08a7d137aaec923dbc8c73c699fa2db4e997850636cbd472408195f1047029d4

Sharing

Copy URL Twitter E-mail

General

Target
smp.zip
Size 127.8MB
Sample260802-kcb7rswvct
SHA256 08a7d137aaec923dbc8c73c699fa2db4e997850636cbd472408195f1047029d4
MD5 9a6ff1821f1903ca5d2c8610695913de
SHA1 3737c9cec7cf2befb7e54fa1b65138db04f29f71
SHA512 2dd3098dadfe9154905c54e55fa549eec65137ce341b5b1aabb611ae584148d82de1a19db0bde8f5ea7db01489158c0ae21b0322557972cae434eb51ec16a8fe
SSDEEP 3145728:Igd9fO36fWWWY+dy4ldx4pb4BOVwcIrmIw0zNh:hfO6rydyUv42BOGcIrOgNh
TLSH
T1ED583337D819BCA9C81AB272D4851B1415DA02D8A3A2DE36FB7ACF30BF9D8D0907175D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  smp (1)/smp/plugins/CommandWhitelist.jar
- Size 1.5MB
- SHA256 27d0252fd9aea95be34f50985fae3f38769a8f33f932941c8a6cf2282dfee687
- MD5 92b626d1ebdc9e06c6a9eb17e7bfc976
- SHA1 c5cf23df43c03203c29657422915b639657e3c27
- SHA512 45589d17853ed5e70d49f6d7f98de907f34c7b23d8f9f355db199ab307898d64b6c7f9dec886fff6e23c1c9a1baffb25b09b3ea724842bf0cb5ebe13d420bda1
- SSDEEP 49152:MX8fmGKOmHX7YQAB7XPMaREc1QOdnvgHLqFHkaJ5KewI:MMfmGK7iDMamc1QEoHLqFHkhI
- TLSH
  T13F75D05BBD86DA65C117D07383A08407E81949CED809B8AF75F9489AC8FDC4A875EFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  smp (1)/smp/plugins/CustomEnderChest-NextGen-2.0.9-beta.jar
- Size 3.0MB
- SHA256 7fedcf317c65e69ba42dd0da44dbb219930dcfaf679646d7a8ea9afc2eb11f50
- MD5 70d741adcca1501e8a53b25fb1f5c634
- SHA1 e98e2a1f19a8d5da62e0021e52e0bf3a0e267f96
- SHA512 178c24eb8fa93c24ab79fbc20173e70d8c4f47d2bbd2836175595684df44ed473b3006907036f20a08e1cfa30a26a2a6145bd1cd3722d6deb7cfcf107bb5a150
- SSDEEP 49152:kW5SBIFCV16/rEM3BTPI+MtIywbrhGq+DP2Q2cMqI5Fy6ytWOKuiHyN:kW3M6/93VI+MtDwgLwc4Fy6ytQgN
- TLSH
  T131E5E138D0AE6573F9351675B3BADC51FC27824CAC5E01A638D42ADFD8F188A960B3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  smp (1)/smp/plugins/DeluxeMenus.jar
- Size 3.9MB
- SHA256 ec10a1317152aa57d76eec8cb3e1e7dc7f52e45c7a5d742c0baa1e394496ec20
- MD5 cd50b1ffbac63a4b50c74607af74828c
- SHA1 a7ae9ad69aa47bbeb3e42444d5823a0eca885f16
- SHA512 c6f01e85ee5b96bba4e65571db133c45fbf157baec4160ecc83eb9f744cbc914e31079bb70cecd9b64fa329564b2e8c842e43c9976a365a54ccc5eb719ff8b65
- SSDEEP 98304:UthO2c+fUssk9IhuTRY32Sf6VvtVdiAK8:k9LfcMI7f2tmAK8
- TLSH
  T15C16C01665CB3A3FF66B61702DA11463EA3E55EBB10B80D120F41EF864A6C852EDF74C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  smp (1)/smp/plugins/EconomyShopGUI.jar
- Size 1.6MB
- SHA256 402b91ad2f7cf74be250f017e25266883f1238ef1311ee120788e9c3eae1c8ba
- MD5 7042087fe9c2bdc0454202960f6c8e0a
- SHA1 6aa84f250816adfb4c53509dfcf6136051f55475
- SHA512 369b8dc0c934622a30c650186b0100b717c585717e00815000e3006fab80b15fe9c4421905a57e86bff3252cb96d26e1f1dad3eea3342137b2fbc35df6233f8f
- SSDEEP 24576:tCOKufl6Pw1oRvpbn0FJCqbthM9yvpbed2RF3AlvMk02uOd+Fhf9jq1ajgAe9Ubq:tCOKOOBGA9N0bwlv26d+FDQAe9Ubq
- TLSH
  T1928501228DCA2C3AEA37F9B9F7410C07FC1D8EBCF215908755F897D686BA7485A8510D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  smp (1)/smp/plugins/FancyHolograms.jar
- Size 1.0MB
- SHA256 0e55fcb60c65a74e3f10a84fb17f7b02bbcc1dcecbcc6fb83b54a006e0457ed6
- MD5 6b86e58cd87fedd9dbd4090aa73369b1
- SHA1 a7de86988c2f10df3b611d236fe1143b7a300b0b
- SHA512 72de209aad16dd5ecc018e5cc928abb8728d0707323ee5f3d03d684d76dd2f06c6a8afd90bf50c78e3e53384bc8b0710f7b20849ecad598928e98a8b07f71930
- SSDEEP 12288:ZrZTpSVvJLwP8uCPpcoei+QtRDQM3x1P+DTC2C+1wEQ7wWPKblKbTBj:9lQ1warepQ3DQox1P2TrXqFQsPl
- TLSH
  T1D235D0167DC8C9FAF467C9398259F812EA1F919CB4067127A961040F8BF7CC8179AFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  smp (1)/smp/plugins/FancyNpcs.jar
- Size 6.3MB
- SHA256 ca8e05b60f2364667cbf14fd1cd4e1e790e10ff6cbbb65067452ef036bef61d3
- MD5 075637b165ea00e62faccde973e6b06c
- SHA1 26b6de1c2b02a7b63c2a6bf6e5a1cb3f05f3ce7f
- SHA512 83194a9437e2800778dd72adbae27e92a435cd2e2496d482840b21c5c9c5d81d4aa0b3139c5b5bddcedfde60feaf8e928d382cd967b5a48738befb12602a725f
- SSDEEP 98304:y05PkhYxTr3v6wZtfagesmB6OXMsEfLwwfaUikqrnxIFQIYpIx:lZUYxf6WKZQOXMsewCriJcKy
- TLSH
  T11C66E06779D8C9F6F967C8328256F422F81F879CE046302726B0051B9DFAC894716FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  smp (1)/smp/plugins/FastAsyncWorldEdit.jar
- Size 14.4MB
- SHA256 77e93ec9ee569dfe4712618af3ae88c3eeb5095bbb3de846cf7d37c430612b27
- MD5 48ce68e05d8dd403a6196b6e3233f823
- SHA1 c266c8fcaf877dac05fe7f6692b21fee4e83bbfe
- SHA512 353cfb54600b90c5c30595e3357f680ec851319bcf95427b5ca319df4feee7b2b074f230b5b16a3d3f7dbd6d9ecc89b8e21941f645f1df08292c2dffa406db26
- SSDEEP 393216:PzWgWsBejOGXowPIJvQyvNn0QJHii6Ca8p527nEzm+4:SjsAqDwPMvPvN0QkGau2QzC
- TLSH
  T106E6122B3ECEDBECC91BDC31D251D462E62FC4AC960275D326F8452928E5E852352FC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  smp (1)/smp/plugins/JustCombat-1.0.5.jar
- Size 4.3MB
- SHA256 cd2b5be6450b2d47c8531e843294affacad07ccee866be54abb9f0aa8a90e18a
- MD5 fa98407569b699c625f9618c14e5331e
- SHA1 67fab512e93a51b7bd79602e6a23017e3b3735cc
- SHA512 29da06cdda72269999e5b427cbf14562e2b1af560247e0330e617f8d680c73443e05ea1fa9bc64a104441d0af3cb8fc4285486b5db567762acae32664c6315c0
- SSDEEP 98304:OEwMIeq1GfUjRjeXrK/Hw1fTZPHkkWFBLHG1p3Px6p3AtjX:OE3wH4XrKo1fTZPWFpG1p/op3AtjX
- TLSH
  T13026DF2C78C8D87AE6F7117E17106403E67F10ECA583A02735509EAAEDF4CD51B52EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  smp (1)/smp/plugins/LuckPerms/libs/asm-9.8.jar
- Size 123KB
- SHA256 876eab6a83daecad5ca67eb9fcabb063c97b5aeb8cf1fca7a989ecde17522051
- MD5 f5adf3bfc54fb3d2cd8e3a1f275084bc
- SHA1 dc19ecb3f7889b7860697215cae99c0f9b6f6b4b
- SHA512 cbd250b9c698a48a835e655f5f5262952cc6dd1a434ec0bc3429a9de41f2ce08fcd3c4f569daa7d50321ca6ad1d32e131e4199aa4fe54bce9e9691b37e45060e
- SSDEEP 3072:8CsHy4iYeO6Wa+gBkNqTblY8FdRB2JC0BGd:bsSspOXTxBjn2XGd
- TLSH
  T190C30221B2C1D051D2EB717890914D53F5694DACD5DEF73BA880DBE2CAE208A9B423F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  smp (1)/smp/plugins/LuckPerms/libs/asm-commons-9.8.jar
- Size 71KB
- SHA256 3301a1c1cb4c59fcc5292648dac1d7c5aed4c0f067dfbe88873b8cdfe77404f4
- MD5 c8c3d9ccf240144e74d94ff658b024c9
- SHA1 36e4d212970388e5bd2c5180292012502df461bb
- SHA512 d2add10e25416b701bd84651b42161e090df2f32940de5e06e0e2a41c6106734db2fe5136f661d8a8af55e80dc958bc7b385a1004f0ebe550828dfa1e9d70d41
- SSDEEP 1536:0IFSgDvgkJafJUU/cAr9R25iuI4F8NNpMCW8k/uqhKBpBAOlsdOT:0IEgk7J/r9R25TF83pMCW8k/uqhKBnAM
- TLSH
  T1E373D061F1DB9027E0B3B1BBB8F26823F63A5F3D9B8A35BA2CADD5C5C4F18481505161
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  smp (1)/smp/plugins/LuckPerms/libs/bytebuddy-1.15.11-remapped.jar
- Size 8.4MB
- SHA256 fc5f314f6141800f96b1c2e269f55a8ccca7cb206b45bf0b32018b2135883bf4
- MD5 c385ebf88c781d61c75b7dcfa8444e17
- SHA1 c736018bd57f5fcb00df5a3a7d064e376f018d6b
- SHA512 22b3a910405ad84426a780bf83aa6c7aa5196058f3f1818a08a77e8f68fec27cbd0a46c9753fa6ceb2a139ebaa8c43f2a902ef7e41ebc3a2b606becc0fcbccd2
- SSDEEP 196608:5hGVE3M4ruh8hD//2Te4atmlRll44tvFdW4XQnaOLIaqOLhShvGBodZv1IIK:5xuh+yTLaAfM4g4AnaOLIaqOLhShvGBf
- TLSH
  T1EA96BF997ECDA9AAF28BE271D89BC223F93571155C0DC04235AC25F07B2C8190F67BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  smp (1)/smp/plugins/LuckPerms/libs/bytebuddy-1.15.11.jar
- Size 8.1MB
- SHA256 fa08998aae1e7bdae83bde0712c50e8444d71c0e0c196bb2247ade8d4ad0eb90
- MD5 603bc53c7a294f23765bfb7e1820ad44
- SHA1 f61886478e0f9ee4c21d09574736f0ff45e0a46c
- SHA512 61a75caa9f9ad14e8f837c296dca12df9aa1cfbf1e6cd25a8344ae9d4a468ee25944c867dc82487b9247383d0695a425b5578620fc6e1132dd24cebc4d6eafcf
- SSDEEP 196608:hTHVto5jvsE5Y/v/2CJBQ0MYVREWa/CN9U6bMWz:hToj0EavvBQ0MYgn2UK
- TLSH
  T19886BFA13F8CCDD9E28B83B2D5389126B63570487C1ED4C32BAD46A5EA24C4547F7B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  smp (1)/smp/plugins/LuckPerms/libs/caffeine-3.2.0-remapped.jar
- Size 887KB
- SHA256 3b16ef1326d9d9c270d99724a3e0b47fdd0206928d9d5f5a59de257263b223d1
- MD5 939e9672a7bb52ac9728679ee28558f6
- SHA1 02a0aceabd477193062ae889b1bcba88b90768f3
- SHA512 e410b8ac770ab71a022244dd6929652acf826fd586890301797f3953bb694148c88b190880d777f23530cf689e4a2ad77bd5792866ae33676671b71773538946
- SSDEEP 12288:c0VHamS9pbpzI1kAPCIXIa4PLgxfRs865rtVAMRlksmlj+KDsWU3MG:LHzqlk1kA4tgxfw5rtC7jjzBG
- TLSH
  T1FD159D5CBDDFB915F60BE07065CBC133D82992CADA06811705998BF2393DC64AE07BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  smp (1)/smp/plugins/LuckPerms/libs/caffeine-3.2.0.jar
- Size 885KB
- SHA256 ec411dfdf0c03f25218648ce89861630b71680e5858a9a7278ebac8e55cab3d7
- MD5 9d19840ccf667df46f8d839bc9aec5c5
- SHA1 35eba09997476a39492ac7f7b2bb0e8292c09d17
- SHA512 898fe3e0c069424d2f2741e8b94c8ef1c3ec8ed6aad0b04d8ccff0167ee7ad8cd66b227606c7f408e188479e9a4dcdae0b1ce7c0207576e0a3fa74636cd3415a
- SSDEEP 24576:pWaQcHx0N2vXCvQBypum2Xvgqx/LEg7pDNIZoxRIjwcBIM:icR0NOXCvQApum2Xvgqx/YeNK8RI9Bd
- TLSH
  T174159E96BCCFB998DB13B8B452529071D43A84FDD306613F05F8AA4AD4E4FC48742FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  smp (1)/smp/plugins/LuckPerms/libs/commodore-2.2-remapped.jar
- Size 22KB
- SHA256 d41d647ae82e5fec8d015b7f0e780b97e62bbba092d9cc53dd5685618c854f40
- MD5 3e0d1db6411ac7e6e7b275eb8579380f
- SHA1 f00e220066443cfcbbd15bcf477c687f406975af
- SHA512 967173a4661fed2420cd53c9d2d598bdd2eb962d360f4ebae0a3d2263bbe7a145e0e884cd38454a3d76d28ba8bf8b423305c05c4fb3a0ffc78aedf55ce902015
- SSDEEP 384:S8SfGbvD66pDO04zB+XodkH5O/JT605wBTZDdGW5QZ3vF1pTXN8pm4gckB+x2Mh0:NUKvevQGkHshu05wBdxGAWNX0Yc4eJTC
- TLSH
  T1EEA28D48BFFAA506E10FF1F29C92D113E8E956198E49112604765EF97C798B01F07BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  smp (1)/smp/plugins/LuckPerms/libs/commodore-2.2.jar
- Size 21KB
- SHA256 86667703f49ff0bbeb4fde5bb93945370744059dfa5fd2acf1228e4b56fb7f6f
- MD5 03c0acf55704e556bc88602f17fda684
- SHA1 08d4cc5c4438fbc4ed6e6052b1fb7cc9aff5a3d8
- SHA512 c155667ca8b3789d8396bc3db61b1f4fa6a659ee3ee2a0cf1b58501e82755ae5130614e226cd6a67120d5b423fcc035416c48c281d436170bc35e5968daa1b03
- SSDEEP 384:nEarpLHd7XFiXNwPqOh/GuE14GDsX1lNXzre7l9EtaFK:EcRHdz09wb3m4RX1lNXzre7leaQ
- TLSH
  T11FA28D78FBBBA578DB0BA172EDD11807F4DD5240CE1E020615148AB6ADEDDB0ED05BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  smp (1)/smp/plugins/LuckPerms/libs/commodore-file-1.0-remapped.jar
- Size 17KB
- SHA256 01d2dba1b47d1464d8d2214c351a1de5ecce80aaed8d634ebbc188c3ee4827bd
- MD5 6b7d785d75c97aa85d439bafd8db251f
- SHA1 2e6438e142ed640eab983d41b7f3db1a3f0f2aae
- SHA512 10fb9fb2f1c173fbbde77c38c819f2aa64b2ff554638bc51616f5d3c5541c71de108d5ea0627d1fa436effa0bfa24f3191732cb1ab128f01a8b27ebaf80dced7
- SSDEEP 384:uPmn4J4TVmAW6kOP1e5J1NGUTdTBJqr1J28:uPhP5OPgJGUT5BJqH28
- TLSH
  T137725B5C6EDAB103D00BE4B3BCC68127D8785719DA09522B491A0BF07DB89242F97BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  smp (1)/smp/plugins/LuckPerms/libs/commodore-file-1.0.jar
- Size 15KB
- SHA256 57dfbe772a7d45bcc3e032ced91f6ea45f19f2fe5259ab325fca1ca98440328c
- MD5 8ca66635ee866430cae00b5dabb249ad
- SHA1 d0a8078c2fd05ae87f336950b9a583969d9087e2
- SHA512 22c2df9d2e2eda14d5b83c51716df6b03629317a87d00760cf7df059489cd4bb9ccd152edd2fcecb67e676d1bc0b1812ad1f3fbb56d8ec0dba4ad7c7f91ffff2
- SSDEEP 384:Da9PUJAgrNgXUe3s6cyu+4ySwR3lc2NwjNO3i:DThNgXV3xc1+40Bry
- TLSH
  T1D1729F2D24D57712E229C5737D9E005AFCD6E644FA0F0228316187F6B5F8A692E1F34E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  smp (1)/smp/plugins/LuckPerms/libs/event-3.0.0-remapped.jar
- Size 12KB
- SHA256 68937044661756f7b0d1ce6a1ad1f12866df0b4d228112a68d0444a63c259e73
- MD5 4f86cb5d4eaeea537fb1fd585e0884ca
- SHA1 46102341dbe52b40715540475d7787b78d5f182d
- SHA512 2ee3796ecbe599840f592cfb6d823a4cc760a41581b8a6ce8ef32ea11df47c5cbde74dc62d2c6e87d48e38dd8e55d1d8880593db59739529580e8ee6af4ea564
- SSDEEP 192:rVU6YGKPmrz+kbZtsnsIVYe9oI4N9c+Fya4EBfRAgozy2rQPCLysrj:JFY1urqkVtsnsIie9rs9cidfWy8vj
- TLSH
  T14A425BACFDCAA00AE11FE1F862C7C027D93641468B4B912701676EF5693C474AF1B89D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  smp (1)/smp/plugins/LuckPerms/libs/event-3.0.0.jar
- Size 11KB
- SHA256 ca3bdd4dd03292d97788511014b1c2dea630c2deff0db09ded973c4384a521a8
- MD5 e0aaf240e71588fa292992c2985cfd38
- SHA1 4e207f07d2adaa15e174a085f65bc6ae5a81029e
- SHA512 49b4549332a6f93a1cd9cedf43b44dc749a172a44b0e89098d4a4c833287a38e10f4186f224bf15355bf4becdc6e3030dbc121d5f4a50dad149e08319cddc5f6
- SSDEEP 192:jbKJ52N/fnnCal2akEjmgWifz0feNzCOWdCJtiA294K6XDtfc9WFCt:SJOCo2aZqgWifQMlaCJtH2D69cYFCt
- TLSH
  T18D328E71775C3299D62A033683D4909678BE19EC38421243F27A9FD7E57B83D0E69707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  smp (1)/smp/plugins/LuckPerms/libs/h2-driver-2.1.214.jar
- Size 2.4MB
- SHA256 d623cdc0f61d218cf549a8d09f1c391ff91096116b22e2475475fce4fbe72bd0
- MD5 93628fb706e682dd989f697394039025
- SHA1 d5c2005c9e3279201e12d4776c948578b16bf8b2
- SHA512 fedc464dee11077ea3e95149b3c1a1420d6e432c940ccb8c368633821b29c0e401b711d45f819d1cc3755a54ad05fdd0e8bb6b17853dd15539613f5e2765f359
- SSDEEP 49152:8UxB834dWt7aAILcZOBCedPjQ5nozteOXL9U/081CDweYlCXkXm9QSvy:8UxoO9LcZ8Ddr5Uy5ik0erkW9hy
- TLSH
  T1E1C50295FDD68037E4C3937171839417BB2A03C8A4CA90A796AC0BD9D9A1C5A9703FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  smp (1)/smp/plugins/LuckPerms/libs/jar-relocator-1.7.jar
- Size 18KB
- SHA256 6f7d1184e17a90788797e3b9b2e34b87ff9e02bd623851052d78709071c3bb82
- MD5 7b2b1881b865fe85640826c3be372f1e
- SHA1 1584ce507e0c165e219d32b33765d42988494891
- SHA512 e17c418b316a77d3aadd76c0ddecb4f626b919fb691d194924099230b8daf9698b7547c8feaea2f4848103f3b89cb20d8508e1f6957ace907a4960ba1add3991
- SSDEEP 384:kOGrKn77m9/7lWwQd2gAuJpIOiu38FxV/9p88w9t:9/mN7kwQlAuJ2OR38F788wt
- TLSH
  T1A982AF11A44B69B7F36850F2FF852831F4975CD0CE8D6065144096B1E72B9FCEF56A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  smp (1)/smp/plugins/LuckPerms/libs/okhttp-3.14.9-remapped.jar
- Size 442KB
- SHA256 f561e7f2f36164840f4b52c2ce15e9cf3284898a50463c77cbfe05c95af30163
- MD5 b10b480061b4e47cae39e875d984b2c5
- SHA1 d69aa76b39c15d7bb102401eb3e36ab516c98b1c
- SHA512 18e33c41711adba4ab4183d1d3062f31eb1cfc07f71456d59cd83e04d7140897ebdc9e895fd00cf3801abaccfbd79f5a3afb32dd3dd21763bbc64fa8e0925955
- SSDEEP 6144:J+BbJtnwI0k+vD2hxUoWuiYXrQIc867gjEjd1pITow58DE+ubR6ZL/r0AOC/B1HV:uJtioW1WzjEjdUF58D6AAFSPV
- TLSH
  T1FFA4E15FADCE7617E50BE0B094D7D213D42542C78842C42601AA86FD2DBA8B45D3FEEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  smp (1)/smp/plugins/LuckPerms/libs/okhttp-3.14.9.jar
- Size 420KB
- SHA256 2570fab55515cbf881d7a4ceef49fc515490bc027057e666776a2832465aeca0
- MD5 69e22f2ccb614cf1bcfcca5cf7711045
- SHA1 3e6d101343c7ea687cd593e4990f73b25c878383
- SHA512 25a7282ba15ece63784e880520e2f1a6dde97712a7a596a96072ba1b4d9fb4e3e82879f2669289305bc9a2396aff5fe3f7dd2bb0b082f5e5fe32fe5bc65659b6
- SSDEEP 12288:Yrf5tWsxDmL+Eh0jEjdUNC979v1jqP68LEvom:+R4sxDs+EhqEj7973i/L8
- TLSH
  T15294F1F659812B73DF27C131B1B0ED1BA45D02CA6177E8B859F0C24B18F34A992BD35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  smp (1)/smp/plugins/LuckPerms/libs/okio-1.17.6-remapped.jar
- Size 95KB
- SHA256 12221c7438b6c70b93d9b78e7a3e9a2631c5bef0c17f131ed4b91b956aca9745
- MD5 66d4e94db9a78103252740a94657eb7e
- SHA1 151cdb63bba48784df8f041bd7885e7e8f60e4ec
- SHA512 07708cd7d1b8c1604f3d3d534399c12911b672dff1784b85f282f9aab5a4156b1ef698dc2db8e89a091626c89fd10ad58c6d24d8170cef58789d95f4a006a6a8
- SSDEEP 1536:5ZOv6zjQe5cA0yTOzO2h3EQu2UUzsHqkQp00Jve3Tx7JX2LMqqecRFzDN:5ZOv6zjQe5cA082JBOUzsHqdp0kvyT79
- TLSH
  T14793D02E7DCDB027E09FE5B1B4CBC513F43A2295A8025066152616EE2D3C8B52F77ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  smp (1)/smp/plugins/PacketEvents.jar
- Size 4.5MB
- SHA256 e62dd46a3236786d81d8066807ff78ea522ef14c7568dca8985dcfe1976ea7dd
- MD5 55389cf4f94e47900556a495d936c8c4
- SHA1 9762b40414372168b4d04b4d53400e7d4b285cbf
- SHA512 f2f8758bfc348913ca4c7a036a550872fcc43c2072d919a29fd472467057bde03e50e22512c3a01f8415d2ee4090b0966b351f5e7120fe13edf428763ae8aee4
- SSDEEP 49152:lxOe3hXtI5Q2H62pEMhgtXSzuDgrvUzCoShkZs2jKrRxalmUtBl2nHG1oIvvMkxb:l0oMatCFYZslaMaOHG1p3Px6p3Ath
- TLSH
  T19E26D09A788EC4D9C967B57D9750B002E93F1CE9E683F01732608C699DF4C850B26FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  smp (1)/smp/plugins/SmartSpawner-1.5.9.jar
- Size 1.6MB
- SHA256 eea809bf70ecba33d0783e83470253715727075ab2381a2b6566d6585c32f124
- MD5 0a90cbfcb1e98f6f900c07ffbcbf016a
- SHA1 14a831699ac9ae8ae12eefd83e005dfa799ddfae
- SHA512 ac4c7665a73c1cdf9bf596a7c8bc2e9187ac98c7fe354f289982efa9c59bd908bb963a9a77911baaaa5d2aebeba9a91f1b78ad82b04254ff62d94c55fc6eba96
- SSDEEP 24576:zqRJfErC1JUMrWNwiT60qdYf301n6e2cMYWJMd5YTM3c7U6AUE6zqJMKJlO:zgm1NfI3MYcAz3VG+JMKJQ
- TLSH
  T15475D151FECFC5F8ED32383ADE01B0A9672E866CDAC5B01755F05A2F98E64890643F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  smp (1)/smp/plugins/SunLight.jar
- Size 1.3MB
- SHA256 2ecacf27c1d076e085ebd9988f06a62e5b5e8b98088446ef681a400c72e1df0e
- MD5 240faa3cfde7dc4ffec078aff25939c3
- SHA1 5d503b6e45b46fdba57b4d18982bbdda2b1335c7
- SHA512 b50375c35f1f2eacd296990602b2bd9509c1806d2c0053eaf1cb99d3147b8e2cc3d7018c7794235a0cb0317cd77d5d9a592d36866795539f66c0d02db65a0e4b
- SSDEEP 24576:7JH2y2fvZFGb0vjy3GMVvlHyelTljm5gLa2iqP1TvnMuTXeDbhnurK8rmY8H:9Hl2nDGby22ivlHPVli5gGVuTvnMgXeB
- TLSH
  T16455D139BAEBC477C8276433B283D011AF5551CD43CB5D2B137868AE0DE6AA14783DE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  smp (1)/smp/plugins/SunLight/commands/air.yml
- Size 340B
- SHA256 0f131f98f533d4167d0531902da8e31278b37a8f4250bdf40e30d973948c6bce
- MD5 44cceb62e48904d21cefe02c3e8e7b3f
- SHA1 bfcc54e628d317bcef8a8eca4ee13a52dc9c950c
- SHA512 d3db9c082e846dafee88862ee20719e4bb66327302e54a9b373cf6e026933c81f2579cef95b026599f38caadbdc964111226ac810d3038aaa9e49ed40bd16105
- TLSH
  T1F9E0EC036813AF18BC98D075BD3AD902B943AD03C1587936B68F436CBF1E158988BBE5
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29
- Target
  smp (1)/smp/plugins/SunLight/commands/experience.yml
- Size 660B
- SHA256 667374e94d30fe9d6c69e7eb2dc721c72a140aa08678b9bf3b14d3cbc306d89c
- MD5 1ad7b324c448beb3e05f2b41780e8ba3
- SHA1 04ae26fae7fcf02aebb3f8cb4e01b66eafa65e83
- SHA512 4a94568c5105ac10d0831f28651cac2a7ca182b53e8e6db06e4555dd8a51bd37e753fb2f152e3088741357923545164a6a0f0e6c5cc1ba24c0217580969e422f
- TLSH
  T1E301A432E9316B24BD28A071EB3EF502B5239D0751097DB1715E072C7F0E34868475A4
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral30
- Target
  smp (1)/smp/plugins/SunLight/commands/foodlevel.yml
- Size 448B
- SHA256 b2d3f9520adf9018d33bc58096f99810cc71c21c329eeb7eb1ca3a4a5ac6fa4f
- MD5 7d0c1b9e33fd6f8358677fde7f42ab86
- SHA1 0c5f68c9c0eaaa60c79531c162b58b48c5d140a4
- SHA512 e7dba57f14b19e47411da00e943d9014d183856786605f2e9b2c1a2d4718c5c5610a26ed709bf6d496534c1fe118394de3cef12328809b9b972d4d76d5eed96e
- TLSH
  T1FBF06D13A8527F25AE55E075AC3BD902B912AD4382987E75F68E432C3F0E348104BFB6
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31
- Target
  smp (1)/smp/plugins/SunLight/commands/nickname.yml
- Size 366B
- SHA256 59625e774c488e9ef3fe62f422b2cecd7eabb2ce8be9e412029a3843443c84f0
- MD5 140a8fca9b6a1617ecb5f0aafde66f29
- SHA1 52a2f70f1871c8320ef03d22aa573fdfecdf7364
- SHA512 afa81127a49cad3304d821bf30be96baef926bdb1175b8fb80eeae2360169e6e80eda71fd9732abb8a363345625aec61188618d70fac4a1aa0d4cb95097e5f7f
- TLSH
  T149E04F0AB8606619BDE8D07A6C2AC501B807BD4791286A34BBCC9A5C7F1931C30CBFB5
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32