General

  • Target

    e39ab2c65deceb3c63869c5e0b855f65b38aca0c34e96534e8087223199769f3

  • Size

    245KB

  • Sample

    220617-jggsdaahhq

  • MD5

    81f7105dd8ccd574c2dd7399931d52d5

  • SHA1

    1a86da9b77441b0486acfe1b4302c8699dd2ae36

  • SHA256

    e39ab2c65deceb3c63869c5e0b855f65b38aca0c34e96534e8087223199769f3

  • SHA512

    cfce0b2fcb76546da3a3a7c3428d6ca9d91c4df14d13aae7bda0af368285a001527df967b28cf2c8bf2ae76360ea507de9b64419fa48781b2e2777c08215bd31

Malware Config

Extracted

Family

vidar

Version

52.6

Botnet

1415

C2

https://t.me/tg_dailylessons

https://busshi.moe/@olegf9844xx

Attributes
  • profile_id

    1415

Extracted

Family

recordbreaker

C2

http://138.197.179.146/

Extracted

Family

redline

Botnet

mario

C2

193.106.191.129:80

Attributes
  • auth_value

    8fb912f79eac650a3e3f25f46f070f5d

Extracted

Family

redline

Botnet

USAeuTEST

C2

193.106.191.246:23196

Attributes
  • auth_value

    7dbf5ba6d421c1b0e8ce8d5867af4537

Targets

    • Target

      e39ab2c65deceb3c63869c5e0b855f65b38aca0c34e96534e8087223199769f3

    • Size

      245KB

    • MD5

      81f7105dd8ccd574c2dd7399931d52d5

    • SHA1

      1a86da9b77441b0486acfe1b4302c8699dd2ae36

    • SHA256

      e39ab2c65deceb3c63869c5e0b855f65b38aca0c34e96534e8087223199769f3

    • SHA512

      cfce0b2fcb76546da3a3a7c3428d6ca9d91c4df14d13aae7bda0af368285a001527df967b28cf2c8bf2ae76360ea507de9b64419fa48781b2e2777c08215bd31

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    • suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

    • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • ModiLoader Second Stage

    • Vidar Stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

4
T1005

Tasks