133d417cb7d24b4362908292d261a075637a9072142bdb9ce1405033e13d8f98

Sharing

Copy URL Twitter E-mail

General

Target
KRX-Client-19.5-win64-public-v1.36.1.zip
Size 78.8MB
Sample260913-qhgmbsvbkd
SHA256 133d417cb7d24b4362908292d261a075637a9072142bdb9ce1405033e13d8f98
MD5 59bd6d2c7a010256192756488048ecce
SHA1 878f5e5e15f2deb0d909cfcd4e7e8c673f37b847
SHA512 6a4509b5d7a5124b7b60367c96bb98272621299c97763f5fc9e93ee5dfdc55a25e7fb9e6087192b3d0ef4601dc36c0e0b61c0e57c41bd5a0eb6fc20f1dd2c602
SSDEEP 1572864:FQwEe8hLibc7/Ic1VkynBA8zB7gLNoCybUOdQQl8dy3/ydqq6uZzQs8crS3LR:tvXk/51Cyi8zB7gLaB7yQl8k/KnmsS3V
TLSH
T1800833DCA2409A1ED768CF7DC248AAB3D1A63C66BC3A42094A7415D5EFC7783538DB43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  KRX-Client-19.5-win64-public-v1.36.1/DDNet-Server.exe
- Size 3.1MB
- SHA256 ae7fdb63bf91a66912dbfb7b1cf292858c111a02d578c4ba89c10943eea42481
- MD5 04fd40dd04829b5916568e42431e05eb
- SHA1 e323ac74341b73dfca141b7aaa1364c3f6831f7e
- SHA512 3b89b301ae3a5d0aaffc3b8c0a1c3487e09de664ab31d4f20e7df92241ab2ce4be96d60ab10edaff2162ee3c42bbccbbe28867bdfe925b93a210a4b57f8c5ed0
- SSDEEP 49152:VkYz/vWf6cka4NPYwQ21mQJs8kXYjlY7Js8Qh6YtBegTcCspeEY8NQD0dhk6eoMN:Vkg1zVdjlVTECspeEY8QoMuAr
- TLSH
  T113E56C07B2A360ECC16BC078875B9772BA31BC5906207D7F15D4EB322F61E505F6EA68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  KRX-Client-19.5-win64-public-v1.36.1/KRX Client.exe
- Size 17.3MB
- SHA256 2d56b1968b3b153f5c77d8697b1cb805d95094ee24286e69586d869d9a099496
- MD5 ce08ce39f1562010d9b1a999805e99f1
- SHA1 50366927a9d5ffe6401669db4dfc738c999a2afe
- SHA512 fd32195a4fe76b9cf354bce0a444ac2efaf3d465822b680c81c0acbbd6afdf63d017aa80e74953239dfe9839d8614c546657675bf58fcb22c45dcc102b042102
- SSDEEP 393216:Qbw/gdBvFZHdbNh9i0QGJHwu6wrKauIYJChoSeOx:p/grH197fwu6wrKauIhhLe6
- TLSH
  T1B80733EE23B13C63FB794BF09590C1788B1997320F68A57D218F5D8E1D07192AB6F660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion trojan discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  KRX-Client-19.5-win64-public-v1.36.1/SDL2.dll
- Size 2.2MB
- SHA256 d0ac4e209a78ad56d53af2df40a51ae9e4043704efbed5b46bf75a57ec92ab1b
- MD5 9f2509c44faa79c87382855d4a94966b
- SHA1 4474c7d2923dd0a535c01612c6bd2c0e1f1faef3
- SHA512 fb5f407af1020109acdf693f5391cdf7905a99d0d09628bf066f459caa36cd2e296adb623a60950191e4e3395501c332b672ecc219bdc02415013dba42d6ccb3
- SSDEEP 49152:5L6mcGjDqleTVMEGol1sEQf21L1gz6vr//uw0508uLMDpYwvuIBxV:F6QHpQO1L1jvrXuw0S8DpD2IBxV
- TLSH
  T1E3B57E5FF2A365ECC717C031836BE772A93178180254ADBB26949B716E32F904B5AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  KRX-Client-19.5-win64-public-v1.36.1/avcodec-61.dll
- Size 2.7MB
- SHA256 58c71baa592da746c9c5e30fdd41814a2736454b2b7168da4ab88585758d4786
- MD5 ae6632db7de61ef9a0e1045b829502dc
- SHA1 e4c9eae709c3b3f415f9183e2e45292c14b9d5e2
- SHA512 37d112a490105d11283fab5a2febb618305919932bc18b55b79bc0d3ef862791d3f6f8cc6dfc57b00ce1fb7dc576c724dafbff84144212b247e51e265904c28f
- SSDEEP 49152:sG89fcQ/HjCDvYceJirwiucX2bpbsyt7U9gkUObKPHv5bW:he0Q/jYv8/NR1TdW
- TLSH
  T11ED59E4AE2B325ECC567C170976FE723FA70782C40247DBB5A90D6312E63F90661AF19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  KRX-Client-19.5-win64-public-v1.36.1/avformat-61.dll
- Size 502KB
- SHA256 b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
- MD5 179f9ae9eb9e05411966a0d943e75360
- SHA1 a543163fbea7ba8061da700133cc97e9ebcda589
- SHA512 ca77ce3fb5e345ea6304c9d405de577b164224df01ca25ce1ae560ab82463dfa6b0dacd6880d8d8821b15d3892f8d12bbee76832dee1cfef083b74f127949fc0
- SSDEEP 12288:vHoTMfa6+pLH1SicSrISTE6bj3tZEdEyd:vHp0HnHASfyd
- TLSH
  T15CB45A17D6A315ECC66BC13043ABA772BA31786511307DBE2794D7312F02FA0A75EB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  KRX-Client-19.5-win64-public-v1.36.1/avutil-59.dll
- Size 1000KB
- SHA256 cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
- MD5 9f4e1d61cf779052fed243c2142495b2
- SHA1 246b28f23c542ba6f38767ad420fc4b6f716c8af
- SHA512 f3059d52d93731fee5fc03af389ea08f85f449caadc79a0021fe3da2234648ad3bbf012d96eddd2de161bab062bb8be3a9bc98114cb941bb46c1e0117c241593
- SSDEEP 12288:4wCIUQiy/TXud3kOo09O11s5mbxZnBR2XoR6nP3J:4uioXud3kOn9x8fqYRoJ
- TLSH
  T190256C01A6E3187EC16B913046AB7657B6313452CA64BE2F67A14D343F34F916CCFA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  KRX-Client-19.5-win64-public-v1.36.1/config_directory.bat
- Size 222B
- SHA256 1fbad52532e2685345cc3e5366e88d965f107e6c6013002e0bd6ad5da0377ad7
- MD5 6191ec1743f8b924e43ebc2ab61ed4fc
- SHA1 ae0e5de76c78618c4b8b1e22976bf50d366f3504
- SHA512 4ff02eb42dddbb1d3845762a42c58abaa26344d64a308dea9210a180a50d1ea36df5d2852db0d1af06d8b35f2d84910281ba1ec712905acc9ef8b359900b8327
- TLSH
  T174D0A9E340088025CAEA12CD7D8998A3204A97E04A4E1AB8B45E1AEDB824CFE13E7340
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  KRX-Client-19.5-win64-public-v1.36.1/config_retrieve.exe
- Size 1.6MB
- SHA256 278aa12afd5178f7fe61b41c0f639bb38449d7d76e20e87948a56c8bfb16273b
- MD5 f7555d80ff6e60a59365f01414501479
- SHA1 1d6178f5c1b2896bc4edfae4c047bf861ca6f948
- SHA512 c8b1a1ca3198e2be632dfbec70408d8c4c2d6a49f33f6d84dae0da599a058a95d881fefec8f0e23d5b1b56c5e4ce5f9fcf7fb387d2fd38e0f746190ed22f9aff
- SSDEEP 24576:9ZD+Rvm86X41C7YrxtyeLLb5TfHdyjMChDl8XMa436oMdZ:7+R+8i41CWxtyeXb5TfHdyjMCxSEqoMD
- TLSH
  T1D5756D17F6A345FCC16BC07487979772A970B4290230BD6F2998D7322F62D909F6EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  KRX-Client-19.5-win64-public-v1.36.1/config_store.exe
- Size 1.6MB
- SHA256 3e3e64438ccc8f4dbd185ae727946f8aafeef7261414c8f529599cd17e83f4e1
- MD5 44b8f89981fe8cee058b46e645bb07f9
- SHA1 b22520a2bca53316d854a57aa3c43bb1199c6f60
- SHA512 ac4b7820966cdd004febdb5683ab4768e9ed4d1d9dfb33297b868a62da3e93061821817d600f45b7c74c3c81a083f08c9995372580e75e9f364e85c7f6e216a0
- SSDEEP 49152:kTgQmuyH46XJ0IR4qbVutKSEFbwWczBvdgoMk:kKXPR4qbVutKkyoMk
- TLSH
  T115755D17F6A345FCC16BC17487A7D772AA30B46D0230BD6E1994D7322F22E909B5EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  KRX-Client-19.5-win64-public-v1.36.1/data/krx/DDNet_original.exe
- Size 6.0MB
- SHA256 0ef05a6cd191a2f8ab1501188d05a870b4aabc6c9d0816f0864aa471f7c43b30
- MD5 bcc2ee2a60aa74e0ee1b3d66da945260
- SHA1 37fed9c6c8b1a6e7db3b57ba652410cb4ac17f40
- SHA512 1a0676edd0510fabfcf6d7f005d0dc61d796cb944066b9f1f6e5a0e371f3abf04f7430eeb2c1bab704221de98e4b4bf85e51eb90682945bbce2f9a368d66507c
- SSDEEP 98304:EuZFpVbR4442kkBiKYp0oZDJrX4G/fU+9QOuUPq9QTPN4roMRAUa99Byl:EzNDuABN4rXRAR99y
- TLSH
  T1F7567E1BB29350ECC56AC074974BDB73A931F46802307DBB15E0DB312FA6D606FADA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  KRX-Client-19.5-win64-public-v1.36.1/dbgcore.dll
- Size 162KB
- SHA256 db947c07167069d3de9e8a637baf01298984355d775ec49801115d7e5f2e47a3
- MD5 8bb7fa4422c9ddc162051d8b7e5522d7
- SHA1 07a01c2ccffd3d27f2a0d0ddf38dde1dd10455ec
- SHA512 7bfbbae884fe9f2235dd24ab9b0f5d35bc6af28bb6e562c000e36962be47de53bf9adc44e8b2d75b1c911a51d1e354ff94e216e66089269e6c7dee8085b98a60
- SSDEEP 3072:XBvYv24Qwk0uHtYN2ZrO3p5oKKASB0ddOQYgOxTsvmbtIahY2rAW:XBg2VWuo3554ASB0ddOgahMW
- TLSH
  T19EF35A62A3A800ABC9A7D23CD657C61BEBB3B00023115BDF0164869D6F57BE17E3D365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  KRX-Client-19.5-win64-public-v1.36.1/dbghelp.dll
- Size 1.8MB
- SHA256 3d92df0984662298a09d988aff0bb7c3081a46bf48177b7af02d3552641f77e9
- MD5 3fbb5bbc320109a3adf8866289a81211
- SHA1 543b936a89fbdb0220381eeff0824b3968390e82
- SHA512 e4fe89ffa2b723a8162a7eae05f42639a6cf86bca77495d2834fa0f58131ab8fac8336901f8bdce19c5b5b49aa6c5c4b0056febccf42b8fe395401696d0694cc
- SSDEEP 24576:VOTeT88eTQhAWiJhXsg/537W7rDLIVn0a1pCVBz2P583pdj8DqF2gIMYT5q4NZrn:gCTwOkh37W7zI1JDUA583pEqF2gIr5vb
- TLSH
  T118957C5693AC01A8EEBBD23CC946851AD3F4740517218BCF21A8879E6F13FE7577A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  KRX-Client-19.5-win64-public-v1.36.1/demo_extract_chat.exe
- Size 1.6MB
- SHA256 f950a26258ac4c5dd1f4de4a638e14bb93a257bc0fca03acab7a660b18d2b1b2
- MD5 6372280ed72fc59a101ae8d16c1a010c
- SHA1 52355b8ea5c80ff745845b5100f79bb62c79bb6f
- SHA512 5a98eec76592f920e279a6759d6ddf717f56f12a5b2fd59c0cc534bba80bf8ad1899a858d9c569f47041f29a31cb0a1d79a3a1c1b5ace5e30eccb647f91c6d6d
- SSDEEP 49152:DmDcar3HdzKK02jTR05/ZStLq7wiIR19EoMA:DOL0OR05/ZStLBcoMA
- TLSH
  T13C755D17F6A344FCC16BC17487979772A930F46D0224BD6E2AD4DB322F22D909B5EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  KRX-Client-19.5-win64-public-v1.36.1/dilate.exe
- Size 1.6MB
- SHA256 100475e5df17f36e30562dcc990122d4304dc8c0929c7ce50078ab6742c701b3
- MD5 ac47fe30562e84f7d72246aef592ade9
- SHA1 d4405f9c1a51f4897b0fbe184de3973286379f58
- SHA512 35f63ebb082a8d5d5b7876a7b23fd152e180184895b0ae8c47b1b39e59f6566cb2be4a1dff9f5722947686ba57df369a2c28be3c1ce63135e89c52fe4def32a6
- SSDEEP 49152:HTyAWMYA+QbuIM6t0oc/Mbda0Gq6DGwToMWCd1Y:HW38u2t0oc/MbM7oMWJ
- TLSH
  T154756D1BF6A344FCC66BC0748797D732AA71B4690230BD6F1998D7322F22D509B5EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  KRX-Client-19.5-win64-public-v1.36.1/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  KRX-Client-19.5-win64-public-v1.36.1/exchndl.dll
- Size 210KB
- SHA256 d9b528694462899a8a799babd8095e93982f471169217553a4d41c61028283b6
- MD5 c17169edfc9209a550dda748669b2be6
- SHA1 f806393f496b7d972a2bbcf8146bc8a06b9fd54b
- SHA512 b43c79e69a53dc34138ade6ec43943f579d3a664370dea834c6d4abc310c9b5d4162ee377234ea04a4b6276cf4fe7a1aa5e4f96c0210418ed14ef5425b4c3733
- SSDEEP 6144:iu5QdsSJMfefeHlnW8nv4hkU03z22De7JPK5l:iuUKefeHlvl
- TLSH
  T14C240B6BA3A30CB9C55B917692D7D7B1A831FC240330E91F0654DB323F2ADA44FAE594
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  KRX-Client-19.5-win64-public-v1.36.1/libcrypto-3-x64.dll
- Size 5.0MB
- SHA256 522e328a1e03c43047c3b9bd316bacf53e2575227a02a8fabab93af6e53e98b5
- MD5 d4cfa003a5a1d3cdae5d5a4e24c3c448
- SHA1 85d51d4dbcc1a78cdb1673711cd00129fd2ea385
- SHA512 b2a073f2a348f23974b16d2824108961342a5407676e865aa1dde12ca63f8b58513a4a2c0bbde410d48653dfb5f37eabcd2acc71907470062a643d3fad3ca601
- SSDEEP 98304:zDj5nSu0/3CPkHUDZ7djsg2+0K+Wet1CPwDvt3uFA0CG:zDjRO3CcHUDZ7djsg1DFK1CPwDvt3uFS
- TLSH
  T14E367D69B9BC0085D87A91BCC2836227E772B41657F057CF2E2846F90F63BD526BE740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Checks whether UAC is enabled

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32