Overview

overview

10

Static

static

10

HYDRA.exe

windows11-21h2-x64

10

Malware

windows11-21h2-x64

1

hyundai st...1).exe

windows11-21h2-x64

10

전산 및...��.exe

windows11-21h2-x64

10

Resubmissions

22/05/2025, 14:24

250522-rqvplavrx510

21/05/2025, 10:32

250521-mk2thaaj2y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    250521-meb1wshr2v.bin
  • Size 132.7MB
  • Sample250522-rqvplavrx5
  • SHA256 a4c7e0fa5387a8d4bf68638494b6a8c0b7299798cb87788edd70963256895e37
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikehawkeye_rebornm00nd3v_loggermodiloadernjratrevengeratsmokeloadervidarxredzeppelinzloader07/0409/0425/03305419896hackhackedinsert-coinmainsamaysystemvictimexdsdddyt26.02.2020backdoorcollectioncryptonediscoveryinfostealerkeyloggerpackerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • zloader

Botnet

  • main

Campaign

  • 26.02.2020

C2

  • https://airnaa.org/sound.php

  • https://banog.org/sound.php

  • https://rayonch.org/sound.php

Attributes
  • build_id

    19

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • XDSDDD

C2

  • 84.91.119.105:333

Mutex

  • RV_MUTEX-wtZlNApdygPh

Extracted

Family

  • revengerat

Botnet

  • Victime

C2

  • cocohack.dtdns.net:84

Mutex

  • RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

  • zloader

Botnet

  • 25/03

C2

  • https://wgyvjbse.pw/milagrecf.php

  • https://botiq.xyz/milagrecf.php

Attributes
  • build_id

    103

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • samay

C2

  • shnf-47787.portmap.io:47787

Mutex

  • RV_MUTEX

Extracted

Family

  • zloader

Botnet

  • 09/04

C2

  • https://eoieowo.casa/wp-config.php

  • https://dcgljuzrb.pw/wp-config.php

Attributes
  • build_id

    140

rc4.plain

Extracted

Family

  • zloader

Botnet

  • 07/04

C2

  • https://xyajbocpggsr.site/wp-config.php

  • https://ooygvpxrb.pw/wp-config.php

Attributes
  • build_id

    131

rc4.plain

Extracted

Family

  • cobaltstrike

Botnet

  • 305419896

C2

  • http://47.91.237.42:8443/__utm.gif

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    47.91.237.42,/__utm.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    8443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS7zRQv7EhhTkbgDrCNBsNay7lzQFmcC/GWwjOq93nKwPSszjIKgtW8nwhtoRhr6MFZx4DSYFdeuJDrtJNcTZz2C/LgZzhSQJmhiEqCkVqPPCfK1C6S4PzDrzy9L794rPLOuoewlGAXgiH5/Ae2aC5k2wedRNfes3DJZDDCaJJYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)

  • watermark

    305419896

Extracted

Family

  • revengerat

Botnet

  • INSERT-COIN

C2

  • 3.tcp.ngrok.io:24041

Mutex

  • RV_MUTEX

Extracted

Family

  • revengerat

Botnet

  • YT

C2

  • yukselofficial.duckdns.org:5552

Mutex

  • RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

  • revengerat

Botnet

  • system

C2

  • yj233.e1.luyouxia.net:20645

Mutex

  • RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • srpmx.ddns.net:5552

Mutex

  • c6c84eeabbf10b049aa4efdb90558a88

Attributes
  • reg_key

    c6c84eeabbf10b049aa4efdb90558a88

  • splitter

    |'|'|

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HACK

C2

  • 43.229.151.64:5552

Mutex

  • 6825da1e045502b22d4b02d4028214ab

Attributes
  • reg_key

    6825da1e045502b22d4b02d4028214ab

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

  • smokeloader

Version

  • 2017

C2

  • http://92.53.105.14/

Extracted

Family

  • hawkeye_reborn

Version

  • 10.1.2.2

Credentials
  • Protocol

    smtp
  • Host

    smtp.yandex.com
  • Port

    587
  • Username

    [email protected]
  • Password

    castor123@
Mutex

  • 245f77ec-c812-48df-870b-886d22992db6

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:castor123@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:245f77ec-c812-48df-870b-886d22992db6 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Targets

    • Target
      HYDRA.exe
    • Size 2.6MB
    • SHA256 f8c17cb375e8ccad5b0e33dae65694a1bd628f91cac6cf65dd11f50e91130c2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoordiscoverypersistencetrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Smokeloader family

      smokeloader

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1
    • Target
      Malware
    • Size 183KB
    • SHA256 53c6cfe9358749d0550adebd63c3461c12910dafbc27bff25c8a5d096dd5413d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral2
    • Target
      hyundai steel-pipe- job 8010(1).exe
    • Size 721KB
    • SHA256 8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hawkeye_rebornm00nd3v_loggercollectiondiscoveryinfostealerkeyloggerspywarestealertrojan

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • Hawkeye_reborn family

      hawkeye_reborn

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nd3v_logger family

      m00nd3v_logger

    • M00nD3v Logger payload

      Detects M00nD3v Logger payload in memory.

      infostealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3
    • Target
      전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
    • Size 545KB
    • SHA256 291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    vidardiscoverystealer
    behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks