General

  • Target

    6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59

  • Size

    5.1MB

  • MD5

    e68e1f1dd52861b65b33805901eadb6d

  • SHA1

    65279d96a0a6615743057403bffe381130d0a749

  • SHA256

    6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59

  • SHA512

    8552c053e6096067d279f289c0ff0da5b98dc6835b248f05357bba30db07dc863af17ad5a0135394744d20980a42baba40070cc2c48f4b5637bc143f692ddf79

  • SSDEEP

    98304:sih0mqjgb0TG9ZUUVd6H9qXGMzZDFNno/uZ+1f501jBIFarM9:sihSjBG9ZjUH94r3nLZGqjBU

Malware Config

Extracted

Family

privateloader

C2

http://45.133.1.107/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

51.178.186.149

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

nullmixer

C2

http://wensela.xyz/

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie family
  • Nullmixer family
  • Privateloader family
  • Socelars family
  • Socelars payload 1 IoCs
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

Files

  • 6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59
    .rar
  • setup_installer/Wed0901eb1dae126e32.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • setup_installer/Wed094c47c32b.exe
    .exe windows:5 windows x86 arch:x86

    4cfda23baf1e2e983ddfeca47a5c755a


    Headers

    Imports

    Sections

  • setup_installer/Wed096a1bff61.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • setup_installer/Wed0971f17486f8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • setup_installer/Wed09977fdc12334.exe
    .exe windows:6 windows x86 arch:x86

    3734cc14c8833ea69b7432c7177e21b9


    Headers

    Imports

    Sections

  • setup_installer/Wed09abf83d9c2.exe
    .exe windows:5 windows x86 arch:x86

    81d7345751d04409b2dd22cc99377edb


    Headers

    Imports

    Sections

  • setup_installer/Wed09b2a8bc4f16cb.exe
    .exe windows:5 windows x86 arch:x86

    0f7adf3ddfcd5cd172c9a2547afae4e3


    Headers

    Imports

    Sections

  • setup_installer/Wed09b3a5ca1a712d390.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • setup_installer/Wed09c42cad92c20f79.exe
    .exe windows:5 windows x86 arch:x86

    0f7adf3ddfcd5cd172c9a2547afae4e3


    Headers

    Imports

    Sections

  • setup_installer/Wed09cfb2f9758281d8.exe
    .exe windows:5 windows x86 arch:x86

    8db81cce9914747c7ca79cf056ce5ce6


    Headers

    Imports

    Sections

  • setup_installer/Wed09d27135e5a8b3b.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • setup_installer/Wed09d8d6edfaff2ac.exe
    .exe windows:6 windows x86 arch:x86

    3734cc14c8833ea69b7432c7177e21b9


    Headers

    Imports

    Sections

  • setup_installer/Wed09db0d52c38.exe
    .exe windows:6 windows x86 arch:x86

    d69e4c13e25f0ad622344ac56118c0df


    Headers

    Imports

    Sections

  • setup_installer/Wed09e95ff6b5.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • setup_installer/Wed09f257bb7877d00b2.exe
    .exe windows:6 windows x64 arch:x64

    a760781485268ad462242975d68411d5


    Headers

    Imports

    Sections

  • setup_installer/libcurl.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • setup_installer/libcurlpp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • setup_installer/libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    04f9a5136edc374e78bc81dc8b0d07af


    Headers

    Imports

    Exports

    Sections

  • setup_installer/libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • setup_installer/libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    fc24104becbbff1210c7fd71e49c8b5f


    Headers

    Imports

    Exports

    Sections

  • setup_installer/setup_install.exe
    .exe windows:4 windows x86 arch:x86

    f9fc0ecba4bcf3f4eadacd9b358488bc


    Headers

    Imports

    Sections