General
-
Target
2025-03-30_84c300a105cb5e140c8c91e2c6ead590_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
Sample
250330-rfmk8szwes
-
MD5
84c300a105cb5e140c8c91e2c6ead590
-
SHA1
5bd18b75d71b2824913a508ce28db8d4c2a936b9
-
SHA256
edfb2e4f23a9c490eb887fe69d57aab4dea230d0b76e3b1c95babb559c36fa58
-
SHA512
eec8f1abe337ec6e09cdf613c015a1cf84a58217f063d884e4a4ef8a925f17f8c7c869ce81e081e81382cb5860cdc46f1b4cb96923b97c0d41e76dd98d99f106
-
SSDEEP
24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:oTvC/MTQYxsWR7a06
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_84c300a105cb5e140c8c91e2c6ead590_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2025-03-30_84c300a105cb5e140c8c91e2c6ead590_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
http://176.113.115.7/mine/random.exe
Extracted
stealc
trump
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Extracted
lumma
https://cosmosyf.top/GOsznj
https://byteplusx.digital/aXweAX
https://travewlio.shop/ZNxbHi
https://skynetxc.live/AksoPA
https://pixtreev.run/LkaUz
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://sparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
https://navstarx.shop/FoaJSi
https://metalsyo.digital/opsa
https://ironloxp.live/aksdd
https://starcloc.bet/GOksAo
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://rodformi.run/aUosoz
https://esccapewz.run/ANSbwqy
https://touvrlane.bet/ASKwjq
https://sighbtseeing.shop/ASJnzh
https://holidamyup.today/AOzkns
https://mtriplooqp.world/APowko
Extracted
quasar
1.5.0
Office04
goku92ad.zapto.org:5000
a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a
-
encryption_key
BF72099FDBC6B48816529089CF1CF2CF86357D14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
2025-03-30_84c300a105cb5e140c8c91e2c6ead590_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
MD5
84c300a105cb5e140c8c91e2c6ead590
-
SHA1
5bd18b75d71b2824913a508ce28db8d4c2a936b9
-
SHA256
edfb2e4f23a9c490eb887fe69d57aab4dea230d0b76e3b1c95babb559c36fa58
-
SHA512
eec8f1abe337ec6e09cdf613c015a1cf84a58217f063d884e4a4ef8a925f17f8c7c869ce81e081e81382cb5860cdc46f1b4cb96923b97c0d41e76dd98d99f106
-
SSDEEP
24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:oTvC/MTQYxsWR7a06
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Gcleaner family
-
Healer family
-
Lumma family
-
Quasar family
-
Quasar payload
-
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Safe Mode Boot
1Modify Registry
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2