General

  • Target

    tmp

  • Size

    400KB

  • Sample

    220911-tletpaffbq

  • MD5

    9519c85c644869f182927d93e8e25a33

  • SHA1

    eadc9026e041f7013056f80e068ecf95940ea060

  • SHA256

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

  • SHA512

    dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

  • SSDEEP

    6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

redline

Botnet

4

C2

79.110.62.196:26277

Attributes
  • auth_value

    e48cb0b64e920bb1a534eba5b2912707

Extracted

Family

redline

C2

20.111.62.187:12944

Attributes
  • auth_value

    dc69bbc8bdf611480705ba6c6d8c091b

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Targets

    • Target

      tmp

    • Size

      400KB

    • MD5

      9519c85c644869f182927d93e8e25a33

    • SHA1

      eadc9026e041f7013056f80e068ecf95940ea060

    • SHA256

      f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

    • SHA512

      dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

    • SSDEEP

      6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw

    • Detects Smokeloader packer

    • Modifies Windows Defender Real-time Protection settings

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Collection

Data from Local System

2
T1005

Tasks