Overview

overview

10

Static

static

10

malware-sa...ce.exe

windows10-2004-x64

1

malware-sa...ce.exe

windows11-ltsc_2024-x64

1

malware-sa...9d.exe

windows10-2004-x64

7

malware-sa...9d.exe

windows11-ltsc_2024-x64

3

malware-sa...29.rtf

windows10-2004-x64

10

malware-sa...29.rtf

windows11-ltsc_2024-x64

10

malware-sa...90.rtf

windows10-2004-x64

1

malware-sa...90.rtf

windows11-ltsc_2024-x64

1

malware-sa...64.rtf

windows10-2004-x64

1

malware-sa...64.rtf

windows11-ltsc_2024-x64

1

malware-sa...24.rtf

windows10-2004-x64

1

malware-sa...24.rtf

windows11-ltsc_2024-x64

1

malware-sa...37.rtf

windows10-2004-x64

1

malware-sa...37.rtf

windows11-ltsc_2024-x64

1

malware-sa...61.rtf

windows10-2004-x64

1

malware-sa...61.rtf

windows11-ltsc_2024-x64

1

malware-sa...79.rtf

windows10-2004-x64

1

malware-sa...79.rtf

windows11-ltsc_2024-x64

8

malware-sa...c4.rtf

windows10-2004-x64

1

malware-sa...c4.rtf

windows11-ltsc_2024-x64

1

malware-sa...86.rtf

windows10-2004-x64

10

malware-sa...86.rtf

windows11-ltsc_2024-x64

10

malware-sa...2f.rtf

windows10-2004-x64

10

malware-sa...2f.rtf

windows11-ltsc_2024-x64

10

malware-sa...1d.rtf

windows10-2004-x64

1

malware-sa...1d.rtf

windows11-ltsc_2024-x64

1

malware-sa...2d.rtf

windows10-2004-x64

1

malware-sa...2d.rtf

windows11-ltsc_2024-x64

1

malware-sa...5a.rtf

windows10-2004-x64

1

malware-sa...5a.rtf

windows11-ltsc_2024-x64

8

malware-sa...d5.rtf

windows10-2004-x64

1

malware-sa...d5.rtf

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    malware-samples source code.zip
  • Size 68.7MB
  • Sample260709-vbj64ady5l
  • SHA256 e3bd83b61c2deec0f5d6febbfc891be6fc52d2b546bafdf9b182032d845805a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrikekpotnanocorezeus0adwarebackdoordiscoveryinstallerkeyloggermacromacro_on_actionpersistenceransomwarerevoked_codesignspywarestealertrojanwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

  • http://job.softline.top/banner.jpg

Extracted

Family

  • cobaltstrike

Botnet

  • 0

C2

  • http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://job.softline.top/SCHEDLGU.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://marc.optimroute.com/tlztwf7
  • exe.dropper

    http://demo.madadaw.com/wp-content/tmp/ttftg7evqv
  • exe.dropper

    http://jongewolf.nl/5oyh89lgev
  • exe.dropper

    http://demo3.grafikaart.cz/b0jilry3
  • exe.dropper

    http://cialgweb.shidix.es/pjob6i3

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://rdweb.ir/jko_vkzlyc_v1p6jev59
  • exe.dropper

    http://mercedeslangha.vn/tro6fqd4_epbfymyjz
  • exe.dropper

    https://cardealersforbadcredit.net/jyxxcv_82ibravt_k7nwl2nu
  • exe.dropper

    http://kosolve.com/ggv_ejwpcn
  • exe.dropper

    http://denis-99bg.com/iti_0vuy_f13

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://hnw7.com/x9zlw7/
  • exe.dropper

    http://mercadosonntag.com.br/sk2vbv3/
  • exe.dropper

    http://hellcatshockey.org/g6wqbef/
  • exe.dropper

    http://tecnauto.com/xuo6/

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://liarla.com/rqajqljlx
  • exe.dropper

    http://espasat.com/1ybh45y
  • exe.dropper

    http://latuconference.com/wp-content/uploads/vvl9xhg
  • exe.dropper

    http://dirtyactionsports.com/vvgr4dva
  • exe.dropper

    http://demign.com/pgt53cb

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://johnnycrap.com/ho1ph0njd
  • exe.dropper

    http://kids-education-support.com/lrl15cy
  • exe.dropper

    http://tortugadatacorp.com/k3y7idp
  • exe.dropper

    http://realitycomputers.nl/cx2ibxr5r4
  • exe.dropper

    http://jaspinformatica.com/sdl8s7hg

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://www.nurserylk.com/4twenjw8
  • exe.dropper

    http://www.afubiagroup.com/xqob5mt
  • exe.dropper

    http://www.mijnlening.nl/0tvfimna
  • exe.dropper

    http://www.iddesign.com.ve/litybohwy
  • exe.dropper

    http://www.surewaytoheaven.org/jjmegtilz

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://hsquareddesignstudio.com/bibhgh/
  • exe.dropper

    http://backon.jp/jhurz/
  • exe.dropper

    http://fyon.de/n1rjbcn/
  • exe.dropper

    http://dominiki.pl/forum/akfa6l4b/

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://shophousekhaisontowncity.com/pl
  • exe.dropper

    http://www.mygidas.lt/m
  • exe.dropper

    http://www.natuhemp.net/m
  • exe.dropper

    http://c-sert.ru/assets/images/zim8ozmy
  • exe.dropper

    http://nusantararental.com/z4azh

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://habarimoto24.com/nh
  • exe.dropper

    http://fenett2018.com/dobgx
  • exe.dropper

    http://eastend.jp/bl5kfa
  • exe.dropper

    http://bemnyc.com/u8erijeq
  • exe.dropper

    http://abakus-biuro.net//a9zqemm

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://japanijob.com/uuc8iefifb
  • exe.dropper

    http://103.11.22.51/wp-content/uploads/yoarkx9
  • exe.dropper

    http://13.126.28.98/hpwxcgczbx
  • exe.dropper

    http://159.65.146.232/ugitr4t4l
  • exe.dropper

    http://159.65.65.213/iz1cc1ghz

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://yourmother4cancer.info/Nereidae/ZdDZ/umping?HGn3Nw=1932-05-23

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://wonnabegonnabe.info/vVZM/TOj/Paletots/1915_07_03?rectifier=IcDrG

Targets

    • Target
      malware-samples-master/2018-05-KPOT/36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce
    • Size 74KB
    • SHA256 36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      malware-samples-master/2018-05-KPOT/67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d
    • Size 79KB
    • SHA256 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/008d54ba06ec1b5fd909c1e0e9d9ba9a23c6d9a11d6e0f6910877e639b31c529
    • Size 61KB
    • SHA256 008d54ba06ec1b5fd909c1e0e9d9ba9a23c6d9a11d6e0f6910877e639b31c529
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    zeus
    behavioral5behavioral6
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/0655d58db2798ad8336f92dd580f988312f37f3e52b405c9c71d3afd2bd2c290
    • Size 112KB
    • SHA256 0655d58db2798ad8336f92dd580f988312f37f3e52b405c9c71d3afd2bd2c290
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/0c91e70676609b765e4d20afa992660f306798af60f9c164dd41336590636864
    • Size 50KB
    • SHA256 0c91e70676609b765e4d20afa992660f306798af60f9c164dd41336590636864
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/10ceb5916cd90e75f8789881af40287c655831c5086ae1575b327556b63cdb24
    • Size 83KB
    • SHA256 10ceb5916cd90e75f8789881af40287c655831c5086ae1575b327556b63cdb24
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/3f922fe437a4394c9c35dbf05252ff8fa20e2bbf10eb726ba9398c933c797837
    • Size 52KB
    • SHA256 3f922fe437a4394c9c35dbf05252ff8fa20e2bbf10eb726ba9398c933c797837
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/45a86012cb99762d57d0fe1626d5cdc9046751e26eac7d9ef0e8adedb03b8661
    • Size 818KB
    • SHA256 45a86012cb99762d57d0fe1626d5cdc9046751e26eac7d9ef0e8adedb03b8661
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/48aa32a4490beefc488add66df46b75bbd480af9cedebaa0c096ac216dd08d79
    • Size 37KB
    • SHA256 48aa32a4490beefc488add66df46b75bbd480af9cedebaa0c096ac216dd08d79
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/5484b0f37f21861c480f43c40168d9767bf619dfcd92436193ab7d7aee188fc4
    • Size 18KB
    • SHA256 5484b0f37f21861c480f43c40168d9767bf619dfcd92436193ab7d7aee188fc4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/54b32a37fc521c258da32fd15acb580d03b820ff69977696af5a134edea48f86
    • Size 81KB
    • SHA256 54b32a37fc521c258da32fd15acb580d03b820ff69977696af5a134edea48f86
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    zeus
    behavioral21behavioral22
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/62c03c4cd9d94029be4e38c4cbaf934a3a19919fab6ef3561a22f544bc892a2f
    • Size 63KB
    • SHA256 62c03c4cd9d94029be4e38c4cbaf934a3a19919fab6ef3561a22f544bc892a2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    zeus
    behavioral23behavioral24
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/6e2a271f9e137bc8c62fa304ede3b5bac046f4957d3f8249dde60357463e651d
    • Size 83KB
    • SHA256 6e2a271f9e137bc8c62fa304ede3b5bac046f4957d3f8249dde60357463e651d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/7532ef45138d57ac4ed9eeec0f62f9edef4447723efde66bffcff38175f6d62d
    • Size 30KB
    • SHA256 7532ef45138d57ac4ed9eeec0f62f9edef4447723efde66bffcff38175f6d62d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/758a0e300edff045ede857ad4b01c4d51f373add59c43b78047dd69ce4c7765a
    • Size 346KB
    • SHA256 758a0e300edff045ede857ad4b01c4d51f373add59c43b78047dd69ce4c7765a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral29behavioral30
    • Target
      malware-samples-master/2018-08-RTF-Byte-Nibble-Obfuscation/7a0c20c85f01a9d11e2b5f67483d154864b1a1dc8112566df156f8232d38a4d5
    • Size 18KB
    • SHA256 7a0c20c85f01a9d11e2b5f67483d154864b1a1dc8112566df156f8232d38a4d5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

revoked_codesignwebsettings0macromacro_on_actioninstallertrojanbackdoorcobaltstrikestealerkpotkeyloggerspywarenanocore
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

discovery
Score
7/10

behavioral4

discovery
Score
3/10

behavioral5

zeus
Score
10/10

behavioral6

zeus
Score
10/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

adwarepersistenceransomwarespyware
Score
8/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

zeus
Score
10/10

behavioral22

zeus
Score
10/10

behavioral23

zeus
Score
10/10

behavioral24

zeus
Score
10/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

adwarepersistenceransomwarespyware
Score
8/10

behavioral31

Score
1/10

behavioral32

Score
1/10