General

  • Target

    6e0232bbb2c5acff98a3726b808d7e0343be831656849ff82ccdc49631ee47d6

  • Size

    1.8MB

  • Sample

    250329-bwpsjav1d1

  • MD5

    7988ece243a744701d58da578abdf90e

  • SHA1

    077d464f60b8c9e5bb40f26935363f263c655cd6

  • SHA256

    6e0232bbb2c5acff98a3726b808d7e0343be831656849ff82ccdc49631ee47d6

  • SHA512

    32689d3a7bcb3351c786b6683ab2d7c0fc40b7f3dadb26d21d73b38fc40898913ab70fefc1b2d497b25e9c921c5c223803f0f4de56dcd390ca1f387b25c2da28

  • SSDEEP

    24576:wU/l6R1236C3vZHRUuHmFsl6RfGchgfAZZgLJwaBfzvEjj/AQAsX9J9Las4/2SHt:wU/13vZHRTdCGqpUHxzvIAdEMOk6S

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

lumma

C2

https://wxayfarer.live/ALosnz

https://oreheatq.live/gsopp

https://xcastmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://advennture.top/GKsiio

https://7targett.top/dsANGt

https://smeltingt.run/giiaus

https://ferromny.digital/gwpd

https://6castmaxw.run/ganzde

https://targett.top/dsANGt

https://skynetxc.live/AksoPA

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://apixtreev.run/LkaUz

https://tsparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

https://cosmosyf.top/GOsznj

https://esccapewz.run/ANSbwqy

https://touvrlane.bet/ASKwjq

Extracted

Family

vidar

Version

13.3

Botnet

11373d37b176b52c098f600f61cdf190

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Targets

    • Target

      6e0232bbb2c5acff98a3726b808d7e0343be831656849ff82ccdc49631ee47d6

    • Size

      1.8MB

    • MD5

      7988ece243a744701d58da578abdf90e

    • SHA1

      077d464f60b8c9e5bb40f26935363f263c655cd6

    • SHA256

      6e0232bbb2c5acff98a3726b808d7e0343be831656849ff82ccdc49631ee47d6

    • SHA512

      32689d3a7bcb3351c786b6683ab2d7c0fc40b7f3dadb26d21d73b38fc40898913ab70fefc1b2d497b25e9c921c5c223803f0f4de56dcd390ca1f387b25c2da28

    • SSDEEP

      24576:wU/l6R1236C3vZHRUuHmFsl6RfGchgfAZZgLJwaBfzvEjj/AQAsX9J9Las4/2SHt:wU/13vZHRTdCGqpUHxzvIAdEMOk6S

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detect Vidar Stealer

    • Detects Healer an antivirus disabler dropper

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies security service

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

    • Stops running service(s)

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Enumerates processes with tasklist

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks