General

  • Target

    http://107.182.129.251/download/Service.exe

  • Sample

    220809-n56tmahhdj

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

nymaim

C2

208.67.104.9

212.192.241.16

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Client

C2

103.235.175.244:4449

103.235.175.244:4448

Mutex

Client

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

C2

5.182.39.50:6737

Attributes
  • auth_value

    b8f3a41a86172637e79ba4fb9a85433c

Targets

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Modifies Windows Defender Real-time Protection settings

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Async RAT payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks