General
-
Target
New Text Document.zip
-
Size
1KB
-
Sample
231202-awj2lsha48
-
MD5
6928fa91ca64fae96060f50f7b1d2812
-
SHA1
ce23e21e0db4097037a1760285f447c6f72d6cdb
-
SHA256
449be8b7045888171621f844a0fbd92c7e79b7b1dbee7b9060224cc3be69e955
-
SHA512
981f615fc6e2c64566b0f97c068b68548fe87f265a7f12c7b77608bbbf4b2a593fa9268f2068818b23a28da271ed816858c9a65e0fcec71bb046c8093d5dc14b
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document.zip
Resource
win11-20231128-en
Behavioral task
behavioral2
Sample
New Text Document.exe
Resource
win11-20231129-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Extracted
Protocol: ftp- Host:
ftp.experthvac.ro - Port:
21 - Username:
[email protected] - Password:
-8{jszMOY*Z8(~Za0#jyP%o7VoB.0)kk^)7_
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.siscop.com.co - Port:
21 - Username:
[email protected] - Password:
+5s48Ia2&-(t
Extracted
stealc
http://77.91.76.36
-
url_path
/3886d2276f6914c4.php
Extracted
lokibot
https://sempersim.su/a14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
https://sempersim.su/a16/fre.php
Extracted
vidar
6.7
52d67d34ad338b1aab9d89c0da5a59b1
https://t.me/s4p0g
https://steamcommunity.com/profiles/76561199575355834
-
profile_id_v2
52d67d34ad338b1aab9d89c0da5a59b1
Extracted
lumma
http://whethergaseoatra.pw/api
Targets
-
-
Target
New Text Document.zip
-
Size
1KB
-
MD5
6928fa91ca64fae96060f50f7b1d2812
-
SHA1
ce23e21e0db4097037a1760285f447c6f72d6cdb
-
SHA256
449be8b7045888171621f844a0fbd92c7e79b7b1dbee7b9060224cc3be69e955
-
SHA512
981f615fc6e2c64566b0f97c068b68548fe87f265a7f12c7b77608bbbf4b2a593fa9268f2068818b23a28da271ed816858c9a65e0fcec71bb046c8093d5dc14b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect PureLogs payload
-
Detect ZGRat V1
-
Gh0st RAT payload
-
SectopRAT payload
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Sets DLL path for service in the registry
-
Sets file execution options in registry
-
Sets service image path in registry
-
Stops running service(s)
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
-
-
Target
New Text Document.exe
-
Size
4KB
-
MD5
a239a27c2169af388d4f5be6b52f272c
-
SHA1
0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
-
SHA256
98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
-
SHA512
f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da
-
SSDEEP
48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect PureLogs payload
-
Detect ZGRat V1
-
SectopRAT payload
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
9Registry Run Keys / Startup Folder
9Scheduled Task/Job
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
9Registry Run Keys / Startup Folder
9Scheduled Task/Job
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
14Subvert Trust Controls
2Install Root Certificate
2Hide Artifacts
2Hidden Files and Directories
2