🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Konni


Vendor detections: 8


Intelligence 8 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba
SHA3-384 hash: 026b968cc4149d1dd41572942d6d62de0030a0159a274519ede47213080b16e401ac55963f8f65e9b7883d22bf991403
SHA1 hash: 4c1d53a52d505f4e0646e3e086aa4b05c7a34aa6
MD5 hash: 26f69f8917f6890f26ec5b10611df092
humanhash: fifteen-butter-lithium-neptune
File name:수강신청정정원.hwp.lnk
Download: download sample
Signature Konni
Create hunting rule
File size:7'497'318 bytes
First seen:2023-09-26 09:47:44 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 1536:PCvBTYv+JOIp/vsbzkndElIuFfqqeK7NaXizmA6Jw8BdZ1QDupx:PyRJOKvu5hcCgZ11
TLSH T13776CF0E76ABC175EC655B7488AA8A237E677F17C8F3974AE15C71080377231A910BCB
Reporter smica83
Tags:apt KONNI lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
Lnk.Trojan.Qakbot-9977832-1
Create hunting rule

TwinWave.EvilLNK.BackToYou.20230602.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.PKInsideHethens.20230420.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.TheGhostAndTheHighway.20230714.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
89%
Tags:
control greyware lolbin replace
Link:
https://www.filescan.io/uploads/6512a8d683a0c6425dffb369/reports/dcdf2098-f36c-4cd2-9f8b-5b053d315854/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1314403
Signature
Antivirus detection for URL or domain
Deletes itself after installation
Encrypted powershell cmdline option found
Found suspicious ZIP file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (has network functionality)
Powershell creates an autostart link
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Writes or reads registry keys via WMI
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314403 Sample: #Uc218#Uac15#Uc2e0#Uccad#Uc... Startdate: 26/09/2023 Architecture: WINDOWS Score: 100 79 Multi AV Scanner detection for domain / URL 2->79 81 Antivirus detection for URL or domain 2->81 83 Windows shortcut file (LNK) starts blacklisted processes 2->83 85 5 other signatures 2->85 9 cmd.exe 1 2->9         started        12 wscript.exe 1 2->12         started        14 OpenWith.exe 16 9 2->14         started        process3 signatures4 97 Windows shortcut file (LNK) starts blacklisted processes 9->97 99 Suspicious powershell command line found 9->99 101 Wscript starts Powershell (via cmd or directly) 9->101 105 3 other signatures 9->105 16 powershell.exe 6 29 9->16         started        20 cmd.exe 1 9->20         started        22 conhost.exe 1 9->22         started        103 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->103 24 cmd.exe 1 12->24         started        process5 file6 47 C:\Users\Public\Documents\stopedge.bat, DOS 16->47 dropped 49 C:\Users\Public\Documents\resolvedns.bat, DOS 16->49 dropped 51 C:\Users\Public\Documents\install.vbs, ASCII 16->51 dropped 53 C:\Users\Public\Documents\unzip.exe, PE32 16->53 dropped 71 Potential malicious VBS script found (has network functionality) 16->71 73 Deletes itself after installation 16->73 75 Powershell creates an autostart link 16->75 77 Powershell drops PE file 16->77 26 wscript.exe 1 16->26         started        29 wscript.exe 12 24->29         started        32 conhost.exe 24->32         started        signatures7 process8 dnsIp9 107 Windows shortcut file (LNK) starts blacklisted processes 26->107 109 System process connects to network (likely due to code injection or exploit) 26->109 111 Wscript starts Powershell (via cmd or directly) 26->111 34 cmd.exe 9 26->34         started        69 anrun.kr 29->69 113 Windows Scripting host queries suspicious COM object (likely to drop second stage) 29->113 signatures10 115 May check the online IP address of the machine 69->115 process11 signatures12 87 Uses nslookup.exe to query domains 34->87 37 systeminfo.exe 1 1 34->37         started        40 nslookup.exe 1 34->40         started        43 wscript.exe 34->43         started        45 11 other processes 34->45 process13 dnsIp14 89 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 37->89 91 Writes or reads registry keys via WMI 37->91 55 222.222.67.208.in-addr.arpa 40->55 57 resolver1.opendns.com 40->57 59 myip.opendns.com 40->59 93 May check the online IP address of the machine 40->93 61 anrun.kr 43->61 95 Windows Scripting host queries suspicious COM object (likely to drop second stage) 43->95 63 anrun.kr 45->63 65 anrun.kr 45->65 67 6 other IPs or domains 45->67 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba/
Threat name:
Shortcut.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-08-30 07:34:08 UTC
File Type:
Binary
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7l2vbhdh2s5kbgdtj4eab6uvn3qgzacrqfjg7gfiuestg25is5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230926-ltyyjahe67/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Enumerates processes with tasklist
Gathers system information
Modifies registry class
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Unexpected DNS network traffic destination
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Konni
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17d7aa84e33ea5d504c39a784007d4ab770364028c0a937cc54509299b5d44ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Archive_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies archive (compressed) files in shortcut (LNK) files.
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:Large_filesize_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file larger than 100KB. Most goodware LNK files are smaller than 100KB.
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_Big_Link_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspiciously big LNK file - maybe with embedded content
Reference:Internal Research
Rule name:SUSP_LNK_Big_Link_File_RID2EDD
Create hunting rule
Author:Florian Roth
Description:Detects a suspiciously big LNK file - maybe with embedded content
Reference:Internal Research
Rule name:SUSP_LNK_Embedded_WordDoc
Create hunting rule
Author:Greg Lesnewich
Description:check for LNK files with indications of the Word program or an embedded doc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments