Static

static

10

Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archive.zip

  • Size

    25.8MB

  • MD5

    83671dbfab2418604f11993fdc392094

  • SHA1

    5386d1fb94ec2974736a4d8895a2218855ffda69

  • SHA256

    60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

  • SHA512

    9cf982c9b2949f05ea4ab7d27b369924334cb9f8a0b85c374cf08ac059281ecf96c97088bb983f74033a1a8fba01f09c2f3f41ae3a60e7c79db8b6312edd5138

  • SSDEEP

    786432:+r/Da8WA3C5BENmtAWzdVTkvq+GY8NEXcJap4DFEME/:4/W8WAS5BENmtZ1kvq+GYi8pw+T

Score
10/10
upxstealersystemxwormrevengeratzeppelinmodiloader

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/2jTT3Lnj

Extracted

Family

revengerat

Botnet

system

C2

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Signatures

  • Detect Xworm Payload 1 IoCs
  • Detects Zeppelin payload 1 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
    modiloader
  • RevengeRat Executable 1 IoCs
    stealer
  • Revengerat family
    revengerat
  • Xworm family
    xworm
  • Zeppelin family
    zeppelin
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • Archive.zip
    .zip
  • Dropper/Berbew.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • Dropper/Phorphiex.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • RAT/31.exe
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • RAT/XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • RAT/file.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Ransomware/Client-2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Ransomware/criticalupdate01.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • Ransomware/default.exe
    .exe windows:4 windows x86 arch:x86

    8acb34bed3caa60cae3f08f75d53f727


    Headers

    Imports

    Sections

  • Stealers/Azorult.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Stealers/BlackMoon.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Stealers/Dridex.exe
    .dll windows:5 windows x64 arch:x64

    a23d507241571c69f1f380438b3a251c


    Headers

    Imports

    Exports

    Sections

  • Stealers/Masslogger/mouse_2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Stealers/lumma.exe
    .exe windows:5 windows x86 arch:x86

    19740cd4fd3dcce67b00ed2a92e30452


    Headers

    Imports

    Sections

  • Trojan/BetaBot.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Trojan/SmokeLoader.exe
    .exe windows:5 windows x86 arch:x86

    0b940f4d2992021389a241ab8513fc6b


    Headers

    Imports

    Sections