cb6950c3dae5b985c9b5070e6513e0a02d6cf1a48cba637cf29e6345f8d6ccd1

Sharing

Copy URL Twitter E-mail

General

Target
Upload Patcher - Kay x Kaz (Cracked By Xyzwon).rar
Size 44.2MB
Sample260816-etb1facq71
SHA256 cb6950c3dae5b985c9b5070e6513e0a02d6cf1a48cba637cf29e6345f8d6ccd1
MD5 7d183925fd09c2a7ceaa6e3a418a8f34
SHA1 d2589908bb25285aafa92f8f6cae6160adcceef7
SHA512 afd8489b111b4ceb769d00f8686c9dc39b34970e495fb4ceddd06faa54e01c014ac5234b63b659a3a97d60cc4f2275418ae6fba43282f6c77246ff961f51f5dd
SSDEEP 786432:+7tXrLVMsvSQD8Rl4ItI++G8DrbLRISZ9yeJFvjyZrjpL4qr80UDYlCschvKk:QF1Mul8IoIY2LRj6HL4w8WhiKk
TLSH
T16BA733A706FDB925124D49FA94B44DB3450BB6427ABFD9B1B90C8E4086B76003ED4EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Upload Patcher - Kay x Kaz/Index.html
- Size 54KB
- SHA256 2335dea8dba5d106b7890a24527d2ccf41029a7f5ed04c1c6c5b5cd10d4e39c4
- MD5 ea4afefcfb6da0dba85b693d9deb0e8b
- SHA1 97f02b954f0ec5b0a2423b6d8a97b2389361f146
- SHA512 f6ee9874c79d347703001650c3f0b98b06536f81cf7e456806763a461a35d9c1bdd8be575fe123231f74b1b91a90a356fd6ff04e6580cbaeedb9360daee27006
- SSDEEP 1536:xsytqE8iFO4UzzfgJgdgv5Ww4SyvfRx3e8wIOabHNzAf5tmmtIWR2Do1bequJHOQ:OLnRPwIrbHKf/mmtIW2Do1beqkO5Wiwr
- TLSH
  T19643EAB321120435C9B7676AB652C38CBB78C0039E07431879ED9966CBB9E42D57EFD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Upload Patcher - Kay x Kaz/Upload Patcher - Kay x Kaz (audio multichunk Method).exe
- Size 701KB
- SHA256 aa76bf895a7529371ae5f5316fcff6327a983cb2b7c44b4c45086d19add9695a
- MD5 9f0fd97f2def63eac025ec691f731bdb
- SHA1 9bf0bc40723859d91823395acdd69072091e214c
- SHA512 a359798fbb36e3524afbf1b6f208d413de194f2a5de4b090b29ebeebe6be6432a6f2a0a2078c1beb436392ce5afe9d98801de6915f8fbec494f6407f21e079c1
- SSDEEP 12288:a1KxnMIXQvn/+C0LGSa87fBNCYQMVNOWk0P/ZUsZ0bbabxbvmb4NetKbMbp0bnbQ:a1SUn/+CyGSa87pNCIVNR2
- TLSH
  T118E4A0E4A35700F9D0A295788DB2C702D623FCC573258EFB16FDB6762B16590AD3A603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  Upload Patcher - Kay x Kaz/Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Upload Patcher - Kay x Kaz/Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Upload Patcher - Kay x Kaz/Upload Patcher - Kay x Kaz (audio multichunk Method).exe.bak
- Size 701KB
- SHA256 135ec51d9e418dd9490d7598f09351a831f6489ca0b59eb9de756e452633529c
- MD5 2a1928fad2bb05acccda332fb06a84af
- SHA1 88b22f7d3fd9aa6a711e039b6fc7d0f6d312da9e
- SHA512 10962dda9d63db08514b9d1a9e61c3090a8420c9f5fb9065985ebbcb0fcd605e6501592af4b677ccb2fa94e40f2e820e058c5319c0792a09072f84383bfe7356
- SSDEEP 12288:a1KhnMIXQvn/+C0LGla87fBNCYQMVNOWk0P/ZUsZ0bbabxbvmb4NetKbMbp0bnbQ:a1eUn/+CyGla87pNCIVNR2
- TLSH
  T160E4A0E4A35700F9D0A295788DB2C702D623FCC573258EFB16FDB6762B16590AD3A603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral13 behavioral14
- Target
  Upload Patcher - Kay x Kaz/WebView2Loader.dll
- Size 161KB
- SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
- MD5 61f430f292f85b18b57f06ea6d3d8b82
- SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
- SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
- SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
- TLSH
  T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Upload Patcher - Kay x Kaz/ffmpeg.exe
- Size 97.2MB
- SHA256 1326dde4c84ff1f96fe6b8916c5bed29e163e9b5dccf995f6f3db069d143ec5e
- MD5 2ca4461e420e98f140cc2a4a98d589d3
- SHA1 d20eec1afb1523f105b574fb63a677476d938895
- SHA512 85093520894342d3e622f56ba0fddda742301bb45291e45ac0756b71b6a65b594057ee78e9235f4cd9637cc50fa615173178a3b2d021fda208cd074a275e40bc
- SSDEEP 1572864:+YXMvZXN5T8/JflTQFVMyup9+XGrtwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfL:K0W
- TLSH
  T192288D9EE1E3509CC227D4B0437EFB73BA24786C10246E7A66D9DA306E62FC0571AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Upload Patcher - Kay x Kaz/unins000.exe
- Size 4.5MB
- SHA256 e57b616baffac3291e84514b85a778d192da1efe5bfc8135627e505a12cd2a9b
- MD5 a4009dab278f3592af00045024259fa5
- SHA1 049b65089e165028b0cfeb67268775eb0f335e09
- SHA512 5217066ffbe1d9cb67eb546112367c0169280e32401076a0044e7de943c2080b22d6c45df0593f1fbc60698b06eac0361e36fe6d6116cc35f46b5aa16349aa6e
- SSDEEP 98304:P9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J+333L:8ItJj90Z6RgKwH
- TLSH
  T1DF2639C3B38B613AD4A61A398C3BD350D83BBEE139258D6B66FC197C4F395406D26643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Network Share Discovery

Checks whether UAC is enabled

Network Share Discovery

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19