General
- Target Повестка.img
- Size 2.2MB
- Sample261012-ls824sbc68
- SHA256 bd4f16a204e56ab9b8f8b0024e7d07490ba26cdc5b84563c4beab02890effdaa
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://2.27.123.243:8080/1000rub.bin
-
exe.dropper
http://2.27.123.243:8080/1000rub.bin
Extracted
-
adaptixc2
-
2.26.116.156
-
port
8080
-
url_path
/updates/check.php
-
user_agent
Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0
Targets
-
- Target Повестка.img
- Size 2.2MB
- SHA256 bd4f16a204e56ab9b8f8b0024e7d07490ba26cdc5b84563c4beab02890effdaa
Score10/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target concrt140.dll
- Size 309KB
- SHA256 8bf7efb1fa4f86db826b79ea1d3daa6e18019790d7b5ff58b53bfb4cad967974
Score1/10 -
- Target doc.pdf
- Size 606KB
- SHA256 8cdd2490c965fd5f7db27dc1d1d163e76a3ccb43bd92ed0b5508cada2507e0eb
Score3/10 -
- Target libcares-2.dll
- Size 258KB
- SHA256 5c49c90b6369772f7b52770beeb64ec0e2ad87b5c2c061ae840c2018d69e0c03
Score10/10Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target libcares-2_orig2.dll
- Size 270KB
- SHA256 2bfe1c8f65ad5c94ea3021a69e914ed575c5be9adc5fca73e55eea5d7189e29c
Score1/10 -
- Target msvcp140.dll
- Size 576KB
- SHA256 3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
Score1/10 -
- Target vcruntime140.dll
- Size 99KB
- SHA256 7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
Score1/10 -
- Target vcruntime140_1.dll
- Size 43KB
- SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
Score1/10 -
- Target Повестка.exe
- Size 63KB
- SHA256 eef8e8fc4c87524003d818711ff20112f0d713fdcd16fa479672f4a95e823bc2
Score10/10Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1