General
- Target Повестка.img
- Size 2.2MB
- Sample261012-ls824sbc68
- SHA256 bd4f16a204e56ab9b8f8b0024e7d07490ba26cdc5b84563c4beab02890effdaa
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://2.27.123.243:8080/1000rub.bin
-
exe.dropper
http://2.27.123.243:8080/1000rub.bin
Extracted
-
adaptixc2
-
2.26.116.156
-
port
8080
-
url_path
/updates/check.php
-
user_agent
Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0
Targets
-
- Target Повестка.img
- Size 2.2MB
- SHA256 bd4f16a204e56ab9b8f8b0024e7d07490ba26cdc5b84563c4beab02890effdaa
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target concrt140.dll
- Size 309KB
- SHA256 8bf7efb1fa4f86db826b79ea1d3daa6e18019790d7b5ff58b53bfb4cad967974
Score1/10 -
- Target doc.pdf
- Size 606KB
- SHA256 8cdd2490c965fd5f7db27dc1d1d163e76a3ccb43bd92ed0b5508cada2507e0eb
Score3/10 -
- Target libcares-2.dll
- Size 258KB
- SHA256 5c49c90b6369772f7b52770beeb64ec0e2ad87b5c2c061ae840c2018d69e0c03
Score10/10-
Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target libcares-2_orig2.dll
- Size 270KB
- SHA256 2bfe1c8f65ad5c94ea3021a69e914ed575c5be9adc5fca73e55eea5d7189e29c
Score1/10 -
- Target msvcp140.dll
- Size 576KB
- SHA256 3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
Score1/10 -
- Target vcruntime140.dll
- Size 99KB
- SHA256 7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
Score1/10 -
- Target vcruntime140_1.dll
- Size 43KB
- SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
Score1/10 -
- Target Повестка.exe
- Size 63KB
- SHA256 eef8e8fc4c87524003d818711ff20112f0d713fdcd16fa479672f4a95e823bc2
Score10/10-
Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1