Overview

overview

10

Static

static

10

virusbomb.zip

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    virusbomb.zip

  • Size

    3.0MB

  • Sample

    241204-tvw5bs1kgv

  • MD5

    52917c0a946305fc5559792a8bebf8bd

  • SHA1

    374d7c957fe6633c597e74e086ced767db328f36

  • SHA256

    56f01de80d010ece0209f6b266462b28305a4373b7d5fcafa0268d2f7e3921be

  • SHA512

    ed7f6c6efb52739fb25bdb34140a461b7ef6c80905055b9bb6527c63918982c1b31d1193c293d0c9f2428be1b2ad15fbc823f4d6ae5e3ad05aa2c92535d8218d

  • SSDEEP

    49152:/+PoMNvrqvm2lpQBHZyZTrw1YK7wyI1UcpRxSRIM2jePjiki3EAGPfj/KM2qTHT0:2g02rpuHZyZwR0yI1UuRxrNkNexkjiCE

Score
10/10
gurcuquasartoxiceyeoffice04discoveryratspywarestealertrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/sendMessage?chat_id=5569740835

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

riprealworld.ddns.net:4782

Mutex

6a893031-8f7c-4e00-9e79-83e39719887d

Attributes
  • encryption_key

    3388F603979BF351F677D18F04E7A89AEBEE7BE8

  • install_name

    Windows.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows

  • subdirectory

    SubDir

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/sendMessage?chat_id=5569740835

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdate

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdates?offset=

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdates?offset=1

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdates?offset=87029332

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdates?offset=87029333

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/getUpdates?offset=87029334

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/sendDocument?chat_id=556974083

Targets

    • Target

      virusbomb.zip

    • Size

      3.0MB

    • MD5

      52917c0a946305fc5559792a8bebf8bd

    • SHA1

      374d7c957fe6633c597e74e086ced767db328f36

    • SHA256

      56f01de80d010ece0209f6b266462b28305a4373b7d5fcafa0268d2f7e3921be

    • SHA512

      ed7f6c6efb52739fb25bdb34140a461b7ef6c80905055b9bb6527c63918982c1b31d1193c293d0c9f2428be1b2ad15fbc823f4d6ae5e3ad05aa2c92535d8218d

    • SSDEEP

      49152:/+PoMNvrqvm2lpQBHZyZTrw1YK7wyI1UcpRxSRIM2jePjiki3EAGPfj/KM2qTHT0:2g02rpuHZyZwR0yI1UuRxrNkNexkjiCE

    Score
    10/10
    gurcuquasartoxiceyeoffice04discoveryratspywarestealertrojan

    • Gurcu family

      gurcu

    • Gurcu, WhiteSnake

      Gurcu aka WhiteSnake is a malware stealer written in C#.

      stealergurcu

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • ToxicEye

      ToxicEye is a trojan written in C#.

      rattrojantoxiceye

    • Toxiceye family

      toxiceye

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

4
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks