Overview

overview

10

Static

static

10

AfMaRTHbXDQeEqK.exe

windows7-x64

1

AfMaRTHbXDQeEqK.exe

windows10-2004-x64

1

AnZNZkqSCLtCdJP.exe

windows7-x64

10

AnZNZkqSCLtCdJP.exe

windows10-2004-x64

10

AwHQZpWsBXMfKoP.exe

windows7-x64

1

AwHQZpWsBXMfKoP.exe

windows10-2004-x64

1

AxStJPBXbsGYNCc.exe

windows7-x64

10

AxStJPBXbsGYNCc.exe

windows10-2004-x64

10

BcJRFxiQTFDdmBX.exe

windows7-x64

10

BcJRFxiQTFDdmBX.exe

windows10-2004-x64

10

BeRWDywBMMSobQZ.exe

windows7-x64

10

BeRWDywBMMSobQZ.exe

windows10-2004-x64

10

BgNDTadHLDiJwMQ.exe

windows7-x64

10

BgNDTadHLDiJwMQ.exe

windows10-2004-x64

10

BjWXPytPSJRdiLA.exe

windows7-x64

1

BjWXPytPSJRdiLA.exe

windows10-2004-x64

7

BmGjLSDwCWXaZqK.exe

windows7-x64

10

BmGjLSDwCWXaZqK.exe

windows10-2004-x64

10

CfGQYemJHRdTnFG.exe

windows7-x64

10

CfGQYemJHRdTnFG.exe

windows10-2004-x64

10

CgENMjeJGCZcdAF.exe

windows7-x64

10

CgENMjeJGCZcdAF.exe

windows10-2004-x64

10

CjYrWNZyEcMBBMa.exe

windows7-x64

8

CjYrWNZyEcMBBMa.exe

windows10-2004-x64

8

CsFbNASzLBKdkHR.exe

windows7-x64

10

CsFbNASzLBKdkHR.exe

windows10-2004-x64

10

DaGdSGFqZFBbLpA.exe

windows7-x64

10

DaGdSGFqZFBbLpA.exe

windows10-2004-x64

10

DcDJLimAFTYswMQ.exe

windows7-x64

10

DcDJLimAFTYswMQ.exe

windows10-2004-x64

10

aCRAEzePNKKgoZZ.exe

windows7-x64

10

aCRAEzePNKKgoZZ.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Samples.zip

  • Size

    12.8MB

  • MD5

    b7c83a49def36623b4c2d0cb539821fd

  • SHA1

    a63b8606a655ab2471845204df97f259cd65cb4f

  • SHA256

    501317a60d63bac59b9cc6994cd4d03207a929ab689939d062635656b4ed8231

  • SHA512

    4c331d5c502350f320b8ac22c2ef78b931d8cba3f67df507335f31e8fa7a7980cc0db7c27cfdc80ffaee553e819d830620be8c9cbb751e1f2bfe9da2c5d391c7

  • SSDEEP

    393216:hx/VnB01nPLQXdxdweGz/JVcqb74n9/Tbbasg:hx/VmFg1irRP4ntXb1g

Score
10/10
ratdefaultoy10upxrenewsnakekeyloggerasyncratagentteslastormkittywarzoneratformbookbitratblustealerquasar

Malware Config

Extracted

Family

snakekeylogger

Credentials

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

meskullzmint.com:8848

meskullzmint.com:4782

127.0.0.1:8080
Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
aes.plain

Extracted

Family

agenttesla

Credentials

Extracted

Family

warzonerat

C2

spicydojo.duckdns.org:2323

Extracted

Family

formbook

Version

4.1

Campaign

oy10

Decoy

wzwanju.com

vaultnutrition.info

propane-gallon.site

balkanmetin2.com

costa-del-sol.email

kayodeokikiolu.com

singlesshirts.com

nearestfoods.com

trenddetail.com

yihaimaidan.net

dfdr3r.site

tuitionmatters.co.uk

benglas.online

coloraja.xyz

tianzicheng.com

lamkt.com

dileca.com

6698856.com

vishi.store

ablehair.com

Extracted

Family

bitrat

Version

1.38

C2

otx66i7lyk5mdfdu55a7v2qkcsq2apyjferoizgzw5yblmf74uvkrkqd.onion:80

Attributes
  • communication_password

    3f09fec94c92a2a8544c7854ec598a24

  • install_dir

    Install path

  • install_file

    Install name

  • tor_process

    tor

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:7707

127.0.0.1:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5432809476:AAHtE5EDW3VQZZBLnEbEZpHEIJz5LbF0no/sendMessage?chat_id=5571556378

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Renew

C2

51.12.244.74:3788

Mutex

QSR_MUTEX_1Q3lnFG6yfoKwTdOsQ

Attributes
  • encryption_key

    8ZgJdDwfl6yZfAWkQcvE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • AgentTesla payload 2 IoCs
  • Agenttesla family
    agenttesla
  • Async RAT payload 4 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Bitrat family
    bitrat
  • Blustealer family
    blustealer
  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Snake Keylogger payload 7 IoCs
  • Snakekeylogger family
    snakekeylogger
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Warzone RAT payload 1 IoCs
    rat
  • Warzonerat family
    warzonerat
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • Samples.zip
    .zip
  • AfMaRTHbXDQeEqK.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AnZNZkqSCLtCdJP.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AwHQZpWsBXMfKoP.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AxStJPBXbsGYNCc.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BcJRFxiQTFDdmBX.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BeRWDywBMMSobQZ.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BgNDTadHLDiJwMQ.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BjWXPytPSJRdiLA.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BmGjLSDwCWXaZqK.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • CfGQYemJHRdTnFG.exe
    .exe windows x64


    Headers

    Sections

  • CgENMjeJGCZcdAF.exe
    .exe windows x86

    b76aafdc988ade2ab3db3b02fa4c6d00


    Headers

    Imports

    Sections

  • CjYrWNZyEcMBBMa.exe
    .exe windows x86

    18fb8f04991eef6621d9adfb6b5f7ff8


    Headers

    Imports

    Sections

  • CsFbNASzLBKdkHR.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • DaGdSGFqZFBbLpA.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • DcDJLimAFTYswMQ.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • aCRAEzePNKKgoZZ.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • aMAKFbxWMEPyRkN.exe
    .exe windows x86


    Headers

    Sections

  • aSMRQdSkMfAPFgL.exe
    .exe windows x86


    Headers

    Sections

  • aXEYgZSBcArFtKF.exe
    .exe windows x86


    Headers

    Sections

  • bBDWaExRNLqAWQo.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bDSTyQTWrPeGoKL.exe
    .exe windows x86


    Headers

    Sections

  • bDTQEgCaZiWFHLk.exe
    .exe windows x86


    Headers

    Sections

  • bQMSQcNmTECkAiC.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bXXKTwMdTESmcDB.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bYCQnKcEHPrXCFi.exe
    .exe windows x86

    4f7271df0bf201cf627af3103fba2c2e


    Headers

    Imports

    Sections

  • cFRPDbtZZLeCNXj.exe
    .exe .js windows x86
  • cJCEHmFsPxTMBNw.exe
    .exe windows x86

    df8fbcbe90e1e305a660f0ac2aa4fae4


    Headers

    Imports

    Sections

  • cKKPfXkWSYjBLQr.exe
    .exe windows x86


    Headers

    Sections

  • cMDTM.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cMDTMbHfQPTykGK.exe
    .exe windows x86

    18fb8f04991eef6621d9adfb6b5f7ff8


    Headers

    Imports

    Sections

  • cRHBaYjNSLKzEbC.exe
    .exe windows x86

    18fb8f04991eef6621d9adfb6b5f7ff8


    Headers

    Imports

    Sections

  • dCCDGcjYPWfAXHo.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections