a71cbc4074b4eece9b98c4da5835bd9af06443a9945432e690849e0133a24bb1

General

Target
DFFDFD.zip
Size 532KB
Sample260925-na2anavaph
SHA256 a71cbc4074b4eece9b98c4da5835bd9af06443a9945432e690849e0133a24bb1
MD5 92b92737f32a41f521becd146284c10e
SHA1 fa910d71292564e0932aee36abdce2b0c09607f4
SHA512 1941a13ddfaffafc06a5f97ce8de26f2e01654c8a038cc798e4fbe49c9e30d31331aac72b8f3084172bae46d1aa365a1cefb7dda01a74c7148a8c8e8776a8ab2
SSDEEP 12288:Ug5MJn5HOfEI4OKhhQlKItaEObdb6+RuvnTlWHMutmcwTAAjp6+rJ:UnJdOEI4D8l5taj0+4vnIHMQwTLp6+rJ
TLSH
T1C1C4230A9150E85ACFF2E73C9C61C800012471D59611E69F2D1A6D6FFE7ECE9AC3EA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DFFDFD/kuroko-rat-cpp/build.bat
- Size 1KB
- SHA256 1dee2779e814abe749d4e7906dbd20785cc24a795af94b8f12b0ae038c1af798
- MD5 d50b7033b0e3283f564d7ddcb40cec9b
- SHA1 6d38d8b8aa971a59e4c04821e2fac765f944d9a9
- SHA512 5d1eb7721d62993740823a1d0621758912c9b015f74a940a92b627246fd6bbfd717bd46bbf818f5d093f19b053366e0b8779d399a2f163fdc00249a4a1b4623b
- TLSH
  T1CD31F03594050521329BDD9DAB20B490E729761B74D80C58B1FF71991FEC1C62CFE8F0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  DFFDFD/kuroko-rat-cpp/client/build_client.bat
- Size 1KB
- SHA256 70375beb2c8768eba6c6d12dd9a678302d04c65d6eb2cf02ef9fb9c2a961a5fa
- MD5 e09a894b38d8f7cae99583c7832b9311
- SHA1 dad873d1f729129e25e97ca054d500724a582dd9
- SHA512 3055104a9bbacc637e59877b9c3472989eb3e72ea579245ee2c1cdf1a912d02ffcbb84da0c7126972a46e33b154453e814b2bb019ba1bb08ff2e075dd2d95a5d
- TLSH
  T1C8410071A44405223646CE9E6A74F4A0D13879AB74A81D69B0EEB49E0FFC0C63DED8F0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  DFFDFD/kuroko-rat-cpp/kuroko_c2.exe
- Size 1.5MB
- SHA256 3ad4f7fa5d168ce9b6933de4efb1c6603a6dcf2c42eac76d6781eb8c83bd4476
- MD5 3b9cbd459f43ed0d9d7a79254fd47d58
- SHA1 f7d531fc311e30c3bb5f6dbfbd9c336afb5c9712
- SHA512 33903753a2db076768e249d577907c2f3a7d7c763787a2c4222f7f6adea63d5f3e1cfaf14c4d55d2c160153a3276afc8a3616dcb3373582887ecb4c98c60c611
- SSDEEP 24576:ZkMXqWC4GP7YXyjyi6nillr37lNBOK6646RR7h4A:ZkM6b4GS4IK576
- TLSH
  T1B1654B02A7E6CDEAC89AA73891CB2719F634FC5017639BDB431052352E577D99E3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6