/src/main/kotlin/org/kamiblue/client/util/world/Interact.kt
- Size 9KB
- SHA256 88a8b7c856bb889c87883404ba1050abaf8b3b043434542a98eba970717e2205
- MD5 b440c0a7963f3e7bf634048f8f718ede
- SHA1 4d9820646d2103ce288243b68acaad04611e32d2
- SHA512 c41e10c54606b9ac6e0afc96c77db2f95d96aaa7097c0179f542e088b77574ccf79cf594652423e2deefd87946adfdfb076afffcbbc9f7d0d1ab7ebb9afe68a0
- SSDEEP 192:tIB4uJU2bUGYnEOUnctUnse8vQ3hpLDgAqoyCyce1eUcY2XNC2M:CbUoOvCsiScVU3
- TLSH
  T10212010A74BE30FA5B5FA26C38694400A73C60D74B09BD58BC1D95281F1F61AD6B7BF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32