Overview

overview

10

Static

static

3

f05e4420df...f1.exe

windows7-x64

f05e4420df...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f05e4420dfc79226b34b0f7e3d1a65f1.exe

  • Size

    3.1MB

  • Sample

    240109-xmyjzahgf9

  • MD5

    f05e4420dfc79226b34b0f7e3d1a65f1

  • SHA1

    95c5fc288a628e2fba01879b0dbe0dbbd79ae74f

  • SHA256

    bd887a31360a06cf6094b3b889bf7ec9d835c9642bff6a0ed98bb248f225bf24

  • SHA512

    d427c45f260e9bd38fa5a843c4eeff5482c102ace9b3f083ce015e9ce303dd9c481b70a715764c3cec16c6dc0246ad66f251197945f52a13e4e5eab77542ce38

  • SSDEEP

    98304:qw3BM5HPz7UtPTkJY58taa7RTBQl50HeaCdRd9zojPGuH:qw3EHPzOTkJYla7RTBQl509CdRd9zojH

Score
10/10
asyncratgcleaneronlyloggerredlinesectopratdefaultliezupdinfostealerloaderrattrojan

Malware Config

Extracted

Family

redline

Botnet

UPD

C2

185.215.113.45:41009

Extracted

Family

gcleaner

C2

g-prtnrs.top

g-prtrs.top

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

whiteshadows.ddns.net:9731

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    microsoft 2.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

Botnet

Liez

C2

liezaphare.xyz:80

Targets

    • Target

      f05e4420dfc79226b34b0f7e3d1a65f1.exe

    • Size

      3.1MB

    • MD5

      f05e4420dfc79226b34b0f7e3d1a65f1

    • SHA1

      95c5fc288a628e2fba01879b0dbe0dbbd79ae74f

    • SHA256

      bd887a31360a06cf6094b3b889bf7ec9d835c9642bff6a0ed98bb248f225bf24

    • SHA512

      d427c45f260e9bd38fa5a843c4eeff5482c102ace9b3f083ce015e9ce303dd9c481b70a715764c3cec16c6dc0246ad66f251197945f52a13e4e5eab77542ce38

    • SSDEEP

      98304:qw3BM5HPz7UtPTkJY58taa7RTBQl50HeaCdRd9zojPGuH:qw3EHPzOTkJYla7RTBQl509CdRd9zojH

    Score
    10/10
    asyncratgcleaneronlyloggerredlinesectopratdefaultliezupdinfostealerloaderrattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Async RAT payload

      rat

    • OnlyLogger payload

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks