2CLoader: A New Malware Loader Delivering Vidar and Remus

Domain/URLs

https://aware-cr1.com/api/beacon

http://62.60.226.185/t0907.exe

Hash

5edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a

0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca6

06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e

066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6

0a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e

0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e

0e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa27

0ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb1

1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb

1447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf

1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f

246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095

2ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b

2c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b

2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6

30cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca

3286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d4

331fd58d489e9fb888a5e4193d0e36f6ff29063808c59a164d98e26835054972

45d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b

4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b

Detection Query 1 :

domainname like "http://62.60.226.185/t0907.exe" or url like "http://62.60.226.185/t0907.exe" or siteurl like "http://62.60.226.185/t0907.exe" or domainname like "https://aware-cr1.com/api/beacon" or url like "https://aware-cr1.com/api/beacon" or siteurl like "https://aware-cr1.com/api/beacon"

Detection Query 2 :

sha256hash IN ("331fd58d489e9fb888a5e4193d0e36f6ff29063808c59a164d98e26835054972","3286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d4","1447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf","0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e","066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6","0ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb1","0e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa27","2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6","4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b","06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e","2ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b","1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f","1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb","246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095","30cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca","45d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b","0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca6","5edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a","2c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b","0a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e")