Overview

overview

10

Static

static

7

Install.exe

windows7-x64

10

Install.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Install.exe

  • Size

    6.0MB

  • Sample

    221030-rt43faedb3

  • MD5

    eafceea4ca99519c188038e4ebe6f1a2

  • SHA1

    8ec353dc36f26f285177c8c001b0b7b75b86c238

  • SHA256

    cb33b1dc12d1858a0d761ea2aa333f4aaabbbf00092d102f697526db3c72dca7

  • SHA512

    b09edadb9dcd9facf46cc524fd10698889e2b57cc1ceb9211e96d1bd6fd004c9f350271eb8d4150cb8e8a445c2380232462c995918fc0aa3a984f5be7f051549

  • SSDEEP

    196608:hbtWfV37KhC0F98GFQK7aP6AjNMct7ldB5LfuQqzx:h0VLK39rpH87ldBt+

Score
10/10
nymaimprivateloaderredlinesmokeloader13106.6dzkeylogsdiller cloud (tg: @logsdillabot)backdoordiscoveryevasioninfostealerloadermainspywarestealerthemidatrojan

Malware Config

Extracted

Family

privateloader

C2

208.67.104.60

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php
Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://193.56.146.76/Proxytest.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

    http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

    https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

    http://185.215.113.208/ferrari.exe

    https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://mnbuiy.pw/adsli/note8876.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

    http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

    https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Extracted

Family

redline

Botnet

1310

C2

79.137.192.57:48771

Attributes
  • auth_value

    feb5f5c29913f32658637e553762a40e

Extracted

Family

redline

Botnet

6.6

C2

103.89.90.61:34589

Attributes
  • auth_value

    440b89cc34922bf733d7d50023876c6f

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.21:7161

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Extracted

Family

redline

Botnet

dzkey

C2

193.106.191.19:47242

Attributes
  • auth_value

    52a449fd61ad73c3abc266d47c699ceb

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      Install.exe

    • Size

      6.0MB

    • MD5

      eafceea4ca99519c188038e4ebe6f1a2

    • SHA1

      8ec353dc36f26f285177c8c001b0b7b75b86c238

    • SHA256

      cb33b1dc12d1858a0d761ea2aa333f4aaabbbf00092d102f697526db3c72dca7

    • SHA512

      b09edadb9dcd9facf46cc524fd10698889e2b57cc1ceb9211e96d1bd6fd004c9f350271eb8d4150cb8e8a445c2380232462c995918fc0aa3a984f5be7f051549

    • SSDEEP

      196608:hbtWfV37KhC0F98GFQK7aP6AjNMct7ldB5LfuQqzx:h0VLK39rpH87ldBt+

    Score
    10/10
    privateloaderredline13106.6dzkeylogsdiller cloud (tg: @logsdillabot)evasioninfostealerloaderspywarestealerthemidatrojannymaimsmokeloaderbackdoordiscoverymain

    • Detects Smokeloader packer

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

      trojannymaim

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Scripting

1
T1064

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks