Extracted

Extracted

• • Target

    2Bob_Download/Update.exe

  • Size

    210KB

  • MD5

    d412df3af3c10af259fd4cc58e68f00b

  • SHA1

    2de05f08b05fb0abb4b24616db00d0ce1dec420e

  • SHA256

    083f0f217bff41523e9faa49bb13e9e5d691a3c51341b12d0c4829d8cfc33292

  • SHA512

    9bcf5dca3811bed78e59bca04ca934965a93b00c53769de477f33d465279ec10d6355a66e841cecf439d783721784378fd570c0a7ce6af00c3c16aa58a29d808

  • SSDEEP

    3072:01hoF2jJ6wiPa1XzwIxJLp7tUE1NgBS5Bs//dm63NzzEfWw:01hnJ6D1IxPtUyNrsHdmqEf

  Score

  10^/10

  redlinesectopratxwormmetindefense_evasiondiscoveryexecutioninfostealerpersistencerattrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2

• • Target

    2Bob_Download/d3dcompiler_47.dll

  • Size

    3.5MB

  • MD5

    2f2e363c9a9baa0a9626db374cc4e8a4

  • SHA1

    17f405e81e5fce4c5a02ca049f7bd48b31674c8f

  • SHA256

    2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df

  • SHA512

    e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924

  • SSDEEP

    49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG

  Score

  3^/10

  discovery
  behavioral3

• • Target

    2Bob_Download/ffmpeg.dll

  • Size

    2.5MB

  • MD5

    9172f8dd983a471ceed9ee659e59a544

  • SHA1

    38bcf3bc620f9f21530ee283df82c426410740eb

  • SHA256

    b82a75025eeb8a9e0417a5a957e374833121dc72d69bfdb56d22b9f504dfb093

  • SHA512

    6fba1b634f5f7b4245ba5a8d9f9f790266d15c062399c3160752ca89f79a7ccb3933e2fb83a18f2f31fd941624339540523da86a8e94fd13cc345422113f6b3e

  • SSDEEP

    49152:mHX9HL2Iv1LDjOzm8H92kpGaWJlAtksQcUff:KX9HLjdL/OzboAHWb6kDff

  Score

  3^/10

  discovery
  behavioral4behavioral5

• • Target

    2Bob_Download/start_bob.exe

  • Size

    6.9MB

  • MD5

    4243f9bda388a571007dc386681bfdd8

  • SHA1

    b9f38a752853f963079fd1d9586a50026345bac1

  • SHA256

    028302c2ef54170e3b8b2cce17e6e0d8c1e46c9db569dcf7f8acfbdf83d7ffaf

  • SHA512

    f8862836f290364809c25dcd46703b149d9ad0cc5ee0fdbaefc737454602f522ed155b0d2bb5b544ed84d8d2e13e86039f09e861c13bc8aff65ba3b5b64db1a7

  • SSDEEP

    98304:6iDjWM8JEE1rkamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRaYKJJcGhEIFWa:6i0VeNTfm/pf+xk4dWRatrbWOjgKN

  Score

  8^/10

  upxcollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral6behavioral7