General

  • Target

    random.exe

  • Size

    5.4MB

  • Sample

    250329-p4w4gattgs

  • MD5

    0bf31c73f0e95a18595dd60e3ce41359

  • SHA1

    00ab9a13e756265f4e45ae70f6af587a8c8184b5

  • SHA256

    d4cf07f30e19535dd48e4a54dd0e8a5030dff5db91c5e1317dd3d4251c6e3c6d

  • SHA512

    761c571d62e846428f560c99c18ff672ff8ea3354f3d929e9868f06e48ecae569049910dd40893ded90bf38a51d3883ef12a4572f58f6ea2a60262a7e85e527c

  • SSDEEP

    98304:SY8MKMFkmzuwOXs4cYIeDhmzwiI7qyudXcrHwVPDo:pVKMFAwO8rpiQz9eXuRD

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://wxayfarer.live/ALosnz

https://oreheatq.live/gsopp

https://castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://smeltingt.run/giiaus

https://fferromny.digital/gwpd

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://holidamyup.today/AOzkns

https://mtriplooqp.world/APowko

https://xcastmaxw.run/ganzde

https://7targett.top/dsANGt

https://ferromny.digital/gwpd

https://skynetxc.live/AksoPA

https://byteplusx.digital/aXweAX

Extracted

Family

vidar

Version

13.3

Botnet

11373d37b176b52c098f600f61cdf190

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Targets

    • Target

      random.exe

    • Size

      5.4MB

    • MD5

      0bf31c73f0e95a18595dd60e3ce41359

    • SHA1

      00ab9a13e756265f4e45ae70f6af587a8c8184b5

    • SHA256

      d4cf07f30e19535dd48e4a54dd0e8a5030dff5db91c5e1317dd3d4251c6e3c6d

    • SHA512

      761c571d62e846428f560c99c18ff672ff8ea3354f3d929e9868f06e48ecae569049910dd40893ded90bf38a51d3883ef12a4572f58f6ea2a60262a7e85e527c

    • SSDEEP

      98304:SY8MKMFkmzuwOXs4cYIeDhmzwiI7qyudXcrHwVPDo:pVKMFAwO8rpiQz9eXuRD

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detect Vidar Stealer

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies security service

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

    • Sets service image path in registry

    • Stops running service(s)

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Enumerates processes with tasklist

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks