nullmixer

General

Target

1c5088ac5461153a35eaf852a6fee84df1a6e32277426844c0cc5593ed6670b4
Size

1.9MB
Sample

221015-y8akpsgbcp
MD5

afbc5b04b75f1ad031b50355f856179a
SHA1

f755d0b70c8ada93edd17ed38e19a69cafbb9aee
SHA256

1c5088ac5461153a35eaf852a6fee84df1a6e32277426844c0cc5593ed6670b4
SHA512

0da9d121d539f4771b1e5202233e064fa75ccc9db21651ad17838ab94c6ee807658560638d2b160376c5c1a6be77de82a28e6837f7f117fbea7b73ae19ea630a
SSDEEP

49152:EgTkiIAaI8XJ0vbkY+Fh6rMhXWeEvba2rHbQa5+hUvDE2HLS:JwihaxZ0bHALCHZEKrHLS

Malware Config

Extracted

Family

nullmixer

C2

http://wxkeww.xyz/

Extracted

Family

raccoon

Botnet

ce21570f8b07f4e68bfb7f44917635b1

C2

http://135.148.104.11/

http://77.73.133.7/

rc4.plain

Extracted

Family

nymaim

C2

45.15.156.54

85.31.46.167

Extracted

Family

vidar

Version

55

Botnet

1679

C2

http://138.201.90.120:80

Attributes

profile_id
1679

Extracted

Family

redline

Botnet

nam6.2

C2

103.89.90.61:34589

Attributes

auth_value
4040fe7c77de89cf1a6f4cebd515c54c

Extracted

Family

redline

Botnet

141022_roz

C2

europe.firstmillion.click:81

Attributes

auth_value
5f7ee4b154c3bb6fe2606434552ee688

Targets

- Target
  
  1c5088ac5461153a35eaf852a6fee84df1a6e32277426844c0cc5593ed6670b4
- Size
  
  1.9MB
- MD5
  
  afbc5b04b75f1ad031b50355f856179a
- SHA1
  
  f755d0b70c8ada93edd17ed38e19a69cafbb9aee
- SHA256
  
  1c5088ac5461153a35eaf852a6fee84df1a6e32277426844c0cc5593ed6670b4
- SHA512
  
  0da9d121d539f4771b1e5202233e064fa75ccc9db21651ad17838ab94c6ee807658560638d2b160376c5c1a6be77de82a28e6837f7f117fbea7b73ae19ea630a
- SSDEEP
  
  49152:EgTkiIAaI8XJ0vbkY+Fh6rMhXWeEvba2rHbQa5+hUvDE2HLS:JwihaxZ0bHALCHZEKrHLS
Score

10^/10

nullmixer nymaim privateloader raccoon redline smokeloader vidar 141022_roz 1679 ce21570f8b07f4e68bfb7f44917635b1 nam6.2 aspackv2 backdoor discovery dropper evasion infostealer loader persistence spyware stealer themida trojan vmprotect
- Detects Smokeloader packer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- NyMaim
  NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
  trojan nymaim
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2