General

  • Target

    5f844573ae53f1461a1fe9fe878d6166074ddde2ed86a3878fdaf8f1e1e81b2f

  • Size

    819KB

  • Sample

    241105-wnt3hawaqe

  • MD5

    5af7ada88775e3949887dd12e0234bb5

  • SHA1

    9fbc382c3b57ab8074664447070f54884882762a

  • SHA256

    5f844573ae53f1461a1fe9fe878d6166074ddde2ed86a3878fdaf8f1e1e81b2f

  • SHA512

    a83040335fd65ebba93931c0ba2e2ba6bc6bb00d72f32dfb922b019ad4f13602da016df22027c686a08df39dfff4694e1c7243c2485d479658297b63e88e5c28

  • SSDEEP

    24576:3Ir/aNpri7YvhQkDRKA19UHj89w338cLW0fR0aW:K/aNpri7YJNKWUHj8q8UW0f5W

Malware Config

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:34589

Attributes
  • auth_value

    64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

5076357887

C2

195.54.170.157:16525

Attributes
  • auth_value

    0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes
  • auth_value

    71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes
  • auth_value

    a516b2d034ecd34338f12b50347fbd92

Extracted

Family

vidar

C2

http://62.204.41.126:80

Extracted

Family

redline

Botnet

RuXaRR_GG

C2

insttaller.com:40915

Attributes
  • auth_value

    4a733ff307847db3ee220c11d113a305

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

C2

http://193.56.146.177

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

C2

http://45.95.11.158/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      9f6b69057e19a7fd08aab0b2df861a65337207dcfac2d6fbd0d1c0a2b75670e7

    • Size

      904KB

    • MD5

      84167d4529f6298e0400499c55d8c7d6

    • SHA1

      f3fb00cffd40e1fc93f1370c2611d94e6a308a39

    • SHA256

      9f6b69057e19a7fd08aab0b2df861a65337207dcfac2d6fbd0d1c0a2b75670e7

    • SHA512

      526bd7ecd2c584ef0aab7fa5315b6e9ab666e495827e4394d322729c411f1e9f58747dc85ce45c57fd8b43e2d6373897bb83f9beed0b0830899ad78687ad5c17

    • SSDEEP

      24576:pAT8QE+kRVNpJc7Y/sDZ0239GhjS9knREHXsW02Ee:pAI+ANpJc7Y60EGhjSmE3sW02Ee

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks