Overview

overview

10

Static

static

10

0415f463a2...af.elf

debian-12-armhf

7

1edf772889...ea.dll

windows10-2004-x64

1

1edf772889...ea.dll

windows11-ltsc_2024-x64

1

1f9acbd618...0b.elf

ubuntu-18.04-amd64

1f9acbd618...0b.elf

debian-9-armhf

1f9acbd618...0b.elf

debian-9-mips

1f9acbd618...0b.elf

debian-9-mipsel

509c2a5b7f...6ce.js

windows10-2004-x64

10

509c2a5b7f...6ce.js

windows11-ltsc_2024-x64

10

66f7e71e7d...f4.elf

debian-9-mips

b122fb13a9...1f.exe

windows10-2004-x64

10

b122fb13a9...1f.exe

windows11-ltsc_2024-x64

10

libiconv-2.dll

windows10-2004-x64

1

libiconv-2.dll

windows11-ltsc_2024-x64

6

libidn2-0.dll

windows10-2004-x64

1

libidn2-0.dll

windows11-ltsc_2024-x64

1

libintl-8.dll

windows10-2004-x64

1

libintl-8.dll

windows11-ltsc_2024-x64

1

libpsl-5.dll

windows10-2004-x64

7

libpsl-5.dll

windows11-ltsc_2024-x64

8

libunistring-5.dll

windows10-2004-x64

1

libunistring-5.dll

windows11-ltsc_2024-x64

1

psl.exe

windows10-2004-x64

6

psl.exe

windows11-ltsc_2024-x64

6

bab90c6e5d...1e.elf

debian-12-mipsel

7

c6ea91b278...6d.exe

windows10-2004-x64

7

c6ea91b278...6d.exe

windows11-ltsc_2024-x64

8

c75d8323a4...6a.exe

windows10-2004-x64

10

c75d8323a4...6a.exe

windows11-ltsc_2024-x64

10

c865fe054a...25.elf

debian-12-armhf

1

d20ac6d6ed...6e.exe

windows10-2004-x64

10

d20ac6d6ed...6e.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-26-15.zip
  • Size 10.5MB
  • Sample260702-w2dbxag18k
  • SHA256 162e34e0816bff8550600acd9d5d4fc5cd4ae94ae0c3941d955fac961c245fb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
miraiquasarredlineremcosremus_stealersectoprat24041885310924microowariadwarebotnetdefense_evasiondiscoveryexecutioninfostealerlinuxpersistenceransomwareratspywarestealersuricatatrojanupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • OWARI

Extracted

Family

  • remcos

Version

  • 7.2.5 Pro

Botnet

  • 24041

C2

  • 62.60.226.68:24041

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    smsmng.exe

  • copy_folder

    Config

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    TRY157-9405HX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • remus_stealer

C2

  • http://myrtler.biz:9549

  • http://carogra.biz:4219

  • http://youngel.biz:8768

Extracted

Family

  • redline

Botnet

  • 885310924

C2

  • salanoajalio.xyz:80

Extracted

Family

  • quasar

Version

  • 1.4.0

Botnet

  • Micro

C2

  • babayagadead.duckdns.org:1933

Mutex

  • 69059989-4d50-45f8-b299-3d7635455c52

Attributes
  • encryption_key

    E1E0263C65C57BAA0955A3EA0636BB8240539AF2

  • install_name

    ChromeServiceUpgrade.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logsssss

  • reconnect_delay

    3000

  • startup_key

    ChromeServiceUpgrade

  • subdirectory

    ChromeServiceUpgrade

Targets

    • Target
      0415f463a25c257eb5a49db51fe4e0f5abcde0d7d950902ad7d583d6f8bbbaaf.elf
    • Size 121KB
    • SHA256 0415f463a25c257eb5a49db51fe4e0f5abcde0d7d950902ad7d583d6f8bbbaaf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasion

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion
    behavioral1
    • Target
      1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea.exe
    • Size 7.3MB
    • SHA256 1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2behavioral3
    • Target
      1f9acbd618b9c829ec705e8bda2441e0fe7e6ae6b8ab7164a6ed6f65af39b60b.elf
    • Size 93KB
    • SHA256 1f9acbd618b9c829ec705e8bda2441e0fe7e6ae6b8ab7164a6ed6f65af39b60b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4behavioral5behavioral6behavioral7
    • Target
      509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce.js
    • Size 68KB
    • SHA256 509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    microdiscoveryexecutionquasarspywaretrojan

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Quasar payload

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Suspicious use of SetThreadContext

    behavioral8behavioral9
    • Target
      66f7e71e7d3d3fb3b507f5d53c80981898db834efb3d17df1bde50aa055918f4.elf
    • Size 117KB
    • SHA256 66f7e71e7d3d3fb3b507f5d53c80981898db834efb3d17df1bde50aa055918f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      b122fb13a9014410c09a8ae53d40979ad4c2f7903223563941aea3be50edf01f.exe
    • Size 170KB
    • SHA256 b122fb13a9014410c09a8ae53d40979ad4c2f7903223563941aea3be50edf01f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverypersistenceremus_stealerstealer

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Modifies visibility of file extensions in Explorer

      defense_evasion

    • Downloads MZ/PE file

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral11behavioral12
    • Target
      libiconv-2.dll
    • Size 1.1MB
    • SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14
    • Target
      libidn2-0.dll
    • Size 251KB
    • SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      libintl-8.dll
    • Size 301KB
    • SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      libpsl-5.dll
    • Size 7.3MB
    • SHA256 1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral19behavioral20
    • Target
      libunistring-5.dll
    • Size 2.1MB
    • SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      psl.exe
    • Size 64KB
    • SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral23behavioral24
    • Target
      bab90c6e5d3cb39b3d324bda17f24928a0c366780528d1d30b143aa30eb7601e.elf
    • Size 120KB
    • SHA256 bab90c6e5d3cb39b3d324bda17f24928a0c366780528d1d30b143aa30eb7601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasion

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion
    behavioral25
    • Target
      c6ea91b2783f566fdc1992ee1a380f26d358bc4a9e25f9675494aed0d069f16d.exe
    • Size 1.9MB
    • SHA256 c6ea91b2783f566fdc1992ee1a380f26d358bc4a9e25f9675494aed0d069f16d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral26behavioral27
    • Target
      c75d8323a4288498f44893d1549ecc98be5b4dc3e89875189fe45f2eee0de36a.exe
    • Size 513KB
    • SHA256 c75d8323a4288498f44893d1549ecc98be5b4dc3e89875189fe45f2eee0de36a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryremcospersistenceratsuricata24041

    • Family: Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

      Network activity triggered a Suricata alert

      suricataremcos

    • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

      Network activity triggered a Suricata alert

      suricataremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral28behavioral29
    • Target
      c865fe054a9fec4ff4976b078e7f59ce8ac0916e216eb3dc2dea6ad5799c2925.elf
    • Size 89KB
    • SHA256 c865fe054a9fec4ff4976b078e7f59ce8ac0916e216eb3dc2dea6ad5799c2925
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      d20ac6d6eda2d70adf552f3bca04c1e030611df9e61febee7246b87410e68d6e.exe
    • Size 588KB
    • SHA256 d20ac6d6eda2d70adf552f3bca04c1e030611df9e61febee7246b87410e68d6e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    885310924discoveryredlinesectopratinfostealerrattrojan

    • Family: RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Family: SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • RedLine payload

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Modify Registry

5
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

owari24041upxbotnetmirairatremcos
Score
10/10

behavioral1

defense_evasion
Score
7/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

microdiscoveryexecutionquasarspywaretrojan
Score
10/10

behavioral9

microdiscoveryexecutionquasarspywaretrojan
Score
10/10

behavioral10

Score
1/10

behavioral11

defense_evasiondiscoverypersistence
Score
10/10

behavioral12

defense_evasiondiscoveryremus_stealerpersistencestealer
Score
10/10

behavioral13

Score
1/10

behavioral14

adwarepersistenceransomwarespyware
Score
6/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
7/10

behavioral20

adwarepersistencespyware
Score
8/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discoverypersistence
Score
6/10

behavioral24

persistence
Score
6/10

behavioral25

defense_evasion
Score
7/10

behavioral26

Score
7/10

behavioral27

adwarepersistenceransomwarespyware
Score
8/10

behavioral28

discoveryremcospersistenceratsuricata
Score
10/10

behavioral29

24041discoveryremcospersistenceratsuricata
Score
10/10

behavioral30

Score
1/10

behavioral31

885310924discoveryredlinesectopratinfostealerrattrojan
Score
10/10

behavioral32

885310924discoveryredlinesectopratinfostealerrattrojan
Score
10/10