Overview

overview

10

Static

static

10

0811cf7c27...de.exe

windows7-x64

9

0dd0b31f05...24.exe

windows7-x64

7

1ad888606f...e0.exe

windows7-x64

3

1c77a07e45...95.exe

windows7-x64

10

23f1c183af...bc.exe

windows7-x64

10

38e891599d...90.exe

windows7-x64

10

3a13e092e9...db.exe

windows7-x64

4

3b9dabd99d...82.exe

windows7-x64

3

58fe9776f3...06.exe

windows7-x64

10

5ab93bd422...11.exe

windows7-x64

3

6b06c25fc6...43.exe

windows7-x64

10

6cc8001c9b...07.exe

windows7-x64

1

73ca5dd6d4...3f.exe

windows7-x64

10

7b931d48ea...f0.exe

windows7-x64

10

7d6892645b...0f.exe

windows7-x64

10

9036aeb570...7e.exe

windows7-x64

3

9b6289a8bf...2b.exe

windows7-x64

8

acf2b76704...a7.exe

windows7-x64

3

af2f191f8d...53.exe

windows7-x64

10

cc7045d9fe...ab.dll

windows7-x64

10

d1a6bd542d...a8.exe

windows7-x64

10

efe947e0a8...69.exe

windows7-x64

10

f13edd0b86...9f.exe

windows7-x64

10

Resubmissions

27/11/2024, 13:29

241127-qrb37svpcv10

27/11/2024, 09:27

241127-le54astrfj10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Unique_Icons_But_Unknown_Malware_2.rar
  • Size 2.3MB
  • Sample241127-le54astrfj
  • SHA256 fa3f7a4c1502f499a481b56f5e7c185876626e3d00110d84e09652f98b776aff
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blacknetchaoscrimsonratdiamondfoxeternitygoziguloadermafiaware666mazenjratpony31707412hackedbankerbotnetcollectioncredential_accessdefense_evasiondiscoverydownloaderevasionexecutionguloaderimpactinfostealerisfbpersistenceprivilege_escalationransomwareratspywarestealertrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • cheat12.ddns.net:57

Mutex

  • a412988a99c974058615f1975119a5d1

Attributes
  • reg_key

    a412988a99c974058615f1975119a5d1

  • splitter

    |'|'|

Extracted

Family

  • blacknet

Botnet

  • HacKed

C2

  • https://xblackeyex.000webhostapp.com/blacknet/

Mutex

  • BN[SNqrYexG-0655563]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    svchost.exe

  • splitter

    |BN|

  • start_name

    17d5d9a29524a220af2c5580f0145c42

  • startup

    false

  • usb_spread

    false

Extracted

Family

  • pony

C2

  • http://butterchoco.net/admin/bull/gate.php

Extracted

Family

  • guloader

C2

  • https://drive.google.com/uc?export=download&id=1pWIXSVxobqZoSDMKYuItyAIYUIZhxr8a

xor.base64

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://frameupds.info/rwrw66/2222z.php

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://frameupds.info/rwrw66/1111z.php

Extracted

Family

  • crimsonrat

C2

  • 172.245.247.112

Extracted

Family

  • gozi

Attributes
  • build

    217161

Extracted

Family

  • gozi

Botnet

  • 7412

C2

  • signin.microsoft.com

  • aaaa.bar

  • cccc.casa

  • wwwww.bar

Attributes
  • base_path

    /jdraw/

  • build

    250211

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • extension

    .crw

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Extracted

Family

  • gozi

Botnet

  • 3170

C2

  • oozoniteco.com

  • cetalischi.com

  • duvensteut.com

Attributes
  • build

    217161

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
    • Size 258KB
    • SHA256 0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    credential_accessdiscoveryransomwarespywarestealer

    • Renames multiple (6841) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1
    • Target
      0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
    • Size 184KB
    • SHA256 0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer
    behavioral2
    • Target
      1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
    • Size 188KB
    • SHA256 1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3
    • Target
      1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
    • Size 114KB
    • SHA256 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    eternitydefense_evasiondiscoveryevasionexecutionimpactransomware

