Overview

overview

10

Static

static

02074294a1...ef.exe

windows7-x64

10

02074294a1...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02074294a16b02d4deb61f85f16c2ef3847f47cf5c53c5c15c011a854486f1ef

  • Size

    5.5MB

  • Sample

    221015-y8bsrsgbcr

  • MD5

    b89e1c694a9b7d2dfe7556220fc5c4b8

  • SHA1

    7d63890f00ddc391797279d2eb68de1a746f4b3b

  • SHA256

    02074294a16b02d4deb61f85f16c2ef3847f47cf5c53c5c15c011a854486f1ef

  • SHA512

    71cae5f99596325ca6cf2675c7f00c130d48d25fdda08ae1c3a0a3ca34a839b41c04087f4bee5fb170260ecd42233712abc7d2ccd00b352b629c6c992f1c54a7

  • SSDEEP

    98304:H2mfSTVQzk+x/cX4gmva9miyobp84qJGANGozaclJejWpdjOGfJ0InK+:7Sp+x/cX/dmiyq84gE9c6KpdXfmIj

Score
10/10
dcratnymaimprivateloaderraccoonredlinesmokeloader141022_rozce21570f8b07f4e68bfb7f44917635b1nam6.2nighbackdoorinfostealerloadermainratspywarestealertrojanvmprotect

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php
Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

raccoon

Botnet

ce21570f8b07f4e68bfb7f44917635b1

C2

http://135.148.104.11/

http://77.73.133.7/
rc4.plain

Extracted

Family

nymaim

C2

45.15.156.54

85.31.46.167

Extracted

Family

redline

Botnet

nam6.2

C2

103.89.90.61:34589

Attributes
  • auth_value

    4040fe7c77de89cf1a6f4cebd515c54c

Extracted

Family

redline

Botnet

141022_roz

C2

europe.firstmillion.click:81

Attributes
  • auth_value

    5f7ee4b154c3bb6fe2606434552ee688

Extracted

Family

redline

Botnet

Nigh

C2

80.66.87.20:80

Attributes
  • auth_value

    dab8506635d1dc134af4ebaedf4404eb

Targets

    • Target

      02074294a16b02d4deb61f85f16c2ef3847f47cf5c53c5c15c011a854486f1ef

    • Size

      5.5MB

    • MD5

      b89e1c694a9b7d2dfe7556220fc5c4b8

    • SHA1

      7d63890f00ddc391797279d2eb68de1a746f4b3b

    • SHA256

      02074294a16b02d4deb61f85f16c2ef3847f47cf5c53c5c15c011a854486f1ef

    • SHA512

      71cae5f99596325ca6cf2675c7f00c130d48d25fdda08ae1c3a0a3ca34a839b41c04087f4bee5fb170260ecd42233712abc7d2ccd00b352b629c6c992f1c54a7

    • SSDEEP

      98304:H2mfSTVQzk+x/cX4gmva9miyobp84qJGANGozaclJejWpdjOGfJ0InK+:7Sp+x/cX/dmiyq84gE9c6KpdXfmIj

    Score
    10/10
    privateloaderraccoonredlinesmokeloaderce21570f8b07f4e68bfb7f44917635b1backdoorinfostealerloaderspywarestealertrojanvmprotectdcratnymaim141022_roznam6.2nighmainrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detects Smokeloader packer

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks