General
-
Target
https://keygenit.com/d/3e16ccf432109nspn247.html
-
Sample
221006-zxrwaaaga6
Malware Config
Extracted
raccoon
b2215797a39d7d41aaec15c1f494d33d
http://94.131.98.5/
http://94.131.97.129
Extracted
nymaim
208.67.104.97
85.31.46.167
Targets
-
-
Target
https://keygenit.com/d/3e16ccf432109nspn247.html
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-