Overview

overview

10

Static

static

10

virusshare...7b.exe

windows11-21h2-x64

10

Resubmissions

16/04/2025, 16:46

250416-vaaahaxnt9 10

16/04/2025, 13:10

250416-qerccswjt5 10

16/04/2025, 12:57

250416-p6x4jsvrx2 10

16/04/2025, 12:51

250416-p3kn2svrv5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware_samples.zip

  • Size

    19.1MB

  • MD5

    d8e816c76ab1b9bc76e73b1aa0f88f2d

  • SHA1

    da193bad12f1b79f8c938d62e8029ba948433859

  • SHA256

    487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c

  • SHA512

    5bd84b71cb39d1d4952255cbabc45608c972757bb63a9f70606e0d2200154374f9e61f1c526ed1fe903b166e5d0b0458540b47da9c70434ae5b31a7b7d1bd02a

  • SSDEEP

    393216:ThCblxXJLB2mW/RxHedw0OZnq0NyWl9Hh9H2KAm4zI:ThSDZLI5xHea9Zf5XHD4zI

Score
10/10
pdflinkminer0upxmacromacro_on_actionono33xmrigcobaltstriketrickbot

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Extracted

Family

trickbot

Version

1000501

Botnet

ono33

C2

5.182.210.226:443

5.182.210.120:443

185.65.202.183:443

212.80.217.243:443

85.143.218.249:443

194.5.250.178:443

198.15.119.121:443

107.175.87.142:443

185.14.31.72:443

188.165.62.2:443

194.5.250.179:443

198.15.119.71:443

185.14.29.4:443

185.99.2.202:443

192.3.193.162:443

89.191.234.89:443

195.54.32.12:443

31.131.21.30:443

5.34.177.194:443

190.214.13.2:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Cobalt Strike reflective loader 2 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike family
    cobaltstrike
  • Trickbot family
    trickbot
  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Office macro that triggers on suspicious action 4 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Attempts to obfuscate APK file format

    Applies obfuscation techniques to the APK format in order to hinder analysis

  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 3 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • malware_samples.zip
    .zip

    Password: infected

  • virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287
    .exe windows:6 windows x64 arch:x64

    Password: infected


    Headers

    Sections

  • virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d
    .exe windows:5 windows x86 arch:x86

    Password: infected


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9
    .xls windows office2003

    Sem

    Page1

    Module1

    UserForm1

    Module2

    Class1

    UserForm6

    Page11

    Module6

    Module5

    Module4

  • virusshare/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9
    .doc windows office2003

    Aojplemq

    Jeuwzqvsdrcqz

    Rgzhzedt

  • virusshare/1/VirusShare_3cd9a967b67fe69351e390195ca7a430
    .pdf

    Password: infected

    • http://amcarizona.com/uploads/1/3/0/4/130478709/d508b2931dd488.pdf

    • http://aufgutdeutsch.net/uploads/1/3/0/2/130291646/zefawove_dojavakumavuv_fesadetekud_pixopibetegoso.pdf

    • http://capscoating.com/uploads/1/3/0/5/130540699/waxasavapiz_tibuxe.pdf

    • http://formormedia.com/uploads/1/3/0/2/130289443/130289443.html#auma+electric+actuator+catalogue

    • http://fountainalleybodycare.com/uploads/1/3/0/2/130270832/kexerewel.pdf

    • http://mingateachers.com/uploads/1/3/0/6/130620948/3396168.pdf

    • http://mwilkinson91.com/uploads/1/3/0/5/130550994/d4e8bf21c6b2322.pdf

    • http://nkaskephotography.com/uploads/1/3/0/3/130323319/941a1631a4c.pdf

    • http://nrttourscentre.com/uploads/1/3/0/7/130776684/3637788.pdf

    • Show all
  • virusshare/1/malware
    .exe windows:6 windows x64 arch:x64

    Password: infected


    Headers

    Sections

  • virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d
    .exe windows:4 windows x86 arch:x86

    Password: infected


    Headers

    Sections

  • virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa
    .exe windows:5 windows x86 arch:x86

    Password: infected

    483f0c4259a9148c34961abbda6146c1


    Code Sign

    Headers

    Imports

    Sections

  • virusshare/2/VirusShare_2fe5b00079aec2d8369a798230313ec8
    .doc windows office2003

    Xmtcmcovmi

    Rlndryuf

    Sfxuqprex

  • virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103
    .doc .vbs windows office2003 polyglot

    ThisWorkbook

    Sheet1

    Sheet2

    Sheet3

    Sheet4

    Module1

  • virusshare/2/VirusShare_480ef02bb062a57724e1b3e14532a140
    .pdf

    Password: infected

    • http://americanbenefitsolutions.net/uploads/1/3/0/5/130590122/0edbbc0c.pdf

    • http://armquiz.com/uploads/2020/01/27/tusuzaw.pdf

    • http://befreeproduction.com/uploads/1/3/0/4/130478663/3e464e773d.pdf

    • http://bulverdepregnancy.net/uploads/1/3/0/6/130639282/wetivuxolaja.pdf

    • http://clearhrsolutionsd.com/uploads/1/3/0/4/130435941/8c7e87.pdf

    • http://link2yoo.net/uploads/1/3/0/6/130604529/42536e7ead401.pdf

    • http://movimentomarianobetania.org/uploads/1/3/0/6/130603773/bupiwudunudasogof.pdf

    • http://vertudevelopment.com/uploads/1/3/0/6/130605267/130605267.html#brother+intellifax+2820+driver

  • virusshare/2/wedding.apk
    .apk android

    Password: infected

    com.google.aplikasi

    com.example.myapplicatior.MainActivity


  • virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e
    .doc .vbs windows office2003 polyglot

    ThisWorkbook

    Sheet1

    Sheet2

    Sheet3

    Sheet4

    Module1

  • virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd
    .pdf
  • virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b
    .exe windows:4 windows x86 arch:x86

    a32f20584ee1cae950a64ef226eea819


    Headers

    Imports

    Sections

  • virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • virusshare/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f
    .doc windows office2003

    Hsheolxjq

    Ytxatmhtmzwws

    Gwgukvssw

  • virusshare/3/delivery.apk
    .apk android

    com.rndytech.smstesd

    com.example.myapplication.MainActivity


  • virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2
    .doc windows office2003

    ThisWorkbook

    Sheet1

    Module1

    AttachedFile

    AttachedFiles

    Module2

    Sheet2

  • virusshare/4/VirusShare_6d2d7d94fe5faab76b3e786e7d810c1d
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections