General

  • Target
    231107-bz5yxsbb62_pw_infected.zip
  • Size 198.7MB
  • Sample240107-w3ew5aceh9
  • SHA256 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • raccoon

Botnet
  • 5ba094fed1175cc7d1abb03fa165c23c

C2
  • http://79.137.207.53/

Attributes
  • user_agent

    901785252112

xor.plain

Extracted

Family
  • privateloader

C2
  • http://45.133.1.107/server.txt

  • pastebin.com/raw/A7dSG1te

  • http://wfsdragon.ru/api/setStats.php

  • 51.178.186.149

  • http://45.133.1.182/proxies.txt

  • 45.133.1.60

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family
  • socelars

C2
  • http://www.iyiqian.com/

  • http://www.hbgents.top/

  • http://www.rsnzhy.com/

  • http://www.znsjis.top/

Extracted

Family
  • stealc

C2
  • http://robertjohnson.top

Attributes
  • url_path

    /e9c345fc99a4e67e.php

rc4.plain

Signatures

  • Detect ZGRat V1 3 IoCs
  • Privateloader family
  • Raccoon Stealer V2 payload 1 IoCs
  • Raccoon family
  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Socelars family
  • Socelars payload 1 IoCs
  • Stealc family
  • Zgrat family
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 99 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • 231107-bz5yxsbb62_pw_infected.zip
    .zip 198.7MB
  • Divided Threats.zip
    .zip 198.9MB
  • Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
    .exe 5.6MB
  • Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
    .exe 349KB
  • Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
    .exe 762KB
  • Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
    .exe 3.2MB
  • Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
    .exe 4.9MB
  • Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
    .exe 253KB
  • Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
    .exe 771KB
  • Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
    .exe 39KB
  • Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
    .exe 298KB
  • Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
    .exe 742KB
  • Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
    .exe 82KB
  • Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
    .exe 8.3MB
  • Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
    .exe 751KB
  • Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
    .exe 940KB
  • Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
    .exe 1.7MB
  • Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
    .exe 572KB
  • Samples 2/15e3a34b2bd7ad520d87fe902eee65f35049cc5bc3579bbb5182dfb91e3fd289.exe
    .exe 279KB
  • Samples 2/18f74890fef60f1e18d5b1d0b43f100c69b430445187d672bbedf46aff687d09.exe
    .exe 5.5MB
  • Samples 2/23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe
    .exe 11.7MB
  • Samples 2/5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2.exe
    .exe 294KB
  • Samples 2/5fca14e334abfa6aefad9d409d44e951f14231ae0a0f91b7af0ce392726be3ad.exe
    .exe 60KB
  • Samples 2/6b53de90d4c71ace801f6208d6a38c6e59a7e5d50de83544b9ef7f20c5296de2.exe
    .exe 101KB
  • Samples 2/6b8687e4a9ec832619d1e0477cc54e1709e25251c79571e697f6b43c4785fc29.exe
    .exe 31KB
  • Samples 2/6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d.exe
    .exe 3.8MB
  • Samples 2/6c48e39183dda2dbdc8c92592c72feef6c6688c7b9e033ffe55581be572858e5.exe
    .exe 107KB
  • Samples 2/8b70ca880f25f4e03bcac422fb2e6044369bf25d45d9b846db546728d66618a6.exe
    .exe 430KB
  • Samples 2/8ce95aee92cffc56420902fa657bc82a44574450ada63eb864d11e404a59a078.exe
    .exe 210KB
  • Samples 2/9cf8a802217928175088777f3f886dde3cba71c0a5c427ed169e24581e1c7a9b.exe
    .exe 3.5MB
  • Samples 2/9d0863c76aa5212eee67a9d8e8fa25547d9c99e9c47286027637fb50812a1110.exe
    .exe 520KB
  • Samples 2/9f9bbdf52e05dd9de10f36aac171224ddded63a05a2e0bbae484353bef4924cb.exe
    .exe 701KB
  • Samples 3/081a3d200edb928e18cfac98d151d6af21b7fc1fb017f066a1ce428929c5da9b.exe
    .exe 56KB
  • Samples 3/093ea014b7458f9388f4c76b758c08b6a34e713736330f97fa49c99d71e2b371.exe
    .exe 488KB
  • Samples 3/095acff5fceaebcb8026d5dc628953ac226c8bf66aa1fbd929b2b569c9b937d2.exe
    .exe 87KB
  • Samples 3/179a03ea134385e1a80aaa05703d70008024d8771d836f62595c5b9187138723.exe
    .exe 504KB
  • Samples 3/209dc352ae660c94c7bd22fc9e97420bebfc56840e237e0d60cc42f734bfa386.exe
    .exe 757KB
  • Samples 3/31e7e054709f5b627f50b6b26f95c6e0536c7d03361c16c9677c70fe327a7181.exe
    .exe 62KB
  • Samples 3/56e26fd1b4bb65afbfccfcd02b594270030f800f0270068d00c3eb6c31553323.exe
    .exe 8KB
  • Samples 3/61a764045daabe15243e13405d418e3f60b6671ee7a1e325c6021204920f741c.exe
    .exe 257KB
  • Samples 3/74bafd56c1fb3cdebf0a63de4ffb6f16dc1d5cee38e11ab0d2bc2614538da65f.exe
    .exe 5.5MB
  • Samples 3/74f60be5e412a3af9701289707be3aa8e6e321283a0280c20cb437ac25d8d90e.exe
    .exe 216KB
  • Samples 3/77bdc94b3e90f3d4df5ca299e563e8425b6dd7ec50e0fe6fa697e87b1926f778.exe
    .exe 402KB
  • Samples 3/80db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168.exe
    .exe 67KB
  • Samples 3/91bbe97818559d7e7f7c35b60c152e6e2db4f42e3f9c6f80421bbdfb646e7068.exe
    .exe 256KB
  • Samples 3/94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e.exe
    .exe 618KB
  • Samples 3/96b3a6f88bebb213230bd38f95804466296c238e0774861ceec6ad4424dcfb45.exe
    .exe 5.5MB
  • Samples 4/0532a82db5727b773fd280a5bc3ffa8b3be3be05bf5a9c125dbdf5f1e9fa63ce.exe
    .exe 487KB
  • Samples 4/0600f0c29e7513b060c4634804b2a2ad7e636c8372f7ee927b9e20e72e2bc807.exe
    .exe 56KB
  • Samples 4/13144b87810fe4739e4e7078968b49e7ca4b75505195fe5c4925f35d2def22e4.exe
    .exe 565KB
  • Samples 4/25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe
    .exe 349KB
  • Samples 4/4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec.exe
    .exe 2.7MB
  • Samples 4/569cf42b940d1e5d5d4d675f6172542a8ac01596c7bc69a8b65dbe7f9ff7ed25.exe
    .exe 35KB
  • Samples 4/5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27.exe
    .exe 2.1MB
  • Samples 4/65350ee5de866f54845c13472cc7e0257b55715560ff9696ba2d4dc0494991e6.exe
    .exe 337KB
  • Samples 4/6577f5c5150e1dc818be87c2483db10b3af00effc2faf5c1acd174a8db760001.exe
