General
-
Target
Sirus_Pass_123 (2).zip
-
Size
1.9MB
-
Sample
210415-rc18q96qgx
-
MD5
855220d69fd153ce51f7ba793fb34249
-
SHA1
914327730225af59f236c337a07a13e6c26a8433
-
SHA256
11d5c63eee71403964679665743186863adce8bcb81172820e6927cfd61248c2
-
SHA512
9052e5c2de887360f1c95b676b569b1d71189fbdc2a42e3d28f6d65aaf83c4f2b75178eb65e631a3c5048f097fc15ef696621b20ab2ceb8da11cbe57ba6d20dc
Malware Config
Extracted
raccoon
1a329a10c40d1d7de968ac01620072546be15062
-
url4cnc
https://tttttt.me/jrrand0mer
Targets
-
-
Target
Sirus.exe
-
Size
2.2MB
-
MD5
196ff748cced551629a1683e3d9d9b37
-
SHA1
a7382072a4729771dec5b10bcf2d4895da444176
-
SHA256
ae841b1c3d0c1a0e490c21d6e373e75d0b66c63f88431b6e89f3d58e434abc91
-
SHA512
43c7dd0bb352ee970dc670fb517a388af52d39352c8d4bfc5ed23a135b311c9a7d18c8b98a9e01c0a955a5d42920f4c7cb41b74167041fe7c2632c5730f80861
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-