Overview

overview

10

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    531292f4b404a53a700330fa4d622d80b3b72ca2c2f525d7fe0009381fb471c0

  • Size

    260KB

  • Sample

    240121-19z8vsbee9

  • MD5

    458210ef2582bca66b0afd0f218cfabe

  • SHA1

    84380de56730f62f60c3b45d91e7434664e57b04

  • SHA256

    531292f4b404a53a700330fa4d622d80b3b72ca2c2f525d7fe0009381fb471c0

  • SHA512

    a21b1bb648a0a230aa156c2f90b4b465e128b20da79b47cc6b7f98abe7e20084fd502a1790b6ed2e37e3974413e0b75edd44b3f9491c4f2c97b1062be0b0da42

  • SSDEEP

    3072:xkhue6/cSz90u2DEJClClQoyLZrs+f6hMCgin21DX7QfrehPY7IQPJUtw+h0j:xkh/BEQ0SBs+f6/gnEre5YEQRE2

Score
10/10
amadeyasyncratdcratloaderbotredlineriseprosmokeloaderzgratdefaultlogsdiller cloud (tg: @logsdillabot)pub1st12backdoordiscoveryinfostealerloaderminerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

45.15.156.60:12050

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

91.92.248.67:6606

91.92.248.67:7707

91.92.248.67:8808
Mutex

MOgiiF6Liim5

Attributes
  • delay

    3

  • install

    false

  • install_file

    temp.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

Botnet

ST12

C2

185.172.128.33:38294

Extracted

Family

risepro

C2

193.233.132.62:50500

Extracted

Family

amadey

Version

4.17

C2

http://185.196.10.34

Attributes
  • install_dir

    eff1401c19

  • install_file

    Dctooux.exe

  • strings_key

    6e23b5eadc27bb0b2eaebdd4fed1beb2

  • url_paths

    /b8sdjsdkS/index.php

rc4.plain

Targets

    • Target

      531292f4b404a53a700330fa4d622d80b3b72ca2c2f525d7fe0009381fb471c0

    • Size

      260KB

    • MD5

      458210ef2582bca66b0afd0f218cfabe

    • SHA1

      84380de56730f62f60c3b45d91e7434664e57b04

    • SHA256

      531292f4b404a53a700330fa4d622d80b3b72ca2c2f525d7fe0009381fb471c0

    • SHA512

      a21b1bb648a0a230aa156c2f90b4b465e128b20da79b47cc6b7f98abe7e20084fd502a1790b6ed2e37e3974413e0b75edd44b3f9491c4f2c97b1062be0b0da42

    • SSDEEP

      3072:xkhue6/cSz90u2DEJClClQoyLZrs+f6hMCgin21DX7QfrehPY7IQPJUtw+h0j:xkh/BEQ0SBs+f6/gnEre5YEQRE2

    Score
    10/10
    amadeyasyncratdcratloaderbotredlineriseprosmokeloaderzgratdefaultlogsdiller cloud (tg: @logsdillabot)pub1st12backdoordiscoveryinfostealerloaderminerpersistenceratspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detect ZGRat V1

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Async RAT payload

      rat

    • LoaderBot executable

    • Downloads MZ/PE file

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks