Overview

overview

10

Static

static

3

575f6a65c2...7f.exe

windows7-x64

10

575f6a65c2...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    575f6a65c28682f88fa808ba8e862d7f

  • Size

    1.5MB

  • Sample

    240112-yql6saeeer

  • MD5

    575f6a65c28682f88fa808ba8e862d7f

  • SHA1

    225b7a4d0d657a93b9074d7df6aa6b1b7c3e225e

  • SHA256

    5e08ef6445c40ba0c1216c04291b0d9ef48f0983a9aebd25f214e6fc988daa53

  • SHA512

    206d5daaf2efae41659632909e9c140399588b2c6b94be5abee46843eb62bbeff4b72df15d6cb173c4e25535c22e824263bad900401d07e46fa49263fdaa1701

  • SSDEEP

    24576:F13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORRY+X1S:F15KzmD+T1toC+ixrw3o1+h5LoY+X1S

Score
10/10
azorultoskiraccoonc81fb6015c832710f869f6911e1aec18747e0184infostealerspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

kullasa.ac.ug

Targets

    • Target

      575f6a65c28682f88fa808ba8e862d7f

    • Size

      1.5MB

    • MD5

      575f6a65c28682f88fa808ba8e862d7f

    • SHA1

      225b7a4d0d657a93b9074d7df6aa6b1b7c3e225e

    • SHA256

      5e08ef6445c40ba0c1216c04291b0d9ef48f0983a9aebd25f214e6fc988daa53

    • SHA512

      206d5daaf2efae41659632909e9c140399588b2c6b94be5abee46843eb62bbeff4b72df15d6cb173c4e25535c22e824263bad900401d07e46fa49263fdaa1701

    • SSDEEP

      24576:F13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORRY+X1S:F15KzmD+T1toC+ixrw3o1+h5LoY+X1S

    Score
    10/10
    azorultoskiraccoonc81fb6015c832710f869f6911e1aec18747e0184infostealerspywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks