Overview

overview

10

Static

static

7

2d29625e81...05.exe

windows7-x64

10

2d29625e81...05.exe

windows10-2004-x64

10

Resubmissions

02-09-2022 14:42

220902-r27hjahhh9 10

02-09-2022 11:45

220902-nwq2tadcgq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05

  • Size

    2.3MB

  • Sample

    220902-nwq2tadcgq

  • MD5

    e18b3707ff095f5dd8eac23474e25809

  • SHA1

    996770ce74c9f7a0f6f1223bd37447bdea794372

  • SHA256

    2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05

  • SHA512

    59db45c751fdb8df979afe6ce803fcb6b511b3c7965c639801eae68d5a51b4b02319102d6ca8c504ae76c68aa6ba6f2d595007a3b73af07e029c0ebbe07fdc58

  • SSDEEP

    49152:nhTsBclN14DVR/dRZV++apFIecXZM7tQB6/M8sbgsq7D:nk8NWVvRron0cQ6/SkH

Score
10/10
colibrinymaimprivateloaderraccoonredlineytstealer3108_ruzkiad82482251879b6e89002f532531462abuild1facebookdiscoveryevasioninfostealerloaderpersistencephishingspywarestealerthemidatrojanupxvmprotect

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12
Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

raccoon

Botnet

ad82482251879b6e89002f532531462a

C2

http://89.185.85.53/

rc4.plain

Extracted

Family

redline

Botnet

3108_RUZKI

C2

213.219.247.199:9452

Attributes
  • auth_value

    f71fed1cd094e4e1eb7ad1c53e542bca

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

    • Target

      2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05

    • Size

      2.3MB

    • MD5

      e18b3707ff095f5dd8eac23474e25809

    • SHA1

      996770ce74c9f7a0f6f1223bd37447bdea794372

    • SHA256

      2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05

    • SHA512

      59db45c751fdb8df979afe6ce803fcb6b511b3c7965c639801eae68d5a51b4b02319102d6ca8c504ae76c68aa6ba6f2d595007a3b73af07e029c0ebbe07fdc58

    • SSDEEP

      49152:nhTsBclN14DVR/dRZV++apFIecXZM7tQB6/M8sbgsq7D:nk8NWVvRron0cQ6/SkH

    Score
    10/10
    nymaimprivateloaderraccoonredlineytstealer3108_ruzkiad82482251879b6e89002f532531462afacebookdiscoveryevasioninfostealerloaderphishingspywarestealerthemidatrojanupxvmprotectcolibribuild1persistence

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

      loadercolibri

    • Detected facebook phishing page

      phishingfacebook

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • YTStealer

      YTStealer is a malware designed to steal YouTube authentication cookies.

      stealerytstealer

    • YTStealer payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks