Errors

Reason
config extraction: GuloaderBin: guloader: invalid shellcode

General

  • Target

    URLhaus.rar

  • Size

    23.8MB

  • MD5

    be69fd1c468ef26067d7d22388e26728

  • SHA1

    694f87484f5b5c816fc54d796695506ae237bdb8

  • SHA256

    477cb83fd991d5267507f61b98b7f7523a2ae79bcb1f2e52a71d9daa20b0b93e

  • SHA512

    718bf21546f5e9674d18ac7f3bd54d0c1f0ad61e87fbd81bc32f139fe1a08147581840a4d6383e5a335de017fafb66b7f2eda32c01a3f1a5a0474dec8fbdfba8

  • SSDEEP

    393216:5HW6ZoE6wc2WPVHdoz07MHQ2q+SWJUlp/DBD3WnDrzbI6GnTaIE0AGyYSgXiBx7V:JW86wDIVH80Mw2q+SmUlpNszM6afAGyr

Malware Config

Extracted

Family

pony

C2

http�--kek.b4mb4m.ru/gate.php

http://b4mb4m.ru/kek/

Attributes
  • payload_url

    http://185.222.202.114/uploads/uploads/update_z.exe

Extracted

Family

formbook

Version

3.8

Campaign

da

Decoy

chainwalkchambers.com

foxyhaul.com

yetisnackdesigns.com

paleodiettips.xyz

51zxsf.com

jisulianxiufu.com

qianbianyun.com

unitedresponders.info

contentlab.video

traveloyunnan.com

tonybehrenslaw.com

adithyafuels.com

huanayule.net

conscious-cross.com

link2register.com

anchoritis.com

vicente20.com

jnmbc.info

m-1944.com

naap-tol.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs
  • Pony family
  • XMRig Miner payload 1 IoCs
  • Xmrig family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 33 IoCs

    Checks for missing Authenticode signature.

Files

  • URLhaus.rar
    .rar
  • 1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1221.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 6b282d34fv2.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • B000CEF.exe
    .exe windows:4 windows x86 arch:x86

    4d59a35b1b431625c014a44bb5f4297c


    Headers

    Imports

    Sections

  • Builder.exe
    .exe windows:4 windows x86 arch:x86

    799d78bdb07347786f30047ee21d6f9f


    Headers

    Imports

    Sections

  • POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Terracotta.exe
    .exe windows:6 windows x64 arch:x64

    8eada872b6f292ff58c2a55744a2ea76


    Headers

    Imports

    Exports

    Sections

  • TerracottaGUI.exe
    .exe windows:6 windows x64 arch:x64

    a7c0a3ab0679307dd23c82f26efafde6


    Headers

    Imports

    Exports

    Sections

  • Zver.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • amdcontroller.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • bg.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bin.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin2.exe
    .exe windows:6 windows x86 arch:x86

    4dce94f0f23a764ed66d7203d9cea91a


    Headers

    Imports

    Sections

  • ej.exe
    .exe windows:4 windows x86 arch:x86

    3fde4334102f29784f18762767cceca3


    Headers

    Imports

    Sections

  • fban4.exe
    .exe windows:4 windows x86 arch:x86

    4368ee82e251b8e90303a7365b191f8e


    Headers

    Imports

    Sections

  • glash.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • johngotovo (2).exe
    .exe windows:5 windows x86 arch:x86

    2a23b322f4a5d4d7ef2a2b48495acd72


    Headers

    Imports

    Sections

  • johngotovo (2)_original_original.exe
    .exe windows:5 windows x86 arch:x86

    2a23b322f4a5d4d7ef2a2b48495acd72


    Headers

    Imports

    Sections

  • ktg.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • otIXAOPqOVgvIKePlwFQLX.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • scvsots.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • setup.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • shit.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ss.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stealedd517v2.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • steel.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ted.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • update_b.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • update_z.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • uyo.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • v72d8z2.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections