Overview

overview

10

Static

static

10

189ca1951e...df.exe

windows7-x64

10

189ca1951e...df.exe

windows10-2004-x64

10

37ca1cfa1f...60.exe

windows7-x64

10

37ca1cfa1f...60.exe

windows10-2004-x64

10

37e3ba3283...c3.elf

debian-9-armhf

1

3898dfa5cb...ba.exe

windows7-x64

10

3898dfa5cb...ba.exe

windows10-2004-x64

10

3e488cd6f6...e9.exe

windows7-x64

10

3e488cd6f6...e9.exe

windows10-2004-x64

10

505fe3cf69...cb.exe

windows7-x64

10

505fe3cf69...cb.exe

windows10-2004-x64

10

6543c547b8...84.exe

windows7-x64

1

6543c547b8...84.exe

windows10-2004-x64

10

911bb31927...e4.exe

windows7-x64

10

911bb31927...e4.exe

windows10-2004-x64

10

913aec7dc7...60.exe

windows7-x64

10

913aec7dc7...60.exe

windows10-2004-x64

10

NEAS.arm7elf_JC.elf

debian-9-armhf

1

a23543464a...48.exe

windows7-x64

10

a23543464a...48.exe

windows10-2004-x64

10

ad21aff38e...59.exe

windows7-x64

1

ad21aff38e...59.exe

windows10-2004-x64

10

ba5ce65d72...ff.exe

windows7-x64

10

ba5ce65d72...ff.exe

windows10-2004-x64

10

ca1af61fd2...7f.elf

debian-9-mipsel

9

cad291a2df...eb.exe

windows7-x64

10

cad291a2df...eb.exe

windows10-2004-x64

10

da8e7392c3...fb.exe

windows7-x64

10

da8e7392c3...fb.exe

windows10-2004-x64

10

e3a0367cf2...02.exe

windows7-x64

10

e3a0367cf2...02.exe

windows10-2004-x64

10

f8ac9d00a1...1b.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Malw.rar

  • Size

    22.2MB

  • Sample

    231007-kf74lscd82

  • MD5

    cd872060986ed067e89bf917300348b9

  • SHA1

    7132ed454d6dd9e0553ca9862e63387185141ee6

  • SHA256

    999d43ee4c9a1ec38c0b00fc38abe0b29b13cc83983c6ee895cbb2768b29022d

  • SHA512

    7280dd388e1222f99e23c8cfd0edfdb20833274e77839505b084604ad668f97cb9401806d44ded23126059c6b2f5a0a392f9200697ad90ecbd7e29aca120b23a

  • SSDEEP

    393216:yJYqXY9Vg0dz1XRIyusiBpSyGcteLnwHGd7JLDAZt5BWRc8APdFTvMEN9Ky:G+99dZRBusKoctgwHx5BLPLNwy

Score
10/10
agentteslaamadeyasyncratchaoschinese_generic_botnetdcrateternitygozihealermiraimysticredlinesmokeloaderstormkittyxmrig5050@ytlogsbotbotnetcrypt onedefaultfrantgigantgruhaviradbackdoorbankerbotnetgoogleclippercollectiondiscoverydropperevasioninfostealerisfbkeyloggerminerpersistencephishingransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Extracted

Family

mirai

Botnet

BOTNET

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php
Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain
rc4.plain

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6415420186:AAFl1R3-Kr5zbvKkeofTPjxvxd9leZKNs2M/sendMessage?chat_id=940609421
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Crypt One

C2

194.180.49.190:9254

Mutex

c7737c6a-d18e-4344-9a5b-860541cfb072

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi

Botnet

5050

C2

http://igrovdow.com

Attributes
  • base_path

    /pictures/

  • build

    250260

  • exe_type

    worker

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

redline

Botnet

frant

C2

77.91.124.55:19071

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

gigant

C2

77.91.124.55:19071

Extracted

Family

amadey

Version

3.83

C2

http://5.42.65.80/8bmeVwqx/index.php

Attributes
  • install_dir

    207aa4515d

  • install_file

    oneetx.exe

  • strings_key

    3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

redline

Botnet

@ytlogsbot

C2

176.123.4.46:33783

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.giroplastic.com.br
  • Port:
    587
  • Username:
    jesiane@giroplastic.com.br
  • Password:
    #no2@tec
  • Email To:
    originallog@mail.com

Extracted

Family

redline

Botnet

virad

C2

77.91.124.82:19071

Attributes
  • auth_value

    434dd63619ca8bbf10125913fb40ca28

Targets

    • Target

      189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.bin

    • Size

      1.5MB

    • MD5

      6419a1e59348225baafa1b58ed611fc9

    • SHA1

      89e4e06f33ddacf9092907bca221ad111fd4dcf1

    • SHA256

      189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df

    • SHA512

      0d85752488eedc84c3bc858e171a1b73ffda869b14b9404e121f5a71cbb4aa64510b51a57890fe3d97ccd9beab854361e009e27e1cc4796f5d5c7bdba36c0634

    • SSDEEP

      24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY

    Score
    10/10
    eternityredlineclipperinfostealerspyware

    • Detects Eternity clipper

      clipper

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe

    • Size

      953KB

    • MD5

      5fc3bd9632a02f189d81f75fc3b12ebf

    • SHA1

      6abbc78a6fb421adf80051365dbfaff0b3fb696b

    • SHA256

      37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60

    • SHA512

      cf0b9df6db5c85ebc85967dbfbdd99ada401f718445f69f258d9d0a9466f7b58a7bb2f1287cb5679988bd79b42807fa0e0e7fc419557f0af3fbb620b40b2c2af

    • SSDEEP

      12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq

    Score
    10/10
    chaosransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Renames multiple (191) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (215) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral3behavioral4

    • Target

      37e3ba3283cd2b6f56990318a0861f92f76aac467a79df61b72878a493c476c3.elf

    • Size

      37KB

    • MD5

      b8c5a7bc9c67b60b4aebb5f9cd450a86

    • SHA1

      405cbbe067d9ee9197d6d533dddb912f8e7805b1

    • SHA256

      37e3ba3283cd2b6f56990318a0861f92f76aac467a79df61b72878a493c476c3

    • SHA512

      459549ee1ec094ebd88f7a16e3c506fcb31928ff92c1410ecd11b4cc818c022a5b6a251849195d96e6ce7e70388b7c5a98368eb25a6e766e7555a55ce5e3901b

    • SSDEEP

      768:B6MpMrH1oYDg4QWttgSYpkD1/wdVkP3F2H5oMxMgll+Y9q3UELOC:BSjE45tvYpQdsktIbll+BL5

    Score
    1/10
    behavioral5

    • Target

      3898dfa5cb6bbc6d6c48c202d31333d3b214d0f2ac7c4396eb54d6ed09bf24ba.exe

    • Size

      334KB

    • MD5

      242c47b16c8755e72d7d1fdbc9ff0f17

    • SHA1

      445486022335d121378877268cfc5a0625b53e4f

    • SHA256

      3898dfa5cb6bbc6d6c48c202d31333d3b214d0f2ac7c4396eb54d6ed09bf24ba

    • SHA512

      f46985cb70a351a57fcf2dfb4b6a0733ac26b93c09daecadc611c5c80e749cc5a52fe10b03a761a4c6de903f3f79bacde7c1f61d056e51040d55bb1ee77317b1

    • SSDEEP

      6144:ge1/duat9Ej/QUsovmgk17/G1aQx9pf7IWbhrC:ge1/dUso61gVRI

    Score
    10/10
    eternitycollectionspywarestealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral6behavioral7

    • Target

      3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.docx

    • Size

      5.2MB

    • MD5

      d381d9db9cbd1b60afdfb4f05e52a775

    • SHA1

      d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

    • SHA256

      3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

    • SHA512

      cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

    • SSDEEP

      98304:Qp4L/JhqnNKIjRFlrDlyzVd/dCR36YDAbJC5kZne:QeL/JhqNRrhyXCR3FAbfhe

    Score
    10/10
    xmrigminer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral8behavioral9

    • Target

      505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.bin

    • Size

      1.0MB

    • MD5

      32d6a8fbfd4b362c8281c3caf0dfebaa

    • SHA1

      c7a119c8f5731d280b65394cdfdc3ff665dc989d

    • SHA256

      505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb

    • SHA512

      6b3e9a57df867a21270f6f2e1dd472bfd360ae03856f96318d5485b5339a15c95e7f590d6fcdc6f6bf3dea7711f81930eed0122927d3880cdc6aed67bebf5725

    • SSDEEP

      24576:CyNGXsSg4D8nP/xmtAuBqR0ZZEZ9MrRKKuo8FzUjTMiyT6:pwg4Dk/xmtAdiZmg0KuajTqT

    Score
    10/10
    healermysticdropperevasionpersistencestealertrojanamadeyasyncratredlinestormkittydefaultgruhainfostealerratspyware

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

    behavioral10behavioral11

    • Target

      6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.bin

    • Size

      10.2MB

    • MD5

      6cfc8a19911d2a4401c1c362587e83ce

    • SHA1

      757f656302382738175a6a73ed7e412bba55011c

    • SHA256

      6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984

    • SHA512

      4da1ae530f9e06cf69ee4d68f5166586096940248f58954e928e16d56faa2cdefcb4ba865588964a254659c14642de8af9fe8e393a168a642e9a5648ef5f29a2

    • SSDEEP

      98304:01+qfbaSe1um0WohRcxAqV6EiTEEhG8VdjDEJgkKQ:nGWM0x7VdiAfj

    Score
    10/10
    asyncratcrypt onerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral12behavioral13

    • Target

      911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4.exe

    • Size

      274KB

    • MD5

      d18f3fecf6d28ddd0f4cf4a9b53c0aec

    • SHA1

      05263b9ec69fcf48cc71443ba23545fabe21df12

    • SHA256

      911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4

    • SHA512

      4629ce7f35716bd2c0fc3c14104251c6b2f3eaf07f7b35cf181654d6bc9be85bda6cb6f802b00f98c6bbb446db4790940605dcf8f8d6391282281ac029ff0512

    • SSDEEP

      3072:utyJSwPI9F4BwVVO+kjH4wjyIphvo3ZDivScpBaa4l8QU:iyrPa4BI7wuIphg3ZDi6cnA8Q

    Score
    10/10
    gozi5050bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral14behavioral15

    • Target

      913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.bin

    • Size

      1.1MB

    • MD5

      97db5929795af713a29da7ee311097b6

    • SHA1

      4edbba98c44d3e0871144507e076afca15bb34d2

    • SHA256

      913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360

    • SHA512

      dfaceddde78a58b7a5957961496c2e5b81106ed0b1d2dbd439548ba90f21515e43a9dc69bb5aa0e5b33199c92d1ef9aff34b099641fd2ca4cb382e6546b6ecbf

    • SSDEEP

      24576:lyLFc4gILHSFdApaMPP+3jauS/PHOb7LnssG3Ge1:ALMLdM+zauSHYst

    Score
    10/10
    mysticevasionpersistencestealertrojanamadeydcrathealerredlinesmokeloader@ytlogsbotfrantgigantbackdoordiscoverydropperinfostealerratspyware

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral16behavioral17

    • Target

      NEAS.arm7elf_JC.elf

    • Size

      50KB

    • MD5

      5c7b331aa38795a202db1a98352c342f

    • SHA1

      a2ccdc33f1ee246eb466c6ae43bce71d3c170f94

    • SHA256

      bce4f077424f31cfff3f8ec50a7c9bda802b4a0b08b27e18e69ad7c4127c32bb

    • SHA512

      b963c9a2f1f6cb0aedbc4cf80a55af99a6fe3f5a273e76cd24421f567928ed1e138768e1e72e86cc784ccce42cf424ab7e4f8f8f5e3fa3bdcd9dbe567cdc1f0b

    • SSDEEP

      1536:la8ZqK2kfJzQA3XbURnB+0J06Kz4sjHLYwKeokllDiP:lHqK2kfX3XbUpBBKz4qHLjW

    Score
    1/10
    behavioral18

    • Target

      a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe

    • Size

      387KB

    • MD5

      f646c097913ec9dc3897ec3b5e452919

    • SHA1

      0948b7d2f5b0ebcbc5c3b7c8ef29a271abbfa93f

    • SHA256

      a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448

    • SHA512

      5e2d2e7356f5c69b6ef676ccb266c58786030a0d751aa8c6e52e9a8ef5365d7d7f41c0434e25260998bbf53d99122f363b0f620a4a8dd4d68e5952545416cf07

    • SSDEEP

      12288:kDoSU8AcJIoxecqF2kTJFLb1ChbNdP+kfXuBuKUv0HJg0YBmgMylojOPcoDYyFtz:kcFpQmyojOwUPXzqSd

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

    • Target

      ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859.bin

    • Size

      592KB

    • MD5

      2b17ef662bfb9464153c8dbd60ccbad9

    • SHA1

      a2883daa62d0f99d6cbf8b51b28d3f479c3807dc

    • SHA256

      ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859

    • SHA512

      e0cb94d546284ee3400a2e8f372b3365c0686ae5a6265b6bbd598f33d677d0582d29e0b6ef33dbadda496f89089a89a3bc9ead862708c4f19a7a5c96793284b4

    • SSDEEP

      12288:Wi+rhsEgj79G/vpZyofAj+KD5icYPahZ:zITpq5icYPahZ

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral21behavioral22

    • Target

      ba5ce65d728b5529fede411b5fb3b99e88a69c797e5bf8b89e18e42a9d6761ff.exe

    • Size

      3.9MB

    • MD5

      2746cf67ced0c91f1cefd3d137bd6a5c

    • SHA1

      c42e2e0080ec2f357c7306754ea82b976bdc220c

    • SHA256

      ba5ce65d728b5529fede411b5fb3b99e88a69c797e5bf8b89e18e42a9d6761ff

    • SHA512

      2cad5e01ff55204ec0c30361a9db29a38ed4bc4eb20ae76c5984aa2cfac9d5fede4aee1981168be47b0f60e1c2f0e7f7b79adce62663f9ab3706ea3a05fb6238

    • SSDEEP

      98304:s7ZyplW12iRY7CWkdntsrBRAxQyvIYA+7THD:duLaCv0BeOyvIYA+Hj

    Score
    10/10
    evasionpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral23behavioral24

    • Target

      ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f.elf

    • Size

      74KB

    • MD5

      7712622b406f7bbf8ba62a28e1e35158

    • SHA1

      eb5fdd089b82ed7634965f6569eeb6c5302b5a71

    • SHA256

      ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f

    • SHA512

      f410834285c2d6f3642eb758a6ac6fc94acf610d853cedc2c6c129f8bcd51b6bcf87d814df9919329179a706c999c92570c6642bc9168af1c3d036fea64c98b2

    • SSDEEP

      1536:znTcO2ULJEAnDrRSWHQLgTPoMgr3d4MXRPd:zTD2ULJEApUiM

    Score
    9/10
    discovery

    • Contacts a large (137941) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral25

    • Target

      cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe

    • Size

      472KB

    • MD5

      762bff46f0d8459d2fd83a7dbc0b3103

    • SHA1

      5fdddc577baaa0ba8c7fe6b88be254866c959321

    • SHA256

      cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb

    • SHA512

      38a1e73a7d3c36817f53311c016a4ddf724dee9531c419298ea1f4452f60e4786ff16f25f5c73e01b7b9af971cc5c1acd323f436667a60ad77a0348f0a3256b5

    • SSDEEP

      6144:WWMjNEqWNAML6edtpVYWNTLq01CQoSE0iHjbRfKugGdGQ/UDlVJHaCV:Wvuq2RL3ddNT+LKugjNTJ6

    Score
    10/10
    chinese_generic_botnetbotnet
    behavioral26behavioral27

    • Target

      da8e7392c3c3d1c521d28c78d60425a2a5b7f52d17eb495d0e5cc581737344fb

    • Size

      758KB

    • MD5

      69910b8a839dcc28f1d96efeade65da8

    • SHA1

      84fbe23ec514b722615a552c4906f50d15ffec08

    • SHA256

      da8e7392c3c3d1c521d28c78d60425a2a5b7f52d17eb495d0e5cc581737344fb

    • SHA512

      8babef83a23685704bbb9a84def0fa93f28c2c5626b7ecdd7ebd2417d532294d7fd64d7657ef60fc78f16fc61eb6e96a6e63262612017cb0ec59300ea9c80d57

    • SSDEEP

      12288:TMrvy90UKTpSrjEM5OKm1AkJ89kUNYM6dlTIIqx0SF54qs6kMCqryeZF0KIcJo2I:sy2TpijEB5VIkU+nTWKSF54bzMDyeZur

    Score
    10/10
    redlineviradinfostealerpersistencehealerdropperevasiontrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral28behavioral29

    • Target

      e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.bin

    • Size

      356KB

    • MD5

      eee483531e1ad411935f8d345d9492c8

    • SHA1

      c7f69aade6bce67a54c768b6ee078fb3b294ce5c

    • SHA256

      e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802

    • SHA512

      a5fdff2635a23b4c75b25e4c65873fbf7a15f54ebee6f258066f6d958dc308760c55a2f8803bcb4c3ccbc375d123c40598a2dbb82e197b91b3ad6941dd1fbca2

    • SSDEEP

      6144:UETeW/s5GqrO5aXnfEGIXWPvZAOXyftjXQTUr5cA72b857mML2GVs0BC+:cmcGqrOk86xutjXQTDjb8D/s0BC+

    Score
    10/10
    mysticstealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Suspicious use of SetThreadContext

    behavioral30behavioral31

    • Target

      f8ac9d00a184e45b3c8600507eb21194712ea65d0e8e72657963c870f039d21b.bin

    • Size

      269KB

    • MD5

      aa305d193e030df354f932232c37492f

    • SHA1

      26f350fa286c442695483e888ae4ad2f91575073

    • SHA256

      f8ac9d00a184e45b3c8600507eb21194712ea65d0e8e72657963c870f039d21b

    • SHA512

      4f73d6c9ed65340ad9159dd8742e9631cbd33c7f9500b70cd0d14a3e0b2b6c7cdf0e2cff2a4ae3c1b43acee596b3903576c0ebdead7e52a99095d52fee281c1a

    • SSDEEP

      6144:YYUctlMQMY6Vo++E0R6gFAO2igELvwog35:YYrtiQMYlXoixvwT35

    Score
    10/10
    amadeydcrathealerredlinesmokeloader@ytlogsbotbackdoorgoogledropperevasioninfostealerpersistencephishingratspywaretrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detected google phishing page

      phishinggoogle

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

6
T1053

Scripting

2
T1064

Persistence

Scheduled Task/Job

6
T1053

Create or Modify System Process

7
T1543

Windows Service

7
T1543.003

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

5
T1547.001

Privilege Escalation

Scheduled Task/Job

6
T1053

Create or Modify System Process

7
T1543

Windows Service

7
T1543.003

Boot or Logon Autostart Execution

5
T1547

Registry Run Keys / Startup Folder

5
T1547.001

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

20
T1112

Impair Defenses

12
T1562

Disable or Modify Tools

11
T1562.001

Scripting

2
T1064

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Credential Access

Unsecured Credentials

12
T1552

Credentials In Files

12
T1552.001

Discovery

Remote System Discovery

2
T1018

Query Registry

14
T1012

System Information Discovery

18
T1082

Peripheral Device Discovery

2
T1120

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Data from Local System

12
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Web Service

2
T1102

Impact

Resource Development

Reconnaissance

Tasks

static1

upxbotnetchaoseternitymirai
Score
10/10

behavioral1

eternityredlineclipperinfostealerspyware
Score
10/10

behavioral2

eternityredlineclipperinfostealerspyware
Score
10/10

behavioral3

chaosransomwarespywarestealer
Score
10/10

behavioral4

chaosransomwarespywarestealer
Score
10/10

behavioral5

Score
1/10

behavioral6

eternitycollectionspywarestealer
Score
10/10

behavioral7

eternitycollectionspywarestealer
Score
10/10

behavioral8

Score
10/10

behavioral9

xmrigminer
Score
10/10

behavioral10

healermysticdropperevasionpersistencestealertrojan
Score
10/10

behavioral11

amadeyasyncrathealermysticredlinestormkittydefaultgruhadropperevasioninfostealerpersistenceratspywarestealertrojan
Score
10/10

behavioral12

Score
1/10

behavioral13

asyncratcrypt onerat
Score
10/10

behavioral14

gozi5050bankerisfbtrojan
Score
10/10

behavioral15

gozi5050bankerisfbtrojan
Score
10/10

behavioral16

mysticevasionpersistencestealertrojan
Score
10/10

behavioral17

amadeydcrathealermysticredlinesmokeloader@ytlogsbotfrantgigantbackdoordiscoverydropperevasioninfostealerpersistenceratspywarestealertrojan
Score
10/10

behavioral18

Score
1/10

behavioral19

redlinediscoveryinfostealerspywarestealer
Score
10/10

behavioral20

redlinediscoveryinfostealerspywarestealer
Score
10/10

behavioral21

Score
1/10

behavioral22

agentteslacollectionkeyloggerspywarestealertrojan
Score
10/10

behavioral23

evasionpersistencetrojan
Score
10/10

behavioral24

evasionpersistencetrojan
Score
10/10

behavioral25

discovery
Score
9/10

behavioral26

chinese_generic_botnetbotnet
Score
10/10

behavioral27

chinese_generic_botnetbotnet
Score
10/10

behavioral28

redlineviradinfostealerpersistence
Score
10/10

behavioral29

healerredlineviraddropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral30

mysticstealer
Score
10/10

behavioral31

mysticstealer
Score
10/10

behavioral32

amadeydcrathealerredlinesmokeloader@ytlogsbotbackdoorgoogledropperevasioninfostealerpersistencephishingratspywaretrojan
Score
10/10