General
-
Target
RNSM00402.7z
-
Size
36.6MB
-
Sample
241030-1n26bssald
-
MD5
4fa555cd87d391822d4c06839a56ceed
-
SHA1
0a5715313aac947dd8190c8743e24e0b51c1c72e
-
SHA256
ebd9e28da32a109bd324355d667639446e7a11165630f955bb6426542b13d562
-
SHA512
295929ecc89b2556550ee919e4b015762781f9c97a75de2734528479c8d75dbd265c882e6ed28dab61f2ca6269c33f79371ae58a930099c41af3895df96a3c76
-
SSDEEP
786432:RS8fJaLSxuMoPTpmlvNYpSTzslLP2Sojx9+BEIN4xJgbxCT3M:RS8foLSZy9svTGL2Sojx9+BNyJKxCT3M
Static task
static1
Malware Config
Extracted
asyncrat
0.5.7B
GITHUB
ratsss.publicvm.com:8908
Ffg435r34rweFedrr67ryryg23r5$FE$f4gfw$TWfgs34f3fqw2f3qfdfgrsdg5464564eteg45gsdfsdfsafafreg5463ghfhcfvgsdzfsgfhdghb535DFgrsg344563FDGergggfWREFG35343443wtgWRETGREWT443534tfDgedewr4gfedrg34T35grG6SI8OkPnk
-
delay
3
-
install
false
-
install_file
svchosts.exe
-
install_folder
%AppData%
Extracted
C:\Users\Admin\Documents\OneNote Notebooks\q87E3_readme_.txt
avaddon
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\q87E3_readme_.txt
avaddon
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\q87E3_readme_.txt
avaddon
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Pictures\q87E3_readme_.txt
avaddon
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\q87E3_readme_.txt
avaddon
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\9597fr48-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FA3B0F6938582C86
http://decryptor.cc/FA3B0F6938582C86
Extracted
C:\Users\Admin\AppData\Roaming\at\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/68D2-9176-A03E-0072-8872
http://bqyjebfh25oellur.onion.cab/68D2-9176-A03E-0072-8872
http://bqyjebfh25oellur.onion.nu/68D2-9176-A03E-0072-8872
http://bqyjebfh25oellur.onion.link/68D2-9176-A03E-0072-8872
http://bqyjebfh25oellur.tor2web.org/68D2-9176-A03E-0072-8872
http://bqyjebfh25oellur.onion/68D2-9176-A03E-0072-8872
Targets
-
-
Target
RNSM00402.7z
-
Size
36.6MB
-
MD5
4fa555cd87d391822d4c06839a56ceed
-
SHA1
0a5715313aac947dd8190c8743e24e0b51c1c72e
-
SHA256
ebd9e28da32a109bd324355d667639446e7a11165630f955bb6426542b13d562
-
SHA512
295929ecc89b2556550ee919e4b015762781f9c97a75de2734528479c8d75dbd265c882e6ed28dab61f2ca6269c33f79371ae58a930099c41af3895df96a3c76
-
SSDEEP
786432:RS8fJaLSxuMoPTpmlvNYpSTzslLP2Sojx9+BEIN4xJgbxCT3M:RS8foLSZy9svTGL2Sojx9+BNyJKxCT3M
-
Asyncrat family
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Cerber family
-
GandCrab payload
-
Gandcrab family
-
Limerat family
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Async RAT payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (540) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Discovery
Network Service Discovery
2Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1