Overview

overview

10

Static

static

3

Trojan;MSI...TB.zip

windows11-21h2-x64

10

Resubmissions

01-06-2024 16:32

240601-t16kysgf8s 3

01-06-2024 15:53

240601-tb2wgaga8t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan;MSIL.FormBook.AFO!MTB.zip

  • Size

    196KB

  • Sample

    240601-tb2wgaga8t

  • MD5

    7b62401dd82be69f3f95f7883fc7e0d9

  • SHA1

    6adab9ef01fec2977a9c6cb3f6ff60b01fed124f

  • SHA256

    69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31

  • SHA512

    faf526a594d2dec297072f66cb5db65b32f2313ffa5f2e25f66a85e40f51b1effcf1f40e02b2e62382275414c6acd3212b30d78855c3ce70f4bd54949840df15

  • SSDEEP

    6144:jHgkWXiqhrYVZCmZLZ5r8n2ys/xdbFqm2WJ:yX1hUbLZJ88PbMm2M

Score
10/10
amadeyasyncratexelastealerprivateloaderredlinetargetcompany149e482@logscloudyt_botfreshbootkitcollectiondiscoveryevasionexecutionexploitinfostealerloaderpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://94.103.188.126/jerry/putty.zip

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://49.13.194.118/ADServices.exe

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Fresh

C2

pepecasas123.net:4608

Mutex

AsyncMutex_5952

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note
Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 7ADB389D383932FC0813DAC3 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �
URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Targets

    • Target

      Trojan;MSIL.FormBook.AFO!MTB.zip

    • Size

      196KB

    • MD5

      7b62401dd82be69f3f95f7883fc7e0d9

    • SHA1

      6adab9ef01fec2977a9c6cb3f6ff60b01fed124f

    • SHA256

      69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31

    • SHA512

      faf526a594d2dec297072f66cb5db65b32f2313ffa5f2e25f66a85e40f51b1effcf1f40e02b2e62382275414c6acd3212b30d78855c3ce70f4bd54949840df15

    • SSDEEP

      6144:jHgkWXiqhrYVZCmZLZ5r8n2ys/xdbFqm2WJ:yX1hUbLZJ88PbMm2M

    Score
    10/10
    amadeyasyncratexelastealerprivateloaderredlinetargetcompany149e482@logscloudyt_botfreshbootkitcollectiondiscoveryevasionexecutionexploitinfostealerloaderpersistenceransomwareratspywarestealertrojanupx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies firewall policy service

      evasion

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • TargetCompany,Mallox

      TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

      ransomwaretargetcompany

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (7042) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasionexecution

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

6
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

4
T1562.001

Modify Registry

8
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

4
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

9
T1012

Remote System Discovery

1
T1018

System Information Discovery

9
T1082

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

5
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Service Stop

1
T1489

Tasks