nullmixer

General

Target

cceff411feab78a02a22744e2eae9ab8
Size

3.9MB
Sample

240316-dhv4hacc72
MD5

cceff411feab78a02a22744e2eae9ab8
SHA1

7b707ac1bfcc7bdd5439c606af91a5dc5a499493
SHA256

cfdcbcca4f75f287d6389cda895571530ddb9a2bbdf54cce52c1c65e969ac0a3
SHA512

0eb9732143fbd7816951acf72bcbf10218a58a4780958b9a57e2d6960781296f73e8f1c0f0262adbb95d855a92e136d87e3e01bea8497d9a8a3e5afa41b3115c
SSDEEP

98304:yLKnNSD/lKELv/i+b0kdcldi1culG9hOAsXl6Ctf9I0ineqI01YO:yB/Q0HFXdczrulG9hO7XBS0inH1YO

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

Build1

C2

45.142.213.135:30058

Targets

- Target
  
  cceff411feab78a02a22744e2eae9ab8
- Size
  
  3.9MB
- MD5
  
  cceff411feab78a02a22744e2eae9ab8
- SHA1
  
  7b707ac1bfcc7bdd5439c606af91a5dc5a499493
- SHA256
  
  cfdcbcca4f75f287d6389cda895571530ddb9a2bbdf54cce52c1c65e969ac0a3
- SHA512
  
  0eb9732143fbd7816951acf72bcbf10218a58a4780958b9a57e2d6960781296f73e8f1c0f0262adbb95d855a92e136d87e3e01bea8497d9a8a3e5afa41b3115c
- SSDEEP
  
  98304:yLKnNSD/lKELv/i+b0kdcldi1culG9hOAsXl6Ctf9I0ineqI01YO:yB/Q0HFXdczrulG9hO7XBS0inH1YO
Score

10^/10

nullmixer privateloader redline risepro sectoprat smokeloader vidar 706 build1 pub5 aspackv2 backdoor dropper infostealer loader persistence rat spyware stealer trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  3.9MB
- MD5
  
  3394285ab7e1ef48bc775f71ed7b0a76
- SHA1
  
  646fadf1a0a0dafe07319c86de0587ed96a0fc2b
- SHA256
  
  732b086183981289f4dff07f2054fa1356bba8d975359e2f40b6f1adae084467
- SHA512
  
  31d754a5f0f005eaf18eed0bd021e2c3698935dd51b10e7c21d4236abe875faf9945aad12e8711da9e42952ab586adf4c98f4a3d6db48e00ab53bb02b7258dc8
- SSDEEP
  
  98304:xWCvLUBsgUhDskhlxVOIRNa28BBF4VQMGXB9UpWib:xfLUCgUhDskhlDO28fTAtb
Score

10^/10

nullmixer privateloader redline risepro sectoprat smokeloader vidar 706 build1 pub5 aspackv2 backdoor dropper infostealer loader persistence rat spyware stealer trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4