Overview

overview

10

Static

static

3

ea7d5de798...18.exe

windows7-x64

10

ea7d5de798...18.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Resubmissions

10-04-2024 04:40

240410-fa2mesgd4v 10

09-04-2024 17:09

240409-vpkd1sdb73 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea7d5de7982f0a08bff6d8e6f17cf664_JaffaCakes118

  • Size

    4.0MB

  • Sample

    240409-vpkd1sdb73

  • MD5

    ea7d5de7982f0a08bff6d8e6f17cf664

  • SHA1

    68c86999e908f4c8e362c2591fd4c8e5907e6410

  • SHA256

    ba15a8b7d1ecc6348ee4806b0903afdf5917a595a909ce529e85cacd197c6e77

  • SHA512

    71a6684cb0d6007261eb81ef4936d2233971d501983b4e70a55143458a8581f615bd83208edc09c75ee9552318506ccfe44a7842d26bbcc31334c103a61face6

  • SSDEEP

    98304:y1jCOwXLeMP+g2GQ0Y/zDQoKMN3lk60fi+Lw6A:y1jCOwqQ+RGGPVBNOhLw6A

Score
10/10
cryptbotnullmixerprivateloaderredlinesectopratsmokeloadervidar706pab3pub6aspackv2backdoordiscoverydropperinfostealerloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.171/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.185

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

pab3

C2

185.215.113.15:61506

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

cryptbot

C2

knurxh28.top

moraku02.top
Attributes
  • payload_url

    http://sargym03.top/download.php?file=lv.exe

Targets

    • Target

      ea7d5de7982f0a08bff6d8e6f17cf664_JaffaCakes118

    • Size

      4.0MB

    • MD5

      ea7d5de7982f0a08bff6d8e6f17cf664

    • SHA1

      68c86999e908f4c8e362c2591fd4c8e5907e6410

    • SHA256

      ba15a8b7d1ecc6348ee4806b0903afdf5917a595a909ce529e85cacd197c6e77

    • SHA512

      71a6684cb0d6007261eb81ef4936d2233971d501983b4e70a55143458a8581f615bd83208edc09c75ee9552318506ccfe44a7842d26bbcc31334c103a61face6

    • SSDEEP

      98304:y1jCOwXLeMP+g2GQ0Y/zDQoKMN3lk60fi+Lw6A:y1jCOwqQ+RGGPVBNOhLw6A

    Score
    10/10
    nullmixerprivateloadersmokeloaderpub6aspackv2backdoordropperloaderpersistencetrojanredlinesectopratvidar706pab3infostealerratstealer

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

      droppernullmixer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

    • Target

      setup_installer.exe

    • Size

      3.9MB

    • MD5

      7ae4349cc7e8c98084c05e2085b56645

    • SHA1

      db7a339d5731471435450be094ba711ca7194685

    • SHA256

      b89fdf606986324fa9260f434dc1561d716985d0886fba180b88f3afb9dec729

    • SHA512

      5196ac4aa9ca69c342fa5a391f011881db608600cbfbfb4ae1391477ec59aa83846c955ed73573a09828b7b574a5a0b07e19871245ac19518c03480b9fc8ec3d

    • SSDEEP

      98304:xaCvLUBsgxkKH8DBAPbT7J7go2i2JjQCQ+gHhjPrLi:x7LUCgSKH84zGo2i2Jc1BHi

    Score
    10/10
    cryptbotnullmixerprivateloaderredlinesectopratsmokeloadervidar706pab3pub6aspackv2backdoordiscoverydropperinfostealerloaderpersistenceratspywarestealertrojan

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

      droppernullmixer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

4
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

2
T1553.004

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

9
T1012

System Information Discovery

8
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

2
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

2
T1102

Impact

Resource Development

Reconnaissance

Tasks