General
-
Target
1.zip
-
Size
14.6MB
-
Sample
240618-25l14sshnp
-
MD5
fb4fd12a45bf9ca32c69abadf7e3a45c
-
SHA1
f8944c795a7e80df7d6fa6a3c05e0a5bf73e3453
-
SHA256
55ced8dbb6f6bfd32b67b6fff510d3e52f09c5b73f10ff68da4d72fc8705f0f0
-
SHA512
58ab45b47c4368b67a52d4143a2d88f3fe2f4dbabc9e6a0198fc475a6f15f559661642392c812ccc881e80f8eea57625c690c15a286b69050edc09fae63656b3
-
SSDEEP
393216:NgR4q5mYg9UMs57EL4cAagQN+vzh8r/wUBHYGpspdu9XEWQ:qR4ewQ5gLfAHQNe2/NHzsz
Malware Config
Extracted
formbook
4.0
w9z
crazzysex.com
hanferd.com
gteesrd.com
bayfrontbabyplace.com
jicuiquan.net
relationshiplink.net
ohchacyberphoto.com
kauegimenes.com
powerful-seldom.com
ketotoken.com
make-money-online-success.com
redgoldcollection.com
hannan-football.com
hamptondc.com
vllii.com
aa8520.com
platform35markethall.com
larozeimmo.com
oligopoly.net
llhak.info
Extracted
danabot
92.204.160.54
2.56.213.179
45.153.186.47
93.115.21.29
185.45.193.50
193.34.166.247
Extracted
formbook
4.1
i0qi
mytakeawaybox.com
goutaihuo.com
kuzey.site
uppertenpiercings.amsterdam
honeygrandpa.com
jenniferabramslaw.com
ncarian.com
heavilymeditatedhouston.com
gsbjyzx.com
akisanblog.com
taoyuanreed.com
jasperrvservices.com
yabbanet.com
myhealthfuldiet.com
flipdigitalcoins.com
toes.photos
shoottillyoumiss.com
maserental.com
smarteacher.net
hamdimagdeco.com
Targets
-
-
Target
1.zip
-
Size
14.6MB
-
MD5
fb4fd12a45bf9ca32c69abadf7e3a45c
-
SHA1
f8944c795a7e80df7d6fa6a3c05e0a5bf73e3453
-
SHA256
55ced8dbb6f6bfd32b67b6fff510d3e52f09c5b73f10ff68da4d72fc8705f0f0
-
SHA512
58ab45b47c4368b67a52d4143a2d88f3fe2f4dbabc9e6a0198fc475a6f15f559661642392c812ccc881e80f8eea57625c690c15a286b69050edc09fae63656b3
-
SSDEEP
393216:NgR4q5mYg9UMs57EL4cAagQN+vzh8r/wUBHYGpspdu9XEWQ:qR4ewQ5gLfAHQNe2/NHzsz
Score6/10-
Legitimate hosting services abused for malware hosting/C2
-
-
-
Target
1.exe
-
Size
12.5MB
-
MD5
af8e86c5d4198549f6375df9378f983c
-
SHA1
7ab5ed449b891bd4899fba62d027a2cc26a05e6f
-
SHA256
7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
-
SHA512
137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1
-
SSDEEP
393216:oKzkshyIMtAcwzhQ/CceAocPwz3fwnjWKlDc8F6tB:BzkmSmzS/Be/cPquj7D36r
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V1 payload
-
AgentTesla payload
-
CryptOne packer
Detects CryptOne packer defined in NCC blogpost.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Formbook payload
-
Looks for VirtualBox Guest Additions in registry
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Windows Management Instrumentation
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
2File Deletion
2Virtualization/Sandbox Evasion
2Modify Registry
2Direct Volume Access
1Subvert Trust Controls
1Install Root Certificate
1