General
- Target c6897ee5e6e0c63e0cf1866460859894664359d397f9d453546adf12c7794818
- Size 94.7MB
- Sample241109-exalsazpck
- SHA256 c6897ee5e6e0c63e0cf1866460859894664359d397f9d453546adf12c7794818
Malware Config
Extracted
-
redline
-
Ninja0809
-
185.92.73.140:80
Extracted
-
44caliber
-
https://discord.com/api/webhooks/854449200544481340/h9Qp-FHl7aROvxHN_j_GBe2W_7GEv-jYyr5ljRUrqO18MRY3RYt72njct-cF-n2sdbCe
Extracted
-
redline
-
asap
-
45.14.49.109:54819
Extracted
-
redline
-
boss8
-
109.248.201.150:63757
Targets
-
- Target Bird.exe
- Size 1.9MB
- SHA256 822c95f975773e71f49d3ed2c9afa87d6d27d245c7f5a4a9439278e27ee0ae64
Score10/10-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Crystal.exe
- Size 3.0MB
- SHA256 a35bb31351cf385fe52b27c02642f2f99aed0d8fd472b4df12bf508faf3426d3
Score10/10-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Install.exe
- Size 317KB
- SHA256 1d322ad6c295b0ee8a552e96ac231c4d9259141c9ed22f7319c7f169eaecee71
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
- Target Minecraft_v4.4.exe
- Size 1.3MB
- SHA256 172b6209ca78d8006297f41fded71268689f8b9be88513673af4420c12176c75
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Suspicious use of SetThreadContext
-
- Target NewHacks.exe
- Size 1.1MB
- SHA256 4732655de9b6a0497a825ab53ef9e8c3db1a9d1520d1ae505ec2b07df305cef1
Score10/10-
Detects Echelon Stealer payload
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon family
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Setup.exe
- Size 373KB
- SHA256 574e22b44f2b1a0af1e8344a2e674d62c246287fa41c9ee3725120bc329a8a89
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Sectoprat family
-
Suspicious use of SetThreadContext
-
- Target Software patch v2.0.5.exe
- Size 3.1MB
- SHA256 010e5cf08f24b0b769747b20d38324e7ea5b3633cc72832a07cb8769b126dd0f
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target file3.exe
- Size 743KB
- SHA256 1db3436f625cebe977fb3a664dda374d3873e50d4f4f46c50a258949905f7494
Score8/10-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target forcenitro2.4.1.exe
- Size 78.9MB
- SHA256 a5c3478916ed2c028f824b22b73fc10699be8640b308e5986b7490a1ac818da3
Score7/10-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target nitro_gen.exe
- Size 6.9MB
- SHA256 d684eb2255665b6953a3ce3f23721d4130987ffa61ad69482fd706392ab9bf3e
Score10/10-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2