fabookie | ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506

Sharing

Copy URL Twitter E-mail

General

Target
ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506
Size 6.8MB
Sample241104-rxgfjs1dpf
SHA256 ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506
MD5 b96ce989c772a073b1bcc341a37787e3
SHA1 2c66915d1384818a982eacb364acb5e86c2a66fc
SHA512 d7094d7a93019235ec6fb193bb0df27063f761f11b6eb0ba38cf69c43db435e6355370106d3c2a87ac566ca4ebcd07ae68e1845047280995f7d35d2d1d430ff5
SSDEEP 196608:t86NetLpl2zCh3a3Dlrn7LKzwRfh1ZscQAedF1cHISas:O6NejMzChaDlrn7Lkkic0dF1Jc
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

yaklalau.xyz:80

Extracted

Family

redline

Botnet

Cana

176.111.174.254:56328

Extracted

Family

fickerstealer

bukkva.club:80

Extracted

Family

smokeloader

Botnet

pub6

Targets

- Target
  app.exe
- Size 4.5MB
- SHA256 0e2bcbe99b84383cfa549598d998bddce096daa94e1eb6dfbfa66d3cf12cc1e4
- MD5 ea57c9a4177b1022ec4d053af865cbc9
- SHA1 7ec0f509955223f91ff3f225bfdc53e5ec56a6d8
- SHA512 a889aa2439957fb8d78c1d582f5f0a3c2a084e1e085ac1ef00a42d69d144599769c6bbb6c0ad24aaf310db9ac153b54970ec292cc75d1bacbb57c1f603297802
- SSDEEP 98304:zCAdBEbQw8N1k4UvgFzDRLIvPJDh6GIJD7k5iIl7nTFrfspCYmQ4:/k58N1RJavmrJs5X7T9lXQ4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence privilege_escalation rootkit trojan
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba family
  glupteba
- Glupteba payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Windows security bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMon driver.
  Roottkits write to WinMon to hide PIDs from being detected.
  rootkit evasion
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
behavioral1 behavioral2
- Target
  arnatic_2.exe
- Size 323KB
- SHA256 d9d4fee430f16d00256908e81a7b735954cad46807da9cd40c28435e5bcf0105
- MD5 69b2b0208246bf893409e69a862eef76
- SHA1 839b1236dc249fa9f19f717ffb42896e09fd9d5e
- SHA512 422762cbd84626f9bf95735479b6832f1970b8498e3f767275c62a9c94c7d46b4525b1af93f3925b2a0fb01bc73ec246792eab1ce02a9245f33cf8d02011e7d8
- SSDEEP 6144:4rYjDIFTxzTnnKDLLFExp2HVfdwQlUb2Axn14ubuJEOEPKriC5:7jDcTxzTnKD8p2HVfGQUHF14ugAlu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader pub6 backdoor trojan discovery
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Smokeloader family
  smokeloader
- Loads dropped DLL
behavioral3 behavioral4
- Target
  arnatic_3.exe
- Size 680KB
- SHA256 d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
- MD5 7837314688b7989de1e8d94f598eb2dd
- SHA1 889ae8ce433d5357f8ea2aff64daaba563dc94e3
- SHA512 3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
- SSDEEP 12288:Umn1vBXNJl0P3ZbcCAjqH0d5Q+qUH6wyZQMvvdgMiCIT:n1vJNJla39cGH0d+7sOlQCIT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  arnatic_4.exe
- Size 972KB
- SHA256 d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
- MD5 5668cb771643274ba2c375ec6403c266
- SHA1 dd78b03428b99368906fe62fc46aaaf1db07a8b9
- SHA512 135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
- SSDEEP 24576:r2FhEQuE3w782S+UWIO5/6TNkdBAnlXG6+Z1mbXRV:Q/3w782SzWn5/akUlXF+Z1IBV
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  arnatic_5.exe
- Size 780KB
- SHA256 46836190326258f65c9dbc1930b01e9d3de04996a1a2c79e39a36c281d79fe0a
- MD5 fd4160bc3c35b4eaed8c02abd8e2f505
- SHA1 3c7bcdc27da78c813548a6465d59d00c4dc75bba
- SHA512 37e671e355c6a533c3273f2af12277b4457719e9b2d4fa9859386eae78010a9be6e63941f85b319ce5c9f98867f82a067bca16c208d2d38dee9f0fee0f656895
- SSDEEP 24576:i77o8t0b5e8dzMdQG/6dfwun9elTFl64D:1jdgdR/+IunmTvxD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
behavioral10 behavioral9
- Target
  arnatic_6.exe
- Size 387KB
- SHA256 e607c6376ebb6db55e15852b51dfe666a09eb498c00cc86be9491564b5751c1d
- MD5 c549246895fdf8d8725255427e2a7168
- SHA1 ae7e4d99b82e6aba4366b34eba32b750d75a0234
- SHA512 b6e8694d3e2bea07072dc643e6c2fe96defc2c8f2f7d9364e7cc1e8568039e340d81c541a8fbb91cd5e9b41b2b97716c0d22844cf179c16b53f96b7f64efc41a
- SSDEEP 12288:B1alverQ2vhIc9fNS0JHz/WJUCUldYIwhW3ofgKzb:La
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat ani discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Suspicious use of SetThreadContext
behavioral11 behavioral12
- Target
  arnatic_7.exe
- Size 397KB
- SHA256 14cb2597414f705abc44a0c54322f995d4ac54b75b50daf64dc3b61895c9f6ea
- MD5 fe5c49e95574a208cdcd0cbbd38d4e04
- SHA1 c79e4a68e3499f66d6ed628911aed4868ce362ea
- SHA512 cfbb2e8b3cf7fe2729ec3189ed18379251a8ed0b9803f3290bfe11be149331b79ec063eb4b506ee18b00d363c2b4b58b6c5d979ee8f03f9277735b5f5fab91a7
- SSDEEP 6144:RgG2QIaoviJXS4tkOGhK85JOMnfJ/z1ZLdQKFKRsoVyhcdKriC:x2QfoviJC4t0K850MfJ/z1rQKFKNtdl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat cana discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
behavioral13 behavioral14
- Target
  null.exe
- Size 445KB
- SHA256 91a7a0dd8930ad66fc44cac3720d7db83fda6f9902c967e47bec0d67cafc6631
- MD5 f3a5853a448abbe8b10144d11401d835
- SHA1 3b1faf00ff991c603fd6c9b01ba1f01e535bf5d4
- SHA512 9c6b30a077859dfdc2e5d59d451096bc5089b3be8f44c7787cb4e82462789b50925964c2048ac7989699b47421622ed1d4c01507e56c87d7d5e83ef5253844cc
- SSDEEP 12288:3kcf3zuGM5Zyc2YBXzziGlTA7W/+PzSYF6ey:3D3zuGMPA8TAvzuey
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

fickerstealer discovery infostealer
- Fickerstealer
  Ficker is an infostealer written in Rust and ASM.
  infostealer fickerstealer
- Fickerstealer family
  fickerstealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral15 behavioral16