General
-
Target
random.exe
-
Size
5.4MB
-
Sample
250329-p4w4gattgs
-
MD5
0bf31c73f0e95a18595dd60e3ce41359
-
SHA1
00ab9a13e756265f4e45ae70f6af587a8c8184b5
-
SHA256
d4cf07f30e19535dd48e4a54dd0e8a5030dff5db91c5e1317dd3d4251c6e3c6d
-
SHA512
761c571d62e846428f560c99c18ff672ff8ea3354f3d929e9868f06e48ecae569049910dd40893ded90bf38a51d3883ef12a4572f58f6ea2a60262a7e85e527c
-
SSDEEP
98304:SY8MKMFkmzuwOXs4cYIeDhmzwiI7qyudXcrHwVPDo:pVKMFAwO8rpiQz9eXuRD
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
random.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral3
Sample
random.exe
Resource
win10ltsc2021-20250314-en
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://wxayfarer.live/ALosnz
https://oreheatq.live/gsopp
https://castmaxw.run/ganzde
https://weldorae.digital/geds
https://steelixr.live/aguiz
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://smeltingt.run/giiaus
https://fferromny.digital/gwpd
https://esccapewz.run/ANSbwqy
https://travewlio.shop/ZNxbHi
https://touvrlane.bet/ASKwjq
https://sighbtseeing.shop/ASJnzh
https://holidamyup.today/AOzkns
https://mtriplooqp.world/APowko
https://xcastmaxw.run/ganzde
https://7targett.top/dsANGt
https://ferromny.digital/gwpd
https://skynetxc.live/AksoPA
https://byteplusx.digital/aXweAX
https://apixtreev.run/LkaUz
https://tsparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
Extracted
vidar
13.3
11373d37b176b52c098f600f61cdf190
https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
vidar
13.3
928af183c2a2807a3c0526e8c0c9369d
https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
stealc
trump
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Extracted
http://176.113.115.7/mine/random.exe
Extracted
http://176.113.115.7/mine/random.exe
Targets
-
-
Target
random.exe
-
Size
5.4MB
-
MD5
0bf31c73f0e95a18595dd60e3ce41359
-
SHA1
00ab9a13e756265f4e45ae70f6af587a8c8184b5
-
SHA256
d4cf07f30e19535dd48e4a54dd0e8a5030dff5db91c5e1317dd3d4251c6e3c6d
-
SHA512
761c571d62e846428f560c99c18ff672ff8ea3354f3d929e9868f06e48ecae569049910dd40893ded90bf38a51d3883ef12a4572f58f6ea2a60262a7e85e527c
-
SSDEEP
98304:SY8MKMFkmzuwOXs4cYIeDhmzwiI7qyudXcrHwVPDo:pVKMFAwO8rpiQz9eXuRD
-
Amadey family
-
Detect Vidar Stealer
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
Lumma family
-
Modifies security service
-
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Sets service image path in registry
-
Stops running service(s)
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Modify Authentication Process
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Safe Mode Boot
1Modify Authentication Process
1Modify Registry
4Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2