Overview

overview

10

Static

static

10

Malware.2024.12.25.7z

windows7-x64

1

Malware.2024.12.25.7z

windows10-2004-x64

1

2024-12-25...19.exe

windows7-x64

2024-12-25...19.exe

windows10-2004-x64

2024-12-25...8a.pdf

windows7-x64

3

2024-12-25...8a.pdf

windows10-2004-x64

3

2024-12-25...0d.pdf

windows7-x64

3

2024-12-25...0d.pdf

windows10-2004-x64

3

2024-12-25...96.exe

windows7-x64

7

2024-12-25...96.exe

windows10-2004-x64

7

2024-12-25...61.exe

windows7-x64

1

2024-12-25...61.exe

windows10-2004-x64

1

2024-12-25...03.pdf

windows7-x64

3

2024-12-25...03.pdf

windows10-2004-x64

3

2024-12-25...62.exe

windows7-x64

10

2024-12-25...62.exe

windows10-2004-x64

10

2024-12-25...25.exe

windows7-x64

1

2024-12-25...25.exe

windows10-2004-x64

1

2024-12-25...6b.exe

windows7-x64

10

2024-12-25...6b.exe

windows10-2004-x64

10

2024-12-25...ec.exe

windows7-x64

1

2024-12-25...ec.exe

windows10-2004-x64

3

2024-12-25...cc.exe

windows7-x64

1

2024-12-25...cc.exe

windows10-2004-x64

3

2024-12-25...3a.exe

windows7-x64

10

2024-12-25...3a.exe

windows10-2004-x64

10

2024-12-25...66.exe

windows7-x64

3

2024-12-25...66.exe

windows10-2004-x64

3

2024-12-25...97.exe

windows7-x64

10

2024-12-25...97.exe

windows10-2004-x64

10

2024-12-25...1d.pdf

windows7-x64

3

2024-12-25...1d.pdf

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Malware.2024.12.25.7z
  • Size 359.1MB
  • Sample250131-v87nnasmdv
  • SHA256 2e96258f3dd21d059f59831295d32d324a849c87bc5a2149a49c97fcf5783558
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
berbewblackmoondcratfakeavfloxifgh0stratlummametasploitneconydnjratquasarsakulasimdaurelaswarzoneratxredhacked by loknlimeaspackv2backdoorbankerdefense_evasiondiscoveryfakeavpersistenceprivilege_escalationpyinstallerratspywarestealerthemidatrojanupxvmprotect

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • berbew

C2

  • http://crutop.nu/index.php

  • http://devx.nm.ru/index.php

  • http://ros-neftbank.ru/index.php

  • http://master-x.com/index.php

  • http://www.redline.ru/index.php

  • http://cvv.ru/index.php

  • http://hackers.lv/index.php

  • http://fethard.biz/index.php

  • http://crutop.ru/index.php

  • http://kaspersky.ru/index.php

  • http://color-bank.ru/index.php

  • http://adult-empire.com/index.php

  • http://virus-list.com/index.php

  • http://trojan.ru/index.php

  • http://xware.cjb.net/index.htm

  • http://konfiskat.org/index.htm

  • http://parex-bank.ru/index.htm

  • http://fethard.biz/index.htm

  • http://ldark.nm.ru/index.htm

  • http://gaz-prom.ru/index.htm

Extracted

Family

  • urelas

C2

  • 218.54.31.226

  • 218.54.31.165

Extracted

Family

  • lumma

C2

  • https://rapeflowwj.lat/api

  • https://crosshuaht.lat/api

  • https://sustainskelet.lat/api

  • https://aspecteirs.lat/api

  • https://energyaffai.lat/api

  • https://necklacebudi.lat/api

  • https://discokeyus.lat/api

  • https://grannyejh.lat/api

  • https://spellshagey.biz/api

  • https://movementby.cyou/api

Extracted

Family

  • neconyd

C2

  • http://ow5dirasuek.com/

  • http://mkkuei4kdsz.com/

  • http://lousta.net/

Extracted

Family

  • njrat

Version

  • 0.7.3

Botnet

  • Lime

C2

  • 192.168.100.59:6522

Mutex

  • Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    9999

Extracted

Family

  • metasploit

Version

  • windows/reverse_tcp

C2

  • 192.168.64.3:4444

Extracted

Family

  • simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HaCkEd bY LoKn

C2

  • customers-edmonton.gl.at.ply.gg:28608

Mutex

  • 5a0e6576524fad771bccf79eb40f7eca

Attributes
  • reg_key

    5a0e6576524fad771bccf79eb40f7eca

  • splitter

    |'|'|

Targets

    • Target
      Malware.2024.12.25.7z
    • Size 359.1MB
    • SHA256 2e96258f3dd21d059f59831295d32d324a849c87bc5a2149a49c97fcf5783558
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      2024-12-25/unknown-df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19
    • Size 404KB
    • SHA256 df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      2024-12-25/unknown-e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a
    • Size 27KB
    • SHA256 e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      2024-12-25/unknown-e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d
    • Size 40KB
    • SHA256 e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      2024-12-25/unknown-e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896
    • Size 380KB
    • SHA256 e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9
    • Target
      2024-12-25/unknown-e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361
    • Size 249KB
    • SHA256 e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      2024-12-25/unknown-e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203
    • Size 565KB
    • SHA256 e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962
    • Size 2.5MB
    • SHA256 e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lummastealerdiscovery

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma
    behavioral15behavioral16
    • Target
      2024-12-25/unknown-e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125
    • Size 182KB
    • SHA256 e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      2024-12-25/unknown-e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b
    • Size 1.3MB
    • SHA256 e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral19behavioral20
    • Target
      2024-12-25/unknown-e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec
    • Size 42KB
    • SHA256 e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      2024-12-25/unknown-ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc
    • Size 29KB
    • SHA256 ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a
    • Size 455KB
    • SHA256 ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blackmoonbankerdiscoverytrojanupx

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25behavioral26
    • Target
      2024-12-25/unknown-ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66
    • Size 2.9MB
    • SHA256 ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      2024-12-25/unknown-ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697
    • Size 2.4MB
    • SHA256 ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • UAC bypass

      defense_evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral29behavioral30
    • Target
      2024-12-25/unknown-ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d
    • Size 27KB
    • SHA256 ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Screensaver

1
T1546.002

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Screensaver

1
T1546.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upxaspackv2ratstealerbackdoorfakeavspywarelimethemidavmprotectpyinstallerhacked by loknxredberbewurelasgh0stratdcratlummawarzoneratneconydfloxiffakeavnjratmetasploitquasarsakulasimda
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
7/10

behavioral10

discovery
Score
7/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

lummastealer
Score
10/10

behavioral16

lummadiscoverystealer
Score
10/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

berbewbackdoordiscoverypersistence
Score
10/10

behavioral20

berbewbackdoordiscoverypersistence
Score
10/10

behavioral21

Score
1/10

behavioral22

discovery
Score
3/10

behavioral23

Score
1/10

behavioral24

discovery
Score
3/10

behavioral25

blackmoonbankerdiscoverytrojanupx
Score
10/10

behavioral26

blackmoonbankerdiscoverytrojanupx
Score
10/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
10/10

behavioral30

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
10/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10