Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Resubmissions

05-02-2024 07:15

240205-h3a2aaach4 10

05-02-2024 04:51

240205-fgzfmsdacl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee

  • Size

    231KB

  • Sample

    240205-fgzfmsdacl

  • MD5

    ff1a6e6863428c2888d990c1afeb477e

  • SHA1

    f15b4c057f1f323c3c9d876f36aa61b315b1dc5a

  • SHA256

    4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee

  • SHA512

    e37b9c8fb7b2d02f241d32b12d2863019af1d701ee10dbe11625379d8d240228dd8b60ad57ea5c5895d5e6c802079e4b2460812c2923085f454b00a3a2bc0394

  • SSDEEP

    3072:rGTH9LSPLkeRLOfoeido3uaXY5n12cEb3X3RW91V35sUnX7q8564e3jGLxYx6TVj:M9LqRL4o2/cDErHwN35rMR3jGFY2

Score
10/10
amadeydjvuredlinesmokeloadervidarzgrat1b9d7ec5a25ab9d78c31777a0016a097@logscloudyt_bot@oleh_ps@oni912@pixelscloudpub1backdoordiscoveryevasioninfostealerpersistenceransomwareratstealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

C2

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110
Attributes
  • profile_id_v2

    1b9d7ec5a25ab9d78c31777a0016a097

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

@logscloudyt_bot

C2

185.172.128.33:8924

Extracted

Family

redline

Botnet

@oni912

C2

45.15.156.209:40481

Extracted

Family

redline

Botnet

@oleh_ps

C2

185.172.128.33:8924

Extracted

Family

redline

Botnet

@PixelsCloud

C2

94.156.67.230:13781

Targets

    • Target

      4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee

    • Size

      231KB

    • MD5

      ff1a6e6863428c2888d990c1afeb477e

    • SHA1

      f15b4c057f1f323c3c9d876f36aa61b315b1dc5a

    • SHA256

      4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee

    • SHA512

      e37b9c8fb7b2d02f241d32b12d2863019af1d701ee10dbe11625379d8d240228dd8b60ad57ea5c5895d5e6c802079e4b2460812c2923085f454b00a3a2bc0394

    • SSDEEP

      3072:rGTH9LSPLkeRLOfoeido3uaXY5n12cEb3X3RW91V35sUnX7q8564e3jGLxYx6TVj:M9LqRL4o2/cDErHwN35rMR3jGFY2

    Score
    10/10
    amadeydjvusmokeloadervidarzgrat1b9d7ec5a25ab9d78c31777a0016a097pub1backdoordiscoverypersistenceransomwareratstealertrojanredline@logscloudyt_bot@oleh_ps@oni912@pixelscloudevasioninfostealer

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Vidar Stealer

      stealer

    • Detect ZGRat V1

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks