General

  • Target

    60248010e3daa79d3138d909dbdd2883aad7b740ff7d9ec11d1c7950b24e7867

  • Size

    1.5MB

  • Sample

    240516-28cxlsdf31

  • MD5

    f000b0c2d69a5f8153f0107ca048d1f3

  • SHA1

    7de3ed7ee8220b700b469795f46e424123bab34e

  • SHA256

    60248010e3daa79d3138d909dbdd2883aad7b740ff7d9ec11d1c7950b24e7867

  • SHA512

    8f1a39b2d3184bba32328c89cf201a508e526008bdeea58790725e3628cd927882e89ac748fd43d74e992e29deedaedfc453c6eb7d955434a4f62c847c8d00f1

  • SSDEEP

    24576:fTNKaj21KnVcBL3O79FtvI5zPz1+UxYvilDi4fv5Xk8SY/zlpmoZtS3kJRh:L1YSvpkfMviNLfv5Xk8D/zlFZtTh

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Targets

    • Target

      60248010e3daa79d3138d909dbdd2883aad7b740ff7d9ec11d1c7950b24e7867

    • Size

      1.5MB

    • MD5

      f000b0c2d69a5f8153f0107ca048d1f3

    • SHA1

      7de3ed7ee8220b700b469795f46e424123bab34e

    • SHA256

      60248010e3daa79d3138d909dbdd2883aad7b740ff7d9ec11d1c7950b24e7867

    • SHA512

      8f1a39b2d3184bba32328c89cf201a508e526008bdeea58790725e3628cd927882e89ac748fd43d74e992e29deedaedfc453c6eb7d955434a4f62c847c8d00f1

    • SSDEEP

      24576:fTNKaj21KnVcBL3O79FtvI5zPz1+UxYvilDi4fv5Xk8SY/zlpmoZtS3kJRh:L1YSvpkfMviNLfv5Xk8D/zlFZtTh

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • XMRig Miner payload

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Modifies boot configuration data using bcdedit

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks