Resubmissions
11-11-2023 08:23
231111-j96bfacf5s 1008-11-2023 14:52
231108-r8x8facc5z 1027-10-2023 03:52
231027-ee6lhabh8x 1027-10-2023 03:51
231027-ee1p9abh8s 1025-10-2023 10:35
231025-mm3htagf6y 1023-10-2023 09:11
231023-k5l8fahc84 1021-10-2023 11:53
231021-n2kf8aga32 1021-10-2023 11:26
231021-njywwsfg64 1020-10-2023 21:27
231020-1a8qysbe9t 10General
-
Target
a.exe
-
Size
5KB
-
Sample
231027-ee6lhabh8x
-
MD5
800a6337b0b38274efe64875d15f70c5
-
SHA1
6b0858c5f9a2e2b5980aac05749e3d6664a60870
-
SHA256
76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571
-
SHA512
bf337140044a4674d69f7a2db30389e248593a99826c8731bc0a5ac71e46819eb539d8c7cbeab48108310359f5604e02e3bd64f17d9fdd380b574f329543645e
-
SSDEEP
48:6O/tGt28lK9iqmcfaFXfkeLJhyPFlWa8tYb/INV/cpwOulavTqXSfbNtm:j/IUiqtaJkeqDUt5xcpmsvNzNt
Malware Config
Extracted
loaderbot
http://185.236.76.77/cmd.php
Extracted
formbook
4.1
sy22
vinteligencia.com
displayfridges.fun
completetip.com
giallozafferrano.com
jizihao1.com
mysticheightstrail.com
fourseasonslb.com
kjnala.shop
mosiacwall.com
vandistreet.com
gracefullytouchedartistry.com
hbiwhwr.shop
mfmz.net
hrmbrillianz.com
funwarsztat.com
polewithcandy.com
ourrajasthan.com
wilhouettteamerica.com
johnnystintshop.com
asgnelwin.com
Extracted
stealc
Extracted
redline
kinza
77.91.124.86:19084
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
formbook
4.1
4hc5
amandaastburyillustration.com
7141999.com
showshoe.info
sagemarlin.com
lithuaniandreamtime.com
therenixgroupllc.com
avalialooks.shop
vurporn.com
lemmy.systems
2816goldfinch.com
pacersun.com
checktrace.com
loadtransfer.site
matsuri-jujutsukaisen.com
iontrapper.science
5108010.com
beidixi.com
21305599.com
peakvitality.fitness
osisfeelingfee.com
Targets
-
-
Target
a.exe
-
Size
5KB
-
MD5
800a6337b0b38274efe64875d15f70c5
-
SHA1
6b0858c5f9a2e2b5980aac05749e3d6664a60870
-
SHA256
76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571
-
SHA512
bf337140044a4674d69f7a2db30389e248593a99826c8731bc0a5ac71e46819eb539d8c7cbeab48108310359f5604e02e3bd64f17d9fdd380b574f329543645e
-
SSDEEP
48:6O/tGt28lK9iqmcfaFXfkeLJhyPFlWa8tYb/INV/cpwOulavTqXSfbNtm:j/IUiqtaJkeqDUt5xcpmsvNzNt
Score10/10-
Detect ZGRat V1
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Stealc
Stealc is an infostealer written in C++.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Formbook payload
-
LoaderBot executable
-
XMRig Miner payload
-
Downloads MZ/PE file
-
Stops running service(s)
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1