onlylogger

Target

Setup.exe
Size

1.6MB
Sample

220213-dqagrsdda9
MD5

ce6eaa52767b2df78b34519231966588
SHA1

ab32d09951189022a1a39e9204ec9ce2926b3fcf
SHA256

40924781ba072ea88bd7cad3f6d2a48e87f370e1c1ee334a3415dd26b5ea17e5
SHA512

36a09fe704823d6db5d0982d761ba1976c940b82b7c1ca650627d66e16b420612b78c761f2ed00e533453eeb2dd7e431cf47b0c2cf826354aa6e779fda531067

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

1c0fad6805a0f65d7b597130eb9f089ffbe9857d

Attributes

url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar

rc4.plain

Extracted

Family

redline

Botnet

shafty_inst

91.243.32.25:25121

Attributes

auth_value
764049059437c802ecea88e790fdca27

Extracted

Family

redline

Botnet

tako

65.108.27.131:45256

Attributes

auth_value
5e2b00f8574b1c698db50a067014ec7c

Targets

- Target
  
  Setup.exe
- Size
  
  1.6MB
- MD5
  
  ce6eaa52767b2df78b34519231966588
- SHA1
  
  ab32d09951189022a1a39e9204ec9ce2926b3fcf
- SHA256
  
  40924781ba072ea88bd7cad3f6d2a48e87f370e1c1ee334a3415dd26b5ea17e5
- SHA512
  
  36a09fe704823d6db5d0982d761ba1976c940b82b7c1ca650627d66e16b420612b78c761f2ed00e533453eeb2dd7e431cf47b0c2cf826354aa6e779fda531067
Score

10^/10

onlylogger raccoon redline 1c0fad6805a0f65d7b597130eb9f089ffbe9857d shafty_inst tako evasion infostealer loader spyware stealer trojan upx vmprotect
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- OnlyLogger Payload
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1