Overview

overview

10

Static

static

Setup (15).exe

windows11_x64

10

Setup (18).exe

windows11_x64

10

Setup (6).exe

windows11_x64

10

Setup (7).exe

windows11_x64

10

Setup (8).exe

windows11_x64

10

Setup (9).exe

windows11_x64

10

Setup.exe

windows11_x64

10

Resubmissions

11-03-2024 21:22

240311-z8dsssgg58 10

01-09-2021 13:18

210901-5bmxjspa5s 10

01-09-2021 13:04

210901-te4btfspqa 10

01-09-2021 05:12

210901-4wnkwm1p3j 10

31-08-2021 21:47

210831-41rp97dma2 10

31-08-2021 19:51

210831-359awwatje 10

29-08-2021 11:37

210829-18htk4slyj 10

28-08-2021 23:10

210828-rt8b9gzxn6 10

28-08-2021 22:59

210828-zxgnh5j4w6 10

28-08-2021 11:31

210828-xrjs66aknj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup.rar

  • Size

    5.1MB

  • Sample

    210901-te4btfspqa

  • MD5

    829ef56bfd2817a87cdd285c627f6fbc

  • SHA1

    28fd7e95ceef12024023c587fb2423a4dd18790f

  • SHA256

    1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

  • SHA512

    789eb1a298d09018050809a5b0ff55a64b51cbc9de7dd6b480463b32508b8ece41dd337b1deb915d993399087ba757188b1ee3b9d217f64c223de26ff2e29a0b

Score
10/10
gluptebametasploitraccoonredlinevidar1bratanchikayenorman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

bratanchikAYE

C2

45.14.49.232:63850

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

1

C2

37.0.8.88:44263

Extracted

Family

redline

Botnet

NORMAN2

C2

45.14.49.184:27587

Extracted

Family

redline

Botnet

spnewportspectr

C2

135.148.139.222:1594

Targets

    • Target

      Setup (15).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidar1bratanchikayenorman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

    • Target

      Setup (18).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidar1bratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral2

    • Target

      Setup (6).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidarbratanchikayespnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral3

    • Target

      Setup (7).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidarbratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral4

    • Target

      Setup (8).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidar1bratanchikayenorman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral5

    • Target

      Setup (9).exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidar1bratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      Setup.exe

    • Size

      631KB

    • MD5

      cb927513ff8ebff4dd52a47f7e42f934

    • SHA1

      0de47c02a8adc4940a6c18621b4e4a619641d029

    • SHA256

      fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

    • SHA512

      988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

    Score
    10/10
    gluptebametasploitraccoonredlinevidar1bratanchikayespnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral7

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

7
T1053

Persistence

Modify Existing Service

7
T1031

Registry Run Keys / Startup Folder

7
T1060

Scheduled Task

7
T1053

Privilege Escalation

Scheduled Task

7
T1053

Defense Evasion

Modify Registry

14
T1112

Disabling Security Tools

7
T1089

Virtualization/Sandbox Evasion

7
T1497

Credential Access

Credentials in Files

20
T1081

Discovery

Query Registry

35
T1012

Virtualization/Sandbox Evasion

7
T1497

System Information Discovery

35
T1082

Remote System Discovery

7
T1018

Lateral Movement

Collection

Data from Local System

20
T1005

Exfiltration

Command and Control

Web Service

7
T1102

Impact

Tasks

static1

Score
N/A

behavioral1

gluptebametasploitraccoonredlinevidar1bratanchikayenorman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral2

gluptebametasploitraccoonredlinevidar1bratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral3

gluptebametasploitraccoonredlinevidarbratanchikayespnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral4

gluptebametasploitraccoonredlinevidarbratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral5

gluptebametasploitraccoonredlinevidar1bratanchikayenorman2spnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral6

gluptebametasploitraccoonredlinevidar1bratanchikayenorman2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10

behavioral7

gluptebametasploitraccoonredlinevidar1bratanchikayespnewportspectrbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojan
Score
10/10