General

  • Target

    archive_36.zip

  • Size

    43.5MB

  • MD5

    052f3f0f8dc33f830c33c669f501eb89

  • SHA1

    4798b5d67f11066ae072b4697838ca7fa5f10c6e

  • SHA256

    5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

  • SHA512

    ff44a445bcc47eecf7605b71f004e1ccf27c5c241fbc5cdec0de0f9dba8844f212fe7819ee4ba2642df392e0ef9d449661171480ef58bcfb7e28100519e61161

  • SSDEEP

    786432:NayQ37eoEMsjaOAU8EfZlg//yxNrPal07//yxNKyfHd+54J2U/i:HQrEtjoU8DaHVrazK

Malware Config

Extracted

Family

xworm

Version

5.0

C2

design-shipped.gl.at.ply.gg:2938

Mutex

v6oCqftosMfufC9R

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain
1
uOQl+XHTLmtk6o3tQLoOdQ==

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4444

Mutex

wexjwwmjkm

Attributes
  • delay

    1

  • install

    true

  • install_file

    g.exe

  • install_folder

    %AppData%

aes.plain
1
VKUcoOqRLjw4XxJY5VZmswihIu7e76sa

Extracted

Family

xworm

Version

3.0

Mutex

Cr8HKuApCXnXgH6p

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/jV6dpDfD

aes.plain
1
UgMK1tFjbDxeINWnjyWPNw==

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.1.3:1177

hakim32.ddns.net:2000

127.0.0.1:7777

Mutex

d2dc16a9135398a3915a035274a224da

Attributes
  • reg_key

    d2dc16a9135398a3915a035274a224da

  • splitter

    |'|'|

Extracted

Family

xworm

C2

127.0.0.1:2980

consider-sensors.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svhost.exe

Extracted

Family

limerat

Attributes
  • aes_key

    1234

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/euvvTAtq

  • delay

    6

  • download_payload

    false

  • install

    true

  • install_name

    csrss.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 3 IoCs
  • Limerat family
  • Njrat family
  • Xworm family
  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_36.zip
    .zip
  • 90ed1454b881cba4ecd9b651325d4638.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 916cd92d3ac28dded1335ac06764e138.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 916fbe67a7968d2b65d54ae3ce72f3e3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91cce1a9f4562b0cd73d60203cebb76a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91d7fa8d891f603b35c77da7fcc4c552.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 91e6d47bd804e58a4e160993dfdfc3cc.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9221b9eea367a2434dacd850f7b30b3c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 927cd0bd1a26a2158a18e48e682ba3b8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 92efd55895cd60b5057f3fb06ad84c78.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 932a9096cd16630970f2bdc5e6cb9aeb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9349ed4c69ca3e73f345d8df225611fdf0d3e8b857d22544b2bd8c7201feca75.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9358b689cea46d3edbdae211c93fa5ff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9374243171ae468836de20b4457836b1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 937dda2d17b3200b6c1f3bc298681a02.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e2fff01d4cbed10c5de003c66f76b6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e4518f8be88993174dedbaed2eecf6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e8496fe1aefda445c257060935762b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93f148e567e36201aad7b7f173b34740.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93fca00fc3b9392db4b422eff9295b7d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94052c9153ab4d3d7298d19ae248bb5e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 942938880ba13326d37ad2876c8bc4de.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9435027e7dc7035f093411ed1e1581e804dd38c5ff7e782ebe8dc1bad9e99b0b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9442633bc37129713a4da8cf62da43915909205a200d5ae2c8187cb001895e03.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9449bfa134ca7676318b630f9e915f62.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 947e274549a9dce34e67780e63636ee8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94938706afb223591dbdd58979fdd0fc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.