General

  • Target

    archive_37.zip

  • Size

    26.8MB

  • MD5

    ceaeb7b9a45b277a284122ad8b2a3b65

  • SHA1

    afba0d3ac06e4c91d6830757c7883dd539a7b9a6

  • SHA256

    805c5709be7589073f6c90410ba05d8d4240ba487fe7c8febf2de9ba214a489e

  • SHA512

    1414ef4e60a6e9fa73e35d733eadd9eb8860ddfea0a0de51ea8eff6380f1faba8b879f2bcfd14f6f20c9ecdef3977dc481b490088a52468ea6e7f08686d9133e

  • SSDEEP

    786432:jF6FPbVIWTyQ37zdWnoIgmiifhwG//yxNmPaLa:jYpSWeQfvmayp

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1352345083734790154/GFci6XX6Mp9mYiOa2PuPVyv_7j7VNbxaCj4Wmx3Z_uGkJGLEHVhy1aRAlSuaZsbKm6Eb

Extracted

Family

njrat

Version

0.7d

Botnet

amore

C2

paodequeijo.ddns.net:1177

Mutex

19990fd2343322c1203853f7bdd329ed

Attributes
  • reg_key

    19990fd2343322c1203853f7bdd329ed

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

RAYZ

C2

rayz511.ddns.net:4744

Mutex

066c35335fc49adbd3a75923ee3411ba

Attributes
  • reg_key

    066c35335fc49adbd3a75923ee3411ba

  • splitter

    |'|'|

Extracted

Family

xworm

Version

3.0

C2

26.ip.gl.ply.gg:54093

Mutex

b1csUhIjEU2ZVYZy

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Umbral payload 1 IoCs
  • Detect Xworm Payload 1 IoCs
  • Njrat family
  • Umbral family
  • Xworm family
  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_37.zip
    .zip
  • 94975fe621437bc551de379ca5db04f88554915fa00e95a8595116a5e91d35cd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 94c020786bf74ea45e95666a68b1d21d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 94c7c87a82c5b86f793f2553cc5a6c20.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94dd6189328a24ea86b9726e0ff01aba18c8b2d13cdd59dcdedf9ae19b9700a1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94e2ada20e21670b71abcc87c81ea0f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 952e0a7f82d06cd737223c4fe0c0d133.exe
    .exe windows:5 windows x86 arch:x86

    7a25240705d7070e2a41d13d53e26b29


    Headers

    Imports

    Sections

  • 953e99960b6bb27c1953eb4c62949b32b63482f7f5613bf53ae7751bb9678140.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9576cc7c1d016017905b260b127b983f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 959c2d37a1e94337957c5323aab9bf19.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 95cc71e95ccf96ee404de6261589d09ec40cc8e5536356806e23b2b8ba21fdeb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 95fc2287fc4fea75666b56cfd668d72c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 960c033d3033f9058766fe5f229e94401874404c1df50c73856346dc7141a104.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96591b574924a1846cfccfedd4cfd584f84e920dc06b5ce05a581a8a067c79ff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9695505ced3961f59e27022cd01b53f6a05fd1dc98c77f3f4d4b1c16aa72b8e7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96959cb1423fd801a2e3d718868a3776.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96985d97b017d4c59db75bdbab49f82d464e90407987be456b1b0ba7f1b748da.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96baaf7c6a7f8d0133cdbbc9b1f0401ea230cfe32a6204ab7f00c6902ba376cb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96bee785af9882016c45de28d4626937137c6beb575357216a77105e24131c86.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 972fed157c3df3fcc288684694cafc78e2d6284af0c61853d320ce9e54883278.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 974b20b3b529c9cc80b31eb587db37f94fecd52322514021bec3c2b6b233f6b9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 974fb8df77001cecdfe21fedb9c28f64.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97870d34a8ae1888df6476246135ae4fd68e74c83fd59989e82e8e45afc6f009.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97909cfabff33c3c157efccb1b828891.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9791b12911fb70b728995c7e53b3e1a6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97bc716103906f4c89bc5c11d06489a1c86c05c594e0754dafa7f9db2b703d40.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 97e8274bac02d9645ca9676c4d6ce2d8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97f86e89bb74eb9c06e17f298884b28dc38e062aadc91e4b96a8faa5b4d6e08a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 982af8d4ea737b8b20626e4cbd9d62f62e74a9d25d0e013f48563a4186b5a84b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 983b1042b16644592d90db0e29a6b929.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 984ee643e00ac586b2f729cb092ee0e8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 98a84bfb3367dfe6ada73f7ae5a3549a7317f97da77d1902f8c1f7c7c826d47b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 98ab58f0b4b94c70e3658c780e7e31fc1b27e2ed9c9920989e5c0d528214ce55.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections