Overview

overview

10

Static

static

Setup.exe

windows7-x64

10

Setup.exe

windows10-1703-x64

10

Setup.exe

windows10-2004-x64

10

Setup.exe

windows11-21h2-x64

Resubmissions

11-08-2022 21:06

220811-zx3msacdem 10

17-05-2022 15:11

220517-sk226adgh4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.zip

  • Size

    224KB

  • Sample

    220811-zx3msacdem

  • MD5

    568adf1dff00d48fb4742bd0bfb7c113

  • SHA1

    1793aa4a491a34fa71e032b23cb1c6e31dcbfc32

  • SHA256

    99d3f10c4d55500225e8b87d6aa9490baef6c5e22be004d6048979f0ed687c29

  • SHA512

    30e3b2b453af37b46186ddf75c2dc7889f8a96125b527816a582f1ef008147b755250416b33f3d8073df48c6bc560caf7f68d4b28d137b7fc7d2661f018adb91

Score
10/10
privateloaderredlinetofseelyla.04.08nam6top1evasioninfostealerloadermainpersistencespywarestealertrojan

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://45.144.225.57/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

2.56.59.42

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

163.123.143.12
Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/1004293542186848319/1006848237547831356/NiceProcessX64.bmp

    https://cdn.discordapp.com/attachments/1004293542186848319/1006848228697841664/NiceProcessX32.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://193.56.146.76/Proxytest.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

    http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

    https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

    http://185.215.113.208/ferrari.exe

    https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://mnbuiy.pw/adsli/note8876.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

    http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

    https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

top1

C2

pemararslava.xyz:80

Attributes
  • auth_value

    e3ff30d1ffe0ffdb11211b351a0179a1

Extracted

Family

redline

Botnet

Lyla.04.08

C2

185.215.113.216:21921

Attributes
  • auth_value

    7f2bf6f810414d0f2fc0b3b8d54a76ac

Extracted

Family

redline

Botnet

nam6

C2

103.89.90.61:34589

Attributes
  • auth_value

    86f67819317f85546241783dd77023e2

Targets

    • Target

      Setup.exe

    • Size

      382KB

    • MD5

      38b5deb16f9cd877a6a7ca7c7434b5ea

    • SHA1

      11051c4a389238fe7e2202cb506a6f23cfa6bfa4

    • SHA256

      5b92d1d8c1df0cc42591bc05cb62331a28f54e3566c708a8fd13b00cb76881c2

    • SHA512

      f1f75b2f2641e09c1ce71b7d442b30169b6335d2e15a6fc9bfcb94ffa6552d4f8783cd6468016789d249e2633332e705631e06ad9ede80c03f87e4a051aee899

    Score
    10/10
    privateloaderevasionloadermainspywarestealertrojanredlinetofseelyla.04.08nam6top1infostealerpersistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

New Service

1
T1050

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks