Overview

overview

10

Static

static

HEUR-Troja...3d.exe

windows7-x64

10

HEUR-Troja...3d.exe

windows10-2004-x64

10

Resubmissions

23-01-2023 07:03

230123-hvkkracc32 10

19-01-2023 02:56

230119-de4apsad4z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan.Win32.Agent.gen-7a4df2fc82c0b553d.exe

  • Size

    3.6MB

  • Sample

    230119-de4apsad4z

  • MD5

    ec9abf614ab015f26629f48c58492005

  • SHA1

    dd6ab65305ec6a6540e430979d4701ee9a457dea

  • SHA256

    7a4df2fc82c0b553d0b703f51635fd62cf02553706f942c66d752c1d8fae207b

  • SHA512

    f39375b4714c9be8ddfdb75757cdd58765938fd4f268db4cf6cde312bda8ddf4734dbd18b1d503ec0d44451653a2ad6c2593acb7185c9150f9939e5e419762e5

  • SSDEEP

    98304:JHnvuRxqSPepIcGYhdkqKcTujg5zWOAgopMai5NdfME3:JHvuRci6Icfhj6vOmpMdfx3

Score
10/10
amadeyfabookienullmixerprivateloaderraccoonredlinesmokeloadervidar164b445f2d85b7aeb3d5c7b23112d6ac3706@new@2023andriii_ffcanadzokey1111111logsdiller cloud (tg: @logsdillabot)medi2servanislovariktest2vertuaspackv2backdoordropperevasioninfostealerloaderpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

nullmixer

C2

http://razino.xyz/

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

redline

Botnet

@new@2023

C2

77.73.133.62:22344

Attributes
  • auth_value

    8284279aedaed026a9b7cb9c1c0be4e4

Extracted

Family

raccoon

Botnet

64b445f2d85b7aeb3d5c7b23112d6ac3

C2

http://45.15.156.209/

rc4.plain

Extracted

Family

redline

Botnet

Medi2

C2

167.235.156.206:6218

Attributes
  • auth_value

    415e49528666a4468e12b696ddda231f

Extracted

Family

redline

Botnet

Dzokey1111111

C2

82.115.223.9:15486

Attributes
  • auth_value

    a46fd18e8e0de86d363c12c2307db5e9

Extracted

Family

redline

Botnet

1

C2

librchichelpai.shop:81

rniwondunuifac.shop:81
Attributes
  • auth_value

    b6c86adb7106e9ee7247628f59e06830

Extracted

Family

redline

Botnet

SlovarikTest2

C2

82.115.223.9:15486

Attributes
  • auth_value

    74f576286d26c99e51edf3860e562ae6

Extracted

Family

amadey

Version

3.66

C2

62.204.41.27/9djZdj09/index.php

Extracted

Family

redline

Botnet

andriii_ff

C2

185.244.181.112:33056

Attributes
  • auth_value

    8caf20244d14f9f793741e94dc56017f

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.210.137.6:47909

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Extracted

Family

redline

Botnet

vertu

C2

62.204.41.159:4062

Attributes
  • auth_value

    fcf83997f362e2cd45c3f3c30912dd41

Targets

    • Target

      HEUR-Trojan.Win32.Agent.gen-7a4df2fc82c0b553d.exe

    • Size

      3.6MB

    • MD5

      ec9abf614ab015f26629f48c58492005

    • SHA1

      dd6ab65305ec6a6540e430979d4701ee9a457dea

    • SHA256

      7a4df2fc82c0b553d0b703f51635fd62cf02553706f942c66d752c1d8fae207b

    • SHA512

      f39375b4714c9be8ddfdb75757cdd58765938fd4f268db4cf6cde312bda8ddf4734dbd18b1d503ec0d44451653a2ad6c2593acb7185c9150f9939e5e419762e5

    • SSDEEP

      98304:JHnvuRxqSPepIcGYhdkqKcTujg5zWOAgopMai5NdfME3:JHvuRci6Icfhj6vOmpMdfx3

    Score
    10/10
    fabookienullmixerprivateloaderraccoonredlinesmokeloadervidar164b445f2d85b7aeb3d5c7b23112d6ac3706@new@2023canadzokey1111111medi2servanislovariktest2aspackv2backdoordropperevasioninfostealerloaderspywarestealertrojanamadeyandriii_fflogsdiller cloud (tg: @logsdillabot)vertupersistenceupxvmprotect

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Fabookie payload

    • Detects Smokeloader packer

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

      droppernullmixer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Nirsoft

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

1
T1089

Scripting

1
T1064

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks