Windows MetaStealer Malware

TRAFFIC GENERATED AFTER ENALBING EXCEL MACRO: – port 443 – https://github.com/michel15P/1/raw/main/notice.zip – port 443 – https://raw.githubusercontent.com/michel15P/1/main/notice.zip TRAFFIC GENERATED BY NOTICE.EXE – port 80 – transfer.sh – GET /get/qT523D/Wlniornez_Dablvtrq.bmp – port 443 – https://transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp – 193.106.191.162 port 1775 – 193.106.191.162:1775 – GET /avast_update – 193.106.191.162 port 1775 – 193.106.191.162:1775 – GET /api/client/new – 193.106.191.162 port 1775 – 193.106.191.162:1775 – POST /tasks/get_worker ALERTS ON POST-INFECTION TRAFFIC TO 193.106.191.162 OVER TCP PORT 1775: – ETPRO MALWARE Win32/MetaStealer Related Activity (GET) (sid:2851362) – ETPRO MALWARE Win32/MetaStealer Related Activity (POST) (sid:2851363) ASSOCIATED MALWARE: – SHA256 hash: 981247f5f23421e9ed736dd462801919fea2b60594a6ca0b6400ded463723a5e – File size: 88,069 bytes – File name: transfer_info2460.xls – File description: Email attachment, Excel file with macro for malware – SHA256 hash: 81e77fb911c38ae18c268178492224fab7855dd6f78728ffedfff6b62d1279dc – File size: 2,828 bytes – File name: open.vbs – File location: same directory as the Excel file – File description: VBS file used to create persistent EXE – SHA256 hash: 8cfa23b5f47ee072d894ee98b1522e3b8acc84a6e9654b71f50536e74a3579a5 – File size: 417,512 bytes – File location: https://raw.githubusercontent.com/michel15P/1/main/notice.zip – File description: data binary retrieved by open.vbs and used to persistent EXE (below) – SHA256 hash: f644bef519fc0243633d13f18c97c96d76b95b6f2cbad2a2507fb8177b7e4d1d – File size: 367,001,600 bytes – File location: C:Users[username]AppDataLocalTempnotice.exe – File location: C:Users[username]AppDataRoamingqwveqwveqw.exe – File description: Windows EXE persistent on the infected Windows host – Note: This binary is appended with more than 366 MB of zero-byte filler – Note: Persistent through “Shell” value at HKCUSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon – SHA256 hash: 7641ae596b53c5de724101bd6df35c999c9616d93503bce0ffd30b1c0d041e3b – File size: 143,400 bytes – File description: Persistent malware notice.exe with most of the zero-byte filler removed – SHA256 hash: fba945b78715297f922b585445c74a4d7663ea2436b8c32bcb0f4e24324d3b8b – File size: 716,288 bytes – File location: https://transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp – File description: Retrieved by notice.exe, this binary is a Windows DLL file in reverse byte order – SHA256 hash: bf3b78329eccd049e04e248dd82417ce9a2bcaca021cda858affd04e513abe87 – File size: 716,288 bytes – File description: Windows DLL file created by reserving the above binary – File type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows – Run method: run by notice.exe – SHA256 hash: cb6254808d1685977499a75ed2c0f18b44d15720c480fb407035f3804016ed89 – File size: 2,182,488 bytes – File location: http://193.106.191.162:1775/avast_update – File description: base64 text representing a Windows DLL file – SHA256 hash: 71e54b829631b93adc102824a4d3f99c804581ead8058b684df25f1c9039b738 – File size: 1,636,864 bytes – File description: Windows DLL file converted from avast_update text – File type: PE32 executable (DLL) (console) Intel 80386, for MS Windows – Run method: unknown, run by notice.exe or the above DLL run by notice.exe