    .exe 351KB
  • Samples 4/7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe
    .exe 3.8MB
  • Samples 4/81539fb95214aadc076c01161cdce901fc57b6cc8d82e27bae4915c512d9baad.exe
    .exe 486KB
  • Samples 4/87876acd533b5e473c1f27bf24ad26a9b6d0e6859186e00ac3efa334711b8f4a.exe
    .exe 657KB
  • Samples 4/8896b158ac271c269cfea637cd9402db48676eeef02b9d694d5c9f0eaeb3dbb0.exe
    .exe 5.1MB
  • Samples 4/9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe
    .exe 1.4MB
  • Samples 4/995d009e2fa6b510a0251895e0e71d0709ebfdeac782eae91caa3b4ee30bd29b.exe
    .exe 5.9MB
  • Samples 5/050506129490bf4fc71dfedbf612532a669ea9b02f2d6b8311428601e915763e.exe
    .exe 4.3MB
  • Samples 5/1391748ce1bffd2513a95275adeb87105e963ef9452ea26798edd2dbd0126f2e.exe
    .exe 280KB
  • Samples 5/210353e2c687a7e1e94408ca27cf59fbbec44495d75a3e466ae528a1a33a53ea.exe
    .exe 2.8MB
  • Samples 5/448140b0da950c59905b373bc96a0cefce7bce665c2727f416353d035f35583d.exe
    .exe 79KB
  • Samples 5/618969df2d98c660836fc0c94f95d93c8c561f19f106c56eca3f5aa9930cbba8.exe
    .exe 2.9MB
  • Samples 5/640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8a.exe
    .exe 4.7MB
  • Samples 5/836486fba787ca151a90548a0ebe5d6bfc006c52133bf6a349a266c8ccf4f79b.exe
    .exe 47KB
  • Samples 5/8710679cc4055b4ed025b3be8a9b248a3ca457cf95673b31fcd7865669e49bcf.exe
    .exe 565KB
  • Samples 5/a5e6cd875238850ec701202134a00d276574d623ac52383f4a96e26650ceac77.exe
    .exe 739KB
  • Samples 5/aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e.exe
    .exe 2.9MB
  • Samples 5/ab2de770aa37881476025be0d91a58826838de592fde00f22ea3a367a0c6a46a.exe
    .exe 4.6MB
  • Samples 5/af74c04a2c7ab70c4b5e3c12ed698d0220be1324f341bd9d4e38d83a9f49adc6.exe
    .exe 32KB
  • Samples 5/b554bb8695c6674175bb3493f8f34c3d1d5b7f4cbb6da4c2e8431bd03acb4351.exe
    .exe 36KB
  • Samples 5/b6b789bb154eaee918cb7eec069e9a80ca1e7596d27a2a8495ddee5e800259ed.exe
    .exe 83KB
  • out.upx
    .exe 201KB
  • Samples 5/b89afe8f268ee82f378f123ec7dbb7de41e296d1ef26993f03f29b0f7b39884c.exe
    .exe 222KB
  • Samples 6/b245325d21b53f21ee7d6a1a8ed3963fcb89cf9770c3d0476ca0544558eaabc3.exe
    .exe 1.4MB
  • Samples 6/b592a44f67e06e47646ade57f8737600011b7317fd9c130b5835e9aaecf795c2.exe
    .exe 64KB
  • Samples 6/b842080ef401cb64de4b9c7d823ef60b0ed4f4bbd42431fbf26db940ece9f4f1.exe
    .exe 1.4MB
  • Samples 6/bb6758a9bce33333cbe3c141c2f7c94077d97cf25c83eb4282cc5ddcaeccc194.exe
    .exe 256KB
  • Samples 6/bb6f2d4376bb6c4e88d386ad55e243295b82704441e9c849ec13063febe5c112.exe
    .exe 29KB
  • Samples 6/bb9f86e51b9f942e3e196517f059b6ed77f27007228acb0a8aa640eab1f2c69f.exe
    .exe 101KB
  • Samples 6/bd4e2dd3ffc3977b2ca8f818c2e51c421a1f4772b4fe11a1aa8448dc50fddab2.exe
    .exe 4.3MB
  • Samples 6/bf738eeee983c909af9211968826b57eefdf3d1050de9a5c0b09e5cfba511314.exe
    .exe 49.0MB
  • Samples 6/bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7.exe
    .exe 2.5MB
  • Samples 6/c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca.exe
    .exe 7KB
