Overview

overview

10

Static

static

1

XYZDropper.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XYZDropper.ps1

  • Size

    930B

  • Sample

    240421-vs2sgafg97

  • MD5

    569f22824ac7ddb4c88a03415e3febce

  • SHA1

    472f449c629f2da5b73a3d04a330937918f72dbf

  • SHA256

    7e1cdeb6b7b6911d9d50b2a2a83bbdeb353c193743025a4ac6f91bf66a943361

  • SHA512

    52e27e78bc5b79bf4050aed82ee5635388ab5d2b3d6b8024b470b934c6ed28dc229cc56f1adbd7a9db3f93851fa311118805edbe218fed05f3012511a4c6e024

Score
10/10
privateloaderriseprovidar1702loaderpersistencestealer

Malware Config

Extracted

Family

vidar

Version

56

Botnet

1702

C2

https://t.me/asifrazatg

https://steamcommunity.com/profiles/76561199439929669

http://116.202.6.206:80
Attributes
  • profile_id

    1702

Targets

    • Target

      XYZDropper.ps1

    • Size

      930B

    • MD5

      569f22824ac7ddb4c88a03415e3febce

    • SHA1

      472f449c629f2da5b73a3d04a330937918f72dbf

    • SHA256

      7e1cdeb6b7b6911d9d50b2a2a83bbdeb353c193743025a4ac6f91bf66a943361

    • SHA512

      52e27e78bc5b79bf4050aed82ee5635388ab5d2b3d6b8024b470b934c6ed28dc229cc56f1adbd7a9db3f93851fa311118805edbe218fed05f3012511a4c6e024

    Score
    10/10
    privateloaderriseprovidar1702loaderpersistencestealer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Blocklisted process makes network request

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks