Malware sandboxing report by Hatching Triage

General

Target

AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe
Size

2MB
Sample

220806-qy359shfe3
MD5

b81a72714c586f9b634b059b73da8a3a
SHA1

2aad87da256f1b26c40e1243f4ec7ea15c2f4690
SHA256

ab479d019576efd4dd391e0bf3fc1bedb10367e1ece7157d609a283873a43645
SHA512

07f076ccf6b4174a4c9848795dcd86b59d4f2a6b7ab2827d25ac8b2808dad47c2ca20bf6d712c1b8c6fa17427fbf0648c5e24f13fc066d22c8e3f5752125c56c

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes

auth_value
71a0558c0eea274a5bd617ea85786884

Extracted

Family

redline

Botnet

install

C2

31.41.244.109:3590

Attributes

auth_value
eb23a0ca5a38a3bf1eb16b2f08524f35

Extracted

Family

vidar

Version

39.7

Botnet

933

C2

https://shpak125.tumblr.com/

Attributes

profile_id
933

Targets

- Target
  
  AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe
- Size
  
  2MB
- MD5
  
  b81a72714c586f9b634b059b73da8a3a
- SHA1
  
  2aad87da256f1b26c40e1243f4ec7ea15c2f4690
- SHA256
  
  ab479d019576efd4dd391e0bf3fc1bedb10367e1ece7157d609a283873a43645
- SHA512
  
  07f076ccf6b4174a4c9848795dcd86b59d4f2a6b7ab2827d25ac8b2808dad47c2ca20bf6d712c1b8c6fa17427fbf0648c5e24f13fc066d22c8e3f5752125c56c
Score

10^/10

privateloader redline install ruzki aspackv2 evasion infostealer loader persistence spyware stealer themida trojan upx vidar 933
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2