Overview

overview

10

Static

static

3

release_v4.rar

windows7-x64

3

release_v4.rar

windows10-2004-x64

7

ICQLiteShell.dll

windows7-x64

1

ICQLiteShell.dll

windows10-2004-x64

1

ICQRT.dll

windows7-x64

3

ICQRT.dll

windows10-2004-x64

3

Resource/S...di.spp

windows7-x64

3

Resource/S...di.spp

windows10-2004-x64

3

Resource/T...50.txt

windows7-x64

1

Resource/T...50.txt

windows10-2004-x64

1

Resource/T...51.txt

windows7-x64

1

Resource/T...51.txt

windows10-2004-x64

1

Resource/T...52.txt

windows7-x64

1

Resource/T...52.txt

windows10-2004-x64

1

Resource/T...53.txt

windows7-x64

1

Resource/T...53.txt

windows10-2004-x64

1

Resource/T...54.txt

windows7-x64

1

Resource/T...54.txt

windows10-2004-x64

1

Resource/T...57.txt

windows7-x64

1

Resource/T...57.txt

windows10-2004-x64

1

Resource/T...58.txt

windows7-x64

1

Resource/T...58.txt

windows10-2004-x64

1

Resource/r...es.pak

windows7-x64

3

Resource/r...es.pak

windows10-2004-x64

3

bentonite.png

windows7-x64

3

bentonite.png

windows10-2004-x64

3

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

10

Resubmissions

23/02/2024, 11:52

240223-n18gnafd9v10

23/02/2024, 09:10

240223-k5b3gaef25

23/02/2024, 08:58

240223-kxe46aea3y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    release_v4.rar
  • Size 15.0MB
  • Sample240223-n18gnafd9v
  • SHA256 f2085a595daeffe3d442f07fee0ef1a2d77cdb521fd4ff4475efd87c75da1932
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
djvugluptebalummariseprosmokeloaderstealczgratpub1pub3backdoordiscoverydropperevasionloaderpersistenceransomwareratspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

  • risepro

C2

  • 193.233.132.62

  • 193.233.132.67:50500

  • 37.120.237.196:50500

Extracted

Family

  • smokeloader

Botnet

  • pub3

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://selebration17io.io/index.php

  • http://vacantion18ffeu.cc/index.php

  • http://valarioulinity1.net/index.php

  • http://buriatiarutuhuob.net/index.php

  • http://cassiosssionunu.me/index.php

  • http://sulugilioiu19.net/index.php

  • http://goodfooggooftool.net/index.php

  • http://sjyey.com/tmp/index.php

  • http://babonwo.ru/tmp/index.php

  • http://mth.com.ua/tmp/index.php

  • http://piratia.pw/tmp/index.php

  • http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

  • stealc

C2

  • http://185.172.128.24

Attributes
  • url_path

    /f993692117a3fda2.php

Extracted

Family

  • smokeloader

Botnet

  • pub1

Extracted

Family

  • djvu

C2

  • http://habrafa.com/test2/get.php

Attributes
  • extension

    .lkfr

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0852ASdw

rsa_pubkey.plain

Extracted

Family

  • lumma

C2

  • https://turkeyunlikelyofw.shop/api

  • https://associationokeo.shop/api

Targets

    • Target
      release_v4.rar
    • Size 15.0MB
    • SHA256 f2085a595daeffe3d442f07fee0ef1a2d77cdb521fd4ff4475efd87c75da1932
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2
    • Target
      ICQLiteShell.dll
    • Size 56KB
    • SHA256 515c8e0b93f0fef15da3e2573ad92b7e7840374140e65e5d73df63d8e22cb3e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      ICQRT.dll
    • Size 32KB
    • SHA256 53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      Resource/SaslPrep/SaslPrepProfile_norm_bidi.spp
    • Size 13KB
    • SHA256 f2501579fc7ab062324b4e1a45428f69f9a37e0363a4fc1d3734157b587b92e1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1250.TXT
    • Size 9KB
    • SHA256 cf79ba755416ae5628a9dd1f870306b5a45fd6b256efed0c2ac1cc2ccb3307f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1251.TXT
    • Size 9KB
    • SHA256 f87ed4480cfddb8f5f6226292338ca407ccc7b1a543f3832f1d20aff6cb72a58
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1252.TXT
    • Size 9KB
    • SHA256 fca3ab5882f0a562794f05d7f15a39157c59d7c07fcbac79ab7cf3d12c979541
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1253.TXT
    • Size 8KB
    • SHA256 2d36bec3e1ecbf2b6de8a37c98717ae21ca8c5bc0b487556996b3fff2b6f6fd9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1254.TXT
    • Size 9KB
    • SHA256 32fa83c6f8ad346e66e544640942906e0a91cc0d2075324b7f244695de5740a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1257.TXT
    • Size 9KB
    • SHA256 7cb16a0b949f8573b06f22f091c44a1ea251cc9904591fceb2743475302c4640
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      Resource/TypeSupport/Unicode/Mappings/win/CP1258.TXT
    • Size 9KB
    • SHA256 f53d0ffb7f3c8182794331cfdd2fbcf77ff6dbdb05b415c98cc8d6fc49dce2fb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      Resource/resources.pak
    • Size 4.9MB
    • SHA256 11d0f55c105883d203137a87a610ba793299dc4774fd6d8b3a86666a2c337041
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral23behavioral24
    • Target
      bentonite.cfg
    • Size 963KB
    • SHA256 658ac17f4047ccc594edfd7c038701fe2c72ec2edf4aefe6f3c2dd28ab3dd471
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral25behavioral26
    • Target
      setup.exe
    • Size 738.0MB
    • SHA256 5daa33a756141dac301dc364c1fc538e91cb66a4878719d3a645fd108c6dfa72
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    gluptebariseprosmokeloaderstealczgratpub1pub3backdoordropperevasionloaderratspywarestealertrojanupxdjvulummadiscoverypersistenceransomwarethemida

    • Detect ZGRat V1

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops Chrome extension

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral27behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

8
T1012

System Information Discovery

7
T1082

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
3/10

behavioral2

Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

gluptebariseprosmokeloaderstealczgratpub1pub3backdoordropperevasionloaderratspywarestealertrojanupx
Score
10/10

behavioral28

djvugluptebalummariseprosmokeloaderstealczgratpub3backdoordiscoverydropperevasionloaderpersistenceransomwareratspywarestealerthemidatrojan
Score
10/10