1f8ee8b4b64e5c3fa04a26edafdbeae8c68f0e258b0d6f603fd09059754028fc

Sharing

Copy URL Twitter E-mail

General

Target
Krypt_Poker_Lite-Setup-1.0.0.exe
Size 73.9MB
Sample260812-2nw5ravsbv
SHA256 1f8ee8b4b64e5c3fa04a26edafdbeae8c68f0e258b0d6f603fd09059754028fc
MD5 538ca76d9801861d8f515c47a6227d72
SHA1 df956af8c7fd7f2d170ca5c97bb6aae5bc975b94
SHA512 e8cf5cc409fd33fac7134a32e3b2af4f41703ce07ddbd82347f3cc471543d9054b8daa623362be8f0f36112fedeca8d7dcc576b44f599527b39ce8d5f93a8825
SSDEEP 1572864:/j2u7dc2RdusEGtYCPX0l/y7f0lLKffniEVuAsKgkpvGcmv9EcvwKO7:/jTJRusEGtHX0Qb0lLkfiEYAP5ZGcmFS
TLSH
T1880833D1FC499120CDAD5F310B330E7E6A8FFDA6D672780EB38D32762A77A550899181
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Krypt_Poker_Lite-Setup-1.0.0.exe
- Size 73.9MB
- SHA256 1f8ee8b4b64e5c3fa04a26edafdbeae8c68f0e258b0d6f603fd09059754028fc
- MD5 538ca76d9801861d8f515c47a6227d72
- SHA1 df956af8c7fd7f2d170ca5c97bb6aae5bc975b94
- SHA512 e8cf5cc409fd33fac7134a32e3b2af4f41703ce07ddbd82347f3cc471543d9054b8daa623362be8f0f36112fedeca8d7dcc576b44f599527b39ce8d5f93a8825
- SSDEEP 1572864:/j2u7dc2RdusEGtYCPX0l/y7f0lLKffniEVuAsKgkpvGcmv9EcvwKO7:/jTJRusEGtHX0Qb0lLkfiEYAP5ZGcmFS
- TLSH
  T1880833D1FC499120CDAD5F310B330E7E6A8FFDA6D672780EB38D32762A77A550899181
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 73.1MB
- SHA256 33af678a56123c109b79e0e02b3c87a2112d84404f52045d3f7ad81fdac961c7
- MD5 6a8be44636dc1df4ac67ee6db01fc647
- SHA1 dcaf9f228e4032f545a57e2da91f60728cc01892
- SHA512 06f00b07ba7bf69bbf9d7f5d971bb542953ae719ce27d308f56a82f1d9329bceea423747bce1631b67171232980d6540277a9669d66567fec2f7457bc47750a3
- SSDEEP 1572864:A2u7dc2RdusEGtYCPX0l/y7f0lLKffniEVuAsKgkpvGcmv9EcvwKOp:ATJRusEGtHX0Qb0lLkfiEYAP5ZGcmFEX
- TLSH
  T140F733D1FC4EE63086FD5C320F52066E6ACDF596E3A3781AB3CA16B31949E291CD91C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 146KB
- SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
- MD5 6c2827fe702f454c8452a72ea0faf53c
- SHA1 881f297efcbabfa52dd4cfe5bd2433a5568cc564
- SHA512 5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5
- SSDEEP 3072:izwJCGIekwusTAaegpIPMKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:izw1IekQTARgSK18Gb0OV8ld0GecQ3Ey
- TLSH
  T1CBE3E1D7B7F4ED7DCB9B56B3A21500B1ECF346280A91424A168ED4763A76B48DCC8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 220KB
- SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
- MD5 77088f98a0f7ea522795baec5c930d03
- SHA1 9b272f152e19c478fcbd7eacf7356c3d601350ed
- SHA512 5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a
- SSDEEP 6144:SDQYaSN6svyd/I8M+RgHgx5GMRejnbdZnVE6YoppO4:3fSN6svydl26edhVELoXO4
- TLSH
  T19D24E1CBA3F49D7CC96746B3622A01F1ECB215394AB6420B17DFDC357A55AC988C9383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 481KB
- SHA256 716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
- MD5 94af96b7f60a4cfb9d596cd8927ba37d
- SHA1 556833517bc6ad77b5427000f2c3dccad91b92e6
- SHA512 6605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83
- SSDEEP 12288:Fio3WJBL9o3w7irJGiCJYR2+H2JynyaI4IR6ro0v7ENgI2CRwHM+2rs3e0lOX5gU:SL9oA7eJdsYR2+H2JynyaI4IR6ro0v7e
- TLSH
  T1E1A41B06EB84273D09A07296BA0846F7BF9CB26CD770B2B6DD9D82360566EFC017D1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 782KB
- SHA256 9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
- MD5 34b24f035bad74764b7cc57420488180
- SHA1 fac3fdba1a94d7676ac4d71447178cfbd1fa4e82
- SHA512 a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0
- SSDEEP 24576:lHR3bNjTZRfxxF1GCj+Fmtz1L5KJgDHVHB7yPGX:ltJx59
- TLSH
  T1070599547EF9F7570F8E8A19A4310E4E9594AE4652803C38C35AE3FC2B2DF1B4DDA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 855KB
- SHA256 516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
- MD5 38b30dfa8ccd369c747c46bef204e2f2
- SHA1 047976a9b0aad536cc61ac3dfbc37b20f39ecbf4
- SHA512 5396af2e915808abb6f0ff8c4a1c3a7675e620687d717193d5e69905a070accce08925b7e243b54b922e1b022fd6210884fd12b18681e1b7d08f28c542cc4c3c
- SSDEEP 12288:TfDNBjEw/0/R/mARz4bvPUgtR3kYG5dN0W3ZCMmXY:T7DWBz5r31
- TLSH
  T1A5157BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 892KB
- SHA256 d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
- MD5 d08e8e493f0b3c8ab19070ab05a78af8
- SHA1 c5fa430269dc2d32baa6885de2453fa84c36f2fc
- SHA512 4b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8
- SSDEEP 24576:ixiUOgGCBfqWPnLYazQkEC9U3VbvcHU373ZjH3aAKUGVDoIglumpod2OQ5cGF1YT:ixiUOgGCBfqWPnLYnWU3VbvcHU373ZDw
- TLSH
  T1161524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
- MD5 696016f43190747d63befa354d76e50b
- SHA1 3399e641930b820b627a4e28dea0a79fc457f929
- SHA512 3966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430
- SSDEEP 3072:tDACbQFusRUVOA2nRRGYUXay5b2cq/j90Yuf1i/QfqTNl2SQRRBbJ/QL5I2DbMJQ:tJbQ401nRRlwR5LPqTNISQRRBb455bR
- TLSH
  T13945DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A25938ADC3C8CADDB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 542KB
- SHA256 7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
- MD5 1ef1e76e7028cf6e0b1f93b3218feddd
- SHA1 20c76258573d7499889147b5532a919a827f6de7
- SHA512 7e1a7e8cc5e5a2d32192dd38005553961037501a3b000210d92a8796cf65e025c60674d206bd9ca6a9dea5007ae322b2f87b233046d5dc1b838ad3e5b5ad91bf
- SSDEEP 12288:o9R7tRE1Dvkd3k5PqF4N3Mw2juwHzejm0t3lvybrTsn/RCHWIsjc4jlLEY0CJkoV:o957dPARIeCPMNfXI8C5UhWal
- TLSH
  T1F8C4F9239FC93B6744D2330AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32