General
- Target UltraDropper.exe.malw
- Size 2.1MB
- Sample251128-sys2eayjdr
- SHA256 fe19aeec466180589b0fba6cfcf11b9741f3c19fa8ee29a26a4e9ea8da5114de
Malware Config
Extracted
-
eternity
-
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/myupdate.exe
Extracted
-
emotet
-
Epoch5
-
178.238.225.252:8080
-
139.196.72.155:8080
-
36.67.23.59:443
-
103.56.149.105:8080
-
37.44.244.177:8080
-
85.25.120.45:8080
-
202.134.4.210:7080
-
78.47.204.80:443
-
83.229.80.93:8080
-
93.104.209.107:8080
-
80.211.107.116:8080
-
165.22.254.236:8080
-
104.244.79.94:443
-
185.148.169.10:8080
-
190.145.8.4:443
-
175.126.176.79:8080
-
139.59.80.108:8080
-
188.165.79.151:443
-
128.199.217.206:443
-
64.227.55.231:8080
Targets
-
- Target UltraDropper.exe.malw
- Size 2.1MB
- SHA256 fe19aeec466180589b0fba6cfcf11b9741f3c19fa8ee29a26a4e9ea8da5114de
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Eternity family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.