General

  • Target

    f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

  • Size

    213KB

  • Sample

    221217-f9j7esgc24

  • MD5

    2141c84aab4a7591fb50e4fd24a9c2a7

  • SHA1

    bab0bd15b12cb785b03bd0a09c603e9884bb5c01

  • SHA256

    f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

  • SHA512

    9f4e6bb793f76fec7f7224e4c2f23f14eab6c1978f1ae5af65ed30b6c8ce6fd8bf0218435f7a7eed03594ed9ed9647cbfefdc29a30c5a186907c48cd4ae8afa3

  • SSDEEP

    3072:p/Qlt+LXk2t8aTR+QOSqxioydbwwSKBjf+QmDKkLszbZSi40zwUzQRKF+:dBLXk2ohioyd0wSMf+rDTgzlSi40M2b

Malware Config

Extracted

Family

redline

Botnet

mario23_10

C2

167.235.252.160:10642

Attributes
  • auth_value

    eca57cfb5172f71dc45986763bb98942

Extracted

Family

djvu

C2

http://abibiall.com/lancer/get.php

Attributes
  • extension

    .bttu

  • offline_id

    8p2Go5ZmkbFk0DF2oJ6E8vGEogpBqqaGCWjto1t1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://abibiall.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0619JOsie

rsa_pubkey.plain

Extracted

Family

raccoon

Botnet

ec7a54fb6492ff3a52d09504b8ecf082

C2

http://88.119.161.188

http://88.119.161.19

rc4.plain

Extracted

Family

danabot

C2

49.0.50.0:57

51.0.52.0:0

53.0.54.0:1200

55.0.56.0:65535

Attributes
  • type

    loader

Targets

    • Target

      f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

    • Size

      213KB

    • MD5

      2141c84aab4a7591fb50e4fd24a9c2a7

    • SHA1

      bab0bd15b12cb785b03bd0a09c603e9884bb5c01

    • SHA256

      f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

    • SHA512

      9f4e6bb793f76fec7f7224e4c2f23f14eab6c1978f1ae5af65ed30b6c8ce6fd8bf0218435f7a7eed03594ed9ed9647cbfefdc29a30c5a186907c48cd4ae8afa3

    • SSDEEP

      3072:p/Qlt+LXk2t8aTR+QOSqxioydbwwSKBjf+QmDKkLszbZSi40zwUzQRKF+:dBLXk2ohioyd0wSMf+rDTgzlSi40M2b

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Detected Djvu ransomware

    • Detects Smokeloader packer

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks