Overview

overview

10

Static

static

10

DoomRat.exe

windows10-1703-x64

10

Resubmissions

27/09/2024, 14:17

240927-rlvh2awfjk10

27/09/2024, 12:01

240927-n63hlatfpb10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DoomRat.exe
  • Size 13.1MB
  • Sample240927-n63hlatfpb
  • SHA256 5c4e60801dd978710cdce9a43bcd6e14e3fa8e6790dc981b4ad25307628b41a0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
berbewblackmooncobaltstrikedoomratemotetgh0stratmetasploitmydoomnjratsalitysimdaepoch3hacked antivm apt backdoor banker bootkit botnet clipper collection crypter discovery downloader dropper evasion exploit exploiter upxadwarebackdoorbankerdefense_evasiondiscoveryevasionexecutionpersistencepyinstallerransomwareratstealertrojanupxworm

Malware Config

Extracted

Family

  • berbew

C2

  • http://crutop.nu/index.php

  • http://crutop.ru/index.php

  • http://mazafaka.ru/index.php

  • http://color-bank.ru/index.php

  • http://asechka.ru/index.php

  • http://trojan.ru/index.php

  • http://fuck.ru/index.php

  • http://goldensand.ru/index.php

  • http://filesearch.ru/index.php

  • http://devx.nm.ru/index.php

  • http://ros-neftbank.ru/index.php

  • http://lovingod.host.sk/index.php

  • http://www.redline.ru/index.php

  • http://cvv.ru/index.php

  • http://hackers.lv/index.php

  • http://fethard.biz/index.php

  • http://ldark.nm.ru/index.htm

  • http://gaz-prom.ru/index.htm

  • http://promo.ru/index.htm

  • http://potleaf.chat.ru/index.htm

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • 127.0.0.1:5552

Mutex

  • 279f6960ed84a752570aca7fb2dc1552

Attributes
  • reg_key

    279f6960ed84a752570aca7fb2dc1552

  • splitter

    |'|'|

Extracted

Path

  • C:\Program Files\Java\jdk-1.8\include\win32\bridge\Restore-My-Files.txt

Ransom Note
  • LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 7D68A5BFD028A31FE028CE4A57C2552A
URLs

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • https://bigblog.at

  • http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

  • http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

  • https://decoding.at

Extracted

Family

  • metasploit

Version

  • windows/download_exec

C2

  • http://172.24.117.197:12333/jquery-3.3.1.slim.min.js

Attributes
  • headers Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 118.243.83.70:80

  • 5.189.168.53:8080

  • 162.241.41.111:7080

  • 190.85.46.52:7080

  • 95.216.205.155:8080

  • 50.116.78.109:8080

  • 54.38.143.245:8080

  • 113.160.248.110:80

  • 115.176.16.221:80

  • 223.17.215.76:80

  • 202.188.218.82:80

  • 172.96.190.154:8080

  • 139.59.12.63:8080

  • 181.95.133.104:80

  • 74.208.173.91:8080

  • 202.166.170.43:80

  • 185.142.236.163:443

  • 198.57.203.63:8080

  • 185.86.148.68:443

  • 88.247.58.26:80

rsa_pubkey.plain

Extracted

Family

  • simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

  • http://www.klkjwre9fqwieluoi.info/

  • http://kukutrustnet777888.info/

Targets

    • Target
      DoomRat.exe
    • Size 13.1MB
    • SHA256 5c4e60801dd978710cdce9a43bcd6e14e3fa8e6790dc981b4ad25307628b41a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    berbewblackmooncobaltstrikeemotetgh0stratmetasploitmydoomnjratsalitysimdaepoch3hackedbackdoorbankerdefense_evasiondiscoveryevasionexecutionpersistenceransomwareratstealertrojanupxworm

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Cobalt Strike reflective loader

      Detects the reflective loader used by Cobalt Strike.

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Detect Blackmoon payload

    • Detects MyDoom family

    • Disables service(s)

      evasionexecution

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • MyDoom

      MyDoom is a Worm that is written in C++.

      wormmydoom

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • simda

      Simda is an infostealer written in C++.

      stealertrojansimda

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

3
T1112

Credential Access

Discovery

Network Service Discovery

1
T1046

Network Share Discovery

1
T1135

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

1
T1489

Tasks