General
-
Target
a.zip
-
Size
832B
-
Sample
230909-denv1sha92
-
MD5
10e578867faad166dc6a8f3868cef2f4
-
SHA1
f541fab60d482834e90638c5aebdefe3d997174e
-
SHA256
6fe03f61ee89f37688356f14ee8dc2d0c001e0d43281fad29386270a9c71c92c
-
SHA512
38389b61e71eed9a9587900f60d59c145d070d0e02602f473c284befcd4898b1191f1982e71463c9cbe17ea36f4ec6c17d665f072e730981eae00fd805863114
Malware Config
Extracted
aurora
212.87.204.93:8081
Extracted
statusrecorder
185.106.94.73
Extracted
formbook
4.1
sy22
vinteligencia.com
displayfridges.fun
completetip.com
giallozafferrano.com
jizihao1.com
mysticheightstrail.com
fourseasonslb.com
kjnala.shop
mosiacwall.com
vandistreet.com
gracefullytouchedartistry.com
hbiwhwr.shop
mfmz.net
hrmbrillianz.com
funwarsztat.com
polewithcandy.com
ourrajasthan.com
wilhouettteamerica.com
johnnystintshop.com
asgnelwin.com
Targets
-
-
Target
a.zip
-
Size
832B
-
MD5
10e578867faad166dc6a8f3868cef2f4
-
SHA1
f541fab60d482834e90638c5aebdefe3d997174e
-
SHA256
6fe03f61ee89f37688356f14ee8dc2d0c001e0d43281fad29386270a9c71c92c
-
SHA512
38389b61e71eed9a9587900f60d59c145d070d0e02602f473c284befcd4898b1191f1982e71463c9cbe17ea36f4ec6c17d665f072e730981eae00fd805863114
Score10/10-
Aurora
Aurora is a crypto wallet stealer written in Golang.
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Phemedrone
An information and wallet stealer written in C#.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Status Recorder Stealer
Status Recorder is a crypto stealer written in C++.
-
Formbook payload
-
Downloads MZ/PE file
-
Stops running service(s)
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-