Resubmissions

19-11-2024 13:59

241119-rawlysxenr 10

10-11-2024 00:55

241110-a97ptswcjr 10

General

  • Target

    aefbc0d077dd909e2a601526bf2b924a7fd895dd202206992cdf0ec0059a02db

  • Size

    819KB

  • Sample

    241110-a97ptswcjr

  • MD5

    156de4ba094b440c091081c7fc3a8008

  • SHA1

    3b08035b243103d601b9aea29c1e5456b6805dc0

  • SHA256

    aefbc0d077dd909e2a601526bf2b924a7fd895dd202206992cdf0ec0059a02db

  • SHA512

    50da1bcbd214df70c214ff1143ee12e5a74e0db23dd193bad6243720f2e2e23011cdb227599a69004efede2d09034a545cd84b82b451b66eee2329cc891fa8de

  • SSDEEP

    24576:rIr8i8NpfK7YzZbcDLIUD9gTjQ9Z/H8cuW0DRo+62V:GGNpfK7Y1aIkgTjQDU1W0DV6Q

Malware Config

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes
  • auth_value

    a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

RuXaRR_GG

C2

insttaller.com:40915

Attributes
  • auth_value

    4a733ff307847db3ee220c11d113a305

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes
  • auth_value

    71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:34589

Attributes
  • auth_value

    64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

5076357887

C2

195.54.170.157:16525

Attributes
  • auth_value

    0dfaff60271d374d0c206d19883e06f3

Extracted

Family

vidar

C2

http://146.19.247.187:80

http://45.159.248.53:80

http://62.204.41.126:80

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

C2

http://45.95.11.158/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

C2

http://193.56.146.177

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      7ad2ecc56160b66356e7b1c0a237bbea3a687e100b3bd9a14c4b4a23bb095d05

    • Size

      904KB

    • MD5

      370447cce517cf145a08d03bd3a7f98d

    • SHA1

      13a9323ed2f5594f37d00c0ad43d0ce41fc99a1b

    • SHA256

      7ad2ecc56160b66356e7b1c0a237bbea3a687e100b3bd9a14c4b4a23bb095d05

    • SHA512

      4bb7897f82c5d84ffad17ea22f0bda7533385d1576b8d5dd04b6f2828cb956918c1b727458f4b72e3ae654493aa146fdf5e591d271193ddf98ae8ffdfe9e361e

    • SSDEEP

      24576:pAT8QE+kFVNpJc7Y/sDZ0239GhjS9knREHXsW02Eljns:pAI+oNpJc7Y60EGhjSmE3sW02Etns

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks