General

  • Target

    archive_36.zip

  • Size

    43.5MB

  • MD5

    052f3f0f8dc33f830c33c669f501eb89

  • SHA1

    4798b5d67f11066ae072b4697838ca7fa5f10c6e

  • SHA256

    5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

  • SHA512

    ff44a445bcc47eecf7605b71f004e1ccf27c5c241fbc5cdec0de0f9dba8844f212fe7819ee4ba2642df392e0ef9d449661171480ef58bcfb7e28100519e61161

  • SSDEEP

    786432:NayQ37eoEMsjaOAU8EfZlg//yxNrPal07//yxNKyfHd+54J2U/i:HQrEtjoU8DaHVrazK

Malware Config

Extracted

Family

xworm

Version

5.0

C2

design-shipped.gl.at.ply.gg:2938

Mutex

v6oCqftosMfufC9R

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4444

Mutex

wexjwwmjkm

Attributes
  • delay

    1

  • install

    true

  • install_file

    g.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

Version

3.0

Mutex

Cr8HKuApCXnXgH6p

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/jV6dpDfD

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.1.3:1177

hakim32.ddns.net:2000

127.0.0.1:7777

Mutex

d2dc16a9135398a3915a035274a224da

Attributes
  • reg_key

    d2dc16a9135398a3915a035274a224da

  • splitter

    |'|'|

Extracted

Family

xworm

C2

127.0.0.1:2980

consider-sensors.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svhost.exe

Extracted

Family

limerat

Attributes
  • aes_key

    1234

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/euvvTAtq

  • delay

    6

  • download_payload

    false

  • install

    true

  • install_name

    csrss.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 3 IoCs
  • Limerat family
  • Njrat family
  • Xworm family
  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_36.zip
    .zip
  • 90ed1454b881cba4ecd9b651325d4638.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 916cd92d3ac28dded1335ac06764e138.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 916fbe67a7968d2b65d54ae3ce72f3e3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91cce1a9f4562b0cd73d60203cebb76a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91d7fa8d891f603b35c77da7fcc4c552.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91e6d47bd804e58a4e160993dfdfc3cc.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9221b9eea367a2434dacd850f7b30b3c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 927cd0bd1a26a2158a18e48e682ba3b8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 92efd55895cd60b5057f3fb06ad84c78.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 932a9096cd16630970f2bdc5e6cb9aeb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9349ed4c69ca3e73f345d8df225611fdf0d3e8b857d22544b2bd8c7201feca75.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9358b689cea46d3edbdae211c93fa5ff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9374243171ae468836de20b4457836b1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 937dda2d17b3200b6c1f3bc298681a02.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e2fff01d4cbed10c5de003c66f76b6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e4518f8be88993174dedbaed2eecf6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e8496fe1aefda445c257060935762b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93f148e567e36201aad7b7f173b34740.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93fca00fc3b9392db4b422eff9295b7d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94052c9153ab4d3d7298d19ae248bb5e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 942938880ba13326d37ad2876c8bc4de.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9435027e7dc7035f093411ed1e1581e804dd38c5ff7e782ebe8dc1bad9e99b0b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9442633bc37129713a4da8cf62da43915909205a200d5ae2c8187cb001895e03.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9449bfa134ca7676318b630f9e915f62.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 947e274549a9dce34e67780e63636ee8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94938706afb223591dbdd58979fdd0fc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections