General

  • Target

    7f488663d29ae2691a48e2ea92d39b61812046bc

  • Size

    15.9MB

  • Sample

    241109-1lx4lashpb

  • MD5

    2cb613560f21a4d9464b525743d579ba

  • SHA1

    7f488663d29ae2691a48e2ea92d39b61812046bc

  • SHA256

    3195334294fd75b18e9c0bc593335290b73dcc315d5c25157f2a3225eb595bad

  • SHA512

    f7d8e9eaac912133e09dfda7cf23687564603737ba0b8a2b3ae2718ab984a9bdd910a8ca1b200b249776396c20871584596f3116cd7f79c3856f3c11abe3ba7a

  • SSDEEP

    393216:ZX5F5p4Q+5MJOMkQIytQt0FlkdrjymkK3nBWa:ZXHn4QjJeQI4Hk9jy5Eca

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://212.193.30.29/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

212.192.241.62

Extracted

Family

socelars

C2

http://www.yarchworkshop.com/

Extracted

Family

redline

Botnet

@Tui

C2

185.215.113.44:23759

Attributes
  • auth_value

    f4763503fd39f2719d3cbb75871d93ad

Extracted

Family

vidar

Version

49

Botnet

915

C2

https://mstdn.social/@sergeev43

https://koyu.space/@sergeev45

Attributes
  • profile_id

    915

Extracted

Family

redline

Botnet

v2user1

C2

159.69.246.184:13127

Attributes
  • auth_value

    0cd1ad671efa88aa6b92a97334b72134

Targets

    • Target

      85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db

    • Size

      15.9MB

    • MD5

      5a656240e5e4b464bbc52ec73e22a573

    • SHA1

      c34996d6b7341ebc700315d2c46f001f29b9d718

    • SHA256

      85f5b66f8c0b9dd1838da31024190463ee565d0052f26bbfdaa84d12ed1163db

    • SHA512

      d9a8410b0e93725893a2f704522b753cc3f704ebb85ed22d85e7239b4d36a34a96acc23683ab3a47a00f2c5366fdd4e3e2ff79275bbff1b20d141223491ed9f4

    • SSDEEP

      393216:J+GWzJ4ZdFyVv/jU65oGX5aZ13YzhaaagqMBD4h74ERRgNj:J+ZzmZdGznVX5U3mhhagvcLw

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

    • Fabookie family

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    • Nullmixer family

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Privateloader family

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars family

    • Socelars payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Vidar Stealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Modifies Windows Firewall

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • System Binary Proxy Execution: Odbcconf

      Abuse Odbcconf to proxy execution of malicious code.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      setup_installer.exe

    • Size

      15.7MB

    • MD5

      2c3db571085a0f88cd336201868ede9c

    • SHA1

      26f219c2369c8c4c8ad8e658fa907f73078e274c

    • SHA256

      c9a4ba85ca3416b83d174844eba1c0aeb8b55d316a68e8d6cf7a732b9c14c2fd

    • SHA512

      34d874cd8e1b5567ba9585cdeec5cf80e35475f1f8880194f09cf2005d3f9153b76ffaa5cd6f830b99ef472b9db37546358118bf3dd0f92933662067876dd65d

    • SSDEEP

      393216:x0dgO1ueIzjGEbRXnABu6K06JG+EmsZiaWAuTT5qS:adg2rIPnbRXAQ0lTZVWAuTV3

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

    • Fabookie family

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba family

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    • Nullmixer family

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Privateloader family

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars family

    • Socelars payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Vidar Stealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Modifies Windows Firewall

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • System Binary Proxy Execution: Odbcconf

      Abuse Odbcconf to proxy execution of malicious code.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops Chrome extension

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Modifies boot configuration data using bcdedit

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks