General

  • Target

    ebf60ae71e4830f9e07d78e9abf7d764.exe

  • Size

    3.2MB

  • Sample

    220313-rrv2rahgcj

  • MD5

    ebf60ae71e4830f9e07d78e9abf7d764

  • SHA1

    9a38784e3b37b2c8f045691378e5c73bd14ec653

  • SHA256

    6f6585d3df024c6e411a075d856c79cc7a70e5509006e53dcaafeb8fc418fdf8

  • SHA512

    46dcd680212a4a2426baa6e65d5fa2fdc2689fdc43d2eb9ffce274a8134dcde7f90383aca6528b47e4fc078b438d132eb136a171295f518a4fd8c2947dacd0a1

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://fuyt.org/test3/get.php

Attributes
  • extension

    .xcbg

  • offline_id

    y6oQcfhmSRc7ZQ1q8yjLE3LhY8kK7FHg6LLlEht1

  • payload_url

    http://zerit.top/dl/build2.exe

    http://fuyt.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-zHDj26n4NW Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0417Jsfkjn

rsa_pubkey.plain

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Extracted

Family

redline

Botnet

pizzadlyashekera

C2

65.108.101.231:14648

Attributes
  • auth_value

    7d6b3cb15fc835e113d8c22bd7cfe2b4

Extracted

Family

redline

Botnet

Installs

C2

94.23.1.92:12857

Attributes
  • auth_value

    c8e146507a5c0004dfcc77a7c5f15bc2

Extracted

Family

redline

Botnet

ruzki12_03

C2

176.122.23.55:11768

Attributes
  • auth_value

    c51ddc8008e8581a01cec6e8291c5530

Extracted

Family

redline

Botnet

ruzki000

C2

86.107.197.196:63065

Attributes
  • auth_value

    80fac7f67bd38aa709bbeef7a44ccb47

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\MicrosoftPaks\Files\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4ebf61c9-c489-4749-8bd7-539d318db8e7}\0.0.filtertrie.intermediate.txt

Ransom Note
0 0 ~ zoom~ zooming when you pinch with two fingers on the touchpad~ zoom mode~ zoom level~ zoom lens size~ zoom lens settings~ zoom in~ zoom increment~ zoom in:wux:zoom in~ zoom behavior~ zoom amount~ zone~ zones~ zone automatically~ ypdate~ your work or school~ your work or school domain~ your work or school cloud domain~ your windows mixed reality headset goes to sleep~ your wheel~ your voice~ your voice to improve speech services~ your voice to control your pc~ your videos library~ your update history~ your touchpad~ your touchpad to its default settings~ your timeline~ your sound output device~ your sound input device~ your settings~ your restart~ your recovery key~ your quick actions~ your profile~ your product id~ your picture~ your pictures library~ your phone~ your phone to timeline~ your personalization settings~ your pen's pressure sensitivity~ your pen shortcuts~ your pen settings~ your pc~ your pc recognizes your handwriting~ your pc name~ your pc and help you, or offer to help someone else~ your password~ your passwords on this pc~ your organization to manage your pc~ your offline files~ your notifications~ your network properties~ your network adapter~ your mouse~ your mouse to the end of the taskbar~ your mouse settings~ your microphone~ your lock screen background~ your language list~ your language and keyboard settings~ your info~ your homepage~ your hololens~ your headset sleeps~ your handwriting~ your fingertip~ your files with file history~ your eye tracker~ your email~ your drives~ your documents library~ your diagnostic data~ your device~ your device to your work or school domain~ your device to your work or school cloud domain~ your device password-less~ your device history~ your device from your work or school~ your device easier to hear~ your desktop background~ your country or region~ your cortana devices~ your contacts~ your computer~ your computer's status and resolve issues~ your computer's power settings~ your computer's memory problems~ your computer name~ your computer is on~ your cellular data connection with other devices~ your camera~ your call history~ your calendar~ your button flows as quick actions~ your braille display~ your advertising id~ your account~ your account picture~ your account info~ your accent color~ you, or offer to help someone else~ you use windows~ you use three finger taps on the touchpad~ you use the touchpad~ you use the mouse~ you use four finger taps on the touchpad~ you type~ you touch the screen~ you to enter tablet mode~ you tap with two fingers on the touchpad~ you store offline maps~ you speak with your device~ you sign in~ you send to microsoft~ you scroll with the mouse wheel~ you pinch with two fingers on the touchpad~ you open links~ you move your mouse to the end of the taskbar~ you have a 32-bit or 64-bit version of windows~ you drag with two fingers on the touchpad~ you drag three fingers on the touchpad~ you drag four fingers on the touchpad~ you double-tap the spacebar~ you double-tap shift~ you choose a text suggestion~ you can always say "hey cortana"~ you are right or left handed~ xdevice settings~ xbox performance~ xbox one settings~ xbox one controller settings~ xbox networking~ xbox networking settings~ xbox multiplayer settings~ xbox live~ xbox game bar~ x-device settings~ x menu~ wwin~ wwindows~ wwan~ wupdate~ wupdater~ wudo~ wuapp~ wsr~ writing~ write~ write in the handwriting panel with your fingertip~ workspace~ workspace when i remove my pen from storage~ workspace settings~ workplace settings~ workplace policies~ workplace network~ workplace access~ workgroup this computer is on~ workgroup name~ workflow~ work users~ work settings~ work remotely~ work or school~ work or school users~ work or school domain~ work or school cloud domain~ work network~ work hours~ work folders~ work email~ work account~ words~ words as you type~ words as i type~ word echo~ wondows~ wndows~ wndows update~ wlan~ wlan settings~ without sound~ without signing~ with your network adapter~ with your fingertip~ with your device~ with your computer~ with your computer's power settings~ with windows update~ with windows store apps~ with windows search~ with windows powershell in the win + x menu~ with windows mixed reality~ with windows firewall~ with two fingers on the touchpad~ with the touch keyboard~ with the screen when using the mouse~ with the mouse wheel~ with speech~ with shared folders~ with recording sound~ with quickstart~ with printing~ with playing sound~ with playing movies, tv shows, or videos~ with other devices~ with narrator~ with file history~ with directaccess~ with bluetooth devices~ with background downloads~ wireless~ wireless:wux:wireless~ wireless settings~ wireless display~ wireless display settings~ wireless devices on or off~ wireless controller settings~ wireless adapter problems~ wireless adapter issues~ wipe:wux:wipe~ winupdate~ winsows~ winows~ winows update~ winodws~ winodws update~ winf~ windws~ windws update~ windwos update~ windpws~ window~ windowupdate~ windows~ windowsupdate~ windowsupdates~ windows y~ windows x~ windows when i hover over them~ windows welcome notifications~ windows vpn~ windows version~ windows version:wux:windows version~ windows ups~ windows upo~ windows upgrade~ windows updte~ windows updatw~ windows updats~ windows updatre~ windows update~ windows updates~ windows updates:wux:windows updates~ windows updater~ windows updater:wux:windows updater~ windows updated~ windows update troubleshooter~ windows update settings~ windows update settings:wux:windows update settings~ windows update restart settings~ windows update problems~ windows update policies~ windows update options~ windows update not working~ windows update issues~ windows update history~ windows update delivery settings~ windows update delivery optimization~ windows update broken~ windows updare~ windows updae~ windows updaet~ windows upate~ windows upadte~ windows uop~ windows uodate~ windows uip~ windows udpate~ windows udate~ windows u[~ windows track app launches to improve start and search results~ windows to the sides or corners of the screen~ windows to go startup options~ windows to fill available space~ windows system:wux:windows system~ windows sync activities from this pc to the cloud~ windows suggest ease of access settings~ windows subscription~ windows store apps~ windows spotlight~ windows speech recognition~ windows specifications~ windows sonic~ windows show on the taskbar when using virtual desktops~ windows settings~ windows security settings~ windows search~ windows searches~ windows search:wux:windows search~ windows search settings~ windows s mode settings~ windows restore:wux:windows restore~ windows repair:wux:windows repair~ windows recovery:wux:windows recovery~ windows privacy~ windows powershell in the win + x menu~ windows permissions~ windows pdate~ windows password~ windows online personalization gallery~ windows on taskbar on secondary displays~ windows on taskbar on primary display~ windows mr settings~ windows mobility center~ windows mixed reality~ windows mixed reality settings~ windows mixed reality headset goes to sleep~ windows mixed reality audio settings~ windows manage my default printer~ windows logo key + c~ windows license~ windows is activated~ windows insider settings~ windows insider program settings~ windows ink workspace settings~ windows ink settings~ windows information:wux:windows information~ windows indexer~ windows hello~ windows hello:wux:windows hello~ windows hello setup~ windows hello settings~ windows hello pin~ windows hello fingerprint~ windows hello face~ windows hd color settings~ windows firewall~ windows firewall with advanced security~ windows firewall troubleshooter~ windows fire wall~ windows feedback frequency~ windows features on or off~ windows features appear in~ windows edition~ windows display language~ windows disk management~ windows diagnostics~ windows device manager~ windows defender~ windows defender firewall~ windows credentials~ windows credential manager~ windows collect activities from this pc~ windows cant hear me~ windows can't hear me~ windows backup:wux:windows backup~ windows background images~ windows anywhere settings~ windows animation~ windows and tabs appear when pressing alt+tab~ windows activation~ windows activation settings~ windows activate~ windows 8~ windows 8.1~ windows 7~ windows 64~ windows 32~ windows 10 update~ windows 10 updates:wux:windows 10 updates~ windows 10 restarts~ windows + x~ windown~ windowing~ windowes~ windowa update~ window, show what i can snap next to it~ window, resize any adjacent snapped window~ window version:wux:window version~ window update~ window updates~ window transparency~ window sup~ window supdate~ window layout~ window firewall~ window fill~ window features~ window de~ window color~ window arrangement~ windos update~ windoq~ windopws~ windoiws~ windoews~ windoes~ windoes update~ windiws~ windd~ winddows~ wind up~ win-x~ win-v~ win-c~ win+x~ win+v~ win+g~ win+c~ win x~ win update~ win updates~ win plus x~ win plus c~ win c~ win - x~ win - v~ win - c~ win + x menu~ win + v~ win + c~ wimd~ wimdows~ wiin~ wiindows~ wifi~ wifi settings~ width~ widows update~ widnows update~ wider cursor~ wider caret~ wide cursor~ wide caret~ wi-fi~ wi-fi:wux:wi-fi~ wi-fi settings~ wi-fi networks~ wi fi~ why an action can't be performed~ white theme~ white pointer~ white mouse pointer~ white mouse cursor~ white cursor~ while roaming~ while focus assist was on~ which workgroup this computer is on~ which icons appear on the taskbar~ which folders appear on start~ which files and folders are indexed~ which domain your computer is on~ which apps show notifications~ which apps should not be included in sets~ which apps can run in the background~ which apps can make phone calls~ which apps can control radios~ which apps can access your videos library~ which apps can access your pictures library~ which apps can access your notifications~ which apps can access your microphone~ which apps can access your eye tracker~ which apps can access your email~ which apps can access your documents library~ which apps can access your contacts~ which apps can access your camera~ which apps can access your call history~ which apps can access your calendar~ which apps can access your account info~ which apps can access diagnostic information~ which accounts appear in your timeline~ whether you are right or left handed~ whether to have a touchpad delay~ whether to enter tablet mode when you sign in~ whether the system asks you to enter tablet mode~ where you store offline maps~ where to install apps from~ where is the product key~ when your windows mixed reality headset goes to sleep~ when your headset sleeps~ when you use three finger taps on the touchpad~ when you use the touchpad~ when you use the mouse~ when you use four finger taps on the touchpad~ when you touch the screen~ when you tap with two fingers on the touchpad~ when you sign in~ when you pinch with two fingers on the touchpad~ when you move your mouse to the end of the taskbar~ when you drag with two fingers on the touchpad~ when you drag three fingers on the touchpad~ when you drag four fingers on the touchpad~ when you double-tap the spacebar~ when you double-tap shift~ when you choose a text suggestion~ when using virtual desktops~ when using the touchpad~ when using the mouse~ when using repeat keys~ when using captures~ when typing~ when two keys are pressed at the same time~ when turning on sticky, toggle, or filter keys~ when to turn off the screen~ when to turn off the screen when plugged in~ when to turn off the screen on battery power~ when the sticky keys modifier key is pressed~ when the screen is turned off~ when the pc sleeps~ when the pc sleeps when plugged in~ when the pc sleeps on battery power~ when pressing caps lock, num lock, or scroll lock~ when pressing alt+tab~ when possible~ when plugged in~ when pcs try to connect to my mobile device using usb~ when on battery~ when num lock is on~ when navigating~ when narrator is speaking~ when narrator is on~ when my device is locked~ when lighting changes~ when launching an app from another app~ when keys are pressed~ when i’m using my pen~ when it’s available~ when it's pressed twice in a row~ when it's moving~ when i turn on narrator~ when i snap a window, show what i can snap next to it~ when i resize a snapped window, resize any adjacent snapped window~ when i remove my pen from storage~ when i record~ when i record a game~ when i hover over them~ when enabling sticky keys, toggle keys, or filter keys~ when duplicating screen~ when closing tabs~ when apps access my location~ when a mouse is connected~ wheel~ wheels~ wheel vibration settings~ wheel vibrate~ wheel settings~ wheel haptics settings~ wheel defaults~ wheel default settings~ whats new~ what's new~ what windows show on the taskbar when using virtual desktops~ what windows and tabs appear when pressing alt+tab~ what version of windows do i have:wux:what version of windows do i have~ what is my computer name:wux:what is my computer name~ what i missed while focus assist was on~ what i can snap next to it~ what happens when you use three finger taps on the touchpad~ what happens when you use four finger taps on the touchpad~ what happens when you drag three fingers on the touchpad~ what happens when you drag four fingers on the touchpad~ what cortana can do, see, and use~ what closing the lid does~ what appears when pressing alt+tab~ what appears when launching an app from another app~ wfi~ well your pc recognizes your handwriting~ welcome screen~ welcome screen settings~ welcome notifications~ website~ websites~ websites can use your language list~ website apps~ weblinks~ webcame~ webcam:wux:webcam~ webcam settings~ webcam privacy~ webcam permissions~ web to app link~ web to app linking~ web pages are displayed in tabs~ web links~ web language~ web languages~ web credentials~ web content control~ web cam:wux:web cam~ web browser~ web browsers~ web browser settings~ web apps~ ways i can set up my device to get the most out of windows~ way measurements are displayed~ way currency is displayed~ was on~ warn~ warning~ warnings~ wallpaper~ wallpaper sync~ wallpaper settings~ wait for second keystroke~ wait for repeated keystrokes~ wait for new keystrokes~ wait for keystrokes~ wait for different keystrokes~ wait before accepting keystrokes~ w up~ vpnm~ vpn while roaming~ vpn settings~ vpn over metered networks~ vpn options~ vpn connection~ vpn advanced settings~ vpn advanced options~ vpmn~ volume~ volume settings~ volume of other apps when narrator is speaking~ volume mixer~ volume mixer:wux:volume mixer~ volume level~ volume control~ voice~ voices~ voiceover~ voice volume~ voice tone~ voice to improve speech services~ voice to control your pc~ voice timbre~ voice timber~ voice speed~ voice settings~ voice rate~ voice quality~ voice pitch~ voice for apps~ voice emphasize formatted text~ voice dictation~ voice data~ voice control~ voice agents~ voice agent settings~ voice activation settings~ voice activation privacy settings~ voice activation permissions~ vlue~ vivid~ visual~ visuals~ visual quality of windows mixed reality~ visual feedback when you touch the screen~ visual feedback touch settings~ visual feedback pen settings~ visual feedback on or off~ visual display~ visual cursor for narrator~ visual alerts for audio notifications~ visual alert for audio notifications~ vision~ vision settings~ visible alerts~ virus~ virtual private networks~ virtual private network settings~ virtual desktop~ virtual desktops~ virtual desktop settings~ view~ viewer

Extracted

Family

redline

Botnet

ruzkida

C2

185.11.73.55:22201

Attributes
  • auth_value

    000938fe0d697ca6a3b6cee46ba02ff3

Targets

    • Target

      ebf60ae71e4830f9e07d78e9abf7d764.exe

    • Size

      3.2MB

    • MD5

      ebf60ae71e4830f9e07d78e9abf7d764

    • SHA1

      9a38784e3b37b2c8f045691378e5c73bd14ec653

    • SHA256

      6f6585d3df024c6e411a075d856c79cc7a70e5509006e53dcaafeb8fc418fdf8

    • SHA512

      46dcd680212a4a2426baa6e65d5fa2fdc2689fdc43d2eb9ffce274a8134dcde7f90383aca6528b47e4fc078b438d132eb136a171295f518a4fd8c2947dacd0a1

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • Modifies Windows Defender Real-time Protection settings

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Danabot Key Exchange Request

      suricata: ET MALWARE Danabot Key Exchange Request

    • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

      suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    • suricata: ET MALWARE GCleaner Downloader Activity M5

      suricata: ET MALWARE GCleaner Downloader Activity M5

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    • suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

      suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    • suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6

      suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • OnlyLogger Payload

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks