Overview

overview

10

Static

static

3

Media-Play...89.exe

windows7-x64

3

Media-Play...89.exe

windows10-2004-x64

5

Empire of dicks.exe

windows7-x64

1

Empire of dicks.exe

windows10-2004-x64

1

02903faf44...7b.exe

windows7-x64

10

02903faf44...7b.exe

windows10-2004-x64

10

073731fa5a...56.exe

windows7-x64

10

073731fa5a...56.exe

windows10-2004-x64

10

172c26f891...27.exe

windows7-x64

1

172c26f891...27.exe

windows10-2004-x64

10

1b59b0fa61...12.ps1

windows7-x64

1

1b59b0fa61...12.ps1

windows10-2004-x64

1

1d801e2756...cf.exe

windows7-x64

7

1d801e2756...cf.exe

windows10-2004-x64

7

Resubmissions

20-03-2024 23:00

240320-2y4btadd85 10

15-03-2024 20:34

240315-zcmqtscf84 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Malware-Database-main (1).zip

  • Size

    96.5MB

  • Sample

    240320-2y4btadd85

  • MD5

    51305dd56975d19b89383f89cd0c345d

  • SHA1

    c5f19481cefa5f79e04a289e451bdc20f3dc164c

  • SHA256

    cd76a354a02015517a2b50d75aa3b68dd0e3164adbb040f6317251016bc62b21

  • SHA512

    cfd62d333665ca237668504a219a0b1a137ed1ddca18299feb371b53afcc0d681259865e0b643edb6f031b8cb9f036b41d82e60ec8359eb7e48a1887a4137b52

  • SSDEEP

    1572864:EUUx1ZUzfiNuLKno6PwohFZPKbtr3aLS6I2Mzv7c6uNhGQvbz6Km7xWf5l:EU+1KzQu+wsvP2t8JFwjc6ERPgW/

Score
10/10
raccoonredlinevidar408f26f614d4c0bc2bcd6601785661fb5cfinfostealerpyinstallerstealer

Malware Config

Extracted

Family

raccoon

Botnet

f26f614d4c0bc2bcd6601785661fb5cf

C2

http://83.217.11.34

http://83.217.11.35
Attributes
  • user_agent

    901785252112

xor.plain

Extracted

Family

vidar

Version

2.5

Botnet

408

C2

https://t.me/noktasina

https://steamcommunity.com/profiles/76561199478503353

http://95.217.152.87:80
Attributes
  • profile_id

    408

  • user_agent

    Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36

Extracted

Family

redline

C2

168.119.228.126:11552

Attributes
  • auth_value

    ee2d0ef2a4d0cbee5b6303070e44cb8a

Targets

    • Target

      Media-Player_160889.exe

    • Size

      9.2MB

    • MD5

      57ae7f3dcb2bbdf3702aa2145a15a84a

    • SHA1

      2467a184982fee815f369ce35d7a9a49b41f1739

    • SHA256

      fd50f25603c80e0b8a147e6a1abe099cd04b3c11b5ef8b32b232a466ec1d1815

    • SHA512

      9cb19919a22bd00507cecd2ec2d26608ea5bc6b3ad498d08a3074fefe53c3aae4a508275dfe0b45fe77598c6279939653bd615cfe922b06127785b69f2fa29a6

    • SSDEEP

      196608:vIQYIVpSDC2cZpQKehATj+d4XLqezaQwfwsFCflWpw5qJeQJ/UQfWY62LHb0vrpt:vrYIVpSDC2CpQKemTj+dhCDgJsv6tWKW

    Score
    5/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      Empire of dicks.exe

    • Size

      12.6MB

    • MD5

      2cacf6978bf86759896f7cf92802e355

    • SHA1

      fb14acec191284c52323f23c3ad69dfd3c6a7836

    • SHA256

      657aa8705f6fe122e55048380304f8d593504f42556abf1f08aa4ab8be90c0f1

    • SHA512

      bb13a31382a16edbcac91b7c7df4c191e66ecb7d086f59160661bc598ebd4cf39cd8716af5ece95ab5511adf74fe817a5bf78826ba0020c2973f616f43c6acc8

    • SSDEEP

      393216:oLJ/lV0TkP3jQPjn+rKUEF5lxx2Xtj4SwVBplc:eliTejQL+YFAtj4SwVBplc

    Score
    1/10
    behavioral3behavioral4

    • Target

      02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b.exe

    • Size

      455KB

    • MD5

      ca4016d215c65d3c44fffa0c5ff31cbc

    • SHA1

      38df050b14a8566e4a57706e91884fa7826779e7

    • SHA256

      02903faf446ed43d79a8509e7743b41eab9605cfb48261bb2105176c3d4a877b

    • SHA512

      cf16707bc4f35f1ebe33691c20f116181f4714ed6417ead9b88f656e4fa1e848dc042e02a6b4a5c280b8bba516b3253a5cfd4a557c62ab14ec5d47b107f1ad52

    • SSDEEP

      12288:/GUT7l7g57eLmTgcH0GIsbU7i9f/jyarsT:/GUT7l7wamQGk7i9f/3rw

    Score
    10/10
    vidar408stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

    • Target

      073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe

    • Size

      2.9MB

    • MD5

      41b2380b454cfa680b4d2b30440e8109

    • SHA1

      f767fbbf9ddeb69c69d0cde4927957647e8a019d

    • SHA256

      073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456

    • SHA512

      a2600fd86158ef8481c18acf1a74c961058b4fbf1e9461294eb39475e634fbbcdea1f60b28cbc8669cd7be17f6406743834b137f44169c3a455f7551d7164421

    • SSDEEP

      12288:opUCj2KN8HnbttOCHfVNWDO2wF6edg0ASy0EPmLUd0btZcodN2BOjDyhC:opUCjobH9kDPww0QSyk0FhC

    Score
    10/10
    redlineinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of SetThreadContext

    behavioral7behavioral8

    • Target

      172c26f8914c92702cdbe134bf65280a1381a91e869f7eac0e62f7527.exe

    • Size

      6.9MB

    • MD5

      c4e5fdf9d792f2ee3a27da184ff29a90

    • SHA1

      e2f3d78e9f24054fcf159dc39d3aa2d3d081c93a

    • SHA256

      42acb43172c26f8914c92702cdbe134bf65280a1381a91e869f7eac0e62f7527

    • SHA512

      a5a20115f90102ae36f8b4fea9dbad3be2139039ccd579f72d26213b9d3f2bc456d0ceca5dd5944d47ddee994f00276897e35ef24d64e92feb0d78f05600c635

    • SSDEEP

      196608:QD6v71WKiyOU3vWmgz/xEYx6F3isjr4kMn:QGz195eF/6YgFSO4z

    Score
    10/10
    raccoonf26f614d4c0bc2bcd6601785661fb5cfstealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    behavioral10behavioral9

    • Target

      1b59b0fa612e7c3d9ce272143058be6815b4ec563dfd7e1782657fe7c2f23812.exe

    • Size

      970B

    • MD5

      d75fdffecc376b239ab9223d7bbf5be0

    • SHA1

      6141788629fc4edf6cbb0b8a89f41422df7dbaa3

    • SHA256

      1b59b0fa612e7c3d9ce272143058be6815b4ec563dfd7e1782657fe7c2f23812

    • SHA512

      03b1f81aa76227ad1a1a83ba8cad02dd2a7ddd941cda3bf01e74238fbc66e7c5216d12856f74c5b66df76458ceb10256b51d760e195274364d9baf971761d666

    Score
    1/10
    behavioral11behavioral12

    • Target

      1d801e2756c864d01cd456f68752a86c52981576839625759ae9e400f0d2a2cf.exe

    • Size

      24.4MB

    • MD5

      fdd59dfdd103f79e4b2916e5f1e0f885

    • SHA1

      1a49240419811b8164236a0e2944b2f0cbb29936

    • SHA256

      1d801e2756c864d01cd456f68752a86c52981576839625759ae9e400f0d2a2cf

    • SHA512

      e28c8629420d9b51463c4ae68d75551f0998b8019447748a2e63619ac4bffe373a7307d140555f241abdae37809683284655ba7a79dee596fc8b474a2d77a058

    • SSDEEP

      393216:32vf9QDD898p1TxNneyhOSBvF1LDddxXE3pQw6sVUDg6s9gUSkhVMhwS9Q1:Gvfz6h3hhOOF1l7ebSDgJ9+kC9Q1

    Score
    7/10

    • Loads dropped DLL

    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks