a196e045f60a513abe5aec10e4e2db3079669a003b08ce5b17e8ddf5dac00392

Sharing

Copy URL Twitter E-mail

General

Target
Kanakos_Haunted_Rampage_DemoV1.2.zip
Size 225.0MB
Sample260820-2qfksagb57
SHA256 a196e045f60a513abe5aec10e4e2db3079669a003b08ce5b17e8ddf5dac00392
MD5 aa0308a2ab81de1dea4a333f3d34444f
SHA1 db03622ea8eb8a8a67ee599d394212c8889d0c98
SHA512 57367433cfa84c560e2c6c264f86e4d012818176d4eb9e132d91d3b9eb874599744d569404ba8d35ccf910d475424b4d32babc9b446b492c81a3069444f9c6c9
SSDEEP 6291456:Ndfb8yKljaUwrM+4kcbl845YfJsYy5nUKzJbRZ:jfAyKdaUww5pbl8SYfCj5nUKJRZ
TLSH
T1B5B83347005BDB9CDE67A2732A5269447E10009FEB9D8EE3924DF0445A1EFD2D06AFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  Kanakos_Haunted_Rampage_DemoV1.2.zip
- Size 225.0MB
- SHA256 a196e045f60a513abe5aec10e4e2db3079669a003b08ce5b17e8ddf5dac00392
- MD5 aa0308a2ab81de1dea4a333f3d34444f
- SHA1 db03622ea8eb8a8a67ee599d394212c8889d0c98
- SHA512 57367433cfa84c560e2c6c264f86e4d012818176d4eb9e132d91d3b9eb874599744d569404ba8d35ccf910d475424b4d32babc9b446b492c81a3069444f9c6c9
- SSDEEP 6291456:Ndfb8yKljaUwrM+4kcbl845YfJsYy5nUKzJbRZ:jfAyKdaUww5pbl8SYfCj5nUKJRZ
- TLSH
  T1B5B83347005BDB9CDE67A2732A5269447E10009FEB9D8EE3924DF0445A1EFD2D06AFB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  KHR_Build/D3D12/D3D12Core.dll
- Size 4.5MB
- SHA256 625bd40005b1c3708695d5256ecf230d278e6b8edba5a88af70f3d91324f3052
- MD5 8bed03240b764906c937c0d6ccd560ac
- SHA1 2a38a4d7116b9d067e9d24d7da2646e2fc9f61c6
- SHA512 6fce3c735a101794634c53fd622be20e69e75c68ba216d0caa0fb48aadf97ed55ceb6ef205a4ea22f405bf5e663638add2f489df720c206739920093479863a7
- SSDEEP 49152:+h38HT1tnrx7KGN6McyBTwbreXHYTNeZQROL+qgGVO9EflU7slMWr+IGrh4TeeYo:IMBxrfwNFrfau5e/H
- TLSH
  T1B1266C07BBA840E8D4A6C079CA6B461FE7B278654370E7CB169087995F73BE1193F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  KHR_Build/Kanako's Haunted Rampage.exe
- Size 652KB
- SHA256 5be81b3fa7df7c08cadee6f79d6ff3fe95481420f166ba8127390ea669c8b12c
- MD5 3a5a1c68595fe27b90770c5e6b2b47ab
- SHA1 0f570ee0607faea94471cee9998e9711011a41fa
- SHA512 42073aec90c027901233e11104b171e9d538511594ce56cdc45bdfec1f22e524d658199f6db38ac692f211b9e4107a6c0384e4653061fdf6f51119ac8c926e01
- SSDEEP 6144:uaMjvuUwZp1UhL+NtEuevMcz/y50srJ9tC/FVYE16:utVwZpehMtqxz/yasN9tC/XE
- TLSH
  T1D4E4D72D2D546ECCC422583E8783CB9242B0EE696CB54B135BF27FA27E310D05D6B796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/Assembly-CSharp.dll
- Size 262KB
- SHA256 4bf4b6f359ece1d36c266eb0971664a2e44907714f568dbcebce83faa5c18d82
- MD5 199a02ab867de422ca31ed17d3e8c980
- SHA1 d0e43587ca00de327fe17350e5ce1710f6645de1
- SHA512 1c6760667af67251d81596c057b36e17667a1a36bc8bb74b7dd17e24bf9ae49bca93e6b0fe69662282ed1e902c74fdc1e3ab5a78d77b4fd40a5e0dcbb4921c2d
- SSDEEP 6144:PgA3PQD+q+6IuNJMZbIm/Ds4nBTpbDRU+PLWFE:PgA3rpSNJMZbIGs2BxR3P
- TLSH
  T1A4443A3C66EC5A37D27F5BBA95710801A7B56467A23AE3CC1EC6B1DE08C6FC16810367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/AstarPathfindingProject.dll
- Size 357KB
- SHA256 c8a618f7536ae5d52496fcdd3af2ba50709e4234a715fda9ec27a96da036f29f
- MD5 7625ebff91434fbb5e9b520a0faf3d18
- SHA1 fe994e2209381a3802958bbd6060ecccb94fa0ee
- SHA512 c4ef16b705c14accaf30ad4927d2984324c98c29a6001af7f4a9e923adccd72ce7b56e5e3e6d83d759f6b27eeb71733590a1d00cc82fffff8817ad415f81b0e6
- SSDEEP 6144:bvhS4io+c292pWEJc5l6pxBhU+6Lh7mrh6YYwsQZ8HKSJzVyf8X4:bvM4ik295oxMrOeQrSmfI4
- TLSH
  T167744B1063E84622EABF5B76E4790990D3B5F92BE67EF7CE4C8894FC1C52B509811363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 9838776992dc44ebe2aff2e9ec52c292024f5464542897aa5d29429a921437b9
- MD5 6510dfc9dc2bf1f9c40d4515f14dfa4a
- SHA1 36430b0c6b87ee4c9760042fa05c91368770106f
- SHA512 cd0f21356f5758e30ea8d7019d067d7952d39178e624dad5a820f60d5b78caca2ffbb611c0bf473ca2a92feb483939b56e2ba7525df81292ee0167de1a46f49a
- SSDEEP 6144:eUjTQ70cnf8MoVRxS9iJdBF119RJXG2yq+Q:vEiH119RJX93
- TLSH
  T1BF344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/Pathfinding.Ionic.Zip.Reduced.dll
- Size 235KB
- SHA256 481cc0f9a53a9ba94f8ea3fc0fb2a520b41812c2fdc6ab10581751eada743d34
- MD5 1bebc6f68d83ae67251378ac7bfd0e56
- SHA1 7650b24feee9be0d5227b59c7f2735df6e05f15a
- SHA512 7ca948290df3d9f4f58d3bba2f5c2f111d74f6859b0ae145b94b08e288da8d24e863887decd5507e30b3da764f21912862b8536c828e13d5ed191ec8ae070b7c
- SSDEEP 3072:cWWdICvUvLYPPC1hLBy6YmkLqY6+xbrzEw/GAJkGnpA4Pel9GS5axw7Bx6W6EKXv:m2Oa1ohEwCspMl9kx8V6y/Q
- TLSH
  T185344A5427E8DE5BF1BD27B4D4E28061C3B6B061F57EEB8F9D4424EA1913340AA053AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 a30fdde214493b540a5a169aa1729ff494d46f519d9c9a036746967c0845e764
- MD5 242b1b7c14f87e09d29418778d728390
- SHA1 bb4492e5575660f3b37bf62e0f4f9aebd8ebcebe
- SHA512 c2c65da0948f9ebada360bd1790ce0e2e187203b9689135792635238dc77def94b453967e4150b86c255253ded93ed4b5739b47146184f48976c4df3cf6d70c6
- SSDEEP 6144:jkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:jkwkYfx8ZNCxL
- TLSH
  T15E44281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 223a6629bb9debb0327082da3e525860e734f231274d0f6bb83a164df778b779
- MD5 7868ffb12b0e1b548c37f33f2e7bb539
- SHA1 d7f94a509763c2fa7bb948ede7d4d1ef72fd0a04
- SHA512 500a1e040a35b689527ed024ffd3503e3aa6d6551d0a8b9577eedffa08dc667a16ebb9d4770bfefc66519e5939eefb574787bdc6e7d3265e7d30ab046233818e
- SSDEEP 3072:SGHTFkizuGCOE/htnREcacWown5WJGL0MIeugNe:SGHT5+H/33vJI
- TLSH
  T10AC3F92563EC872BE2EE177EF8B515100FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 db725196b862d96beefb95bbb6693f892a12dc401b5c044660d13789e45c255d
- MD5 07a5e2fccfb92bb83373015e5e2deb64
- SHA1 fdaf7c90cb87ee85451c492266c0cc5b20635c64
- SHA512 09ddce94de3a272d31d8720e06f551113eef91124df47a3c53104d3516419cf14923030985d07b08c76181f46585034674e38753737b59791276bfe1fdb9ae64
- SSDEEP 12288:wWK8Xi19FV57751umv0RX15PgLdfJ18VjjvM44hvetIX6e+fxHzR:Sl/umv0Z15PyC9vMNV1+fF
- TLSH
  T1F2354C01B3EC9B27D5FF7776A4B442A007B6FC46AB3BD78F104891A95D56B008D887A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 1d6f66f38cabd57b3d099804593ce5144e22921871dfdf0d6487a4bc725b9c8b
- MD5 def36a6bef34a2121f44fff332dc09dd
- SHA1 96b1fe08d82321a6d3f6ab81027ec8ce45d78dca
- SHA512 191c9b97f9b1b4f9bb8a954a3c1a2d58a9474c78d61468a96a3e39831131bcb554231d771c37a122836bebf1eb15715b9b893da88f53ce4bf096277368852abb
- SSDEEP 384:3EAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOxBsnRbli3ESmMadMkrVr5UhH:3cZC8Ll4LiMXkv2Y2Mcd3sj5Q
- TLSH
  T113D2C915D3EC4311E3B727B5BCF9518A8AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.Data.dll
- Size 2.0MB
- SHA256 f1e0909723a04b1b8ba3630593893e1a4683b391349b79697b8958d7e897a68f
- MD5 bc136d8c62d201d281e597e71558d06b
- SHA1 f6e43b44fd388f705dd7d9c74ec1b86519214723
- SHA512 1692a9d9dd482891657313feadc5c1c9bf499235776d1ee1d4cf8e2c6b36a09664b36071ce1bbf491ef2bb2a7943c0f43cc29978bf7ad2d65dde987f80f77fba
- SSDEEP 24576:CTy8NQuznGO4TiWB1V0Nt8OZUuhHwjpj5zuctRoOB4MbQ4cggyT:4ykz74VHV0MOZUsgoOB4Mbi
- TLSH
  T198A5185077FC5A16E5FF2B31A871101567FAFC16EB72D38E6508A17E1C62B508CA23A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.Drawing.dll
- Size 478KB
- SHA256 630aeba7b15de154e6faf86270eaaf6921ab2b5e9dd2273382e3a0df8ed918ad
- MD5 c6c826126af84c7c13ec99cc0834a220
- SHA1 cbc3ec2950ecd83a0ea5ac30ff660951dccbf7b3
- SHA512 f59c7df1e41db5fe64b5d8232918892c55a61ef6149a60449964222d37700a351110608f954db0ded32ab5da6e37b957791f1c813312fef419165927afc12ddf
- SSDEEP 6144:gHutOmSUsXjt/z5B4CqvhOgEGKPx+Jg/NY7c/nENZ4k7cheeEk:gOtOmVsXjt/PicgEN/MGq4k
- TLSH
  T141A44A1077B4592BD5EF2B38E0B24968A631FC076B26E75F4681B62D1CF2B809D417E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.EnterpriseServices.dll
- Size 43KB
- SHA256 e0bd4c9aa95b3264e2bc5c43404637447de098829be95d5364a50c286651ede1
- MD5 b93536ac29e7dba51528d5628ee4e4a3
- SHA1 2f1aeca255d85281e1afe9c96de4e135e8dd1a47
- SHA512 f4148cbb711ee504d4d3008e9ba2365c5eb7427e11b4a3aa2e8437f68b1d3c665878a87ede39cf07ca0c17f400c7dfa399f0b3c4236c7ade9f9b2f8973690948
- SSDEEP 768:DT7LlB8tFJutlA/kUTr8yI32JVmugdQXwGHZgm5S:/7BBk8tlA/kVy7JVmuguXwGHZgm5S
- TLSH
  T12813D51043D48B7ACAFB4BBAFCB342264676BB026F37D3EF2605D2994E4374C4412666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.IO.Compression.FileSystem.dll
- Size 18KB
- SHA256 738c6ea02bb89c69473f8e128f077cb6f7d62b04e7928e0e244ea7a991e65853
- MD5 1b2ff78cfdff4dc66b5410d358fc3f1f
- SHA1 051e07eacce345d069bbad1ba9c43f2e92f5f326
- SHA512 48b37c35a8c05c86f69e047d94c2a19a43b1ab69cac76029a951d4cbebb70751c0380cb1e6911137032d3ba5a3d9d97bc231d266f1d32e6d746b024697421adc
- SSDEEP 384:VPQA4DgKGRwrtLsWARbli3ESmMadM1vz2a:VoA4D/J7q
- TLSH
  T1F482602493E44315F6FB4BB4ACF7428686727D13AE36C79D298A135E0C327884D63B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  KHR_Build/Kanako's Haunted Rampage_Data/Managed/System.IO.Compression.dll
- Size 112KB
- SHA256 11877b20d2c14bb0eb208f3e20f102ddd3c78b8c5d18edcea935dd5960e48449
- MD5 c3b1895d25b45ff790ce0c5fb60bdfb4
- SHA1 f78f340e80417f9bf9b542db0785ba2905b9d79a
- SHA512 4649e044817f6e98c79be3707ef7d7c840132ecfa271d744d297e22919d770be867bc85269ca263d7b413edabc9884caa754d9d4cd3b8e86b95112d2463eaeb5
- SSDEEP 3072:l/J3w/nNoiAvsJ0c4gY4gbcRiuT/0HuVB:lx3wPOffq
- TLSH
  T162B3391863F80757F2FB6BB4A87506510B72BD43AA3ED78D394459EE1C62B808CA1773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32