Overview

overview

10

Static

static

10

quarantine...0K.exe

windows10-2004-x64

10

quarantine...0K.exe

windows11-21h2-x64

10

quarantine...TS.exe

windows10-2004-x64

10

quarantine...TS.exe

windows11-21h2-x64

10

quarantine...qK.exe

windows10-2004-x64

3

quarantine...qK.exe

windows11-21h2-x64

3

quarantine...ZK.exe

windows10-2004-x64

10

quarantine...ZK.exe

windows11-21h2-x64

10

quarantine/Energy.exe

windows10-2004-x64

10

quarantine/Energy.exe

windows11-21h2-x64

10

quarantine...es.exe

windows10-2004-x64

10

quarantine...es.exe

windows11-21h2-x64

10

quarantine...cL.exe

windows10-2004-x64

7

quarantine...cL.exe

windows11-21h2-x64

3

quarantine...9O.exe

windows10-2004-x64

10

quarantine...9O.exe

windows11-21h2-x64

10

quarantine...6q.exe

windows10-2004-x64

10

quarantine...6q.exe

windows11-21h2-x64

10

quarantine...di.exe

windows10-2004-x64

10

quarantine...di.exe

windows11-21h2-x64

10

quarantine...89.msi

windows10-2004-x64

9

quarantine...89.msi

windows11-21h2-x64

9

quarantine/main.exe

windows10-2004-x64

3

quarantine/main.exe

windows11-21h2-x64

3

quarantine/random.exe

windows10-2004-x64

7

quarantine/random.exe

windows11-21h2-x64

7

quarantine..._2.exe

windows10-2004-x64

10

quarantine..._2.exe

windows11-21h2-x64

10

quarantine...vA.exe

windows10-2004-x64

7

quarantine...vA.exe

windows11-21h2-x64

7

quarantine...Z1.exe

windows10-2004-x64

10

quarantine...Z1.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    quarantine.7z

  • Size

    55.3MB

  • MD5

    3bb1d70ec71b0a92e9739edee4e883d7

  • SHA1

    028a58d221e65d7e95599f903a9352001d9f7ee1

  • SHA256

    b7a2def2630cbbca20d06f0d40ceaf00f8df471adb12f62efbeb513681cf4878

  • SHA512

    11988c6dc6b060cd09d45aaaecd718d72e843e48606a5796d41cdb58fba5ebfd5144628da29c68c6b3e14ae943ea6c3d2982244ec3cf26a0e6a1b5f921d48bc8

  • SSDEEP

    1572864:PPB4ejeeHwYuQ/HqaCRCuv3B3PenFUrE8NQPW:RywuwkCuJubW

Score
10/10
8ac6b9pyinstallerlimeratamadeyxworm

Malware Config

Extracted

Family

limerat

Wallets

34oTgBswSRbYC4CZFC9TdmhEtC4CU2TDY7

Attributes
  • aes_key

    1212

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/qEZEFuXv

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Windows.exe

  • main_folder

    AppData

  • pin_spread

    true

  • sub_folder

    \Security\

  • usb_spread

    true

Extracted

Family

amadey

Version

5.34

Botnet

8ac6b9

C2

http://185.215.113.59

Attributes
  • install_dir

    f1e82329e5

  • install_file

    namez.exe

  • strings_key

    022d16de15289562e076160ac426da7d

  • url_paths

    /Dy5h4kus/index.php

rc4.plain

Signatures

  • Amadey family
    amadey
  • Detect Xworm Payload 1 IoCs
  • Limerat family
    limerat
  • Xworm family
    xworm
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

Files

  • quarantine.7z
    .7z
  • quarantine/07jGt0K.exe
    .exe windows:6 windows x64 arch:x64

    7feaa62d3cdd3508cb78e9efbaa561af


    Headers

    Imports

    Sections

  • quarantine/235T1TS.exe
    .exe windows:5 windows x86 arch:x86

    55347c971789434361ebf2c1c21a714b


    Headers

    Imports

    Exports

    Sections

  • quarantine/4CJvcqK.exe
    .exe windows:6 windows x86 arch:x86

    a01ec155558d7515efe74cb06148b0ea


    Headers

    Imports

    Sections

  • quarantine/CBOZ4ZK.exe
    .exe windows:6 windows x64 arch:x64

    27edcdc26ece14730711ef2521583ca2


    Headers

    Imports

    Sections

  • quarantine/Energy.exe
    .exe windows:6 windows x64 arch:x64

    27edcdc26ece14730711ef2521583ca2


    Headers

    Imports

    Sections

  • quarantine/GPSHees.exe
    .exe windows:5 windows x86 arch:x86

    bf95d1fc1d10de18b32654b123ad5e1f


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/Diesel.bin
  • $TEMP/Invite.bin
  • $TEMP/Thu.bin
  • TheologyEditor/Activation.bin
  • TheologyEditor/Clearance.bin
  • TheologyEditor/Concentration.bin
  • TheologyEditor/Feeds.bin
    .cab
  • Bra
  • Indeed
  • Intermediate
  • Legally
  • Mercury
  • Oakland
  • Pipe
  • Poetry
  • Readings
  • Semi
  • Smilies
  • Specialty
  • That
  • Virus
  • TheologyEditor/Legal.bin
  • TheologyEditor/Lesson.bin
  • TheologyEditor/Mileage.bin
  • TheologyEditor/Ppm.bin
  • TheologyEditor/Seal.bin
  • TheologyEditor/Sword.bin
  • quarantine/VcYJXcL.exe
    .exe windows:6 windows x64 arch:x64

    79e87148437d141c79ebf2c1a4314136


    Headers

    Imports

    Sections

  • quarantine/aUdWe9O.exe
    .exe windows:6 windows x64 arch:x64

    27edcdc26ece14730711ef2521583ca2


    Headers

    Imports

    Sections

  • quarantine/eLa1r6q.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • quarantine/fLoJWdi.exe
    .exe windows:6 windows x64 arch:x64

    27edcdc26ece14730711ef2521583ca2


    Headers

    Imports

    Sections

  • quarantine/fyBqr89.msi
    .msi
  • quarantine/main.exe
    .exe windows:6 windows x86 arch:x86

    1aae8bf580c846f39c71c05898e57e88


    Headers

    Imports

    Sections

  • quarantine/random.exe
    .exe windows:6 windows x86 arch:x86

    1e7280afbf80c2800b272220ce0718da


    Headers

    Imports

    Sections

  • quarantine/random_2.exe
    .exe windows:4 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • quarantine/s8Sj4vA.exe
    .exe windows:6 windows x64 arch:x64

    42f3feb912369525c7576a1977af5fe8


    Code Sign

    Headers

    Imports

    Sections

  • quarantine/t98WFZ1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • quarantine/vlc-3.0.21-win64.exe
    .exe windows:6 windows x64 arch:x64

    965e162fe6366ee377aa9bc80bdd5c65


    Headers

    Imports

    Sections

  • remote3.pyc
  • quarantine/xztOH3r.exe
    .exe windows:6 windows x64 arch:x64

    27edcdc26ece14730711ef2521583ca2


    Headers

    Imports

    Sections