Overview

overview

10

Static

static

1

XYZDropper.ps1

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XYZDropper.ps1
  • Size 930B
  • Sample240421-vs2sgafg97
  • SHA256 7e1cdeb6b7b6911d9d50b2a2a83bbdeb353c193743025a4ac6f91bf66a943361
  • MD5 SHA1 SHA512
Score
10/10
privateloaderriseprovidar1702loaderpersistencestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 56

Botnet

  • 1702

C2

  • https://t.me/asifrazatg

  • https://steamcommunity.com/profiles/76561199439929669

  • http://116.202.6.206:80

Attributes
  • profile_id

    1702

Targets

    • Target
      XYZDropper.ps1
    • Size 930B
    • SHA256 7e1cdeb6b7b6911d9d50b2a2a83bbdeb353c193743025a4ac6f91bf66a943361
    • MD5 SHA1 SHA512
    Score
    10/10
    privateloaderriseprovidar1702loaderpersistencestealer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Blocklisted process makes network request

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks