Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://yaatde.com/r2...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://yaatde.com/r2.php?e=HVy1fQlxedMIqIi9uocLtH49fjI1V2RsM0JCaTZuVS80WTFzaHBiaC9XYmdIeWpkMzlqQ2lhbm91eUYzVGthOEgrN1Z5VG5lZkxXR0dQS0JDTDJ3Y0R0MTY0dHVnSlhjTkthVVQ2Q3RQZXVIRUZSRmYrSW1qbmJGTnN2WERkZG5xN0lGVE5yNjFuZXpsVXpMZ2JQVzUyell2L3RlZFlCYmpxQklkV2o4T2w1MXk2cEloSGZ4TERQdUwzUHFOcjlURmE0QW96dHY1TEF2ZHI2YVpIOVo0UnIySWhpVlFNSjBFQlE5angrZWtieDI1dGZ4VHo4bHpqVkU3UGt4Wm52QWQzUndyVDB3WkhqQnY3VHRkeFRNZ2wza3dTMmZIRGJ4L1hJcGJXYzlTU0dhUzJManExQldFWDZtQWZVVHJUOHpkLzJUWWtWeHU0TU5sVks3eFhBYzFFZUpDa2JXNmd3bEVVY05QYmRMb0tXZmRtdG1ORFBmQ3FYclNrK0VaM1RMTmk5aFVaZjlHSk1mSUJCTHNEa1A4WXpjUWUrU0lsNTEwM3NMN2x3aGxRdjNROGhkaElOMGZzVVluQlBrcFZSOFl5N0Ixci9Zam9lb3d0Nk1PNnJNRExQaTNodUhzdkxKLzh2TTRmRFB2bU9JbnFDRUpyUC9iaVdicTUvVVdma1pQUWlZMFg1TUdhSWhHNDk3TFdya1REZjNTMkxFNUJuVUJMSjd2ZHhhMGpLblhsK1BLV0hpY0VINVF5UFEzb2x6MmFsL3ozRkJ4ODVtMk5ZeGZ0SWFYZDZ1OHhHUUFDdnQzbVZhdHZYOFU1bk84SkwvSUxHWDErZS9GMlNKdTVWUEJIZjNRTmZnQzV3c3p4ZHlJZWUreUVLbnZvb1hKYjJlWUg5VS92UkEyc0RYL3lWb0tQeGlUcWgrRWVNREJpbldmODNSNnpNV3BaRG0vOVVYSW05eVRCODV4eEkwN280UWNReVBxQllRUnFEMmQ3aGl5SGVWMGNmU0RmaVozZzFpWXRPbUdIdG5Odmx0Wm9sS0VFOWFPbzJML1E4bk9JMGlZV2s1YWZtYU1PNmR1SXYvQlRTYUxMMTFwdXkzaHBhTUJqUUNWNFhYak5uQlRtSkdpTWlQejZqa1Z2cUZGTDArVlpGbXpnVUd0WXRVNk9pcjVHOVpyT29SNXNJRHRjdkNoSDUzNUJBRnE0T3NmckUwd1pxUnIxcXh2dDdNcC9mcWhFQUNST1lJbWJtYjBTdHFlMSs5ZDlmYjh4blFLM21HSGFJT2NJV3FneDNiandkWjk4UA%3D%3D

  • Sample

    240201-feqeysbef2

Score
10/10
badrabbitmimikatzransomware

Malware Config

Targets

    • Target

      http://yaatde.com/r2.php?e=HVy1fQlxedMIqIi9uocLtH49fjI1V2RsM0JCaTZuVS80WTFzaHBiaC9XYmdIeWpkMzlqQ2lhbm91eUYzVGthOEgrN1Z5VG5lZkxXR0dQS0JDTDJ3Y0R0MTY0dHVnSlhjTkthVVQ2Q3RQZXVIRUZSRmYrSW1qbmJGTnN2WERkZG5xN0lGVE5yNjFuZXpsVXpMZ2JQVzUyell2L3RlZFlCYmpxQklkV2o4T2w1MXk2cEloSGZ4TERQdUwzUHFOcjlURmE0QW96dHY1TEF2ZHI2YVpIOVo0UnIySWhpVlFNSjBFQlE5angrZWtieDI1dGZ4VHo4bHpqVkU3UGt4Wm52QWQzUndyVDB3WkhqQnY3VHRkeFRNZ2wza3dTMmZIRGJ4L1hJcGJXYzlTU0dhUzJManExQldFWDZtQWZVVHJUOHpkLzJUWWtWeHU0TU5sVks3eFhBYzFFZUpDa2JXNmd3bEVVY05QYmRMb0tXZmRtdG1ORFBmQ3FYclNrK0VaM1RMTmk5aFVaZjlHSk1mSUJCTHNEa1A4WXpjUWUrU0lsNTEwM3NMN2x3aGxRdjNROGhkaElOMGZzVVluQlBrcFZSOFl5N0Ixci9Zam9lb3d0Nk1PNnJNRExQaTNodUhzdkxKLzh2TTRmRFB2bU9JbnFDRUpyUC9iaVdicTUvVVdma1pQUWlZMFg1TUdhSWhHNDk3TFdya1REZjNTMkxFNUJuVUJMSjd2ZHhhMGpLblhsK1BLV0hpY0VINVF5UFEzb2x6MmFsL3ozRkJ4ODVtMk5ZeGZ0SWFYZDZ1OHhHUUFDdnQzbVZhdHZYOFU1bk84SkwvSUxHWDErZS9GMlNKdTVWUEJIZjNRTmZnQzV3c3p4ZHlJZWUreUVLbnZvb1hKYjJlWUg5VS92UkEyc0RYL3lWb0tQeGlUcWgrRWVNREJpbldmODNSNnpNV3BaRG0vOVVYSW05eVRCODV4eEkwN280UWNReVBxQllRUnFEMmQ3aGl5SGVWMGNmU0RmaVozZzFpWXRPbUdIdG5Odmx0Wm9sS0VFOWFPbzJML1E4bk9JMGlZV2s1YWZtYU1PNmR1SXYvQlRTYUxMMTFwdXkzaHBhTUJqUUNWNFhYak5uQlRtSkdpTWlQejZqa1Z2cUZGTDArVlpGbXpnVUd0WXRVNk9pcjVHOVpyT29SNXNJRHRjdkNoSDUzNUJBRnE0T3NmckUwd1pxUnIxcXh2dDdNcC9mcWhFQUNST1lJbWJtYjBTdHFlMSs5ZDlmYjh4blFLM21HSGFJT2NJV3FneDNiandkWjk4UA%3D%3D

    Score
    10/10
    badrabbitmimikatzransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks