General
-
Target
240328-2npexaaf8x_pw_infected.zip
-
Size
1.8MB
-
Sample
240328-2w7lfsbf73
-
MD5
0cba41fc9aa4b75d30768d777d86de9f
-
SHA1
28ee994eb6b8df924a07e3714f67f17815392608
-
SHA256
c979181926592d0356b6d1cce88d6666b8636793b344aafe0f766cec719b3eb8
-
SHA512
983e88849ce430cdf661c8cf3aa54202fda9b06c04d11aec7816dde9f6dd1b86c6d375c22ec8a920f5b882382237e06c99208b1e2d8dd9c04f6287b95107b293
-
SSDEEP
49152:HLbRDjb8nntIF/CjDtUvy4l4MbMswyZQPp3/gqV:HfRDvYnWhCjRWy4UsBZ23/g8
Static task
static1
Behavioral task
behavioral1
Sample
c643ac1729b33660a218af7260f0a8b3230c1ef8795d21528479396dfd491ccb.exe
Resource
win11-20240221-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
koal@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
fwdlfdkmls19@wxmail.xyz - Password:
Ofqc7VGWIey.0
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
sandradavis@epix.net - Password:
Davis99
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
av2018@netzero.net - Password:
febnoid07
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
rc0004@netzero.net - Password:
1997harley
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
fcdmcb5@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
timjune1@epix.net - Password:
Password92!
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
wpxh@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
getisaha@epix.net - Password:
Samhan1
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
hvictoryman@epix.net - Password:
Baxter11
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
venablehome@netzero.net - Password:
ajvawv02
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
spokelse@frontier.com - Password:
alm1990
Extracted
Protocol: smtp- Host:
smtp.foxvalley.net - Port:
587 - Username:
pcdanehl@foxvalley.net - Password:
coonN3R55
Extracted
Protocol: smtp- Host:
smtp.coqui.net - Port:
587 - Username:
zcolon@coqui.net - Password:
jO0127sE
Extracted
Protocol: smtp- Host:
teamrgm.com - Port:
587 - Username:
rickandnida@teamrgm.com - Password:
Salt2012!
Extracted
Protocol: smtp- Host:
smtp.totalise.co.uk - Port:
587 - Username:
unidec@totalise.co.uk - Password:
na210597a
Extracted
Protocol: smtp- Host:
smtp.frontiernet.net - Port:
587 - Username:
diken@frontiernet.net - Password:
levinson
Extracted
Protocol: smtp- Host:
smtp.coqui.net - Port:
587 - Username:
zcolon@coqui.net - Password:
Jo0127sE
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
4cqcsz@wxmail.xyz - Password:
BxAn8llh1Wb.9
Extracted
Protocol: smtp- Host:
mail.aboskandar.xyz - Port:
587 - Username:
9gulittv29np@aboskandar.xyz - Password:
MxmJ2HbhCU0OBuqb.4
Extracted
Protocol: smtp- Host:
smtp.tapamarsa.com.ar - Port:
587 - Username:
produccion@tapamarsa.com.ar - Password:
Camusso250%
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
pam_taylor@frontier.com - Password:
ssn614
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
greenbean721@netzero.net - Password:
aiden123
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
gzyhuq@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
sawyer@epix.net - Password:
Dakota10
Extracted
Protocol: smtp- Host:
smtp.bignet.com.br - Port:
587 - Username:
renatosouza@bignet.com.br - Password:
828436
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
m7gl@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
smtp.coqui.net - Port:
587 - Username:
rrsummit@coqui.net - Password:
Lucyrafy1944
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
kennydj38@netzero.net - Password:
Rocket27107
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
jtknull@netzero.net - Password:
JustinTK07
Extracted
Protocol: smtp- Host:
smtp.coqui.net - Port:
587 - Username:
robcasa@coqui.net - Password:
7047rcg
Extracted
Protocol: smtp- Host:
smtp.microlins.com.br - Port:
587 - Username:
com.itaitinga@microlins.com.br - Password:
07194494000131
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
tripit2@netzero.net - Password:
Redshoe3
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
ndv74hf@wxmail.xyz - Password:
WichxShop.xyz@5555
Extracted
Protocol: smtp- Host:
smtp.tapamarsa.com.ar - Port:
587 - Username:
zcolon@coqui.net - Password:
Jo0127sE
Extracted
Protocol: smtp- Host:
grass.or.kr - Port:
587 - Username:
master@grass.or.kr - Password:
k1783718
Extracted
Protocol: smtp- Host:
smtp.epix.net - Port:
587 - Username:
warren59@epix.net - Password:
Local59
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
sheaps@netzero.net - Password:
Tanner1
Extracted
Protocol: smtp- Host:
mail.wxmail.xyz - Port:
587 - Username:
vzdhlsddakbo@wxmail.xyz - Password:
WzUojSyIa4S.7
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
jtknull@netzero.net - Password:
jUsTiNtK07
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Targets
-
-
Target
c643ac1729b33660a218af7260f0a8b3230c1ef8795d21528479396dfd491ccb
-
Size
1.9MB
-
MD5
89450faa279114b445948f37ae2fc674
-
SHA1
8730905024fa2787cbb858b0e9db33bdd22393e3
-
SHA256
c643ac1729b33660a218af7260f0a8b3230c1ef8795d21528479396dfd491ccb
-
SHA512
ddc4a1925c8822f81f894c775a0c180d5715a79f7c39cb82cf1f83d2353bc4da7a77d39ea4a4f2abcbeac4eba33e62234d22f41c5a9c45883e37af65a40719ab
-
SSDEEP
49152:PAusQnXROzdymOTSMi7y6c7W3obn6cu2kFlEJpR:PA4kstSMiBk/uDAJp
-
Detect ZGRat V1
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Creates new service(s)
-
Downloads MZ/PE file
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1