General

  • Target

    archive_27.zip

  • Size

    82.5MB

  • MD5

    a0a31d79f5a5d0effe760a1067d7380d

  • SHA1

    f89716a4a3b125389fd5316dfe439295d059236b

  • SHA256

    f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

  • SHA512

    5a3624677fe54791d63d15fc2d79d676e531156dc710e25064297274831c55a96849cda957cffd9c4c32832a1418b81be1b4f0874b917b8223865b3118cf75f4

  • SSDEEP

    1572864:MEa84yWS9ADl00oDoLSs/L02EEECyM798l2NNTSfJMJRREfjLjvKKE9:MEa8DWnDhoD8SKEELWl2TShMJROfbvz8

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1349737650407604295/kN2hdyzALgg9c2Ia6GKF0wNZZml2dtdpO2NAdLBn8XrNbrC2Y1pvYHXcPUZNzIXn4Pna

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:5574

sets-fatty.gl.at.ply.gg:5574

127.0.0.1:1603

morning-ultimately.gl.at.ply.gg:1603

Mutex

b3PIGP4IGis5HwSz

Attributes
  • install_file

    USB.exe

aes.plain
aes.plain

Extracted

Family

xworm

C2

26.ip.gl.ply.gg:14526

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:6522

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

38.49.43.182:8848

Mutex

DcRatMutex

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchostdc.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

discordrat

Attributes
  • discord_token

    MTM1MjIzMTcwOTc2ODE1OTI4Mg.GP5l5j.qzedntLWXWCJWJMhOo_A7sCtEVYSNyef7zauDM

  • server_id

    1352231905797476362

Extracted

Family

revengerat

Botnet

vikas

C2

192.168.43.133:4040

Mutex

RV_MUTEX-eawrHJfWfhaR

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Umbral payload 1 IoCs
  • Detect Xworm Payload 3 IoCs
  • Discordrat family
  • Njrat family
  • RevengeRat Executable 1 IoCs
  • Revengerat family
  • Umbral family
  • Xworm family
  • Unsigned PE 30 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_27.zip
    .zip
  • 6ea09dc024349dc98b36f4ace0dd0fbf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6ea800eee1fc82ad358d35a7fde8ccd12b93a783300c4a97f7b8a7abcc7d7383.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6ec1c209b158ca6a09569dab997a10da.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f456ca5318d53c7577e67e641dbb36c8380514e08a7c4dd8ba88f15cebded05.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f46a588081210caf9fc5f69f68daa1eb869bfb5658baaa201c7d9f466e3a00c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f6b7ee9a4b8c657931ecaacd04849db.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f723cd9002531ad31487e588d1132bc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f7e5a757226029c4770683df8125105.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f8921f28520259dde636ae0740e643e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f8a4cd4e0092c7cf850cf6434225de4ade9b7eb92d8110bb7cbec7fdc29c10e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f9568a7c563f84e4331fd0954d9ad321f41199035067dca004e1c927c1989ba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6f9d1b3820144f3c5df2673cd155bfe0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6faa2d85ae06f7888287bec8ae3e079b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6fd711c9c2d9499442df85e477e670c6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6fe5c591a1fbdd543b030912700b164a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 700e6ce6f395e4dae14457cc4ab6a8b9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7049426717c981cf0de71a9f23316df5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 70782b22e9ab03b456935b415edd7554.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 70c3d4e54115c02f6f97a45e96901f535fdd55742e909345878345f258fcf2ad.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 70f906e2b0fadfd01987ffac4f2c4c0d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 70fcf8fc394baa72765e9db3c61b7fe39bdb52e975879628d34e26c6a010f832.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 710c647181c003deaba6bd592f17aebf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7137f56f2d17d5b7b130ffb2c21ac5e9ad0fb33b4747da94a3e34ecc03863f5e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 713b311b6d23513f88d580c20920060dd67189f9d34c86e298a797298586be21.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 716b1b85c0f1b7123c86301d495906f9.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 721d6e3cf2910ad2ec0a7c1db92af8b7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7222539ac3b776d1e29fa6791f6b6598.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 722f9ed9fecb754aeaeae58e496b04d1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 723522864e21c2d6a6c93b28c8e2d4ed.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 72396811f24dbf41d1e001b84068ab9e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 72677bb65f9b6ebc7ad631aefa731b24.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections