Resubmissions

06-09-2021 14:13

210906-rjpvrsedbm 10

08-07-2021 11:08

210708-4gztl3mwl6 10

08-07-2021 08:02

210708-klfb4qeda6 10

07-07-2021 09:39

210707-nem57xyvf2 10

06-07-2021 17:51

210706-7pcrmjy3fa 10

06-07-2021 13:45

210706-eybelwcq86 10

05-07-2021 04:26

210705-z99jkt6lce 10

03-07-2021 10:43

210703-fdvvvqqjja 10

General

  • Target

    60d529d298fda60d_setupInstall.rar

  • Size

    75.6MB

  • Sample

    210701-2g6gney3w6

  • MD5

    a550717538ccd830a11b2b1f4f6eaa34

  • SHA1

    702ddf3dfa759b0a0021cf6f0280af53a7093765

  • SHA256

    b244fb7a7b39c836a9629262eaa80865cfbaf37aaea1b1d4b880d8a864f865a4

  • SHA512

    a8cddb3f2121c664e76963d053b41ff70f1866adc0fbb3e2e240ddfeb68a67f2ca3929e514a804b856aa9526a22915ce71e20795b996712016925b43e6df7804

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

fickerstealer

C2

game2030.site:80

Extracted

Family

cryptbot

C2

xeibmh42.top

mororx04.top

Attributes
  • payload_url

    http://lopcpd05.top/download.php?file=lv.exe

Extracted

Family

redline

Botnet

01_07_r

C2

rdanoriran.xyz:80

Targets

    • Target

      setup_x86_x64_install - копия (10).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (11).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (12).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (13).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • DiscordStealer

      Discord_Stealer.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (14).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (15).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (16).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • DiscordStealer

      Discord_Stealer.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (17).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (18).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (19).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (2).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (20).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (21).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • DiscordStealer

      Discord_Stealer.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (22).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (23).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      setup_x86_x64_install - копия (3).exe

    • Size

      3.2MB

    • MD5

      3ae1c212119919e5fce71247286f8e0e

    • SHA1

      97c1890ab73c539056f95eafede319df774e9d38

    • SHA256

      30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

    • SHA512

      5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

    • DiscordStealer

      Discord_Stealer.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • fickerstealer

      Ficker is an infostealer written in Rust and ASM.

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

16
T1031

Registry Run Keys / Startup Folder

16
T1060

Bootkit

3
T1067

Defense Evasion

Modify Registry

47
T1112

Disabling Security Tools

16
T1089

Install Root Certificate

15
T1130

File Permissions Modification

14
T1222

Credential Access

Credentials in Files

52
T1081

Discovery

Query Registry

74
T1012

System Information Discovery

82
T1082

Peripheral Device Discovery

16
T1120

Collection

Data from Local System

52
T1005

Command and Control

Web Service

16
T1102

Tasks

static1

Score
N/A

behavioral1

cryptbotfickerstealergluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral2

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral3

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral4

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral5

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral6

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral7

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral8

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral9

fickerstealergluptebametasploitplugxredlinevidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral10

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral11

cryptbotgluptebametasploitplugxredlinesmokeloadervidar01_07_rservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderspywarestealertrojanupx
Score
10/10

behavioral12

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral13

gluptebametasploitplugxsmokeloadervidaraspackv2backdoorbootkitdiscoverydropperevasionloaderpersistencespywarestealertrojan
Score
10/10

behavioral14

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral15

fickerstealergluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojan
Score
10/10

behavioral16

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral17

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral18

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral19

plugxredlinevidarservaniaspackv2discoveryinfostealerstealertrojanupx
Score
10/10

behavioral20

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral21

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojan
Score
10/10

behavioral22

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral23

cryptbotfickerstealerplugxredlinesmokeloadervidaraspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral24

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral25

cryptbotfickerstealergluptebametasploitredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral26

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscordstealerdiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral27

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral28

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral29

fickerstealerplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojan
Score
10/10

behavioral30

gluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral31

fickerstealergluptebametasploitplugxredlinesmokeloadervidarservaniaspackv2backdoorbootkitdiscordstealerdiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx
Score
10/10

behavioral32

plugxredlinesmokeloadervidarservaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10