ea3e35053c3c95fdcb13579caa7fa4eabf132bbe930808bf92fd11fe0301b3a8

Sharing

Copy URL Twitter E-mail

General

Target
white knight train.zip
Size 87.6MB
Sample260811-y9hmpsge96
SHA256 ea3e35053c3c95fdcb13579caa7fa4eabf132bbe930808bf92fd11fe0301b3a8
MD5 51e5362289ffa1f04da4d8c23a96bdc7
SHA1 8a5329fa164e9970f03a54036cc6caeaf8614735
SHA512 ff033ff075a313ff0f1aab27e0a26c8d5c724664fedf5026486a5bc0e13c041ff7c852493052a4cae3a37ab86edf3e89e14271b4b73c67e18e2805c1b0462378
SSDEEP 1572864:AmA1JZN3+xGGX6UKZDuDEGIgjGVY2JqnGGkAiGXCB6d60cWngFJPFbzdHLsA1nHC:7ADZN3+xGK69DUEGIgjIY2mGGkA9CB65
TLSH
T1B118339495BADA8ECC7F61BEB03365D4614D89B0E0934EF0EE2805943F8345A971BBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Targets

- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size 595KB
- SHA256 15bb9d00bb61fd06707a4b5a0b7b2717859b6a195e862e0ab28836a0c4200783
- MD5 794fceb498739e1d2d2d81e35c1de164
- SHA1 43a27079275b708f43a7963637ce66430b0c5d92
- SHA512 b6890cec1bf477741d8dbdc9ca9c28477e19238db5e58d92cae30a333936a573d0224d3429aa350dfd8ac9c5b7d3c5936bb11b9a4cd164549f892b37d5e17cda
- SSDEEP 12288:gOmNAmdeVH9Mwe9Ek/7jY4hOTBPy29Gay:gnAmdcMj9Ek/7jYSOT88y
- TLSH
  T1AED47C56B7A402B9E577D138C6834B5AEAB27811572093CF03E897AA1F137E11B7F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size 7.5MB
- SHA256 085abe445068edebd378b2c927f8946f05fc0084f2cde013942171b6b7101118
- MD5 b26f9555cc1355c8d8cb118f516c9f62
- SHA1 cefebb1df7c6892c55af4398b8929d3205800c15
- SHA512 8388102618e15e7a403a5c5a5212f3f98855d7e5962b62d8bfcd7e574de3bc92508cace45c035ca6b34bf0811e6a164aef390835e05e39a84ce539a591721667
- SSDEEP 98304:runhnzPR9HR4DBl7JoblF3zqmLFGplVtdqkX:rYdP7HRcBl78/zq2FGplVDNX
- TLSH
  T18F867D5A92760068C8ABC23DCB676B33D775700443306EEB46905F6A6F23AE1537E7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 a7ee159699e11d97e592e0775c2d71c234c59e05cdc8554439d3a6fb375afc80
- MD5 790687f46ec9fe7cc2dfb6bbc6d3c0db
- SHA1 61f1463664f4e4c5c46fcad5784ad41e1593d7d5
- SHA512 f1c534cf318f5e84ad8114a922cd8da8eeacfd4536f0d794ce141a52742d840fe2ad21cf19e5be3c05cff3c105175fb529632ed9fa8a304958f5e3d3ba06fbdd
- SSDEEP 12288:3Y5HYLpCI+1WN5Bl6PwsGCLm5s6j93Lmmc/90o/moKRp1qoQfz2fzAC1:3Y541Cb1sLCLm5ZNbPRpcz+zA8
- TLSH
  T130357B5A6AA800E8D5A79039C956491FF3B27C1607208BDF1390B76B2F3B6D55E3F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/UnityPlayer.dll
- Size 29.5MB
- SHA256 fccac144f4bbdcca5dbfc67031de586394e515b0d62d0e3e7ec56f2c6de66a18
- MD5 8b8cb093e3b08b2ced0d5dc0b2a1522c
- SHA1 5a51da619d524b57e458a6777c47d8310d28b318
- SHA512 41c630765bb2e8d1211ebddf0bb04b551d3d13c5ec14f122630a82aee446e42cfb256da495310ca8935d80c38166455e40137ba5289111a974ce3881425cb2cd
- SSDEEP 393216:rZeUL2wiMN2VgnfQHWERCfLpOtjOxSBh411jrofINf:regnDYO1jUfINf
- TLSH
  T1ED679DA6B2B800D4D47BC074D65BA90BFBB1344A033086EB62E149956F73BF11ABF751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White.exe
- Size 651KB
- SHA256 4a524c93ac667c81cdf38a426bb222c0b98449033f08ba6dc6dd8ecccc079b63
- MD5 5b64f81989b7f2adcc37bb7516d736c7
- SHA1 52093ecb9e7177767598705759f9f9d69c8380d3
- SHA512 6cba503a2708cba9edcc9d05490151296a3a90be077e77d7ad1f267237feb52ab09b40944e64cc7832d8ab4ca687d412aa5d0ff7a827ecabe6a1f1e4c8aaa967
- SSDEEP 6144://7FG9mpcJ/OD85X/AkQcYVYHJqgJHGSAMjhX7tjPBvYDkzz5aB096UJQ2cs68jR://744aOD8VAzcYVYh1ajLLk3
- TLSH
  T1C7E4E7B7941895D2CAD4BDBBD44418C2BEF8C8D1CF8C297F2A911E7B046E9D08B16E53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 44KB
- SHA256 ef78d127c6be15e1e30e69250bc2f56ac0b3a880b21907975a1ece6d0a2cde87
- MD5 71f8d9cd1852b8cb1387f018ceb5881a
- SHA1 ca8ef6fa1f095bdc54d510dafb408b1a292431d4
- SHA512 ced37aec8c640ae0fdefb73aa3a7e07ea9ba0401f349a5c18f50dd1efb02f74bed55bec7aaccb7834ee45c8a8190140bcceb37d65268df32b5e6b4ac75dae428
- SSDEEP 768:BLuP08ecBk/hKufKY6PtC6an4p84+Vv0ydId6u+TLpYX6:BKPVJBk/h1Spdanr4+FJbb
- TLSH
  T11E230AEA8B781337C69F0A3964149901C770D32A8A16F766BE4BF1F4805BF9369403E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/Assembly-CSharp.dll
- Size 104KB
- SHA256 021e587f5cb9b16ba2ad7cfab52d4d55f423204fe97b89a93f51ffea1c6a130c
- MD5 aaa508b6d67227d9353c4a0347c860ca
- SHA1 4bc0f1bdc17ce7da849e13b412794da2a552ca3b
- SHA512 43159c15751df358dc72aef829d77f2a4f7326e5ae3f6f5b2dd8c53de5b550cedcf9ab677fa73942cdec0f30a0aa83698e985d172001c73b9712fb34d57bc962
- SSDEEP 1536:AdnjLZ5Ujh2oNZ7n4u2LLSdPqfTjkzgwJQNLEyXI6fwQECuytp:AljL7oNVn42dPqrQzgRXI6fbJ
- TLSH
  T1A0A32A38B2A48F73D6AE17FA90E49640E3769346644FE78D0ED5B4DD08C2BD526022DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/DOTween.dll
- Size 171KB
- SHA256 8e90fc43ab564a5a51424af56531ab074a5a2e9cab271b2d653d287954237b83
- MD5 c278d7f5c05b8470da58390f1a1efaa9
- SHA1 5785a56e7938608debdb1c67960d1cd5bdeb337c
- SHA512 ca749b0bcf368e5a9d273025b7c945cb0ba9b3886d42f1b483cdfc56009c9f2c1ea76a1717a065f60861a41a115603a3840c7996d3799fe3835e44fe2c0cd6e7
- SSDEEP 3072:6+OseYXEszneCqlL5lVu3GiO8J6Ye0JeUjnC+ee+e+4LWGOCdXaYr8yzi+:RO4zneCqlL5lA3DD6YeWJLWGOz88ye
- TLSH
  T142044B48A7E95632CBEF537FA0382D58A335D55DCEABF7DA2950A8F41C03706A801397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/MagicaClothV2.dll
- Size 430KB
- SHA256 a912d204c5d9ade636dadb27f402c80edd914446f3f69b51c758c6a5f7ceeea6
- MD5 1d62da064f4acabf50afa1dec7591346
- SHA1 525f46aedd92481cff11a4a504979f65cc8405b3
- SHA512 9e39d686ace3f584d2f1ed2b379c50e5331f13c7d2b7f80bbbe74cf5d27e637b2a8499c1b725ddaa00bb3c3c2d820a7f6abf09aeaf38812db3604942bfbd4d6f
- SSDEEP 6144:9YmqLtiMREeLrn5eka0resBnNTCyNxHk/T83LFu13fTmkYDv1Dl/4R2s8O:9YHLD55a0resbThkkDmJ8
- TLSH
  T197946E4037A4AF1AE89F577AE0E04E5D53B28206D9EDFB8D0D4CE5EA1C97350AD06393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 5ad4adabd1574f00f300033704e430b848356d64a4b6de4fca9417199d952866
- MD5 cdb5899e6cea22efb314a6574cd05492
- SHA1 21e3b0ad273f5663fd0530dd433674bf8ec819f9
- SHA512 c9cd48fa0482333745091521593999594726fe2b2a4d5dc2f3b92d8037a26a8c6869524a6ecc6b7591399a6c97b379050a27923893aa093a5856d8ec83442a88
- SSDEEP 6144:kUjTQ70cnf8MoVRxS9iJdBF119RJXG2yY+Q:VEiH119RJXj3
- TLSH
  T172344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/Obi.dll
- Size 615KB
- SHA256 03a9c1438a2b51908a9524dec77a21d0564a21b36f2af0e594d05ec57539509a
- MD5 55c442b1f430b21bc2030220a81476a9
- SHA1 e974f6090b13783f53262adcf34e8a66e8f5d7d7
- SHA512 d19b963b28572ea0ba7457fc1af911f815b086f417cf1806c544f45b278eef880db1534471a8c9502b32b84828abb64bd0401ebb1f205af048da4ec149b18848
- SSDEEP 12288:kNKRuo9CBgHd9jMvgieFNUrC0nY7QDuIK0Fo7gBG2Omuee+H+edBAoA7tKZ8egpT:k5o9CB09jMvgieFNUrC0nY7QDdK0Fo7d
- TLSH
  T168D47CA333A48922D96F5B77F451586D63F9990331D6FF4CDEC8E9D808EB7A048061A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 fea941a88ff3dd83e4a4a144a920cebbeffa8eaa9d201f0b9ae558e811333158
- MD5 273a622ffaeaed21e1f0893bca81a7c5
- SHA1 5bec4cc3022634c62a967d94a90f9b5b275e5b4d
- SHA512 d303d6efb7c911c7bb56bb546b6cf3832fcb20fa9088a9b346fa6a283fc26603b57a3b4c9f7f8dfea2573efb71124bf3f9707495f0e798e9b5fb3f79db5622cd
- SSDEEP 6144:gkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:gkwkYfx8ZNCxL
- TLSH
  T19C44281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  white knight train/[Kimochi] RJ01574150 v1.1 64bit/White_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 ad5635b0625a898a5fac68664e83733641cdb76e175236f99e7b0516fa285d2a
- MD5 642c652695cc4bba31e285160bf56d9f
- SHA1 f3d9f87f70607ecccbea4cd23919084e63b994a8
- SHA512 2b8ef0fb366db00c2407a83da934ffe53611668a62f11490abc9158244a5fed3655cad43a2c16248e515b9de613c81bf9a7c176e4fd0690b7e001fe934df8e16
- SSDEEP 3072:QGHTFkizuGCOE/htnREcacWown5WJGL0MIeAgNe:QGHT5+H/33vJm
- TLSH
  T120C3F92563EC872BE2EE177EF8B515100FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32