Overview

overview

10

Static

static

10

1/0178b79b...bd.exe

windows7-x64

10

1/0178b79b...bd.exe

windows10-2004-x64

10

1/0280cde4...60.exe

windows7-x64

10

1/0280cde4...60.exe

windows10-2004-x64

10

1/08b76206...65.exe

windows7-x64

10

1/08b76206...65.exe

windows10-2004-x64

10

1/0e4fc438...91.exe

windows7-x64

3

1/0e4fc438...91.exe

windows10-2004-x64

10

1/0fb86a8b...05.exe

windows7-x64

10

1/0fb86a8b...05.exe

windows10-2004-x64

10

1/25898c73...8f.exe

windows7-x64

10

1/25898c73...8f.exe

windows10-2004-x64

10

1/2c2e9491...3c.exe

windows7-x64

3

1/2c2e9491...3c.exe

windows10-2004-x64

10

1/2ef0f582...2e.exe

windows7-x64

3

1/2ef0f582...2e.exe

windows10-2004-x64

10

1/39884fc0...82.exe

windows7-x64

10

1/39884fc0...82.exe

windows10-2004-x64

10

1/3a72ecec...8a.exe

windows7-x64

10

1/3a72ecec...8a.exe

windows10-2004-x64

10

1/3bfcb4f7...71.exe

windows7-x64

10

1/3bfcb4f7...71.exe

windows10-2004-x64

10

1/4103411f...f5.exe

windows7-x64

10

1/4103411f...f5.exe

windows10-2004-x64

10

1/4e0fdb84...95.exe

windows7-x64

3

1/4e0fdb84...95.exe

windows10-2004-x64

7

1/5297372f...33.exe

windows7-x64

5

1/5297372f...33.exe

windows10-2004-x64

5

1/68292f38...e4.exe

windows7-x64

3

1/68292f38...e4.exe

windows10-2004-x64

10

1/6da4696b...e5.exe

windows7-x64

7

1/6da4696b...e5.exe

windows10-2004-x64

7

Resubmissions

11/12/2024, 15:32

241211-sy44nssrdm10

09/08/2024, 21:57

240809-1t1vfs1cpm10

06/08/2024, 13:03

240806-qas1dszdqm

06/08/2024, 13:01

240806-p9f97szdlm10

06/08/2024, 12:52

240806-p3672stdkg10

06/08/2024, 12:29

240806-ppa8fsygqr10

06/08/2024, 12:29

240806-pn9pmaygqq

06/08/2024, 12:26

240806-pmc92ashlh10

Sharing

Copy URL Twitter E-mail

General

  • Target
    silly.zip
  • Size 20.2MB
  • Sample240806-p9f97szdlm
  • SHA256 3123af93014a5a5c49aa6fd2118f6805041af178c222be27e30b2fd477085c19
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaasyncratbabylonratlockbitredlineremcosstealcxworm6951125327defaulthelloremotehostcredential_accessdefense_evasiondiscoveryexecutioninfostealerkeyloggerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

  • stealc

Botnet

  • hello

C2

  • http://85.28.47.70

Attributes
  • url_path

    /570d5d5e8678366c.php

Extracted

Family

  • xworm

C2

  • schools-copper.gl.at.ply.gg:14154

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot6887301557:AAE2e7AcjyzPeaHQb_2XBthrT3TTCKt7jCs/sendMessage?chat_id=7045481276

Extracted

Family

  • redline

Botnet

  • 6951125327

C2

  • https://t.me/+7Lir0e4Gw381MDhi

  • https://steamcommunity.com/profiles/76561199038841443

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default

C2

  • 82.65.19.134:4443

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • agenttesla

Credentials

Extracted

Path

  • C:\7V7uPExzv.README.txt

Ransom Note
  • ~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CA4035F465EA9AFB4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

  • http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

  • http://group.goocasino.org

  • https://nullbulge.com

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.bonnyriggdentalsurgery.com.au
  • Port

    587
  • Username

    [email protected]
  • Password

    Sages101*

Extracted

Credentials
  • Protocol

    ftp
  • Host

    ftp.libreriagandhi.cl
  • Port

    21
  • Username

    [email protected]
  • Password

    x6p2^m#1#~+O

Extracted

Family

  • remcos

Botnet

  • RemoteHost

C2

  • 192.3.64.149:2888

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7Q1GRN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://85.28.47.101

Attributes
  • url_path

    /f3ee98d7eec07fb9.php

Targets

    • Target
      1/0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd.exe
    • Size 678KB
    • SHA256 0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      1/0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160.exe
    • Size 1.3MB
    • SHA256 0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    remcosremotehostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral3behavioral4
    • Target
      1/08b7620610fc30c54e5cc095a54ae6d2949f68b0f224c285283e1612c254ef65.exe
    • Size 161KB
    • SHA256 08b7620610fc30c54e5cc095a54ae6d2949f68b0f224c285283e1612c254ef65
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    stealchellodiscoverystealer
    behavioral5behavioral6
    • Target
      1/0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
    • Size 389KB
    • SHA256 0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverystealcdefaultstealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Suspicious use of SetThreadContext

    behavioral7behavioral8
    • Target
      1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
    • Size 146KB
    • SHA256 0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (669) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9
    • Target
      1/25898c73a877d87ba289bb4ab9585eb36eba9d27d47af678a86befdbf9aa938f.exe
    • Size 1.0MB
    • SHA256 25898c73a877d87ba289bb4ab9585eb36eba9d27d47af678a86befdbf9aa938f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral11behavioral12
    • Target
      1/2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
    • Size 338KB
    • SHA256 2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryredline6951125327infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral13behavioral14
    • Target
      1/2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
    • Size 338KB
    • SHA256 2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryredline6951125327infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral15behavioral16
    • Target
      1/39884fc02ed9a51ffcc9b298916be79307f15f1518b6ae2021dd07af0aeecb82.exe
    • Size 3.3MB
    • SHA256 39884fc02ed9a51ffcc9b298916be79307f15f1518b6ae2021dd07af0aeecb82
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    babylonratdiscoverytrojanupx

    • Babylon RAT

      Babylon RAT is remote access trojan written in C++.

      trojanbabylonrat

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral17behavioral18
    • Target
      1/3a72ecec34a29f53a1d73677a0e6f4c2e19087a32f1808f8f4ff643f62128d8a.exe
    • Size 487KB
    • SHA256 3a72ecec34a29f53a1d73677a0e6f4c2e19087a32f1808f8f4ff643f62128d8a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral19behavioral20
    • Target
      1/3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    • Size 731KB
    • SHA256 3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral21behavioral22
    • Target
      1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
    • Size 109KB
    • SHA256 4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redline6951125327discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23behavioral24
    • Target
      1/4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95.exe
    • Size 1.2MB
    • SHA256 4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral25behavioral26
    • Target
      1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
    • Size 719KB
    • SHA256 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of SetThreadContext

    behavioral27behavioral28
    • Target
      1/68292f388207f8ec69774dbad429e67420881ce46ecfad55f23182ec3a8893e4.exe
    • Size 765KB
    • SHA256 68292f388207f8ec69774dbad429e67420881ce46ecfad55f23182ec3a8893e4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryredline6951125327infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral29behavioral30
    • Target
      1/6da4696b804777582ae586a4e9f42f6c18ccf540222d70dcf3374ee291e674e5.exe
    • Size 2.1MB
    • SHA256 6da4696b804777582ae586a4e9f42f6c18ccf540222d70dcf3374ee291e674e5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

6
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

4
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks

static1

hello6951125327ratdefaultstealclockbitxwormredlineasyncrat
Score
10/10

behavioral1

agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral2

agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral3

remcosremotehostdiscoveryrat
Score
10/10

behavioral4

remcosremotehostdiscoveryrat
Score
10/10

behavioral5

stealchellodiscoverystealer
Score
10/10

behavioral6

stealchellodiscoverystealer
Score
10/10

behavioral7

discovery
Score
3/10

behavioral8

stealcdefaultdiscoverystealer
Score
10/10

behavioral9

defense_evasiondiscoveryransomwarespywarestealer
Score
10/10

behavioral10

defense_evasiondiscoveryransomwarespywarestealer
Score
10/10

behavioral11

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan
Score
10/10

behavioral12

agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan
Score
10/10

behavioral13

discovery
Score
3/10

behavioral14

redline6951125327discoveryinfostealer
Score
10/10

behavioral15

discovery
Score
3/10

behavioral16

redline6951125327discoveryinfostealer
Score
10/10

behavioral17

babylonratdiscoverytrojanupx
Score
10/10

behavioral18

babylonratdiscoverytrojanupx
Score
10/10

behavioral19

xwormexecutionpersistencerattrojan
Score
10/10

behavioral20

xwormexecutionpersistencerattrojan
Score
10/10

behavioral21

agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan
Score
10/10

behavioral22

agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan
Score
10/10

behavioral23

redline6951125327discoveryinfostealer
Score
10/10

behavioral24

redline6951125327discoveryinfostealer
Score
10/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
5/10

behavioral28

discovery
Score
5/10

behavioral29

discovery
Score
3/10

behavioral30

redline6951125327discoveryinfostealer
Score
10/10

behavioral31

discoverypersistence
Score
7/10

behavioral32

discoverypersistence
Score
7/10