General
- Target 2020-03-19.zip
- Size 47.0MB
- Sample260710-agzthsa19q
- SHA256 70dee3facba3df0bba48770362256ab377b8ac1dffb6e5238a87f3be7a78d29e
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
USER
-
ratvictims2.ddns.net:6398
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
-
njrat
-
0.7d
-
TEST
-
103.91.205.79:30111
-
7de649687699ed09ca599fd1527fb4d0
-
reg_key
7de649687699ed09ca599fd1527fb4d0
-
splitter
|'|'|
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
S??t?n Panpa
-
mehmetcomet.duckdns.org:81
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
-
njrat
-
0.7d
-
HacKed
-
127.0.0.1:4444
-
127.0.0.1:5552
-
salimdz899.ddns.net:27212
-
bc4633c7cad50e9fd5e79a99a4157416
-
reg_key
bc4633c7cad50e9fd5e79a99a4157416
-
splitter
|'|'|
Extracted
-
sodinokibi
-
$2a$10$pQLa9gPejF03WQ4XtbFgweLLYFD.4opCNh6w8taV1.5SK58V9vGem
-
1556
-
alten-mebel63.ru
-
dr-pipi.de
-
layrshift.eu
-
evologic-technologies.com
-
crediacces.com
-
manutouchmassage.com
-
marketingsulweb.com
-
eadsmurraypugh.com
-
kojinsaisei.info
-
mrtour.site
-
paulisdogshop.de
-
architecturalfiberglass.org
-
autodujos.lt
-
vetapharma.fr
-
vietlawconsultancy.com
-
lange.host
-
foretprivee.ca
-
prochain-voyage.net
-
milltimber.aberdeen.sch.uk
-
cityorchardhtx.com
-
net
true
-
pid
$2a$10$pQLa9gPejF03WQ4XtbFgweLLYFD.4opCNh6w8taV1.5SK58V9vGem
-
prc
sqlwriter
onenote
excel
infopath
outlook
msftesql
mysqld
thebat
wordpad
tbirdconfig
winword
mysqld_nt
visio
firefoxconfig
steam
isqlplussvc
ocssd
ocautoupds
sqlservr
agntsvc
sqbcoreservice
ocomm
dbsnmp
thunderbird
msaccess
mspub
sqlagent
mydesktopqos
dbeng50
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1556
-
svc
mepocs
memtas
backup
veeam
svc$
sql
sophos
vss
Extracted
-
limerat
-
46R7GZaerKc82Vr1e3A9atZW1SAqnbPEa3soU7g5d6fHUKRz9Am5d3cTpFdFY1uYEqSPqZwbUtmFDQnUmnPWcAjJDQCDPZ5
-
aes_key
1111
-
antivm
true
-
c2_url
https://pastebin.com/raw/a8zmXirE
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Extracted
-
njrat
-
0.6.4
-
USER
-
ratvictims2.ddns.net:5685
-
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Extracted
-
njrat
-
0.7d
-
Hotel
-
fidapeste.ddnsfree.com:5552
-
f3456dc0c7d89e0389c8d3837bb578b5
-
reg_key
f3456dc0c7d89e0389c8d3837bb578b5
-
splitter
|'|'|
Extracted
-
sodinokibi
-
$2a$10$1TpVCAmIjkgVnyLyrsp1.Oa839flZJSvGurEea9a1/4.ePpsvgCcu
-
3638
-
zweerscreatives.nl
-
mindpackstudios.com
-
maxadams.london
-
ivivo.es
-
run4study.com
-
pinkexcel.com
-
importardechina.info
-
jandaonline.com
-
schmalhorst.de
-
the-virtualizer.com
-
physiofischer.de
-
dsl-ip.de
-
pcprofessor.com
-
architecturalfiberglass.org
-
ditog.fr
-
levdittliv.se
-
baumkuchenexpo.jp
-
team-montage.dk
-
trackyourconstruction.com
-
apprendrelaudit.com
-
net
true
-
pid
$2a$10$1TpVCAmIjkgVnyLyrsp1.Oa839flZJSvGurEea9a1/4.ePpsvgCcu
-
prc
isqlplussvc
synctime
powerpnt
mydesktopqos
xfssvccon
thebat
wordpad
dbsnmp
outlook
thunderbird
msaccess
sqbcoreservice
tbirdconfig
visio
encsvc
winword
steam
oracle
agntsvc
mydesktopservice
mspub
excel
infopath
sql
dbeng50
onenote
ocomm
ocautoupds
firefox
ocssd
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3638
-
svc
memtas
svc$
backup
mepocs
veeam
sophos
vss
sql
Extracted
-
njrat
-
Hallaj PRO Rat [Fixed]
-
HacKed
-
jnhackerr.con-ip.com:5577
-
jnhackerr.con-ip.com:5552
-
9469373d0e582e350a1b99751fd2f6dd
-
reg_key
9469373d0e582e350a1b99751fd2f6dd
-
splitter
boolLove
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
192.168.0.100:1000
-
QSR_MUTEX_MWPfr6HooR2YrD8P1g
-
encryption_key
Klugtq2ft3UYaDbyh5Eh
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
asyncrat
-
0.5.5A
-
null
-
ixbdqbakobpwgspvpbh
-
delay
5
-
install
false
-
install_file
trojan
-
install_folder
%AppData%
-
private_ip
192.168.1.6
Extracted
-
remcos
-
1.7 Pro
-
Microsoft 2020
-
enmark81.duckdns.org:4045
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Windows logoff sound.exe
-
copy_folder
Windows Audio
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Windows Audio
-
keylog_path
%WinDir%
-
mouse_option
false
-
mutex
Windows Audio
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Windows Audio
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
Username;password;proforma;invoice;notepad
Extracted
-
guloader
-
https://www.soygorrion.com.ar/ii/bin_encrypted_A67C47F.bin
-
https://drive.google.com/uc?export=download&id=1Zecti13UUxptgtFRFt-gmx-v1bJ0HO0B
-
https://drive.google.com/uc?export=download&id=1znJauNFq74a-ICZLHV2_UW_uLaJqzsRg
Extracted
-
xlm4.0
Extracted
-
formbook
-
3.9
-
bz1
-
lagrangelibrary.com
-
tiengchuong.net
-
ablesurvival.com
-
aserehe-notic.com
-
htlandscaping.net
-
resultsoryourmoneyback.com
-
zeptembermaui.info
-
1m1twowork.loan
-
nerdivo.com
-
happytimeplaycare.com
-
turnpikebagels.com
-
upnse.com
-
eatingbon-bons.com
-
roma-analytics.com
-
siyoungshop.com
-
gostartthis.com
-
lentejuelascouture.com
-
herblossomspirit.com
-
skylarkcorp.com
-
agentkangproperty.com
Extracted
-
xlm4.0
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
ike2020.xyz
-
Port
587
-
Username
-
Password
_RFZ2R^Ip.ah
Extracted
-
formbook
-
3.9
-
or09
-
rieymbkp2a4h.com
-
amour.ink
-
houses-sitges.com
-
aixieclub.com
-
lsnlny.com
-
xn--9i1bt4ghscw7ruyctub.com
-
oefeuig.com
-
ultimateimpactmovement.com
-
spendabit.online
-
successenemies.com
-
neuwiederknuspermarkt.com
-
goldentouch.online
-
projetovisto.com
-
liuzhouvr.com
-
vmeiwu.com
-
w108developmentllc.net
-
homeremodelsplash.info
-
wundarbalm.info
-
enjoyingsunset.review
-
gannettinsites.com
Extracted
-
lokibot
-
http://pyungz.org/55j/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
-
http://fllxprint.com/loki/Panel/fre.php
Targets
-
- Target 023946cb10325407c30c9ec45ecd241d5e0e3f9ebaeffe2ab12f8cd5f0646013.exe
- Size 637KB
- SHA256 023946cb10325407c30c9ec45ecd241d5e0e3f9ebaeffe2ab12f8cd5f0646013
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Program crash
-
Suspicious use of SetThreadContext
-
- Target 04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b.exe
- Size 43KB
- SHA256 04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b
Score3/10 -
- Target 08ab20e9f7ed555353e17e1249d921725f9e212aae4e85e860e45b1e8da77beb.exe
- Size 656KB
- SHA256 08ab20e9f7ed555353e17e1249d921725f9e212aae4e85e860e45b1e8da77beb
Score10/10-
Family: Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
- Target 09ed1487ad28e1dffabd42618c997fe3d110ddb12e9cbc7d42ff5b2e7c74e010.exe
- Size 871KB
- SHA256 09ed1487ad28e1dffabd42618c997fe3d110ddb12e9cbc7d42ff5b2e7c74e010
Score10/10-
Family: Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
- Target 0bba310d0af941efeae9dd5e3bffeef258680c5633dfe1a96a4e88c8e15b5d2b.exe
- Size 76KB
- SHA256 0bba310d0af941efeae9dd5e3bffeef258680c5633dfe1a96a4e88c8e15b5d2b
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target 0edae896c82accd8703457f84d1f2de7a345c60a9643b2499c6ad798b94f621a.exe
- Size 23KB
- SHA256 0edae896c82accd8703457f84d1f2de7a345c60a9643b2499c6ad798b94f621a
Score10/10-
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target 10547fbcab56e5eeced75b4db50aac92a2eafe3581ad35018e27ea840b6abcb6.xls
- Size 841KB
- SHA256 10547fbcab56e5eeced75b4db50aac92a2eafe3581ad35018e27ea840b6abcb6
Score10/10-
Family: TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL
-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-
- Target 11892c93ce6ecc668a92bcbb2e618edbc40f87cea8938e2dbe7061cbc6d1f689.exe
- Size 401KB
- SHA256 11892c93ce6ecc668a92bcbb2e618edbc40f87cea8938e2dbe7061cbc6d1f689
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target 1a344f443cb63b15248b6ec7b7dcfe4d3b9cb68fa7ffd8cce0415963d0c81d62.xls
- Size 957KB
- SHA256 1a344f443cb63b15248b6ec7b7dcfe4d3b9cb68fa7ffd8cce0415963d0c81d62
Score10/10-
Family: TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL
-
- Target 2084e95f6624b243760b5ac8e5f486168a84a08cb0d71b285f01720ebd77ee8f.exe
- Size 934KB
- SHA256 2084e95f6624b243760b5ac8e5f486168a84a08cb0d71b285f01720ebd77ee8f
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-
- Target RFQ QUOTATION.exe
- Size 76KB
- SHA256 d05800ab82af8100fbb6ee66729de2aa580f8acde780df49ef14b4213f316e87
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target 25d0644abcd60f265f05633bab35cceb3e617b48334b3e8ddf0be3569aae31c4.ps1
- Size 26KB
- SHA256 25d0644abcd60f265f05633bab35cceb3e617b48334b3e8ddf0be3569aae31c4
Score3/10 -
- Target 28f39e656758b6c40db049e40bbfe958a7a20a754ea6531ccca3e4fdb8dcc66a.exe
- Size 58KB
- SHA256 28f39e656758b6c40db049e40bbfe958a7a20a754ea6531ccca3e4fdb8dcc66a
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target 31ca432734bc4854e948fc0bdb2d14da67c6e5759cd54980e1ad0858b8102ec7.exe
- Size 76KB
- SHA256 31ca432734bc4854e948fc0bdb2d14da67c6e5759cd54980e1ad0858b8102ec7
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target COVID-19 avoid touchless solution to prevent from CORONA VIRUS.exe
- Size 1.8MB
- SHA256 b0cd91c32f6b9cca78cc162d1967e47de491d55b928a5e6538a104249d523f7e
Score10/10-
AgentTesla payload
-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
- Target 3906afd9e6d7463f7d0886a54417f1c976bf647d96912340187a5851eaede2eb.exe
- Size 1.1MB
- SHA256 3906afd9e6d7463f7d0886a54417f1c976bf647d96912340187a5851eaede2eb
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2