Overview

overview

10

Static

static

10

7_zip_installer.exe

windows7-x64

8

CHOCORAT.exe

windows7-x64

10

ChrisMessage.exe

windows7-x64

1

Free Porn.exe

windows7-x64

1

Gay Porn Mailer.exe

windows7-x64

1

GottaWork.exe

windows7-x64

PleaseWork.exe

windows7-x64

THING.exe

windows7-x64

7

Technoturn...AT.exe

windows7-x64

1

Verified by Visa.exe

windows7-x64

10

abwsx1.exe

windows7-x64

7

eee.exe

windows7-x64

1

hypno.exe

windows7-x64

8

mbam-setup...00.exe

windows7-x64

8

molesto.exe

windows7-x64

1

runme.exe

windows7-x64

7

setup.exe

windows7-x64

3

sevgi.exe

windows7-x64

6

shrek.exe

windows7-x64

8

upnp.exe

windows7-x64

7

virus.exe

windows7-x64

10

vmdestroyer.exe

windows7-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CollabVM (FTP Partial).rar

  • Size

    78.8MB

  • MD5

    96d1b4d815e96b67b29d157715b3c074

  • SHA1

    ae3f969933414b5e901d1df5576c51ae47dc1af4

  • SHA256

    c8a496dcf94d5d246dec0747f139957709b63412f48d9a1591ca5e771a988636

  • SHA512

    ed5ce8952830e696a76583af4e4b5b685656fb13384b9e73774756774d08c1cb054a427cf6ce954cf28fb04ddf07279e95a22c9e37bb31ff7d12a703238ad4d5

  • SSDEEP

    1572864:po7MwiiwnO+khwOPqPACWqc+ZmdClkU6gyxXFaDrOegXCkgO/k/+WwOg:YMXZNOPqPQlCGnx1qrOegXdpk/+TOg

Score
10/10
upxquasarorcusnanocoremetasploit

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

70.177.68.141:30005

127.0.0.1:30005
Mutex

6d38efcc-c3ca-4519-9a65-962ebb7a84ff

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2017-09-02T04:47:37.850801436Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    30005

  • default_group

    iC Scammer Baited

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    6d38efcc-c3ca-4519-9a65-962ebb7a84ff

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    70.177.68.141

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.75.128:4444

Signatures

  • Metasploit family
    metasploit
  • Nanocore family
    nanocore
  • Orcurs Rat Executable 2 IoCs
  • Orcus family
    orcus
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • CollabVM (FTP Partial).rar
    .rar
  • 7_zip_installer.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • CHOCORAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ChrisMessage.exe
    .exe windows:5 windows x86 arch:x86

    c89a92a0f14f67d0a94c277040254501


    Headers

    Imports

    Sections

  • Free Porn.exe
    .exe windows:4 windows x86 arch:x86

    0471d9f3d9f142373524705d6a5cb951


    Headers

    Imports

    Sections

  • Gay Porn Mailer.exe
    .exe windows:4 windows x86 arch:x86

    8f4ae91e208a12efd6d4a5a26f8d5c35


    Headers

    Imports

    Sections

  • GottaWork.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • PleaseWork.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • THING.EXE
    .exe windows:5 windows x86 arch:x86

    130312efe8892496180179ce46d20b79


    Headers

    Imports

    Sections

  • Technoturnover's RAT.exe
    .exe windows:5 windows x86 arch:x86

    95cf55f501a718a172701eb4aea60d74


    Headers

    Imports

    Sections

  • Verified by Visa.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • abwsx1.exe
    .exe windows:5 windows x86 arch:x86

    f14aba31075188e8a83ea826ace3eca3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    aaa34d9251e34ceebd6bf5066471d799


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/service.dll
    .dll windows:4 windows x86 arch:x86

    35ffecf0b129f1801e010e7d78bbbd74


    Headers

    Imports

    Exports

    Sections

  • abysssc.exe
    .exe windows:4 windows x64 arch:x64

    31771aa1aeef7bbf8758d77ef1d38cf4


    Headers

    Imports

    Sections

  • abyssws.exe
    .exe windows:4 windows x64 arch:x64

    872d6378d3a1782b1443ca20d53baeaf


    Headers

    Imports

    Sections

  • zlib1.dll
    .dll windows:4 windows x64 arch:x64

    46efcc36aad0b8ca15806e7841a5fd75


    Headers

    Imports

    Exports

    Sections

  • eee.exe
    .exe windows:1 windows x86 arch:x86

    a83ef0017295c90121b3183a1a10245c


    Headers

    Imports

    Sections

  • hypno.exe
    .exe windows:4 windows x86 arch:x86

    4d17be67c8d0394c5c1b8e725359ed89


    Headers

    Imports

    Sections

  • mbam-setup-1.75.0.1300.exe
    .exe windows:1 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • molesto.exe
    .exe windows:1 windows x86 arch:x86

    0a6d0102c9ce43044d6e7177ecf5bf6f


    Headers

    Imports

    Exports

    Sections

  • runme.exe
    .exe windows:4 windows x86 arch:x86

    5c7433b2a8bfdbd866a519f5ce78aa7b


    Headers

    Imports

    Sections

  • setup.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • sevgi.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • shrek.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • upnp.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • virus.exe
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections

  • vmdestroyer.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections