Overview

overview

10

Static

static

10

Toxic/ Dot...er.exe

windows10-2004-x64

1

Toxic/ Dot...er.exe

windows11-21h2-x64

1

Toxic/ Vap...er.exe

windows10-2004-x64

8

Toxic/ Vap...er.exe

windows11-21h2-x64

8

Toxic/000.exe

windows10-2004-x64

Toxic/000.exe

windows11-21h2-x64

Toxic/004e...bb.exe

windows10-2004-x64

7

Toxic/004e...bb.exe

windows11-21h2-x64

7

Toxic/027c...d9.dll

windows10-2004-x64

10

Toxic/027c...d9.dll

windows11-21h2-x64

10

Toxic/0283...5e.exe

windows10-2004-x64

10

Toxic/0283...5e.exe

windows11-21h2-x64

10

Toxic/0364...d0.exe

windows10-2004-x64

4

Toxic/0364...d0.exe

windows11-21h2-x64

4

Toxic/1002.exe

windows10-2004-x64

7

Toxic/1002.exe

windows11-21h2-x64

7

Toxic/1003.exe

windows10-2004-x64

7

Toxic/1003.exe

windows11-21h2-x64

7

Toxic/119.exe

windows10-2004-x64

6

Toxic/119.exe

windows11-21h2-x64

6

Toxic/131.exe

windows10-2004-x64

3

Toxic/131.exe

windows11-21h2-x64

3

Toxic/15c0...8c.exe

windows10-2004-x64

7

Toxic/15c0...8c.exe

windows11-21h2-x64

7

Toxic/21.exe

windows10-2004-x64

10

Toxic/21.exe

windows11-21h2-x64

10

Toxic/26b4...39.exe

windows10-2004-x64

Toxic/26b4...39.exe

windows11-21h2-x64

Toxic/323CANON.exe

windows10-2004-x64

10

Toxic/323CANON.exe

windows11-21h2-x64

10

Toxic/36dc...ce.exe

windows10-2004-x64

1

Toxic/36dc...ce.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    250619-rgqpaagq71.bin
  • Size 420.8MB
  • Sample250619-twypjsxps3
  • SHA256 d480cb485075e7faad2c5b863f98d0c546827a8bfe1a9611e1be09b8dd5bca90
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaaurotunblackcatdarkcomethermeticwipermimikatzmodiloaderneshtanjratobliqueredlineremcosrevengeratsectopratthanosxmrigzebrocyguestguest1111hostlimaspackv2bootkitcredential_accessdefense_evasiondiscoverymacromacro_on_actionminerpersistencepyinstallerransomwarespywarestealerthemidatrojanupxvmprotectwiper

Malware Config

Extracted

Family

  • blackcat

Credentials
  • Username

    CREDITONE\Administrator
  • Password

    K3ny@2009
Credentials
  • Username

    CREDITONE\bexec
  • Password

    CloneD1sk4Song$%
Credentials
  • Username

    CREDITONE\KLarry
  • Password

    Kl..2021
Credentials
  • Username

    CREDITONE\BKuhl
  • Password

    Gromit2021!
Credentials
  • Username

    CREDITONE\rlopez
  • Password

    Victoria7856!
Credentials
  • Username

    CREDITONE\EJaramilla
  • Password

    1LoveVeros4
Credentials
  • Username

    .\Administrator
  • Password

    $fiji12$
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    7954i9r

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Extracted

Family

  • darkcomet

Botnet

  • Guest1111

C2

  • 193.242.166.48:1605

Mutex

  • DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Extracted

Family

  • redline

Botnet

  • LIM

C2

  • 195.3.223.120:25539

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Extracted

Family

  • agenttesla

C2

  • http://193.56.29.110/divine/inc/4e9eb8fc30c033.php

Targets

    • Target
      Toxic/ DotNetLoader.exe
    • Size 37KB
    • SHA256 0d7d4dc173c88c4f72c8f9f419ae8473d044f4b3e8f32e4a0f34fe4bbc698776
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      Toxic/ VapeHacksLoader.exe
    • Size 414KB
    • SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoveryransomware
    behavioral3behavioral4
    • Target
      Toxic/000.exe
    • Size 6.7MB
    • SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoverypersistenceransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral5behavioral6
    • Target
      Toxic/004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
    • Size 11.9MB
    • SHA256 004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral7behavioral8
    • Target
      Toxic/027cc450ef5f8c5f653329641ec1fed9.exe
    • Size 353KB
    • SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral10behavioral9
    • Target
      Toxic/0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
    • Size 5.4MB
    • SHA256 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    neshtaobliquediscoverypersistencespywarestealertrojan

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Oblique family

      oblique

    • ObliqueRAT

      Remote Access Trojan discovered in early 2020.

      trojanoblique

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral11behavioral12
    • Target
      Toxic/03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0.exe
    • Size 596KB
    • SHA256 03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral13behavioral14
    • Target
      Toxic/1002.exe
    • Size 251KB
    • SHA256 5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral15behavioral16
    • Target
      Toxic/1003.exe
    • Size 255KB
    • SHA256 8cf50ae247445de2e570f19705236ed4b1e19f75ca15345e5f00857243bc0e9b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral17behavioral18
    • Target
      Toxic/119.exe
    • Size 24KB
    • SHA256 431111e367629bea37db016682c6354303360cd1419c033a22a26115121ccfe9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistenceupx

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20
    • Target
      Toxic/131.exe
    • Size 2.3MB
    • SHA256 2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      Toxic/15c069fcb2407bfeb791823dfb849f30df28ec00c8b4e2b27bcde99007cb618c.exe
    • Size 404KB
    • SHA256 15c069fcb2407bfeb791823dfb849f30df28ec00c8b4e2b27bcde99007cb618c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral23behavioral24
    • Target
      Toxic/21.exe
    • Size 54KB
    • SHA256 8abb47ca7c0c4871c28b89aa0e75493e5eb01e403272888c11fef9e53d633ffe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverytrojanupx

    • UAC bypass

      defense_evasiontrojan

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25behavioral26
    • Target
      Toxic/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral27behavioral28
    • Target
      Toxic/323CANON.EXE
    • Size 300KB
    • SHA256 fe32599d6f2d1a874b65928cfd01a87f9d0a83d2b1e30b8f1148c8ad8aefd985
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistence

    • Modifies visiblity of hidden/system files in Explorer

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral29behavioral30
    • Target
      Toxic/36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce.exe
    • Size 74KB
    • SHA256 36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

8
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

4
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks

static1

upxpyinstalleraspackv2guest1111wiperlimmacromacro_on_actionhoststealerguestthemidaminervmprotectaurotunneshtathanosblackcatdarkcomethermeticwiperredlinesectopratnjratmodiloaderremcosrevengeratzebrocyagentteslamimikatzxmrig
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

defense_evasiondiscoveryransomware
Score
8/10

behavioral4

defense_evasiondiscoveryransomware
Score
8/10

behavioral5

defense_evasiondiscoverypersistenceransomware
Score
8/10

behavioral6

defense_evasiondiscoverypersistenceransomware
Score
8/10

behavioral7

Score
7/10

behavioral8

credential_accessdiscoveryspywarestealer
Score
7/10

behavioral9

mimikatzbootkitdiscoverypersistencespywarestealer
Score
10/10

behavioral10

mimikatzbootkitdiscoverypersistencespywarestealer
Score
10/10

behavioral11

neshtaobliquediscoverypersistencespywarestealertrojan
Score
10/10

behavioral12

neshtaobliquediscoverypersistencespywarestealertrojan
Score
10/10

behavioral13

discovery
Score
4/10

behavioral14

discovery
Score
4/10

behavioral15

persistence
Score
7/10

behavioral16

persistence
Score
7/10

behavioral17

persistence
Score
7/10

behavioral18

persistence
Score
7/10

behavioral19

discoverypersistenceupx
Score
6/10

behavioral20

discoverypersistenceupx
Score
6/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discoverypersistence
Score
7/10

behavioral24

discoverypersistence
Score
7/10

behavioral25

defense_evasiondiscoverytrojanupx
Score
10/10

behavioral26

defense_evasiondiscoverytrojanupx
Score
10/10

behavioral27

bootkitpersistence
Score
6/10

behavioral28

bootkitpersistence
Score
6/10

behavioral29

defense_evasiondiscoverypersistence
Score
10/10

behavioral30

defense_evasiondiscoverypersistence
Score
10/10

behavioral31

Score
1/10

behavioral32

Score
1/10