General

  • Target

    26f3ab3022c32610a89a7299d0074351.exe

  • Size

    5MB

  • Sample

    221115-q5tkeaaa4z

  • MD5

    26f3ab3022c32610a89a7299d0074351

  • SHA1

    b5937933f35fe44805887dcee9488b60f0ef8493

  • SHA256

    3c4f456e84a4b82254480d17bd6db4c0a9ae6259e085b362b10183a82956d1ba

  • SHA512

    05901445ac3b15e09e9c452979496542c8a61a64a0deb1560868cae3d86ba39d8f9ab9e30f7859db3548d6368f6fbe078646f6e5981b8730ae9160eacc9e4fb4

  • SSDEEP

    98304:dIRDHjQTy8c7ZKwF0nI9D6HKM8dG70bpAf:dIRH8cvOJmG7epAf

Malware Config

Extracted

Family

privateloader

C2

208.67.104.60

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

vidar

Version

55.7

Botnet

937

C2

https://t.me/deadftx

https://www.ultimate-guitar.com/u/smbfupkuhrgc1

Attributes
  • profile_id

    937

Extracted

Family

redline

Botnet

boy

C2

77.73.134.241:4691

Attributes
  • auth_value

    a91fa8cc2cfaefc42a23c03faef44bd3

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Extracted

Family

redline

Botnet

neruz

C2

193.106.191.27:47242

Attributes
  • auth_value

    0169a8759f3c9be473f782b96a6ff704

Extracted

Family

redline

Botnet

@andriii_ff

C2

185.173.36.94:31511

Attributes
  • auth_value

    525a7ad8080b3552f2f7735af7644111

Targets

    • Target

      26f3ab3022c32610a89a7299d0074351.exe

    • Size

      5MB

    • MD5

      26f3ab3022c32610a89a7299d0074351

    • SHA1

      b5937933f35fe44805887dcee9488b60f0ef8493

    • SHA256

      3c4f456e84a4b82254480d17bd6db4c0a9ae6259e085b362b10183a82956d1ba

    • SHA512

      05901445ac3b15e09e9c452979496542c8a61a64a0deb1560868cae3d86ba39d8f9ab9e30f7859db3548d6368f6fbe078646f6e5981b8730ae9160eacc9e4fb4

    • SSDEEP

      98304:dIRDHjQTy8c7ZKwF0nI9D6HKM8dG70bpAf:dIRH8cvOJmG7epAf

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Scripting

1
T1064

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks