Resubmissions

20-09-2024 07:39

240920-jgxtlavgmh 10

20-09-2024 07:03

240920-hvl4kstglg 666

General

  • Target

    DoomRat.exe

  • Size

    12.1MB

  • Sample

    240920-jgxtlavgmh

  • MD5

    0cf5c5253e621e56587ead9ccf6fc23c

  • SHA1

    0f3d67f82bf309ac7ac3df68a78be948c12a0cad

  • SHA256

    2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

  • SHA512

    6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9

  • SSDEEP

    393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Targets

    • Target

      DoomRat.exe

    • Size

      12.1MB

    • MD5

      0cf5c5253e621e56587ead9ccf6fc23c

    • SHA1

      0f3d67f82bf309ac7ac3df68a78be948c12a0cad

    • SHA256

      2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

    • SHA512

      6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9

    • SSDEEP

      393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo

    • Berbew

      Berbew is a backdoor written in C++.

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • Detect XtremeRAT payload

    • Detects MyDoom family

    • MyDoom

      MyDoom is a Worm that is written in C++.

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • simda

      Simda is an infostealer written in C++.

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Target

      Dispam.pyc

    • Size

      4KB

    • MD5

      d1c7ecb169b3f42d3cfb94a3a7b0a069

    • SHA1

      b88b816a48976b99e74eff26aae89faa2eb8fd41

    • SHA256

      97863694de0ef241511cf5061e433f9693a86f69f55f591ba4dc878c0d18b921

    • SHA512

      770662f38cfedf1d2c1c559ada74db4212ba74128dca70241ba26963fe67338e6b5b7d8f7d942182eb485cd2229ca3d7e5a92df880f008edbf2769f98c61baac

    • SSDEEP

      96:FqLNe5BjJtR3m+/vlqegK8regFAaa5sVB7sQsr+:IGJT3tnllgKuamX4r+

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks