9c925610812abbc9be62d28b5840d1aeb604b6942a7b6567b58bb2f248070ec4

Sharing

Copy URL Twitter E-mail

General

Target
Krypton.zip
Size 67KB
Sample260909-jdvvtstygt
SHA256 9c925610812abbc9be62d28b5840d1aeb604b6942a7b6567b58bb2f248070ec4
MD5 4b6e322da94c65b36671454e48039ee3
SHA1 e66fa84d21f091f910b3dc332829ac1e66cd9a94
SHA512 d76a8853fc351f8ab1e934c7c2a492a9675cf4e92b24661d28d599a7f0214b2f4e2c316f17103ad4032da767ece770c6f81dd464688845093c9ddef8351b061b
SSDEEP 1536:vjx2tb7AgtFPHOHAUI9huhxqOibRruCunKv7KyTONI4pm:Sb7AaPHOgiNiboq7KyUIp
TLSH
T1466302384F6210ACC9CD1A70E0BFA9E911692280FB1A9E5F29A133D529E826C5FF5107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Krypton.zip
- Size 67KB
- SHA256 9c925610812abbc9be62d28b5840d1aeb604b6942a7b6567b58bb2f248070ec4
- MD5 4b6e322da94c65b36671454e48039ee3
- SHA1 e66fa84d21f091f910b3dc332829ac1e66cd9a94
- SHA512 d76a8853fc351f8ab1e934c7c2a492a9675cf4e92b24661d28d599a7f0214b2f4e2c316f17103ad4032da767ece770c6f81dd464688845093c9ddef8351b061b
- SSDEEP 1536:vjx2tb7AgtFPHOHAUI9huhxqOibRruCunKv7KyTONI4pm:Sb7AaPHOgiNiboq7KyUIp
- TLSH
  T1466302384F6210ACC9CD1A70E0BFA9E911692280FB1A9E5F29A133D529E826C5FF5107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  Krypton/LICENSE.lock
- Size 1KB
- SHA256 7f6f7a303c14030a0b20fdd95d2c6c01560724e4893e10c1f55fe7eb438b09b1
- MD5 0d56f6dd56c8af011553cdb545fa02cd
- SHA1 4f4bcfd5b58be10965723cdd610d536ab8dbf5fc
- SHA512 8db9c7077999629afe99c5b70614829838b1adf4955acc2b5da7249c816813007c528cf6f6c7466e4c29a9cf266d24b57b3fdbf361005dbecf87c7cc186fdd2c
- TLSH
  T18811861E72540776189A13A05574A8C5B22B725ABA5F2A84146DF345232A06CC5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  Krypton/README.md
- Size 1KB
- SHA256 ba23449be784ec5156ad1f860014bdefeea28222bf557b31c33cf825098dd603
- MD5 ec969a8f944f55c3840d5ebcbb976a75
- SHA1 dc66081257c17c775e84d7b7fa07f81900e6567a
- SHA512 dd836ef110662e26bbfc08a2996e50661ef5e9419a2d44f5e19a1cafc358748875c874f2be3e1ecf0efba1a5077c304b70e4a9f246d4482f1eb386ca55a2ede9
- TLSH
  T1B9114FA34F04E1500A92DB07D27337D6E76B93AAB1B868EC0C2C440C0339A4A946EF97
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Krypton/RunApp.bat
- Size 285B
- SHA256 a6e9cae4db1f30493f805f10445efe034e19823c99736bc28567710d3734568d
- MD5 f9f5adaf36d60b558df0f75d22f81e61
- SHA1 161c48104b5fdfc4d2163cbd8103ae0d29a8fe22
- SHA512 18a04543064e39806266d7ef0c185341f32f2479ca6ece7fc029d86dd79e43a1cf5d49e59d20b86b5738037a5e1be3287bc507a00dc9156e5f5c17ec669605eb
- TLSH
  T17FD02B19225AA276B4B323D5C67D3023B593D04B30273C28B0E7419C4F5B9E276EA2B7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  Krypton/__pycache__/main.cpython-312.pyc
- Size 118KB
- SHA256 f4191cec9e65fa480d0a740dafb674733d6bf5cb08ec6226edede2bb7036eda7
- MD5 55bbf637ebf4fc494071818e07c67de9
- SHA1 903af6e04ba8f120e15249cf71020cccc7d8a8ca
- SHA512 84852ec8f2cb23feab8a2d2c5b9e172e79bf6accb3c0b2d568e2c5a4b00ce8db484d359f401f0863a5cc3f0d4bd2ebb8d0200f673c898db0ac107d7b377e2570
- SSDEEP 1536:3UtEA2WqiRq94+7kMOHBHBUvukAi7VuyF+EUXw0NDJgpiqCelb90a6Xqxocw:41qiR64PBhU2fi7syF+N7gitaxo/
- TLSH
  T139C3D6862793D9BBFCC5B636456A178FB7B560B67B00C30769A7D024FC032627CA119E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Krypton/__pycache__/status_rotator.cpython-311.pyc
- Size 3KB
- SHA256 e96302b32058cb4f371b2f1fcd066217f2ef4fc22e88e7558ec9d47f39065a67
- MD5 30ac47b10b1219ef2fd1b5faf8911d1b
- SHA1 c5ab038ae3c56adb285c1836ea9a4f6510669528
- SHA512 ade3ccc9de272dec9799bfb116d6059109d516fe3d21d27047688c993cd811c08227c269df85f77ec821115eb020ad7ade1898476640254c8438a35f317cf737
- TLSH
  T199717585A29C80EDFC546374A49A051877E2CCE9B693972B0B2790678C6DFC42DA4CDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  Krypton/auto_responses.json
- Size 238B
- SHA256 58f767ca1aa446a9498ba4a0ecc412cb777aa14a8c3d35614f0005bb40451b87
- MD5 bdc27269472e847baffadc6dfdcc462e
- SHA1 c4c8fdb63ee480d2e29ec9b82c1af752e3b5b079
- SHA512 9548b633f00da11054a82bad3077a71cda7aadde98aefe7c72641c0af4d6a3b020a8287e52ce034bc6dbc0876cd77cbf70b65ffeadb299ca0df643cfbfb5451b
- TLSH
  T1DDD0A71BD721DF076235083115442510F13A57BF044C88B7F6B0045EDF33C2120476E5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Krypton/config.json
- Size 284B
- SHA256 b0ad3c806a62debf2a607aee6260c8b6813cfb1be0498f7fc06e205a0839ab63
- MD5 03438d61c97d3b9b605b9571407cc668
- SHA1 1a2d319c44f1c21294fbc3e832dfe1e23b640c45
- SHA512 5498d674e7457ab06f8192a3e4f06144c5d2614aa0b78a69f9c9defd501fa115dbb92e5a69fbefc5ac99d03dc19bf4b864a7e19fa85c6db459623c669cf812e3
- TLSH
  T16DD017ABDD420E5251A0E0AA20DA5C1AFB04629F0C6E6046F79694EC0F9C96F21BD81D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  Krypton/main.py
- Size 65KB
- SHA256 fd366490e43646070e829e855684bf83830bb7986fa6dc74883492002f2fb27f
- MD5 e33c368caae468fe3bb972e930574468
- SHA1 6d5897f4076c445342a60c6e63a75fd697c179a2
- SHA512 73899e01adb7d7865d8a3742f07d3b2c43b20923b6233545a35dc9e47b6eb5fc6e5e56da4d68a1b6f58cc63e203ab84c7edb4adde8e4a8c6cb9126d29134ddf8
- SSDEEP 1536:4GI71s7FRF3rUi6eSxwzIaobsht7nndh+Ym01EYCw:4GI71s7FRNUifMHbsb7nnh
- TLSH
  T19763B92A856A0C3257C394A5E6B3A087622DF60BCD4838BA7BFDD1441F5C332C975B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Krypton/requirements.txt
- Size 108B
- SHA256 63ef874736f1817cccca58558fa9240e4e402f89a4e2802623cdcad5271d5e11
- MD5 579c6532061227c9d1ebe401c61c6f2e
- SHA1 aab10135b6577b89da78b48a7f6e12665ab44c16
- SHA512 407b03391b49b61804957f849b82dc7be3c19bdabe5aed55461856c71501cb74cd6bcacb2a39d73a54ab6f3e18d4f53c87531eed376590307a59083ff29c4e12
- TLSH
  T1B1B02280C2AC80C8000CCC08C083E330883BBC203333F2C00308823CA30C3203CA0328
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10
- Target
  Krypton/status_rotator.py
- Size 1KB
- SHA256 6adf242c424387fd21a7e5842747f61c09e407bbb0595c63acfe2d0b89d70dcf
- MD5 64011bd7dd1ab7288400bd82da238705
- SHA1 b18177af5e015012275719bcb4cdb3e789fd0b11
- SHA512 0da2ac16b0f326874a9395d598713bb0e63d44c4dbadd59a8ee2639f8ecb87ac29efab71510e6175a1be531193c5614dd201755aef3f54c3126577df2f834269
- TLSH
  T13821CA1E4C6EA6129DF2692A9437A137EF8E0E47196F169371BCE6100F3C0D2C48CDA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  Krypton/statuses.txt
- Size 13B
- SHA256 9464bd04a5e1610008adfd155dddaa51a9247c5836a24e934cf91d69e83c057f
- MD5 8b23261430185fcdccf05d9c17467890
- SHA1 7ebafe96ef74bc9b9a174d70e503ca3aa372d19b
- SHA512 f8db7932efd9baaa2f7177819eeb3b4df5a80aa5fa6de40a596f25be822f639e9bc132f30baf62d6eea07c06c41166a47fa447865f4b120992aea751839db0b7
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12