  • Samples 6/c6befd3879040aeca88afd9b461177c9a3fc830f2020f2878696ddca0cea994e.exe
    .exe 4.5MB
  • Samples 6/c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31.exe
    .exe 3.2MB
  • Samples 6/c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe
    .exe 92KB
  • Samples 6/ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a.exe
    .exe 248KB
  • Samples 6/cd22c1aabcafc40bf81d42b42e625e49eff9e0f928fa961e43573e1eb45ace18.exe
    .exe 481KB
  • Samples 7/d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122.exe
    .exe 89KB
  • Samples 7/d0d97c70ea6e26b3708dc101a310f056d690bbc17306c493ccba4a6f00fad541.exe
    .exe 211KB
  • Samples 7/d3d18f34a1494d87502f0ea05c56f6194e50610bc71f53653e15c98d25e57e62.exe
    .exe 269KB
  • Samples 7/da52dc0f002d544115f1d64dbc1d7ec9569be150d59cfe0bfd3f6bb5aed54dc5.exe
    .exe 254KB
  • Samples 7/dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe
    .exe 5.3MB
  • Samples 7/dd225dc0284234d7ec035b06461bb9e15a5851fa4414d0a3c67541297bef8c64.exe
    .exe 32.7MB
  • Samples 7/dde59b015e0acd1910513cf1da07f3b17d6530816d663c102ed9ad6ab6d575a5.exe
    .exe 2.5MB
  • Samples 7/e396aa398fb1fa0f6c9db780211f758649e9a1f26bb5a2e7026b1cfec6ea9c0d.exe
    .exe 1.7MB
  • Samples 7/e5474bdcb0a87bd6c1c74d6a2fd6cff6c8ff913248b84e22c1ef5e82cb6f5cde.exe
    .exe 414KB
  • Samples 7/e63f3efc1462f054169998d9bdb7e5b2ca0cb78b393e978880458965472f76de.exe
    .exe 5.5MB
  • Samples 7/e99f3824ab81860db9ae48fac88f7530d0b5a8a450e16d85580c9cc57d064ea6.exe
    .exe 255KB
  • Samples 7/e9c49519d313aa6bb790838f020b991b862bead9aaf2a3a665004a8d284973ea.exe
    .exe 770KB
  • Samples 7/e9c61a893b569c4af984f03b39ae1e0850dff66cc9ce743156a0612021ba2cf7.exe
    .exe 632KB
  • Samples 7/ea8e29d73139cc53e5ecf03f229c27ecec1f4f54a34a3781aab5f0e59596f2ee.exe
    .exe 351KB
  • Samples 7/eba7c64e693a1092dfc9dce17576a7a638c1858dcf69d14534a2f462bce03b23.exe
    .exe 26.1MB
  • Samples 8/ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
    .exe 44KB
  • Samples 8/ebc207c310f6738099c6e4522b022b4c18fcbb3a0c385b1a8d71fc411285ca48.exe
    .exe 669KB
  • Samples 8/ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe
    .exe 389KB
  • Samples 8/efb621959cf78ebda987c42334d70311e95e3359a6c149a3a134493d988e3324.exe
    .exe 61KB
  • Samples 8/f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe
    .exe 5.5MB
  • Samples 8/f2866d013e000884415fa13490799a626792a29967bf20e7bbbf23a72c0fd7f7.exe
    .exe 744KB
  • Samples 8/f6aedcfebf23aa3dae3c39862ad14c350479335c30e45f231e2108e4b5395488.exe
    .exe 255KB
  • Samples 8/f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938d.exe
    .exe 167KB
  • Samples 8/fc490a08797ff3a4ad9b791fcecc88f90e1140759220023e97489a08ff5e0cbf.exe
    .exe 486KB
  • Samples 8/fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a.exe
    .exe 900KB
  • Samples 8/fe622c4801737dede008dfecf2bcf48316f0adebbc080d27a2664ee8b606415c.exe
    .exe 394KB

231107-bz5yxsbb62_pw_infected.zip

  • SHA256 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8
  • MD5 SHA1 SHA512 SSDEEP
Password
infected