Overview

overview

10

Static

static

071a890281...6e.exe

windows7_x64

10

071a890281...6e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    071a890281fa9af6ca273fa2f46f556e.exe

  • Size

    1.1MB

  • Sample

    220714-3lj8vaeha9

  • MD5

    071a890281fa9af6ca273fa2f46f556e

  • SHA1

    b3670135cd77735ea97a1171fbc7a7ae588973c6

  • SHA256

    0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52

  • SHA512

    ee0ca77ba47fedf35e1e2fd703e66698ef7fefd677d3309a5ad9dd792ea3702d80d7f2504657924f95f215b6af98364f71f25708a8569bb70413bb95033c2b70

Score
10/10
djvunymaimprivateloaderredlinevidar1120937@andriii_flogsdiller cloud (tg: @mr_golds)discoveryevasioninfostealerloadermainransomwarestealersuricatathemidatrojanupx

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://85.202.169.116/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

85.202.169.116

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

http://212.193.30.29/server.txt

212.193.30.21

http://45.144.225.57/server.txt
Attributes
  • payload_url

    http://193.233.185.125/download/NiceProcessX64.bmp

    http://193.233.185.125/download/NiceProcessX32.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://193.56.146.76/Proxytest.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

    http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

    https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

    http://185.215.113.208/ferrari.exe

    https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://mnbuiy.pw/adsli/note8876.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

    http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

    https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

    http://64.227.67.0/searchApp.exe

Extracted

Family

vidar

Version

53.2

Botnet

937

C2

https://t.me/tgch_hijuly

https://c.im/@olegf9844h
Attributes
  • profile_id

    937

Extracted

Family

redline

Botnet

@andriii_f

C2

176.124.223.132:42925

Attributes
  • auth_value

    f08502984a5709462933115515fb9837

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @mr_golds)

C2

185.173.38.57:37309

Attributes
  • auth_value

    4b2de03af6b6ac513ac597c2e6c1ad51

Extracted

Family

vidar

Version

53.2

Botnet

1120

C2

https://t.me/tgch_hijuly

https://c.im/@olegf9844h
Attributes
  • profile_id

    1120

Extracted

Family

nymaim

C2

45.141.237.3

31.210.20.149

212.192.241.16

Extracted

Family

djvu

C2

http://acacaca.org/test3/get.php

Attributes
  • extension

    .hhwq

  • offline_id

    P5roSwExLC3PZ5YJGG124rDyTKEfudWUDPhNJBt1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://acacaca.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-sac7bmVIKJ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: supportsys@airmail.cc Your personal ID: 0520Lsokd

rsa_pubkey.plain

Targets

    • Target

      071a890281fa9af6ca273fa2f46f556e.exe

    • Size

      1.1MB

    • MD5

      071a890281fa9af6ca273fa2f46f556e

    • SHA1

      b3670135cd77735ea97a1171fbc7a7ae588973c6

    • SHA256

      0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52

    • SHA512

      ee0ca77ba47fedf35e1e2fd703e66698ef7fefd677d3309a5ad9dd792ea3702d80d7f2504657924f95f215b6af98364f71f25708a8569bb70413bb95033c2b70

    Score
    10/10
    privateloaderloadermaindjvunymaimredlinevidar1120937@andriii_flogsdiller cloud (tg: @mr_golds)discoveryevasioninfostealerransomwarestealersuricatathemidatrojanupx

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata

    • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata

    • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

      suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

      suricata

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Modifies file permissions

      discovery

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Uses the VBS compiler for execution

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

File Permissions Modification

1
T1222

Scripting

1
T1064

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks