General

  • Target

    archive_37.zip

  • Size

    26.8MB

  • MD5

    ceaeb7b9a45b277a284122ad8b2a3b65

  • SHA1

    afba0d3ac06e4c91d6830757c7883dd539a7b9a6

  • SHA256

    805c5709be7589073f6c90410ba05d8d4240ba487fe7c8febf2de9ba214a489e

  • SHA512

    1414ef4e60a6e9fa73e35d733eadd9eb8860ddfea0a0de51ea8eff6380f1faba8b879f2bcfd14f6f20c9ecdef3977dc481b490088a52468ea6e7f08686d9133e

  • SSDEEP

    786432:jF6FPbVIWTyQ37zdWnoIgmiifhwG//yxNmPaLa:jYpSWeQfvmayp

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1352345083734790154/GFci6XX6Mp9mYiOa2PuPVyv_7j7VNbxaCj4Wmx3Z_uGkJGLEHVhy1aRAlSuaZsbKm6Eb

Extracted

Family

njrat

Version

0.7d

Botnet

amore

C2

paodequeijo.ddns.net:1177

Mutex

19990fd2343322c1203853f7bdd329ed

Attributes
  • reg_key

    19990fd2343322c1203853f7bdd329ed

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

RAYZ

C2

rayz511.ddns.net:4744

Mutex

066c35335fc49adbd3a75923ee3411ba

Attributes
  • reg_key

    066c35335fc49adbd3a75923ee3411ba

  • splitter

    |'|'|

Extracted

Family

xworm

Version

3.0

C2

26.ip.gl.ply.gg:54093

Mutex

b1csUhIjEU2ZVYZy

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain
1
oqhn/IwbrMoi76CakI0YfQ==

Signatures

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Umbral payload 1 IoCs
  • Detect Xworm Payload 1 IoCs
  • Njrat family
  • Umbral family
  • Xworm family
  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_37.zip
    .zip
  • 94975fe621437bc551de379ca5db04f88554915fa00e95a8595116a5e91d35cd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 94c020786bf74ea45e95666a68b1d21d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 94c7c87a82c5b86f793f2553cc5a6c20.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94dd6189328a24ea86b9726e0ff01aba18c8b2d13cdd59dcdedf9ae19b9700a1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 94e2ada20e21670b71abcc87c81ea0f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 952e0a7f82d06cd737223c4fe0c0d133.exe
    .exe windows:5 windows x86 arch:x86

    7a25240705d7070e2a41d13d53e26b29


    Headers

    Imports

    Sections

  • 953e99960b6bb27c1953eb4c62949b32b63482f7f5613bf53ae7751bb9678140.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 9576cc7c1d016017905b260b127b983f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 959c2d37a1e94337957c5323aab9bf19.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 95cc71e95ccf96ee404de6261589d09ec40cc8e5536356806e23b2b8ba21fdeb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 95fc2287fc4fea75666b56cfd668d72c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 960c033d3033f9058766fe5f229e94401874404c1df50c73856346dc7141a104.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96591b574924a1846cfccfedd4cfd584f84e920dc06b5ce05a581a8a067c79ff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9695505ced3961f59e27022cd01b53f6a05fd1dc98c77f3f4d4b1c16aa72b8e7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96959cb1423fd801a2e3d718868a3776.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96985d97b017d4c59db75bdbab49f82d464e90407987be456b1b0ba7f1b748da.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96baaf7c6a7f8d0133cdbbc9b1f0401ea230cfe32a6204ab7f00c6902ba376cb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 96bee785af9882016c45de28d4626937137c6beb575357216a77105e24131c86.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 972fed157c3df3fcc288684694cafc78e2d6284af0c61853d320ce9e54883278.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 974b20b3b529c9cc80b31eb587db37f94fecd52322514021bec3c2b6b233f6b9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 974fb8df77001cecdfe21fedb9c28f64.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97870d34a8ae1888df6476246135ae4fd68e74c83fd59989e82e8e45afc6f009.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97909cfabff33c3c157efccb1b828891.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9791b12911fb70b728995c7e53b3e1a6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97bc716103906f4c89bc5c11d06489a1c86c05c594e0754dafa7f9db2b703d40.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 97e8274bac02d9645ca9676c4d6ce2d8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 97f86e89bb74eb9c06e17f298884b28dc38e062aadc91e4b96a8faa5b4d6e08a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 982af8d4ea737b8b20626e4cbd9d62f62e74a9d25d0e013f48563a4186b5a84b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 983b1042b16644592d90db0e29a6b929.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 984ee643e00ac586b2f729cb092ee0e8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 98a84bfb3367dfe6ada73f7ae5a3549a7317f97da77d1902f8c1f7c7c826d47b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 98ab58f0b4b94c70e3658c780e7e31fc1b27e2ed9c9920989e5c0d528214ce55.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.