Overview

overview

10

Static

static

2ff77816fa...24.exe

windows7_x64

10

2ff77816fa...24.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324.exe

  • Size

    627KB

  • Sample

    210903-n7qkesdab5

  • MD5

    f50136c9ca26451e33d5b1d09890dad5

  • SHA1

    1827fabd646f12bef405fef65f5078c4c8809f68

  • SHA256

    2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324

  • SHA512

    68beea7a2791cc0f25398d30da143a07a8df363e0f09e0c2aff7f3c8ff72a566f6ed7eb4df57f0508d74789d7959df964a81df5c1ea02a83ee810e23ad39c084

Score
10/10
gluptebametasploitraccoonredlinesmokeloadervidar02_09_fat12d1fa8a1b3c606f582add005087c86b4317a0710937b8ef25fa9e346b7a31e4b6ff160623dd5fed2474norman3testbackdoordiscoverydropperevasioninfostealerloaderspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

1

C2

37.0.8.88:44263

Extracted

Family

redline

Botnet

NORMAN3

C2

45.14.49.184:28743

Extracted

Family

raccoon

Botnet

2d1fa8a1b3c606f582add005087c86b4317a0710

Attributes
  • url4cnc

    https://telete.in/bimboDinotrex

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

test

C2

45.14.49.169:22411

Extracted

Family

raccoon

Botnet

b8ef25fa9e346b7a31e4b6ff160623dd5fed2474

Attributes
  • url4cnc

    https://telete.in/iphbarberleo

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

02_09_fat

C2

185.215.113.104:18754

Extracted

Family

vidar

Version

40.4

Botnet

937

C2

https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324.exe

    • Size

      627KB

    • MD5

      f50136c9ca26451e33d5b1d09890dad5

    • SHA1

      1827fabd646f12bef405fef65f5078c4c8809f68

    • SHA256

      2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324

    • SHA512

      68beea7a2791cc0f25398d30da143a07a8df363e0f09e0c2aff7f3c8ff72a566f6ed7eb4df57f0508d74789d7959df964a81df5c1ea02a83ee810e23ad39c084

    Score
    10/10
    raccoonredline12d1fa8a1b3c606f582add005087c86b4317a0710norman3testevasioninfostealerspywarestealerthemidatrojangluptebametasploitsmokeloadervidar02_09_fat937b8ef25fa9e346b7a31e4b6ff160623dd5fed2474backdoordiscoverydropperloader

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks