General

  • Target

    add1ddb5275b8cae585d0b34fd5d7c979d628c05ac634ae238ee555f301fda54

  • Size

    844KB

  • Sample

    241109-llngtsscmg

  • MD5

    b3e552cbde43422ab5735734d362087b

  • SHA1

    4efb3feacc9740c6c76b52691ace32fe05006d5e

  • SHA256

    add1ddb5275b8cae585d0b34fd5d7c979d628c05ac634ae238ee555f301fda54

  • SHA512

    4704f7b7be2bbd109a79d2b259c267ae7e9ba4999a367ef1ab17b3e2c9cfb208276393340cf0df09d04d8b6438a891ef6963c5f33d4696ff79d2b891672252e1

  • SSDEEP

    24576:jIrMVpgNpnw7YDZriDHUM/9u1ji91n/8cRW07RP5BTR:+MgNpnw7YlUU8u1ji/UeW07dR

Malware Config

Extracted

Family

vidar

C2

https://t.me/albaniaestates

https://c.im/@banza4ker

http://146.19.247.187:80

http://45.159.248.53:80

https://t.me/babygun222

http://168.119.59.211:80

http://62.204.41.126:80

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:34589

Attributes
  • auth_value

    64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes
  • auth_value

    a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes
  • auth_value

    71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

5076357887

C2

195.54.170.157:16525

Attributes
  • auth_value

    0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

C2

insttaller.com:40915

Attributes
  • auth_value

    4a733ff307847db3ee220c11d113a305

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

C2

http://193.56.146.177

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

C2

http://45.95.11.158/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      b503e95080871d70f3a758124d473ed31a4ede3d2e87d252d3bc878868274023

    • Size

      929KB

    • MD5

      a737b257ab801b1aaf46b684cfd5e42b

    • SHA1

      d66bae3ce29fce2828a41f85b2040df0187fb10b

    • SHA256

      b503e95080871d70f3a758124d473ed31a4ede3d2e87d252d3bc878868274023

    • SHA512

      d02d8a316f5cb61f5bae7174c48ce8c17e2a8e731e23252c7a05653a795c81a6e62eab4a5c71a756b5aadca1f84cfaaeebcaa898bab101987cc4d7f22ba08742

    • SSDEEP

      24576:pAT8QE+kVVNpJc7Y/sDZ0239GhjS9knREHXsW02EBKac:pAI+eNpJc7Y60EGhjSmE3sW02EBS

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks