General
-
Target
2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
Sample
250330-qtwkmay1hz
-
MD5
8c87bad579d801bb7bea5acc51e8fe5d
-
SHA1
78b3bdaad59a371cf44e709e94ec00ccdc05421c
-
SHA256
dae649137a35a584025e94fee43e229a06818d9f9e600dd9d4a6917b2e01b6cb
-
SHA512
6fb9a96f6a83e42ae8be6b1ea00ba8417628a38e81654190f37602de36ee2ff6f1c7843eb9acd6991f254a5edfd5efc42b74af144a66fbb35b7fb410ca7692dc
-
SSDEEP
24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a0Su:ATvC/MTQYxsWR7a0S
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://rodformi.run/aUosoz
https://metalsyo.digital/opsa
https://ironloxp.live/aksdd
https://navstarx.shop/FoaJSi
https://starcloc.bet/GOksAo
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://esccapewz.run/ANSbwqy
https://travewlio.shop/ZNxbHi
https://touvrlane.bet/ASKwjq
https://sighbtseeing.shop/ASJnzh
https://holidamyup.today/AOzkns
https://mtriplooqp.world/APowko
https://skynetxc.live/AksoPA
https://byteplusx.digital/aXweAX
https://apixtreev.run/LkaUz
https://tsparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
https://cosmosyf.top/GOsznj
https://triplooqp.world/APowko
Extracted
stealc
trump
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Extracted
http://176.113.115.7/mine/random.exe
Extracted
quasar
1.5.0
Office04
goku92ad.zapto.org:5000
a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a
-
encryption_key
BF72099FDBC6B48816529089CF1CF2CF86357D14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
MD5
8c87bad579d801bb7bea5acc51e8fe5d
-
SHA1
78b3bdaad59a371cf44e709e94ec00ccdc05421c
-
SHA256
dae649137a35a584025e94fee43e229a06818d9f9e600dd9d4a6917b2e01b6cb
-
SHA512
6fb9a96f6a83e42ae8be6b1ea00ba8417628a38e81654190f37602de36ee2ff6f1c7843eb9acd6991f254a5edfd5efc42b74af144a66fbb35b7fb410ca7692dc
-
SSDEEP
24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a0Su:ATvC/MTQYxsWR7a0S
-
Amadey family
-
Detect Xworm Payload
-
Detects Healer an antivirus disabler dropper
-
Gcleaner family
-
Healer family
-
Lumma family
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Modifies security service
-
Quasar family
-
Quasar payload
-
Stealc family
-
Xworm family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Sets service image path in registry
-
Stops running service(s)
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Modifies file permissions
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Boot or Logon Autostart Execution: Authentication Package
Suspicious Windows Authentication Registry Modification.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
4Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify Tools
5Modify Registry
10Virtualization/Sandbox Evasion
2