Overview

overview

10

Static

static

b466f58861...e8.exe

windows7-x64

10

b466f58861...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b466f58861bb4069db99312de146a2e8.exe

  • Size

    241KB

  • Sample

    221109-xgyb1schhn

  • MD5

    b466f58861bb4069db99312de146a2e8

  • SHA1

    295f06794b26ba5ac7c73fbf636c581624f897cd

  • SHA256

    6cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420

  • SHA512

    8693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d

  • SSDEEP

    6144:kR69jvgMRufd/piq5aIiS87fSujpDBL1u:iKjmX5ag8+ujpDvu

Score
10/10
amadeyeternityraccoonredlineremcos@redlinevip cloud (tg: @fatherofcarders)bf3346f8b90a3b56b998fed7451ba685remotehostcollectiondiscoveryinfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

redline

C2

45.15.156.37:110

157.90.145.151:14075
Attributes
  • auth_value

    19cd76dae6d01d9649fd29624fa61e51

Extracted

Family

redline

Botnet

@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.233:13553

Attributes
  • auth_value

    fbee175162920530e6bf470c8003fa1a

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/myupdate.exe

Extracted

Family

remcos

Botnet

RemoteHost

C2

157.90.145.151:1441

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    onhyxlqy.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    gftlbusy-PLYPFW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

raccoon

Botnet

bf3346f8b90a3b56b998fed7451ba685

C2

http://87.236.161.20/

rc4.plain

Targets

    • Target

      b466f58861bb4069db99312de146a2e8.exe

    • Size

      241KB

    • MD5

      b466f58861bb4069db99312de146a2e8

    • SHA1

      295f06794b26ba5ac7c73fbf636c581624f897cd

    • SHA256

      6cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420

    • SHA512

      8693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d

    • SSDEEP

      6144:kR69jvgMRufd/piq5aIiS87fSujpDBL1u:iKjmX5ag8+ujpDvu

    Score
    10/10
    amadeyeternityredline@redlinevip cloud (tg: @fatherofcarders)collectiondiscoveryinfostealerpersistencespywarestealertrojanraccoonremcosbf3346f8b90a3b56b998fed7451ba685remotehostrat

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Amadey credential stealer module

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks