Overview

overview

10

Static

static

10

0297bbb0f0...ee.exe

windows7-x64

3

0297bbb0f0...ee.exe

windows10-2004-x64

3

15aeb8380c...71.exe

windows7-x64

10

15aeb8380c...71.exe

windows10-2004-x64

10

1820a0542f...34.dll

windows7-x64

10

1820a0542f...34.dll

windows10-2004-x64

10

1df11bc19a...ad.exe

windows7-x64

5

1df11bc19a...ad.exe

windows10-2004-x64

5

22934e006b...e7.exe

windows7-x64

3

22934e006b...e7.exe

windows10-2004-x64

3

24989d884f...b7.exe

windows7-x64

10

24989d884f...b7.exe

windows10-2004-x64

10

2828fabf39...65.dll

windows7-x64

1

2828fabf39...65.dll

windows10-2004-x64

1

32b0fbaf95...08.exe

windows7-x64

10

32b0fbaf95...08.exe

windows10-2004-x64

10

4bf2dace8a...d7.exe

windows7-x64

10

4bf2dace8a...d7.exe

windows10-2004-x64

10

55d03f9954...44.dll

windows7-x64

10

55d03f9954...44.dll

windows10-2004-x64

10

5e58e3818a...cb.exe

windows7-x64

10

5e58e3818a...cb.exe

windows10-2004-x64

10

611cf2be67...47.exe

windows7-x64

10

611cf2be67...47.exe

windows10-2004-x64

10

654e574fb4...01.exe

windows7-x64

3

654e574fb4...01.exe

windows10-2004-x64

3

6f4ac0da34...a5.exe

windows7-x64

9

6f4ac0da34...a5.exe

windows10-2004-x64

9

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Newfolder8.7z
  • Size 17.6MB
  • Sample240927-2axjcssfmj
  • SHA256 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotdjvuicedidlokibotsmokeloaderstormkittywellmess2683308570416777478881910897067backdoorbankercollectiondiscoveryevasionloaderpersistenceprivilege_escalationransomwarespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

  • icedid

Botnet

  • 2683308570

C2

  • funnymemos.shop

  • trythisshop.club

  • shopoholics.best

  • buytheone.best

Attributes
  • auth_var

    1

  • url_path

    /audio/

Extracted

Family

  • wellmess

C2

  • http://178.211.39.6:80

  • https://141.98.212.55:121

rsa_privkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

  • danabot

Botnet

  • 4

C2

  • 192.119.110.73:443

  • 192.236.192.201:443

Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Extracted

Family

  • djvu

C2

  • http://asvb.top/nddddhsspen6/get.php

  • http://astdg.top/nddddhsspen6/get.php

Attributes
  • extension

    .ehiz

  • offline_id

    94ZMASYQt4QGhpOo8gEwVMGuTvtKzw670thXUlt1

  • payload_url

    http://asvb.top/files/penelop/updatewin1.exe

    http://asvb.top/files/penelop/updatewin2.exe

    http://asvb.top/files/penelop/updatewin.exe

    http://asvb.top/files/penelop/3.exe

    http://asvb.top/files/penelop/4.exe

    http://asvb.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IMhsjaUZQE Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0299ewgfDd

rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

  • icedid

Campaign

  • 1677747888

C2

  • jeliskvosh.com

Extracted

Family

  • lokibot

C2

  • http://becharnise.ir/fa11/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Extracted

Family

  • icedid

Campaign

  • 1910897067

C2

  • epicprotovir.download

Targets

    • Target
      0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe
    • Size 2KB
    • SHA256 0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe
    • Size 150KB
    • SHA256 15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoordiscoverytrojan
    behavioral3behavioral4
    • Target
      1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.exe
    • Size 38KB
    • SHA256 1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid1910897067bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral5behavioral6
    • Target
      1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
    • Size 1.3MB
    • SHA256 1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7behavioral8
    • Target
      22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe
    • Size 2KB
    • SHA256 22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe
    • Size 1.2MB
    • SHA256 24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral11behavioral12
    • Target
      2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.exe
    • Size 179KB
    • SHA256 2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe
    • Size 844KB
    • SHA256 32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral15behavioral16
    • Target
      4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
    • Size 787KB
    • SHA256 4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral17behavioral18
    • Target
      55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.exe
    • Size 231KB
    • SHA256 55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid1677747888bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral19behavioral20
    • Target
      5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe
    • Size 865KB
    • SHA256 5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lokibotcollectiondiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral21behavioral22
    • Target
      611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe
    • Size 280KB
    • SHA256 611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    stormkittydiscoverypersistenceprivilege_escalationspywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral23behavioral24
    • Target
      654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe
    • Size 8KB
    • SHA256 654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe
    • Size 3.0MB
    • SHA256 6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    discoveryevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral27behavioral28
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 14KB
    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

upxloader2683308570themidastormkittyicedidwellmess
Score
10/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

smokeloaderbackdoordiscoverytrojan
Score
10/10

behavioral4

smokeloaderbackdoordiscoverytrojan
Score
10/10

behavioral5

icedid1910897067bankerloadertrojan
Score
10/10

behavioral6

icedid1910897067bankerloadertrojan
Score
10/10

behavioral7

upx
Score
5/10

behavioral8

upx
Score
5/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

danabot4bankerdiscoverytrojan
Score
10/10

behavioral12

danabot4bankerdiscoverytrojan
Score
10/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

djvudiscoverypersistenceransomware
Score
10/10

behavioral16

djvudiscoverypersistenceransomware
Score
10/10

behavioral17

djvudiscoverypersistenceransomware
Score
10/10

behavioral18

djvudiscoverypersistenceransomware
Score
10/10

behavioral19

icedid1677747888bankerloadertrojan
Score
10/10

behavioral20

icedid1677747888bankerloadertrojan
Score
10/10

behavioral21

lokibotcollectiondiscoveryspywarestealertrojan
Score
10/10

behavioral22

lokibotcollectiondiscoveryspywarestealertrojan
Score
10/10

behavioral23

stormkittydiscoverypersistenceprivilege_escalationspywarestealer
Score
10/10

behavioral24

stormkittydiscoverypersistenceprivilege_escalationspywarestealer
Score
10/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discoveryevasionthemidatrojan
Score
9/10

behavioral28

discoveryevasionthemidatrojan
Score
9/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10