General

  • Target

    inv.zip

  • Size

    32.9MB

  • MD5

    395df612211bd2ab91e4b5ed7cd8aaab

  • SHA1

    26da38e651426bf17c9c634e168fbd3c67536e46

  • SHA256

    12ca4ad8cd613c8d086cd39a5c6e787c12209f2271ba850817b72eae3cd559da

  • SHA512

    5a8e583a5f9009ea6a7469ac85ffb3c74650f9fbf468464829ccad8c19350efa2e522cd21f6d58769f04104fe78cac582a3eb1044505b28b54e7f5690e66e7b8

  • SSDEEP

    786432:yf1JKtsiYULst2jeCweXzj4x0kJD04lQsccAp2i8NdgpkEB2MSg7b7nnxzmFlwJn:U7iYULSMeCpzoL7TGpMdguEQW7b7nnx9

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

C2

45.136.51.217:2222

45.136.51.217:5173

Mutex

d1mBeqcqGummV1rEKw

Attributes
  • encryption_key

    h9j7M9986eVjQwMbjacZ

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    NET framework

  • subdirectory

    SubDir

Extracted

Family

meduza

C2

62.60.217.159

62.60.244.198

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    xss

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    1.048576e+06

  • port

    15666

  • self_destruct

    true

Extracted

Family

stealc

Botnet

Voov1

C2

http://154.216.17.90

Attributes
  • url_path

    /a48146f6763ef3af.php

Extracted

Family

vidar

Version

11.8

Botnet

0174ec9d0ab5d3dd4d0bbe7415cfa10c

C2

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

amadey

Version

5.04

Botnet

a66537

C2

http://89.110.69.103

http://94.156.177.33

Attributes
  • install_dir

    a121af5f66

  • install_file

    Gxtuum.exe

  • strings_key

    09dbfb77de24d28905cfed05aeef2129

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain

Extracted

Family

vidar

Version

11.8

Botnet

41d35cbb974bc2d1287dcd4381b4a2a8

C2

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

amadey

Version

5.04

Botnet

e8c9ce

C2

http://89.110.69.103

http://94.156.177.33

Attributes
  • install_dir

    bfe2cd46d6

  • install_file

    Gxtuum.exe

  • strings_key

    0e6c50aa38bbb0a80ecad7e6fa3b2c11

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain

Signatures

  • Amadey family
  • DCRat payload 3 IoCs
  • Dcrat family
  • Detect Vidar Stealer 2 IoCs
  • Meduza Stealer payload 4 IoCs
  • Meduza family
  • Quasar family
  • Quasar payload 2 IoCs
  • Stealc family
  • Vidar family
  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

Files

  • inv.zip
    .zip
  • InstalIеr-x86.zip
    .zip
  • InstalIеr-x86/Qts5Svg.dll
  • InstalIеr-x86/SbieMsg.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Sections

  • InstalIеr-x86/SbieShelIPkc.dll
  • InstalIеr-x86/TTDesktop18.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • InstalIеr-x86/cfg/platforms/qwindows.dll
    .dll windows:6 windows x64 arch:x64

    829a516ed7929d66c69478df5f0562c2


    Headers

    Imports

    Exports

    Sections

  • InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Sections

  • TT18.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TTDesktop18.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TikTokDesktop18.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • adjthjawdth.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bxftjhksaef.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • cli.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • dujkgsf.exe
    .exe windows:5 windows x86 arch:x86

    b43a496632b1ed46252f26d650f3ccb2


    Code Sign

    Headers

    Imports

    Sections

  • fdaerghawd.exe
    .exe windows:4 windows x86 arch:x86

    0252f8597a857ddcc37d09e38ea5837d


    Headers

    Imports

    Sections

  • fkydjyhjadg.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • fsyjawdr.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • gjawedrtg.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • hfaewdth.exe
    .exe windows:6 windows x86 arch:x86

    dbd248d6a07e5b5d3562c903534448e7


    Headers

    Imports

    Sections

  • jgesfyhjsefa.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • jhnykawfkth.exe
    .exe windows:6 windows x64 arch:x64

    d18aa68269a30cd13693bec0b3505c6a


    Headers

    Imports

    Sections

  • kfhtksfesek.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • kohjaekdfth.exe
    .exe windows:6 windows x86 arch:x86

    23454d9fe3671c5369b6f4936d1e3735


    Headers

    Imports

    Sections

  • krgawdtyjawd.exe
    .exe windows:5 windows x86 arch:x86

    9688495fa0fb07674109d4238c74f5ee


    Headers

    Imports

    Sections

  • kthkksefd.exe
    .exe windows:6 windows x64 arch:x64

    d18aa68269a30cd13693bec0b3505c6a


    Headers

    Imports

    Sections

  • kyhjasehs.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • kyjjrfgjjsedf.exe
    .exe windows:6 windows x64 arch:x64

    0095cfee1cdfcef936c4c086b6b4fe85


    Headers

    Imports

    Sections

  • lfcdgbuksf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • lkyhjksefa.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • lyjdfjthawd.exe
    .exe windows:5 windows x86 arch:x86

    0b8c3b7f5974cb002243977711d52689


    Headers

    Imports

    Sections

  • nbothjkd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • nhbjsekfkjtyhja.exe
    .exe windows:6 windows x86 arch:x86

    dbd248d6a07e5b5d3562c903534448e7


    Headers

    Imports

    Sections

  • nothjgdwa.exe
    .exe windows:6 windows x86 arch:x86

    407b29a1346b818a12b66f58555063ce


    Headers

    Imports

    Sections

  • nthnaedltg.exe
    .exe windows:5 windows x86 arch:x86

    0b8c3b7f5974cb002243977711d52689


    Headers

    Imports

    Sections

  • pghsefyjhsef.exe
    .exe windows:6 windows x86 arch:x86

    407b29a1346b818a12b66f58555063ce


    Headers

    Imports

    Sections

  • pyjnkasedf.exe
    .exe windows:6 windows x86 arch:x86

    81961373b32efd4098659dcd8637f4f9


    Headers

    Imports

    Sections