Overview

overview

10

Static

static

1

transfer.js

windows10-2004-x64

Resubmissions

31-03-2023 23:54

230331-3x7taafh4s 10

31-03-2023 23:51

230331-3v8ykaee57 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    transfer.js

  • Size

    3KB

  • Sample

    230331-3x7taafh4s

  • MD5

    df563b8889a28abc0115800b3a26f52e

  • SHA1

    6e2fb36fbe2023ad4f437e7b4a40d69acaabcba0

  • SHA256

    8f997207451d58f68b271fa61a13b0cc6bf335043f2c458eee17cd577be2959e

  • SHA512

    3f463b4f9522127946bd9f79b4aceb62e96f5afd3931fb5eb3c93c08cdc635e22349d524a42a28eecf64ab387f47f3e8d836904ecbaeebb674335c65c3405593

Score
10/10
amadeyredlinesectopratvidarb354ae133888f81047933923e33e8d49bs7a t5wirainfostealerratspywarestealertrojanupx

Malware Config

Extracted

Family

vidar

Version

3.2

Botnet

b354ae133888f81047933923e33e8d49

C2

https://steamcommunity.com/profiles/76561199489580435

https://t.me/tabootalks
Attributes
  • profile_id_v2

    b354ae133888f81047933923e33e8d49

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79

Extracted

Family

redline

Botnet

bs7a t5wira

C2

6.tcp.ngrok.io:10240

Targets

    • Target

      transfer.js

    • Size

      3KB

    • MD5

      df563b8889a28abc0115800b3a26f52e

    • SHA1

      6e2fb36fbe2023ad4f437e7b4a40d69acaabcba0

    • SHA256

      8f997207451d58f68b271fa61a13b0cc6bf335043f2c458eee17cd577be2959e

    • SHA512

      3f463b4f9522127946bd9f79b4aceb62e96f5afd3931fb5eb3c93c08cdc635e22349d524a42a28eecf64ab387f47f3e8d836904ecbaeebb674335c65c3405593

    Score
    10/10
    amadeyredlinesectopratvidarb354ae133888f81047933923e33e8d49bs7a t5wirainfostealerratspywarestealertrojanupx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks