General
-
Target
JaffaCakes118_669ae7546f43d4f4c06680ccf97908e524ad1ccd818d13e2cc8460619ce753a3
-
Size
6.0MB
-
Sample
241225-d5klaawrbq
-
MD5
3fcd3282025425bc4399e1e31bfee2da
-
SHA1
a076249925b6469a5a175b98ac74535fc1c164f0
-
SHA256
669ae7546f43d4f4c06680ccf97908e524ad1ccd818d13e2cc8460619ce753a3
-
SHA512
0610df228fe965062df687b196f09b46d1e2d6ad7fa83d362252391cc34c644ac1dcb6796f36b9497f5d6c22afda891d4a98eba69ac8b28155ad724f68e2f31c
-
SSDEEP
196608:URbU+g2If7N0ACTMx0apynL/6TKJImjcqteZ3zWARi:UZFg2ApaTMjynuTKmuSU
Static task
static1
Behavioral task
behavioral1
Sample
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
socelars
http://www.yarchworkshop.com/
Extracted
redline
media14n
65.108.69.168:13293
-
auth_value
db1bd9b56a9c8bae94bb9c3ceead1829
Extracted
redline
v2user1
159.69.246.184:13127
-
auth_value
0cd1ad671efa88aa6b92a97334b72134
Extracted
vidar
49.1
915
https://noc.social/@sergeev46
https://c.im/@sergeev47
-
profile_id
915
Targets
-
-
Target
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277
-
Size
6.0MB
-
MD5
86ccfd1a65f0462d8e9f0f6f8afdfb56
-
SHA1
81d24059fc2153dcee703c5a15ddbf05bdf40dc0
-
SHA256
7e937f29320a38d6ed0e384bc19cc45dd3b06c32edb635a905663d063d226277
-
SHA512
a57371adebbe59510b6068f8b204ab296d34f8f0bdc97926ed2c239ff5d4d4521cc2b7fbd39cd26045a219754a087dca9e0f07189fafbeb77f93c3da2d467372
-
SSDEEP
196608:JCkC/es5dTeoJSnAaokBCXno+6Rj815MJxQP:JEmsXTeE5ahonJX6e
-
Detect Fabookie payload
-
Fabookie family
-
Nullmixer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Socelars family
-
Socelars payload
-
Vidar family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Vidar Stealer
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-
-
-
Target
setup_installer.exe
-
Size
6.0MB
-
MD5
cb6ea932807f63821715e87a32d96ba6
-
SHA1
cc2fb753d385683d6f972adab5b3148ca30d75c9
-
SHA256
aa401b09d4b6ec37c7159a9b025500993642573bc32b1e78aaea25c2fe168c57
-
SHA512
acc3a31e1753e3185674f57c870a410e9ca6aa139fd43384845ebd51cacebb682e1a70a65acb170859b71f7562b9717d2fca8c192dfc366fcf16d9477dc4d065
-
SSDEEP
98304:xXCvLUBsgXkIzHTp32FUbhKMr7+dbQQ9bCGJjK6f9SIoYg8FDJHgiCSdUs+ZRjWy:xULUCgUuHTsFUbrwzm6M1x81tLdUlPWy
-
Detect Fabookie payload
-
Fabookie family
-
Nullmixer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Socelars family
-
Socelars payload
-
Vidar family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Vidar Stealer
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1