{"id":8868,"date":"2024-09-23T10:24:23","date_gmt":"2024-09-23T10:24:23","guid":{"rendered":"\/cybersecurity-blog\/?p=8868"},"modified":"2024-09-25T10:24:15","modified_gmt":"2024-09-25T10:24:15","slug":"kransom-abuses-rpg","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/kransom-abuses-rpg\/","title":{"rendered":"Kransom Ransomware: New Threat Using DLL-Sideloading to Hijack Popular RPG"},"content":{"rendered":"\n

Recently, our team of analysts discovered a sample of a yet-unknown ransomware that they dubbed Kransom. The malware employed the malicious DLL-sideloading technique to hijack the execution flow of an .exe file belonging to the popular game Honkai: Star Rail. Here is everything we have on the threat so far.<\/p>\n\n\n\n

Initial Infection Vector<\/h2>\n\n\n\n

View the sandbox session for detailed analysis<\/a>.<\/p>\n\n\n

\n
\"\"\/
The archive distributed as part of the Kransom attack analyzed in the ANY.RUN sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

The Kransom ransomware attack began with a deceptive archive containing two files: an executable and a DLL (Dynamic Link Library) file.<\/p>\n\n\n

\n
\"\"
The certificate of the executable found inside the archive<\/em><\/figcaption><\/figure><\/div>\n\n\n

The executable was signed with a valid certificate from COGNOSPHERE PTE. LTD, the publishing company for Honkai: Star Rail, a popular RPG. <\/p>\n\n\n\n\n

\n\n

\nEasily analyze malware and phishing<\/span> in ANY.RUN sandbox  \n<\/p>\n\n\nSign up for free\n<\/a>\n<\/div>\n\n\n\n