General

  • Target

    2025-04-04_e284eb1bb218551f13f057ff5f80e290_agent-tesla_black-basta_cobalt-strike_luca-stealer

  • Size

    938KB

  • Sample

    250404-1sln5svydx

  • MD5

    e284eb1bb218551f13f057ff5f80e290

  • SHA1

    f84f7c9b97999c6531f646df17d1deca0bac2d19

  • SHA256

    c9fc73fbb1b49dcddd1eb74ed1df8bd71ec8d6d688a34678b2b24b713c22c100

  • SHA512

    99dae424a9a6671ea20683faf3942b3b96afd97598e8ca330187b04b65d40753d906628210d55dfa78526ed65055068dbf5d2946d6f9773abdf8bfc809904e44

  • SSDEEP

    24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8a04u:NTvC/MTQYxsWR7a04

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://krxspint.digital/kendwz

https://jrxsafer.top/shpaoz

https://rhxhube.run/pogrs

https://ogrxeasyw.digital/xxepw

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

https://pepperiop.digital/oage

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://fkquavabvc.top/iuzhd

https://rambutanvcx.run/adioz

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Extracted

Family

meshagent

Version

2

Botnet

test123

C2

http://aaso12.duckdns.org:443/agent.ashx

Attributes
  • mesh_id

    0x0CF4A8B0663DD2F1D3A44CE8D231621166DBDB1E723B374C911544DE2F45A87C6C52F7206CED32F5B6A52A5551B75A3C

  • server_id

    22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8

  • wss

    wss://aaso12.duckdns.org:443/agent.ashx

Targets

    • Target

      2025-04-04_e284eb1bb218551f13f057ff5f80e290_agent-tesla_black-basta_cobalt-strike_luca-stealer

    • Size

      938KB

    • MD5

      e284eb1bb218551f13f057ff5f80e290

    • SHA1

      f84f7c9b97999c6531f646df17d1deca0bac2d19

    • SHA256

      c9fc73fbb1b49dcddd1eb74ed1df8bd71ec8d6d688a34678b2b24b713c22c100

    • SHA512

      99dae424a9a6671ea20683faf3942b3b96afd97598e8ca330187b04b65d40753d906628210d55dfa78526ed65055068dbf5d2946d6f9773abdf8bfc809904e44

    • SSDEEP

      24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8a04u:NTvC/MTQYxsWR7a04

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Detects Healer an antivirus disabler dropper

    • Detects MeshAgent payload

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Meshagent family

    • Modifies security service

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

    • Sets service image path in registry

    • Stops running service(s)

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Modifies file permissions

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks