General

  • Target

    3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

  • Size

    929KB

  • Sample

    241110-a5qwhsvncw

  • MD5

    0b4df70b068c231a06bb8fcc5a256e34

  • SHA1

    29ecfc8234162b43674d90e137546a4ecd4f65d7

  • SHA256

    3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

  • SHA512

    603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b

  • SSDEEP

    24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY

Malware Config

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:34589

Attributes
  • auth_value

    64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

C2

https://t.me/albaniaestates

https://c.im/@banza4ker

http://146.19.247.187:80

http://45.159.248.53:80

http://62.204.41.126:80

https://t.me/babygun222

http://168.119.59.211:80

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes
  • auth_value

    a516b2d034ecd34338f12b50347fbd92

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

C2

http://193.56.146.177

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Extracted

Family

redline

Botnet

5076357887

C2

195.54.170.157:16525

Attributes
  • auth_value

    0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

C2

insttaller.com:40915

Attributes
  • auth_value

    4a733ff307847db3ee220c11d113a305

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes
  • auth_value

    71466795417275fac01979e57016e277

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

C2

http://45.95.11.158/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

    • Size

      929KB

    • MD5

      0b4df70b068c231a06bb8fcc5a256e34

    • SHA1

      29ecfc8234162b43674d90e137546a4ecd4f65d7

    • SHA256

      3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

    • SHA512

      603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b

    • SSDEEP

      24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks