Static

static

10

Resubmissions

18/11/2023, 19:53

231118-ymbwmsfe36 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    MailRanger 2 [Crack.sx].rar

  • Size

    28.2MB

  • MD5

    d8fb5afde86b7a80449d03d2842ad96f

  • SHA1

    76281be80382423d4e1f2b798e820482ef71ee93

  • SHA256

    7e1410e3f42623dc9a9e7965991735bbe6ee2a2c3e7855455f1929174f629fc2

  • SHA512

    2f103a31a99e0b13c3cc46c2032a4a57505ad4780efa83ce0c18c6317250da92633a72563b500765d40c268c74d0d1029ca782c8a97846b629b468aa5d3f53d1

  • SSDEEP

    786432:okUinvcSkGyFjdDP2fpcrXm3tEBCRyEi0Te26dmrBcdHDmmi8N:HujFjBPTcRyt1mryZDli8N

Score
10/10
pyinstallerempyreanblankgrabbernanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

man-organized.gl.at.ply.gg:21927

Mutex

2773ba68-2ef8-4382-80ab-00e3d545b481

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    man-organized.gl.at.ply.gg

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2023-08-26T03:19:00.073689236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    21927

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    2773ba68-2ef8-4382-80ab-00e3d545b481

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    man-organized.gl.at.ply.gg

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
    blankgrabber
  • Detects Empyrean stealer 1 IoCs
  • Empyrean family
    empyrean
  • Nanocore family
    nanocore
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • MailRanger 2 [Crack.sx].rar
    .rar

    Password: 123

  • MailRanger 2 [Crack.sx]/MailRanger.exe
    .exe windows:5 windows x64 arch:x64

    Password: 123

    1e92fd54d65284238a0e3b74b2715062


    Headers

    Imports

    Sections

  • main.pyc
  • MailRanger 2 [Crack.sx]/Mailranger2.exe
    .exe windows:5 windows x64 arch:x64

    Password: 123

    20d446c1cb128febd23deb17efb67cf6


    Headers

    Imports

    Sections

  • ����.pyc
  • MailRanger 2 [Crack.sx]/Mailranger2Hits.txt
  • MailRanger 2 [Crack.sx]/Read Me.txt
  • MailRanger 2 [Crack.sx]/Serverlist.exe
    .exe windows:4 windows x86 arch:x86

    Password: 123

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections