General
-
Target
987D0F92ED9871031E0061E16E7BBAC4.exe
-
Size
773KB
-
Sample
210701-ddeh9fpth2
-
MD5
987d0f92ed9871031e0061e16e7bbac4
-
SHA1
b69f3badc82b6da0ff311f9dc509bac244464332
-
SHA256
adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
-
SHA512
f4ecf0bd996fd9aab99eba225bed9dbe2af3f8857a32bc9f0eda2c2fe8b468f5f853e68e96c029cf4cfd161409e072777db92a7502b58b541e0057b449f79770
Static task
static1
Malware Config
Extracted
metasploit
windows/single_exec
Extracted
redline
01_07_r
rdanoriran.xyz:80
Extracted
vidar
39.4
865
https://sergeevih43.tumblr.com
-
profile_id
865
Extracted
vidar
39.4
932
https://sergeevih43.tumblr.com
-
profile_id
932
Extracted
fickerstealer
game2030.site:80
Extracted
cryptbot
xeibmh42.top
mororx04.top
-
payload_url
http://lopcpd05.top/download.php?file=lv.exe
Extracted
vidar
39.4
903
https://sergeevih43.tumblr.com
-
profile_id
903
Extracted
redline
proliv333
130.193.54.53:32750
Targets
-
-
Target
987D0F92ED9871031E0061E16E7BBAC4.exe
-
Size
773KB
-
MD5
987d0f92ed9871031e0061e16e7bbac4
-
SHA1
b69f3badc82b6da0ff311f9dc509bac244464332
-
SHA256
adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
-
SHA512
f4ecf0bd996fd9aab99eba225bed9dbe2af3f8857a32bc9f0eda2c2fe8b468f5f853e68e96c029cf4cfd161409e072777db92a7502b58b541e0057b449f79770
-
CryptBot Payload
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-