General

  • Target

    22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41.exe

  • Size

    16.7MB

  • Sample

    211207-gssmxaahh6

  • MD5

    e77221d7a4b47b9107ba1b61a551ca89

  • SHA1

    95c5ae3fec0d900e4634e11b3ad81971e78e2b31

  • SHA256

    22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41

  • SHA512

    8bf9870a4f9dceb06e7d879777a3731168842bb4da03371afed59baca04552b5034df55e727d401b4edb1ab39019a280920ffaeb9bdb8ca33699e7851d623025

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

efc20640b4b1564934471e6297b87d8657db774a

Attributes
  • url4cnc

    http://91.219.236.162/jredmankun

    http://185.163.47.176/jredmankun

    http://193.38.54.238/jredmankun

    http://74.119.192.122/jredmankun

    http://91.219.236.240/jredmankun

    https://t.me/jredmankun

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

48.9

Botnet

915

C2

https://qoto.org/@mniami

https://noc.social/@menaomi

Attributes
  • profile_id

    915

Extracted

Family

amadey

Version

2.85

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

03.12_BUILD_3

C2

45.9.20.221:15590

Targets

    • Target

      22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41.exe

    • Size

      16.7MB

    • MD5

      e77221d7a4b47b9107ba1b61a551ca89

    • SHA1

      95c5ae3fec0d900e4634e11b3ad81971e78e2b31

    • SHA256

      22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41

    • SHA512

      8bf9870a4f9dceb06e7d879777a3731168842bb4da03371afed59baca04552b5034df55e727d401b4edb1ab39019a280920ffaeb9bdb8ca33699e7851d623025

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Tasks