General

  • Target

    61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

  • Size

    1MB

  • Sample

    231129-q96ersgf73

  • MD5

    ed023543b40e9ebaf6cb40da28074173

  • SHA1

    986bd1989695ea88b503f7e40958a17b5c635b0e

  • SHA256

    61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

  • SHA512

    75629fcd087df7197ff678a1d8b165774486e84129df26ac2ad40f1654804cb043f31816650c74d62252286e9a4644edf54216322c99e68161900957ca180b59

  • SSDEEP

    49152:M/pGRzjjMoZ0NmuCBdOMYVcbCD23Eflux69AJe:qpIEmZUT2Wjm2

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Extracted

Family

redline

Botnet

horda

C2

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

C2

http://194.49.94.210/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

C2

195.10.205.16:2245

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes
  • payload_urls

    https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Targets

    • Target

      61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

    • Size

      1MB

    • MD5

      ed023543b40e9ebaf6cb40da28074173

    • SHA1

      986bd1989695ea88b503f7e40958a17b5c635b0e

    • SHA256

      61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

    • SHA512

      75629fcd087df7197ff678a1d8b165774486e84129df26ac2ad40f1654804cb043f31816650c74d62252286e9a4644edf54216322c99e68161900957ca180b59

    • SSDEEP

      49152:M/pGRzjjMoZ0NmuCBdOMYVcbCD23Eflux69AJe:qpIEmZUT2Wjm2

    • Detect ZGRat V1

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks