Overview

overview

10

Static

static

10

virussign....57.exe

windows10-2004-x64

7

virussign....57.exe

windows11-21h2-x64

7

virussign....be.dll

windows10-2004-x64

1

virussign....be.dll

windows11-21h2-x64

1

virussign....87.exe

windows10-2004-x64

3

virussign....87.exe

windows11-21h2-x64

3

virussign....88.exe

windows10-2004-x64

3

virussign....88.exe

windows11-21h2-x64

3

virussign....09.exe

windows10-2004-x64

10

virussign....09.exe

windows11-21h2-x64

10

virussign....ee.exe

windows10-2004-x64

6

virussign....ee.exe

windows11-21h2-x64

6

virussign....45.sys

windows10-2004-x64

1

virussign....30.exe

windows10-2004-x64

10

virussign....30.exe

windows11-21h2-x64

10

virussign....1c.exe

windows10-2004-x64

10

virussign....1c.exe

windows11-21h2-x64

10

virussign....01.exe

windows10-2004-x64

7

virussign....01.exe

windows11-21h2-x64

7

virussign....c4.exe

windows10-2004-x64

6

virussign....c4.exe

windows11-21h2-x64

6

virussign....3d.exe

windows10-2004-x64

10

virussign....3d.exe

windows11-21h2-x64

10

virussign....a3.exe

windows10-2004-x64

3

virussign....a3.exe

windows11-21h2-x64

3

virussign....7f.exe

windows10-2004-x64

7

virussign....7f.exe

windows11-21h2-x64

7

virussign....48.exe

windows10-2004-x64

7

virussign....48.exe

windows11-21h2-x64

7

virussign....5a.exe

windows10-2004-x64

10

virussign....5a.exe

windows11-21h2-x64

10

virussign....fb.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    Virussign.2025.10.05.7z
  • Size 66.0MB
  • Sample251108-sma2fszrfp
  • SHA256 7c1254baab799eab747860ef83cdc1b57e7cadf184da68a302e6ed7b9f487bf0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
berbewblihanstealercobaltstrikecosmugluptebamacoutemofksyssakulasimdasnakekeyloggerxmrig0defense_evasiondiscoveryminerpersistencespywarestealertrojanupxworm

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Extracted

Family

  • berbew

C2

  • http://crutop.nu/index.php

  • http://devx.nm.ru/index.php

  • http://ros-neftbank.ru/index.php

  • http://master-x.com/index.php

  • http://www.redline.ru/index.php

  • http://cvv.ru/index.php

  • http://hackers.lv/index.php

  • http://fethard.biz/index.php

  • http://crutop.ru/index.php

  • http://kaspersky.ru/index.php

  • http://color-bank.ru/index.php

  • http://adult-empire.com/index.php

  • http://virus-list.com/index.php

  • http://trojan.ru/index.php

  • http://xware.cjb.net/index.htm

  • http://konfiskat.org/index.htm

  • http://parex-bank.ru/index.htm

  • http://fethard.biz/index.htm

  • http://ldark.nm.ru/index.htm

  • http://gaz-prom.ru/index.htm

Extracted

Family

  • snakekeylogger

Credentials

Extracted

Family

  • blihanstealer

Mutex

  • pomdfghrt

Attributes
  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Extracted

Family

  • macoute

C2

  • 87.98.185.184

Extracted

Family

  • simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Targets

    • Target
      virussign.com_03936463469cebb254362691e6f0b857.vir
    • Size 184KB
    • SHA256 f0011bf5e34cc85a89ca4d8aaba37a1ffa42885ed27f2987edd6a12fc334f5b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral1behavioral2
    • Target
      virussign.com_43b9e58128575b88640a4bdb9e4c5ebe.vir
    • Size 4.3MB
    • SHA256 dc5f3fef8a76caf1e46de200c77e160c77c5f3ce41f5842930b577892ebf70bb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      virussign.com_45c7f4533dc5f1605beebf0cf9a9cb87.vir
    • Size 77KB
    • SHA256 eccb4e64f6a0f921cae93aefc14d51d6488b2b2055e3326169d468a2fc031ad7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      virussign.com_547098b10eda78036ed2560637c10a88.vir
    • Size 119KB
    • SHA256 04cd1d5ffae069fa4d07fdb0e6717dd121ed24a2203f2516a1ba204b46595f5b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      virussign.com_5ca734eb458c0e2c512f9ee7dcfabe09.vir
    • Size 9.7MB
    • SHA256 5e49a2acfd01c36dbc081b86b77823845423ae798686016d045d308a7ebede36
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverycosmuworm

    • Cosmu

      Cosmu is a Windows worm written in C++.

      wormcosmu

    • Cosmu family

      cosmu

    • Detects Cosmu payload

      Cosmu is a worm written in C++.

    behavioral10behavioral9
    • Target
      virussign.com_5d27e5465182f2f4c5a0b1a0a8d881ee.vir
    • Size 4.6MB
    • SHA256 e211ae4650149478085b3404c45fe48f5242a22e59dde009685cab5d8594376c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    behavioral11behavioral12
    • Target
      virussign.com_932d2d4b85a02fa50afe7522e8534d45.vir
    • Size 174KB
    • SHA256 1c3919f7fd810c57eba300f94390a7d87d5dda5179cf44a498caa768823cbae3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13
    • Target
      virussign.com_99ed548226eb5a874caf631aa404e330.vir
    • Size 213KB
    • SHA256 0780768f93e79e5e442726e461f88028a084c3c1d4c4a772282d3d945c7a7436
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverysimdapersistencestealertrojan
    behavioral14behavioral15
    • Target
      virussign.com_99fd79c64a18733dc341877df20e971c.vir
    • Size 748KB
    • SHA256 a86c5150438809ec22627857263f0bc0a4aef0074b856e7e44cccae0f8c6cd57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistenceupx

    • Modifies visibility of hidden/system files in Explorer

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral16behavioral17
    • Target
      virussign.com_9f82bfc617ce0255bcba7bf033628301.vir
    • Size 1.8MB
    • SHA256 7131d30ebe351a1a5b54698f16fbf6d7b450172e4a6f316490f94fcaebe03671
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral18behavioral19
    • Target
      virussign.com_a2bc32bfb9776b52141fb2b9f5ddfac4.vir
    • Size 5.1MB
    • SHA256 24e8867e24dc459c1cc2a9c7952ddd85d8837dfb1478b40aaaefad83f9e12bfd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    behavioral20behavioral21
    • Target
      virussign.com_a45665f6d0fb8b48b8c9a9a3f420e23d.vir
    • Size 90KB
    • SHA256 ef0102bf8747677fbcb15c6abe367d5933b852316da437d0fcaabe921332dc1d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscovery

    • Modifies visibility of file extensions in Explorer

      defense_evasion

    • Executes dropped EXE

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral22behavioral23
    • Target
      virussign.com_a4bf3f44753764456926fadfd5fe80a3.vir
    • Size 4KB
    • SHA256 b153c7d74328a5845f9aade4b7f4eeeabe56f928e53796d08de0dc35063f3ab8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral24behavioral25
    • Target
      virussign.com_b5f1fb94ca52b537634edaba84bd767f.vir
    • Size 468KB
    • SHA256 db2641e42108397bfb2057e2e506b26d5de72562168e35bdf1642f6ad06a95e4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral26behavioral27
    • Target
      virussign.com_b80ab0e826287d58c89aa30baac08848.vir
    • Size 4.1MB
    • SHA256 12f35c6deef5889cc31c74d121ddeea7d9ad85ac474f03755bf2c9bbba0bbf01
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral28behavioral29
    • Target
      virussign.com_b9bfcc98c1eac4ecb12243e00ea6be5a.vir
    • Size 9.7MB
    • SHA256 baad8ed5c080b5f027a18535d6109a8bb4a455fb33182a9ffbd22f0558bec483
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverycosmuworm

    • Cosmu

      Cosmu is a Windows worm written in C++.

      wormcosmu

    • Cosmu family

      cosmu

    • Detects Cosmu payload

      Cosmu is a worm written in C++.

    behavioral30behavioral31
    • Target
      virussign.com_c91dbe8d1c295cbfcbc2c51bdc7181fb.vir
    • Size 468KB
    • SHA256 eee3719534c2dcc8b6c4caff80b4e6fec6118be25dffeca4f6a9a10ab4b90cbc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

upxminer0gluptebaxmrigcobaltstrikeberbewsnakekeyloggermofksyssakulablihanstealermacoute
Score
10/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discoverycosmuworm
Score
10/10

behavioral10

discoverycosmuworm
Score
10/10

behavioral11

discovery
Score
6/10

behavioral12

discovery
Score
6/10

behavioral13

Score
1/10

behavioral14

discoverysimdapersistencestealertrojan
Score
10/10

behavioral15

discoverysimdapersistencestealertrojan
Score
10/10

behavioral16

defense_evasiondiscoverypersistenceupx
Score
10/10

behavioral17

defense_evasiondiscoverypersistenceupx
Score
10/10

behavioral18

discoveryspywarestealer
Score
7/10

behavioral19

discoveryspywarestealer
Score
7/10

behavioral20

discovery
Score
6/10

behavioral21

discovery
Score
6/10

behavioral22

defense_evasiondiscovery
Score
10/10

behavioral23

defense_evasiondiscovery
Score
10/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
7/10

behavioral28

discoverypersistence
Score
7/10

behavioral29

discoverypersistence
Score
7/10

behavioral30

discoverycosmuworm
Score
10/10

behavioral31

discoverycosmuworm
Score
10/10

behavioral32

discovery
Score
7/10