nullmixer

General

Target

9aab74021fae67b0ec355bbc9138b1c4
Size

4.6MB
Sample

240214-d9yzgaga4x
MD5

9aab74021fae67b0ec355bbc9138b1c4
SHA1

29ef8b5405f75c09e495e0937e3d9d8b8dbdf4ae
SHA256

befd232ab8dab62c010a0a96e0e62a1ff561509877fd8acfa1507df11e092aec
SHA512

d46b1edb1903b094db95136fbe7f078615450c3d9c5f376430d4abe8f3c76172d3af2782728b3089ac933392cd326da319da4b64ffd7532873896e45e7b4cd2b
SSDEEP

98304:yfKP0VfhaPhaEFHHiRCp4cCH6iUdIbLnTrgAQzuGIOqiC1c2MeS:yfm0Vf8PhaEFniRCp06i+qgksBC1c2xS

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

Build1

C2

45.142.213.135:30058

Targets

- Target
  
  9aab74021fae67b0ec355bbc9138b1c4
- Size
  
  4.6MB
- MD5
  
  9aab74021fae67b0ec355bbc9138b1c4
- SHA1
  
  29ef8b5405f75c09e495e0937e3d9d8b8dbdf4ae
- SHA256
  
  befd232ab8dab62c010a0a96e0e62a1ff561509877fd8acfa1507df11e092aec
- SHA512
  
  d46b1edb1903b094db95136fbe7f078615450c3d9c5f376430d4abe8f3c76172d3af2782728b3089ac933392cd326da319da4b64ffd7532873896e45e7b4cd2b
- SSDEEP
  
  98304:yfKP0VfhaPhaEFHHiRCp4cCH6iUdIbLnTrgAQzuGIOqiC1c2MeS:yfm0Vf8PhaEFniRCp06i+qgksBC1c2xS
Score

10^/10

nullmixer privateloader redline risepro sectoprat smokeloader socelars vidar xmrig 706 build1 pub5 aspackv2 backdoor discovery dropper infostealer loader miner persistence rat spyware stealer trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Vidar Stealer
  stealer
- XMRig Miner payload
  miner
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  4.6MB
- MD5
  
  0182d7dcdb4e1d8c87ef13ccca528b16
- SHA1
  
  f0f3d321a0829992d81bba5460abad5c555439cd
- SHA256
  
  1f4d8c3b8625c3506e6907a4e50e2f43cd851cbde208af218e50a9994b35388b
- SHA512
  
  f21c3d8792e805ef3aceaf294385c383e0db4964d36a51654f82b97a448349631a1b829e9602ca78e60caa89311d85a7b569636766521c9f2de167e28860beb9
- SSDEEP
  
  98304:x4CvLUBsg2sNW92XS1SgEjpAqU5m7WNHCBqW0N010hh8O7ayZsJc:xlLUCg1U8S1SLjpB6Fmd0kqh8oR
Score

10^/10

nullmixer privateloader redline risepro sectoprat smokeloader socelars vidar xmrig 706 build1 pub5 aspackv2 backdoor discovery dropper infostealer loader miner persistence rat spyware stealer trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Vidar Stealer
  stealer
- XMRig Miner payload
  miner
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral3 behavioral4