hxxps://r2[.]krxteam[.]com/v1[.]36[.]1/KRX-Client-19[.]5-win64-public-v1[.]36[.]1[.]zip

Analysis

user interaction
yes
max time kernel
872s
max time network
877s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://r2.krxteam.com/v1.36.1/KRX-Client-19.5-win64-public-v1.36.1.zip
Sample260808-b4ktjsxfpb

Score

5^/10

Malware Config

Signatures

Probable phishing domain 1 TTPs 13 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ad6828ec60b27	29
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ad81f2b9e0b27	41
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ad9e75c770b27	53
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27adf3fdc120b27	89
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ae2d068880b27	113
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ae82a58d10b27	149
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ad3874e3d0b27	5
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ad4ff0c2b0b27	17
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27adbaf7bb20b27	65
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27add779a8f0b27	77
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ae1082eab0b27	101
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ae499bcd50b27	125
HTTP URL	32	https://r2.krxteam.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27ae66219050b27	137

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4481

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Size 26KB
SHA256 9e6b392a0a1bf402f64aca3dc049d462a9a9c9eaae716c4287b12ae06dd82e52
MD5 7a852f31a1d0937793070271c82850ab
SHA1 f65c17641c5c0e59058b530ff256b1f493bf9fff
SHA512 ea656f815def2e69d6fa728600e95eb75a77f83a16d13d9fccc0b4b869221b0ab9aac3889cdc3b2bc34cb76d3db58153f8bf988861a509216f21ccc35e12c598
SSDEEP 384:nxmFq41h1wfKSoOeJ9hhlwuTjCh5F58CwdbhegZiOGP5MIsoCSDbyJg66Qv/MO:8wmj4y9hheohvZBO5MIsoCSD+Jz6jO
TLSH
T11CC21732EB50313B356BC2AE7784FA8521349A585365AB74FAFA6524CFC804B35733C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads