Resubmissions

06-02-2023 08:40

230206-kk236acg99 10

06-02-2023 08:37

230206-kjc3mscg93 10

06-02-2023 07:50

230206-jpbw4acf42 10

General

  • Target

    008ad6f06b42fa51f990a67d08a39cae.bin

  • Size

    3.3MB

  • Sample

    230206-kk236acg99

  • MD5

    1cefb61bc04d04ac2db1d0dc447cea1a

  • SHA1

    0041a52155376c216ebe9544a3ad3197388b0355

  • SHA256

    c3704d9a70d0ad5a30590190e69f4748de1e232042bfbd6d43a3ea6f573dc18c

  • SHA512

    e9ab6191648c908f3636c41d805aca0b1a9947adcb8a19fac42b3d6e1351b240021d307366a5b005f8cd15164774fe3c5fd390ae26edee7e00ce431669719f89

  • SSDEEP

    49152:qWP7+TTAbkk60inpejudKswewO8DphzsDL4kDPDLAkJ7jWqNle:qWwvxndKzewO8Dphzyck7TJ7jWz

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

vidar

Version

39.8

Botnet

706

C2

https://xeronxikxxx.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

AniOLD

C2

liezaphare.xyz:80

Targets

    • Target

      dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe

    • Size

      3.3MB

    • MD5

      008ad6f06b42fa51f990a67d08a39cae

    • SHA1

      74be7d963aa3fa076e2119cebc5ee4a246069941

    • SHA256

      dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a

    • SHA512

      0c6a89a9382e46b8fe4740f0d539c2f302a0301b8fdf060efcdb989971410b958118c9b56b6946c861607210852d4a20b9a2c44ef9d500653188a4b44ca2b91d

    • SSDEEP

      98304:JhZ2y+lmG4JJsHf608xmtdOVTjQwiH11XD9ml7Js1NR8:Jh0y+lmzJJY6dm7Ol9M11XD8l7Js1o

    • Detect Fabookie payload

    • Detects Smokeloader packer

    • Fabookie

      Fabookie is facebook account info stealer.

    • Modifies Windows Defender Real-time Protection settings

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks