Resubmissions

03/07/2024, 16:09

240703-tl9n3ayepb

03/07/2024, 16:04

240703-thygmaycpc10

01/07/2024, 18:12

240701-ws6xvswbkj10

01/07/2024, 18:03

240701-wm5sls1gka10

01/07/2024, 18:03

240701-wm39sa1gjf10

01/07/2024, 18:03

240701-wm2e7avhkj10

01/07/2024, 18:03

240701-wmzxcs1fre10

01/07/2024, 18:02

240701-wmzats1frc10

01/07/2024, 18:02

240701-wmvbwa1fqh10

22/11/2023, 17:02

231122-vkac9adg6410

Errors

Reason
office: invalid password

General

  • Target
    Downloads.rar
  • Size 154.7MB
  • Sample240703-tl9n3ayepb
  • SHA256 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • zloader

Botnet
  • main

Campaign
  • 26.02.2020

C2
  • https://airnaa.org/sound.php

  • https://banog.org/sound.php

  • https://rayonch.org/sound.php

Attributes
  • build_id

    19

rc4.plain

Extracted

Family
  • zloader

Botnet
  • 07/04

C2
  • https://xyajbocpggsr.site/wp-config.php

  • https://ooygvpxrb.pw/wp-config.php

Attributes
  • build_id

    131

rc4.plain

Extracted

Family
  • revengerat

Botnet
  • XDSDDD

C2
  • 84.91.119.105:333

Mutex
  • RV_MUTEX-wtZlNApdygPh

Extracted

Family
  • revengerat

Botnet
  • Victime

C2
  • cocohack.dtdns.net:84

Mutex
  • RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family
  • zloader

Botnet
  • 25/03

C2
  • https://wgyvjbse.pw/milagrecf.php

  • https://botiq.xyz/milagrecf.php

Attributes
  • build_id

    103

rc4.plain

Extracted

Family
  • revengerat

Botnet
  • samay

C2
  • shnf-47787.portmap.io:47787

Mutex
  • RV_MUTEX

Extracted

Family
  • zloader

Botnet
  • 09/04

C2
  • https://eoieowo.casa/wp-config.php

  • https://dcgljuzrb.pw/wp-config.php

Attributes
  • build_id

    140

rc4.plain

Extracted

Family
  • revengerat

Botnet
  • INSERT-COIN

C2
  • 3.tcp.ngrok.io:24041

Mutex
  • RV_MUTEX

Extracted

Family
  • revengerat

Botnet
  • system

C2
  • yj233.e1.luyouxia.net:20645

Mutex
  • RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family
  • revengerat

Botnet
  • YT

C2
  • yukselofficial.duckdns.org:5552

Mutex
  • RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family
  • njrat

Version
  • 0.7d

Botnet
  • HacKed

C2
  • srpmx.ddns.net:5552

Mutex
  • c6c84eeabbf10b049aa4efdb90558a88

Attributes
  • reg_key

    c6c84eeabbf10b049aa4efdb90558a88

  • splitter

    |'|'|

Extracted

Family
  • njrat

Version
  • 0.7d

Botnet
  • HACK

C2
  • 43.229.151.64:5552

Mutex
  • 6825da1e045502b22d4b02d4028214ab

Attributes
  • reg_key

    6825da1e045502b22d4b02d4028214ab

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Detects Zeppelin payload 1 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
  • Njrat family
  • RevengeRat Executable 6 IoCs
  • Revengerat family
  • Zeppelin family
  • Zloader family
  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 73 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

File Explorer

  • Downloads.rar
    .rar 154.7MB
  • 08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d
    .dll 144KB
  • 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
    .exe 355KB
  • 0di3x.bin.zip
    .zip 78KB
  • 0di3x.bin
    .exe 111KB
  • 1.bin/1.exe
    .exe 12.5MB
  • 201106-9sxjh7tvxj_pw_infected.zip
    .zip 162KB
  • 4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab
    .dll 524KB
  • 2019-09-02_22-41-10.exe
    .exe 251KB
  • 2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba
    .dll 183KB
  • 2c01b007729230c415420ad641ad92eb
    .exe 1.3MB
  • 31.exe
    .exe 12.5MB
  • 3DMark 11 Advanced Edition.exe
    .exe 11.6MB
  • 42f972925508a82236e8533567487761
    .exe 3.7MB
  • 42f972925508a82236e8533567487761(1)
    .exe 3.7MB
  • 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
    .exe 669KB
  • 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
    .exe 80KB
  • 6a9e7107c97762eb1196a64baeadb291
    .exe 209KB
  • 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
    .exe 21KB
  • 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
    .exe 17KB
  • 95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9
    .dll 260KB
  • Archive.zip__ccacaxs2tbz2t6ob3e.exe
    .exe 430KB
  • CVE-2018-15982_PoC.swf
    12KB
  • CVWSHSetup[1].bin/WSHSetup[1].exe
    .exe 898KB
  • DiskInternals_Uneraser_v5_keygen.exe
    .exe 12.9MB
  • E2-20201118_141759.zip
    .zip 148KB
  • f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
    .exe 248KB
  • ForceOp 2.8.7 - By RaiSence.exe
    .exe 1.0MB
  • HYDRA.exe
    .exe 2.6MB
  • #/power.exe
    .exe 507KB
  • #/sant.exe
    .exe 12KB
  • #/ufx.exe
    .exe 272KB
  • #/va.exe
    .exe 88KB
  • KLwC6vii.exe
    .exe 17KB
  • Keygen.exe
    .exe 849KB
  • Lonelyscreen.1.2.9.keygen.by.Paradox/FILE_ID.DIZ
    39B
  • Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
    .exe 13.4MB
  • Lonelyscreen.1.2.9.keygen.by.Paradox/Paradox.nfo
    12KB
  • LtHv0O2KZDK4M637.exe
    .exe 10.6MB
  • Magic_File_v3_keygen_by_KeygenNinja.exe
    .exe 8.6MB
  • OnlineInstaller.exe
    .exe 3.6MB
  • REVENGE-RAT.js.zip
    .zip 134KB
  • REVENGE-RAT.js
    .js 1.2MB
  • Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
    .exe 9.5MB
  • [email protected]
    .exe 372KB
  • SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869
    .dll 486KB
  • SecurityTaskManager_Setup.exe
    .exe 2.9MB
  • Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
    .exe 10.5MB
  • VyprVPN.exe
    .exe 1.6MB
  • $1/1337/VyprVPN.exe
    .exe 3.2MB
  • $1/1337/joinResult.exe
    .exe 1.8MB
  • $1/1337/1111.exe
    .exe 1.4MB
  • $1/1337/Clipper.exe
    .exe 18KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • WSHSetup[1].exe
    .exe 898KB
  • Yard.dll
    .dll 400KB
  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서.tgz
    .gz 575KB
  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
    .exe 545KB
  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
    .exe 228KB
  • api.exe
    .exe 22.9MB
  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb
    .exe 166KB
  • cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7
    .exe 1.1MB
  • cobaltstrike_shellcode.bin (1).zip
    .zip 187KB
  • default.exe
    .exe 211KB
  • efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
    .js 920KB
  • emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504._exe
    .exe 505KB
  • emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823._exe
    .exe 448KB
  • f1987289f7a42f8ef652f6f6504991dbf0cd00a92653c544f67f1f25d4361ffc
    .dll 187KB
  • f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
    .exe 332KB
  • fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c
    .exe 19KB
  • fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d350
    .exe 660KB
  • file
    .exe 101KB
  • file(1)
    .exe 16KB
  • gjMEi6eG.exe
    .exe 23KB
  • good.exe
    .exe 143KB
  • hyundai steel-pipe- job 8010(1).exe
    .exe 721KB
  • hyundai steel-pipe- job 8010.exe
    .exe 721KB
  • infected dot net installer.exe
    .exe 1.7MB
  • inps_979.xls
    .xls 228KB
  • jar.jar
    .jar 81KB
  • june9.dll
    .dll 491KB
  • mouse_2
    .exe 984KB
  • oof.exe
    .exe 662KB
  • openme.exe
    .exe 756KB
  • ou55sg33s_1.exe
    .exe 609KB
  • senate.m4a
    .dll 575KB
  • str.dll
    .dll 536KB
  • svchost.exe
    .exe 31KB
  • update.exe
    .exe 12.0MB
  • vir1.xls
    .xlsx .xls 303KB
  • wwf[1].exe
    .exe 2.3MB
  • xNet.dll
    .dll 99KB

Downloads.rar

  • SHA256 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f
  • MD5 SHA1 SHA512 SSDEEP