General
-
Target
2025-04-05_3a7a07298c22363a144ebeca63545efe_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
Sample
250405-chjvsszry3
-
MD5
3a7a07298c22363a144ebeca63545efe
-
SHA1
7c20930cd69c339151398444de355de1fb1e13ca
-
SHA256
6554fa82ba24090b93676f6fb0d64692f97f63d064c7676963b084b9967cb1c1
-
SHA512
376db910bcd13ab9f8921f131ae55ec2608888fd5afdae266fe89a29725d70c5e0281e0425f9527776277ca80fc0c95111200a4c88723b0d030f2f7074294060
-
SSDEEP
24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a0ou:yTvC/MTQYxsWR7a0o
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-05_3a7a07298c22363a144ebeca63545efe_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
gcleaner
185.156.73.98
45.91.200.135
Extracted
lumma
https://pepperiop.digital/oage
https://jrxsafer.top/shpaoz
https://plantainklj.run/opafg
https://spuerrogfh.live/iqwez
https://quavabvc.top/iuzhd
https://padvennture.top/GKsiio
https://targett.top/dsANGt
https://rambutanvcx.run/adioz
https://kywmedici.top/noagis
https://cosmosyf.top/GOsznj
https://yjrxsafer.top/shpaoz
https://krxspint.digital/kendwz
https://rhxhube.run/pogrs
https://grxeasyw.digital/xxepw
https://advennture.top/GKsiio
https://xrfxcaseq.live/gspaz
https://ywmedici.top/noagis
https://6grxeasyw.digital/xxepw
https://gkrxspint.digital/kendwz
https://erhxhube.run/pogrs
https://navstarx.shop/FoaJSi
https://metalsyo.digital/opsa
https://ironloxp.live/aksdd
https://starcloc.bet/GOksAo
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://puerrogfh.live/iqwez
Targets
-
-
Target
2025-04-05_3a7a07298c22363a144ebeca63545efe_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
MD5
3a7a07298c22363a144ebeca63545efe
-
SHA1
7c20930cd69c339151398444de355de1fb1e13ca
-
SHA256
6554fa82ba24090b93676f6fb0d64692f97f63d064c7676963b084b9967cb1c1
-
SHA512
376db910bcd13ab9f8921f131ae55ec2608888fd5afdae266fe89a29725d70c5e0281e0425f9527776277ca80fc0c95111200a4c88723b0d030f2f7074294060
-
SSDEEP
24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a0ou:yTvC/MTQYxsWR7a0o
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Detects MeshAgent payload
-
Gcleaner family
-
Healer family
-
Lumma family
-
Meshagent family
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Modifies security service
-
Contacts a large (4600) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Creates new service(s)
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Modifies file permissions
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
7Windows Service
7Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
7Windows Service
7Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify Tools
5Modify Registry
7Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2