Overview

overview

10

Static

static

10

Retrac Patcher.exe

windows7-x64

7

Retrac Patcher.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

OGFnPatcher.exe

windows10-2004-x64

9

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...e3.dll

windows7-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...act.js

windows7-x64

3

resources/...act.js

windows10-2004-x64

3

sqlite-aut...llback

ubuntu-18.04-amd64

1

sqlite-aut...llback

debian-9-armhf

1

sqlite-aut...llback

debian-9-mips

1

sqlite-aut...llback

debian-9-mipsel

1

sqlite-aut...ace.js

windows7-x64

3

sqlite-aut...ace.js

windows10-2004-x64

3

sqlite-aut...al.ps1

windows7-x64

3

sqlite-aut...al.ps1

windows10-2004-x64

3

sqlite-aut...re.vbs

windows7-x64

1

sqlite-aut...re.vbs

windows10-2004-x64

1

sqlite-aut...all-sh

ubuntu-18.04-amd64

1

Resubmissions

21-09-2024 11:34

240921-nprd1azend 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Retrac Patcher.exe

  • Size

    83.2MB

  • Sample

    240921-nprd1azend

  • MD5

    d8b516ccd538b7fb0b43887437955737

  • SHA1

    80682e6da24c2f43efea4a7c122c8622a083e901

  • SHA256

    55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6

  • SHA512

    12c017f28753e859ae13127edb9a859c299d6567d5529d72c01293d7fc949d16f2c2c32edcc720765aea66457807757973ef1d4ecf2a3b74b2108dfed668a42d

  • SSDEEP

    1572864:DC/xlZ1DRUH32qZ0QaTY5pONinTIXK7hqsAyUhEvpPLjjW:DYTAPO4nsayyUmxPLW

Score
10/10
zloadercredential_accessdiscoveryexecutionlinuxpersistencespywarestealer

Malware Config

Targets

    • Target

      Retrac Patcher.exe

    • Size

      83.2MB

    • MD5

      d8b516ccd538b7fb0b43887437955737

    • SHA1

      80682e6da24c2f43efea4a7c122c8622a083e901

    • SHA256

      55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6

    • SHA512

      12c017f28753e859ae13127edb9a859c299d6567d5529d72c01293d7fc949d16f2c2c32edcc720765aea66457807757973ef1d4ecf2a3b74b2108dfed668a42d

    • SSDEEP

      1572864:DC/xlZ1DRUH32qZ0QaTY5pONinTIXK7hqsAyUhEvpPLjjW:DYTAPO4nsayyUmxPLW

    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      LICENSES.chromium.html

    • Size

      9.0MB

    • MD5

      f017c462d59fd22271a2c5e7f38327f9

    • SHA1

      7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9

    • SHA256

      40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37

    • SHA512

      72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07

    • SSDEEP

      24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      OGFnPatcher.exe

    • Size

      177.3MB

    • MD5

      82db6baf5501b11cf7582d68cb173689

    • SHA1

      ff40fcae2ecfb00eb3f1a36521afbdc93db1e6e6

    • SHA256

      17f48d532943a1160b9c171e183599d28b3a03b4943df8d1b5f8af2aaed142fc

    • SHA512

      9d47fc31fec0379b7ec6461401e5cda54f7b64d6ff0a30136e5ad58bb94446cfa6f1e511380eb5bf99f59174e56fdc7a7cd06cf7cf46898c672bf37c36ec4d82

    • SSDEEP

      1572864:s+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:sA5kyGScXQT

    Score
    9/10
    credential_accessdiscoverypersistencespywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Enumerates processes with tasklist

      discovery
    behavioral13

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      a7b7470c347f84365ffe1b2072b4f95c

    • SHA1

      57a96f6fb326ba65b7f7016242132b3f9464c7a3

    • SHA256

      af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    • SHA512

      83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

    • SSDEEP

      49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc

    Score
    1/10
    behavioral14

    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      ed10fd2777a030b2895d2f555207f1b3

    • SHA1

      81448e7a72e49eff746abbedea503139b7eadbdd

    • SHA256

      996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c

    • SHA512

      435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9

    • SSDEEP

      49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H

    Score
    1/10
    behavioral15

    • Target

      libEGL.dll

    • Size

      473KB

    • MD5

      e3f6c7b1316f7ca06ee178377ce16ff7

    • SHA1

      f546da89ec0d3ef238892be8f2dd697d411518bb

    • SHA256

      ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9

    • SHA512

      cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b

    • SSDEEP

      6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f

    Score
    1/10
    behavioral16

    • Target

      libGLESv2.dll

    • Size

      8.0MB

    • MD5

      ac216b22cb7ca21d9803ae6b111792e5

    • SHA1

      f6678626aa522628110315889ca744572549bb73

    • SHA256

      3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50

    • SHA512

      df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90

    • SSDEEP

      98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma

    Score
    1/10
    behavioral17

    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node

    • Size

      1.8MB

    • MD5

      66a65322c9d362a23cf3d3f7735d5430

    • SHA1

      ed59f3e4b0b16b759b866ef7293d26a1512b952e

    • SHA256

      f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

    • SHA512

      0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

    • SSDEEP

      49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt

    Score
    1/10
    behavioral18behavioral19

    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js

    • Size

      224B

    • MD5

      f0a82a6a6043bf87899114337c67df6c

    • SHA1

      a906c146eb0a359742ff85c1d96a095bd0dd95fd

    • SHA256

      5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74

    • SHA512

      d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240

    Score
    3/10
    execution
    behavioral20behavioral21

    • Target

      sqlite-autoconf-3440200/Makefile.fallback

    • Size

      547B

    • MD5

      8ff4cdbeec29d794549a0aa48da06bc3

    • SHA1

      7fd897fc720b6c9c6f760867c97a95431fa4693e

    • SHA256

      67d473327dd92f5cad68fddb78b8bb3e8745aba851147945893e4db5a2b59892

    • SHA512

      9871a654d8b140ad5d6768d385b86ba7f32927f8ed6374e62c93db99be4a40841f6900d648f33d07dc118b6ea93f00c45f53e4b675643b2b487c9c0df1ea1474

    Score
    1/10
    behavioral22behavioral23behavioral24behavioral25

    • Target

      sqlite-autoconf-3440200/Replace.cs

    • Size

      7KB

    • MD5

      335ee30449b5d0d52ab314dbff93d52f

    • SHA1

      02c67258801c2fb5f63231e0ac0f220b4b36ba91

    • SHA256

      74ba0687a84c328df2836f73d7d36368099a5f5c1c360a84211e51fa71f1dfc0

    • SHA512

      02f40bc955c833105811f78471e29f062c1cebfe4bd96ffba941670c0026ad5bbc81f336b7c2c6b9f804c67ed46c9dabab927ec0fb4c709bd7a049454f27073a

    • SSDEEP

      96:lJC/3zjNPMMQIQBmajlyM3px6D3t1KO4vNoHyJ:l0iAM3vlO4vNcyJ

    Score
    3/10
    execution
    behavioral26behavioral27

    • Target

      sqlite-autoconf-3440200/aclocal.m4

    • Size

      364KB

    • MD5

      6f9e7a7b0ab591c27b3cbf01a3c1036a

    • SHA1

      1f464e1017c18769c630a1d4fbfe9acd57a303ec

    • SHA256

      a459cf9e72aa3bf51c748226e37c2e192144047e3b1a5173119b92fa62f2bf82

    • SHA512

      aa0aec1a3442ecf4bbcdb908f32d72803e0988ca0b3d6ebaf32a49a2a898328c3bb71cf77ca3b062d55ccec9d86953fa52ddf02460d7724de09a4efb38d8ef7d

    • SSDEEP

      6144:tdAwSQSqrgHFnOvwYAU9FWgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tt:rAtM7E0LQNnc

    Score
    3/10
    execution
    behavioral28behavioral29

    • Target

      sqlite-autoconf-3440200/configure

    • Size

      485KB

    • MD5

      a3cfbb77ff42001bb363783c3b2dd261

    • SHA1

      9b222ed32dd27dc2b2bba00e7c2fbd1a0ac5974d

    • SHA256

      e4fd1a4c97d06f37d55eadf277cbcc62f01bf505c743ae50db90117457042c20

    • SHA512

      6e6a70a449d52ebe05b74124ba47476764bc3c0d640b3f32d6f9b46fe31b1842fb469792705215627398c88e0f0a0f64f1590e438f0bce92bedca1c68ebb0cd5

    • SSDEEP

      6144:X0hKTRerWD0QrR482PTxJToVL6APIudUVQUszNr3+5c+D+hmCk7XDSy+va++XYK4:ChKIJ3C1IJ4p5Z7H1eAvySpjxhH

    Score
    1/10
    behavioral30behavioral31

    • Target

      sqlite-autoconf-3440200/install-sh

    • Size

      14KB

    • MD5

      b090c5891571c820e91d345a9551af44

    • SHA1

      894e0a9de7976233743575c6b84dedc1b37025b6

    • SHA256

      3d7488bebd0cfc9b5c440c55d5b44f1c6e2e3d3e19894821bae4a27f9307f1d2

    • SHA512

      e9ed1ec4b9903ccca1d2d7c224200aaa194f22e6ccbcc2a3a595f38f5e3bf04177bcfac4ae12310bb91262ad8aa3f63420d795a42fb08d95296e0836f4c6a5e9

    • SSDEEP

      384:9dj/jriL5B5hZgfViYUnMRLMRfur6vTUk9J3kX/sddHswFhTmrVxPD:9l7e1B5hZgfViYeE+ur6bUk9J3kvsddg

    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

zloader
Score
10/10

behavioral1

discovery
Score
7/10

behavioral2

discoverypersistence
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

credential_accessdiscoverypersistencespywarestealer
Score
9/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10