Overview

overview

10

Static

static

738BC607C1...42.exe

windows7_x64

10

738BC607C1...42.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    738BC607C1A64D1867103F3F4B6558C89401C539C3442.exe

  • Size

    18.6MB

  • Sample

    220311-11mleabgd2

  • MD5

    926523aad05fb0df30f2a20685f705d4

  • SHA1

    67ccae075f8c02609030c77ce6afbe333d911a0c

  • SHA256

    738bc607c1a64d1867103f3f4b6558c89401c539c34422d1e7a20fe634828cea

  • SHA512

    afef1048c73dd7d25645e4f85105936bef3b6776486810a8d560c5a7adbfb746dd30e69d287b50054dfe3bd0bec8aaafe36d40a13caf5640655d07d4a0c4955a

Score
10/10
amadeyloaderbotonlyloggerraccoonredlinesocelarstofseevidar4da27d123a577c68e42716053343dd3f8da508a2@tuimedia7newtesttrafuser1aspackv2evasioninfostealerloaderminerpersistencestealertrojan

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.71/cs/SkyDrive.oo

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.71/cs/RED.oo

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.71/Offer/Offer.oo

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.71/cs/Fax.oo

Extracted

Family

redline

Botnet

@Tui

C2

185.215.113.44:23759

Attributes
  • auth_value

    f4763503fd39f2719d3cbb75871d93ad

Extracted

Family

raccoon

rc4.plain

Extracted

Family

amadey

Version

2.85

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

user1

C2

23.88.118.113:23817

Attributes
  • auth_value

    8fa01dd66c262df9908a74caff781e02

Extracted

Family

redline

Botnet

media7newtest

C2

65.108.69.168:16278

Attributes
  • auth_value

    4606545ff99a568149814aa95592386f

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

4da27d123a577c68e42716053343dd3f8da508a2

Attributes
  • url4cnc

    http://91.219.236.27/borderxra

    http://94.158.245.167/borderxra

    http://185.163.204.216/borderxra

    http://185.225.19.238/borderxra

    http://185.163.204.218/borderxra

    https://t.me/borderxra

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

traf

C2

194.62.105.57:46625

Attributes
  • auth_value

    81954a1cbb71df8cdf16319449781191

Targets

    • Target

      738BC607C1A64D1867103F3F4B6558C89401C539C3442.exe

    • Size

      18.6MB

    • MD5

      926523aad05fb0df30f2a20685f705d4

    • SHA1

      67ccae075f8c02609030c77ce6afbe333d911a0c

    • SHA256

      738bc607c1a64d1867103f3f4b6558c89401c539c34422d1e7a20fe634828cea

    • SHA512

      afef1048c73dd7d25645e4f85105936bef3b6776486810a8d560c5a7adbfb746dd30e69d287b50054dfe3bd0bec8aaafe36d40a13caf5640655d07d4a0c4955a

    Score
    10/10
    socelarsaspackv2stealeramadeyloaderbotonlyloggerraccoonredlinetofseevidar4da27d123a577c68e42716053343dd3f8da508a2@tuimedia7newtesttrafuser1evasioninfostealerloaderminerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • LoaderBot executable

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • OnlyLogger Payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks