7f2f0e4ec8634766820c5d53902142c089cdd0fca69b1ebffa0bcd7424d31239

Sharing

Copy URL Twitter E-mail

General

Target
Upload Patcher - Kay x Kaz (Cracked By Xyzwon).rar
Size 44.0MB
Sample260816-m4h6hawdng
SHA256 7f2f0e4ec8634766820c5d53902142c089cdd0fca69b1ebffa0bcd7424d31239
MD5 0d0d49b935d3e3a80d0f10b11fd05d88
SHA1 25d62c67af000c109b799c0dcb0b487f59811007
SHA512 95b7c370aff56ef439a221d4a16cbb44f9dd3372d53add7886bf2d302091fec2e6bf616fe12af41ac6032db2ae0e3da142388a0e286336721070a7ce2fb7a978
SSDEEP 786432:t7tXbLVMsvSQD8Rl4ItI++G8DrbLRISZ9yeJFvjyZHjpn4Wr80iDYLfExabvnq:dFlMul8IoIY2LRj6Ln4U80DQUnq
TLSH
T131A733A647FD6A11224D4AF5A87449F35947B2027BAFD9B5780C8F4582FA6002ED0FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/Index.html
- Size 55KB
- SHA256 d906cea49e188e0edf0b7b716ddf488d0747e1e20858dc9b222018ecb004dcd7
- MD5 aec49c332d42d0b2a7dec3ec739d6e80
- SHA1 2d9791335156e135bdc9474fa9503771d7c4d2db
- SHA512 1edb3338e0186b3d4ca278f78d197f5ee4d2b10c70de20e49fd79d5b7318056db37f1fb1226b802684c13f3dfc5fa326029fd720a97e8d392b40ab1b2ab60ce5
- SSDEEP 1536:xsytqE8iFO4UzzfgJgdgv5IwWSyP7Rx3e8wIOabHNzAf5tmmtIWR2Do1bequJHOQ:Q/TRPwIrbHKf/mmtIW2Do1beqkO5Wiwr
- TLSH
  T17543FAB321120835C9B76765B652C38CBB78C0039E07431879ED9966CBB9E42D57EFD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/Upload Patcher - Kay x Kaz (audio multichunk Method).exe
- Size 746KB
- SHA256 d380806ee7fd4a6c40396f9fa6ab60ee4f21b29ff9b469b40e14dd421cfb681f
- MD5 e0659b04c1ac574dcf3f14894726a82e
- SHA1 53eb3d1c62e33a30cbb16638831791438b6705eb
- SHA512 a811f231c504116c20c26c74e1271e8edc36f37a259463a843a06f92c04cf02c2d4c59f0e18c833daed35c1088a734c62766360992164a31357e8bc508cd8231
- SSDEEP 12288:Gs4inp4n/nYM0jHDshsfs8Z8yVlbrl0P/ZUsZpbGPbdbvmb4ATtfbJbkIbnbzMkZ:Gsen/nYM0jHDshMs8Z/VlzIM2
- TLSH
  T102F46DD8AB5700F4D06595788D72C702E663FCC973668EFB16FE7AB20B164909D3A603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/WebView2Loader.dll
- Size 161KB
- SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
- MD5 61f430f292f85b18b57f06ea6d3d8b82
- SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
- SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
- SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
- TLSH
  T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/ffmpeg.exe
- Size 97.2MB
- SHA256 1326dde4c84ff1f96fe6b8916c5bed29e163e9b5dccf995f6f3db069d143ec5e
- MD5 2ca4461e420e98f140cc2a4a98d589d3
- SHA1 d20eec1afb1523f105b574fb63a677476d938895
- SHA512 85093520894342d3e622f56ba0fddda742301bb45291e45ac0756b71b6a65b594057ee78e9235f4cd9637cc50fa615173178a3b2d021fda208cd074a275e40bc
- SSDEEP 1572864:+YXMvZXN5T8/JflTQFVMyup9+XGrtwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfL:K0W
- TLSH
  T192288D9EE1E3509CC227D4B0437EFB73BA24786C10246E7A66D9DA306E62FC0571AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/unins000.exe
- Size 4.5MB
- SHA256 4af4cfff9492bbcce6d20bccc288cc91e3a4f435cd1ff561fbfad35f00b605bc
- MD5 f1f9a66429c7d916a6d28c6256481a06
- SHA1 bf5c5f6282bebfa6288ebddf16bd090587867f2b
- SHA512 3012c313d4dc159dd24245966eba62284bca9bfa4cbdca26a32296e3d64c0717b0d8aaa4bfd0264634c9c330d29504da94452ae17147fc1d6563e35352b55890
- SSDEEP 98304:P9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J+333B:8ItJj90Z6RgKwl
- TLSH
  T1FB2639C3B38B613AD4A61A398C3BD350D83BBEE139258D6B66FC197C4F395406D26643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
behavioral16 behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Looks up external IP address via web service

Network Share Discovery

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17