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Eternity family

      eternity

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Disables Task Manager via registry modification

      evasion
    behavioral4
    • Target
      23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
    • Size 169KB
    • SHA256 23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral5
    • Target
      38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
    • Size 265KB
    • SHA256 38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    gozi3170bankerdiscoveryisfbtrojan
    behavioral6
    • Target
      3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
    • Size 184KB
    • SHA256 3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral7
    • Target
      3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
    • Size 185KB
    • SHA256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral8
    • Target
      58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
    • Size 506KB
    • SHA256 58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mazecredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealertrojan
    behavioral9
    • Target
      5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
    • Size 189KB
    • SHA256 5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10
    • Target
      6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
    • Size 156KB
    • SHA256 6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdiscoverydownloaderguloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader payload

      guloader

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral11
    • Target
      6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
    • Size 156KB
    • SHA256 6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
    • Size 212KB
    • SHA256 73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral13
    • Target
      7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
    • Size 82KB
    • SHA256 7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    crimsonratrat

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

      ratcrimsonrat

    • Crimsonrat family

      crimsonrat

    • Executes dropped EXE

    behavioral14
    • Target
      7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
    • Size 247KB
    • SHA256 7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blacknethackedpersistencetrojan

    • BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • BlackNET payload

    • Blacknet family

      blacknet

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral15
    • Target
      9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
    • Size 87KB
    • SHA256 9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral16
    • Target
      9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
    • Size 86KB
    • SHA256 9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    evasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral17
    • Target
      acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
    • Size 253KB
    • SHA256 acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral18
    • Target
      af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
    • Size 317KB
    • SHA256 af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    diamondfoxbotnetdiscoveryinfostealerstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • Diamondfox family

      diamondfox

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

      infostealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral19
    • Target
      cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.exe
    • Size 256KB
    • SHA256 cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    gozi7412bankerdiscoveryisfbtrojan
    behavioral20
    • Target
      d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
    • Size 273KB
    • SHA256 d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mafiaware666discoveryransomware

    • Detect MafiaWare666 ransomware

    • MafiaWare666 Ransomware

      MafiaWare666 is ransomware written in C# with multiple variants.

      ransomwaremafiaware666

    • Mafiaware666 family

      mafiaware666

    • Renames multiple (3494) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    behavioral21
    • Target
      efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
    • Size 161KB
    • SHA256 efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral22
    • Target
      f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
    • Size 188KB
    • SHA256 f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomware

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

4
T1552

Credentials In Files

4
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks

static1

hackedeternitynjratblacknetmafiaware666ponychaos
Score
10/10

behavioral1

credential_accessdiscoveryransomwarespywarestealer
Score
9/10

behavioral2

credential_accessdiscoveryspywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

eternitydefense_evasiondiscoveryevasionexecutionimpactransomware
Score
10/10

behavioral5

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral6

gozi3170bankerdiscoveryisfbtrojan
Score
10/10

behavioral7

discovery
Score
4/10

behavioral8

discovery
Score
3/10

behavioral9

mazecredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealertrojan
Score
10/10

behavioral10

discovery
Score
3/10

behavioral11

guloaderdiscoverydownloaderguloader
Score
10/10

behavioral12

Score
1/10

behavioral13

discoveryexecution
Score
10/10

behavioral14

crimsonratrat
Score
10/10

behavioral15

blacknethackedpersistencetrojan
Score
10/10

behavioral16

discovery
Score
3/10

behavioral17

evasionpersistenceprivilege_escalation
Score
8/10

behavioral18

discovery
Score
3/10

behavioral19

diamondfoxbotnetdiscoveryinfostealerstealer
Score
10/10

behavioral20

gozi7412bankerdiscoveryisfbtrojan
Score
10/10

behavioral21

mafiaware666discoveryransomware
Score
10/10

behavioral22

ponycollectioncredential_accessdiscoveryratspywarestealer
Score
10/10

behavioral23

chaosdefense_evasionevasionexecutionimpactransomware
Score
10/10