General
-
Target
ad95953f1162d1179340da7c4b087fb5.exe
-
Size
10.3MB
-
Sample
211129-g92xxaefd5
-
MD5
ad95953f1162d1179340da7c4b087fb5
-
SHA1
d3eab9147bb6482ccb5e45aa4c12ff9671ed4448
-
SHA256
501db6290affecf31a95c2fb5e1b93e047aa3a1cc93657891fd90c0f7bb16830
-
SHA512
9a2842484196b14ee635bfd581baa2fa16ae8a3015e3d00852cf6a425392f031bc2f178b7af856215613b093c4d708e719948a942088b11458f541ff3ec79c60
Malware Config
Extracted
socelars
http://www.gianninidesign.com/
Extracted
amadey
2.82
185.215.113.45/g4MbvE/index.php
Extracted
metasploit
windows/single_exec
Extracted
redline
udptest
193.56.146.64:65441
Extracted
redline
Faker
51.79.188.112:7110
Targets
-
-
Target
ad95953f1162d1179340da7c4b087fb5.exe
-
Size
10.3MB
-
MD5
ad95953f1162d1179340da7c4b087fb5
-
SHA1
d3eab9147bb6482ccb5e45aa4c12ff9671ed4448
-
SHA256
501db6290affecf31a95c2fb5e1b93e047aa3a1cc93657891fd90c0f7bb16830
-
SHA512
9a2842484196b14ee635bfd581baa2fa16ae8a3015e3d00852cf6a425392f031bc2f178b7af856215613b093c4d708e719948a942088b11458f541ff3ec79c60
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
UAC bypass
-
Windows security bypass
-
Downloads MZ/PE file
-
Executes dropped EXE
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-