Derin Analiz - Downloader (cc-coins.xyz) | Tehdit: YUKSEK
Fichier Kimligi
| SHA256 | 36fcbb6705cfb33700f750b218cf948f73590504a9fc31b4c1d9d8b517e5b8d9 |
|---|---|
| Taille | 1,644,032 byte (1.57 MB) PE32 GUI x86 |
| Entropi | 5.92 (normal) |
C2 Adresleri
C2 IOC: Aktif indirme URL'leri tespit edildi!
http://103.118.255.239:8888/wj/1.jpg <- sahte JPG, gercekte payload!\nhttp://app.cc-coins.xyz <- kripto dolandirici C2 paneli\n\nIndirilen: crypt.bin (/crypt.bin) <- sifreli payload dosyasi\n/btcf <- Bitcoin fraud endpoint
Teknik Architecture
InternetOpenA + InternetOpenUrlA (WinInet)\n -> http://103.118.255.239:8888/wj/1.jpg indirir (sahte resim=payload)\n -> crypt.bin olarak kaydedilir\n\nMuhtemelen crypt.bin icinde:\n - Sifreli bir RAT veya miner payload\n - Dropper bu payload'u bellekte cozup calistirir
IOC
| SHA256 | 36fcbb6705cfb33700f750b218cf948f73590504a9fc31b4c1d9d8b517e5b8d9 |
|---|---|
| C2 IP | 103.118.255.239:8888 (payload server) |
| C2 Domain | app.cc-coins.xyz (kripto dolandirici panel) |
| Payload | crypt.bin (sifreli ikincil yukleyici) |
Liste IOC (3 indicateurs)
IOC — Downloader
# SHA256
36fcbb6705cfb33700f750b218cf948f73590504a9fc31b4c1d9d8b517e5b8d9
# DOMAIN
cc-coins.xyz
# URL
http://103.118.255.239:8888/wj/1.jpg
| Type | Valeur | Note |
|---|---|---|
| sha256 | 36fcbb6705cfb33700f750b218cf948f73590504a9fc31b4c1d9d8b517e5b8d9 | |
| domain | cc-coins.xyz | |
| url | http://103.118.255.239:8888/wj/1.jpg |
Serveurs C2 (1 serveurs enregistrés pour cette famille)
| Adresse | Type | Port | Protocole | Statut | Pays |
|---|---|---|---|---|---|
| cc-coins.xyz | domain | 80 | HTTP | inactive | — |
Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.