Overview

overview

10

Static

static

10

Dropper/Berbew.exe

windows7-x64

10

Dropper/Berbew.exe

windows10-2004-x64

10

Dropper/Phorphiex.exe

windows7-x64

10

Dropper/Phorphiex.exe

windows10-2004-x64

10

RAT/31.exe

windows7-x64

10

RAT/31.exe

windows10-2004-x64

10

RAT/XClient.exe

windows7-x64

10

RAT/XClient.exe

windows10-2004-x64

10

RAT/file.exe

windows7-x64

7

RAT/file.exe

windows10-2004-x64

7

Ransomware...-2.exe

windows7-x64

10

Ransomware...-2.exe

windows10-2004-x64

10

Ransomware...01.exe

windows7-x64

10

Ransomware...01.exe

windows10-2004-x64

10

Ransomware...lt.exe

windows7-x64

10

Ransomware...lt.exe

windows10-2004-x64

10

Stealers/Azorult.exe

windows7-x64

10

Stealers/Azorult.exe

windows10-2004-x64

10

Stealers/B...on.exe

windows7-x64

10

Stealers/B...on.exe

windows10-2004-x64

10

Stealers/Dridex.dll

windows7-x64

10

Stealers/Dridex.dll

windows10-2004-x64

10

Stealers/M..._2.exe

windows7-x64

10

Stealers/M..._2.exe

windows10-2004-x64

10

Stealers/lumma.exe

windows7-x64

10

Stealers/lumma.exe

windows10-2004-x64

10

Trojan/BetaBot.exe

windows7-x64

10

Trojan/BetaBot.exe

windows10-2004-x64

10

Trojan/Smo...er.exe

windows7-x64

10

Trojan/Smo...er.exe

windows10-2004-x64

10

Resubmissions

03/09/2024, 14:02 UTC

240903-rb57sazdqf 10

03/09/2024, 13:51 UTC

240903-q59avszclf 10

02/09/2024, 19:51 UTC

240902-yk8gtsxbpd 10

02/09/2024, 02:27 UTC

240902-cxh7tazflg 10

02/09/2024, 02:26 UTC

240902-cwxc2sygll 10

21/06/2024, 19:37 UTC

240621-yca7cszgnd 10

09/06/2024, 17:07 UTC

240609-vm7rjadd73 10

13/05/2024, 17:36 UTC

240513-v6qblafe3y 10

12/05/2024, 17:17 UTC

240512-vty3zafh5s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archive.zip

  • Size

    25.8MB

  • MD5

    83671dbfab2418604f11993fdc392094

  • SHA1

    5386d1fb94ec2974736a4d8895a2218855ffda69

  • SHA256

    60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

  • SHA512

    9cf982c9b2949f05ea4ab7d27b369924334cb9f8a0b85c374cf08ac059281ecf96c97088bb983f74033a1a8fba01f09c2f3f41ae3a60e7c79db8b6312edd5138

  • SSDEEP

    786432:+r/Da8WA3C5BENmtAWzdVTkvq+GY8NEXcJap4DFEME/:4/W8WAS5BENmtZ1kvq+GYi8pw+T

Score
10/10
upxstealersystemxwormrevengeratzeppelinmodiloader

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/2jTT3Lnj

Extracted

Family

revengerat

Botnet

system

C2

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Signatures

  • Detect Xworm Payload 1 IoCs
  • Detects Zeppelin payload 1 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Modiloader family
    modiloader
  • RevengeRat Executable 1 IoCs
    stealer
  • Revengerat family
    revengerat
  • Xworm family
    xworm
  • Zeppelin family
    zeppelin
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • Archive.zip
    .zip
  • Dropper/Berbew.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • Dropper/Phorphiex.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • RAT/31.exe
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • RAT/XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • RAT/file.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Ransomware/Client-2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Ransomware/criticalupdate01.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • Ransomware/default.exe
    .exe windows:4 windows x86 arch:x86

    8acb34bed3caa60cae3f08f75d53f727


    Headers

    Imports

    Sections

  • Stealers/Azorult.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Stealers/BlackMoon.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Stealers/Dridex.exe
    .dll windows:5 windows x64 arch:x64

    a23d507241571c69f1f380438b3a251c


    Headers

    Imports

    Exports

    Sections

  • Stealers/Masslogger/mouse_2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Stealers/lumma.exe
    .exe windows:5 windows x86 arch:x86

    19740cd4fd3dcce67b00ed2a92e30452


    Headers

    Imports

    Sections

  • Trojan/BetaBot.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Trojan/SmokeLoader.exe
    .exe windows:5 windows x86 arch:x86

    0b940f4d2992021389a241ab8513fc6b


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.