nullmixer

General

Target

23b9f735f8bb2607ae05fec9b71dee60
Size

5.7MB
Sample

231231-cfv52sbbck
MD5

23b9f735f8bb2607ae05fec9b71dee60
SHA1

0c0209030161610fca6baba7ecb588da4029f6aa
SHA256

0df9cc018e5258e289ffea0bb4137ae6f0bc8fe85b48b544520c7dae95453f68
SHA512

3ea0a8c2157dfaa159e529785b2497da71c41f1d95f371b36f86ada8ca5c76cf02e858cfce6f1043b3f5c0b3f284b4a1f903b6fa6e05a29a1af4f5fc7c1cb322
SSDEEP

98304:y/Pu1T6mvtNC5BcF4qdYOkDPZoSa6VcCThT5U7Sg3KWOlsUEn99:y/6T6mrCbM42uDPza6CCT3/BsH9

Score

10^/10

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes

profile_id
706

Targets

- Target
  
  23b9f735f8bb2607ae05fec9b71dee60
- Size
  
  5.7MB
- MD5
  
  23b9f735f8bb2607ae05fec9b71dee60
- SHA1
  
  0c0209030161610fca6baba7ecb588da4029f6aa
- SHA256
  
  0df9cc018e5258e289ffea0bb4137ae6f0bc8fe85b48b544520c7dae95453f68
- SHA512
  
  3ea0a8c2157dfaa159e529785b2497da71c41f1d95f371b36f86ada8ca5c76cf02e858cfce6f1043b3f5c0b3f284b4a1f903b6fa6e05a29a1af4f5fc7c1cb322
- SSDEEP
  
  98304:y/Pu1T6mvtNC5BcF4qdYOkDPZoSa6VcCThT5U7Sg3KWOlsUEn99:y/6T6mrCbM42uDPza6CCT3/BsH9
Score

10^/10

nullmixer privateloader risepro smokeloader zgrat pub6 aspackv2 backdoor dropper evasion loader rat spyware stealer themida trojan vidar 706
- Detect ZGRat V1
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2