Ranger

CnC Hunter and busy college student
Targets: #Qealler (presumed extinct) #OrcusRAT #Tsunami 🎯

[Ranger @RangXOR]

@Abjuri5t @vmray @WPI We'll be there!

(well, my friends and I will be there digitally at least)

[Ranger @RangXOR]

CC
@CentriLogic
@0x4d_ @1ZRR4H @Abjuri5t @abuse_ch @AndreGironda @corq @Crose_96 @cybersyrupblog @GardenerSantana @hernanespinoza @JRoosen @Malwaredev @shotgunner101 @wwp96 @YourAnonRiots @yungmay0

[Ranger @RangXOR]

New #Qealler CnC 192.254.79[.]67:80

Samples first showed-up on April 15th. Malicious #CnC server hosted on @CentriLogic
https://t.co/6w82edo3w4 👎

🏖️ report: https://t.co/I6Kh8hzX4R

Shout-out to @Crose_96 and @malwrhunterteam for bringing my attention to it 🙏

[Ranger @RangXOR]

Overall: nothing seems to be new for these #Qealler samples (you know, other than the 🆕 #CnC on @CentriLogic)

As @Crose_96 pointed out, #VT detection ratios are rather low - but that's normal ☹️
(on average, the ratios are actually a bit higher than when I first started 🏹)

[Ranger @RangXOR]

@Crose_96 @malwrhunterteam @wwp96 The detection ratios are usually below 10 (originally)
Do you have the hash? I’d love to take a look sometime tonight and see if there’s anything significantly different

[Ranger @RangXOR]

@Crose_96 @malwrhunterteam @wwp96 Feel free DM me any time 🤓
Also been working on a write-up analyzing #Qealler - but college courses really slowing me down tho
You can view some preliminary notes/artifacts here: https://t.co/kPtsPWSOVU

[Ranger @RangXOR]

CC
@0x4d_ @0xthreatintel @1t1sNobody @1ZRR4H @Abjuri5t @abuse_ch @c0ns010 @corq @cybersyrupblog @Dkavalanche @GardenerSantana @GPI_Giancola @James_inthe_box @JAMESWT_MHT @JCyberSec_ @JRoosen @Malwaredev @malwrhunterteam @pan_kmb @shotgunner101 @Virus_Deck @wwp96 @yungmay0

[Ranger @RangXOR]

New #Qealler server for the blocklist 🔥: 79.143.87[.]120:80
(first new one since 3/22)

https://t.co/bpWMcazkzk 👎

Qealler devs finally moved from Private Layer, this #CnC is hosted on #HyrdaCom

🏖️ sandbox: https://t.co/7bjSG7kfYr

[Ranger @RangXOR]

Active #Qealler samples:🔬

4b804f4defa52df0534b9acc5503b808 - https://t.co/O0RMtCcU7h

7312c90ad802c82304d349e671ba451c - https://t.co/OU1eI6AU6f

a9c77d8c90730be4c19acd41ee1963cf - https://t.co/UmhpLdhT2P

(improved detection ratios in #VT since I first started reporting 😁)

[Ranger @RangXOR]

@wwp96 @JAMESWT_MHT

[Ranger @RangXOR]

🆕#Qealler server: 31.7.61[.]14:80
https://t.co/Mu2FMeD66d
Discovered by @wwp96 🤘

The Qealler devs seem to have settled on hosting #CnC servers at @PrivateLayer this season (see https://t.co/mEzKDdpDqs)

👾Sample: 426ce0823c081d2f4b9c491d9c302e77
https://t.co/MEgjPaPPxj [6/61]

[Ranger @RangXOR]

Just a sneak-peek for my upcoming report on #Qealler and its networking protocols. Should hopefully be done writing sometime next week (but that's also #midterm week so... 🤞)

CC
@0xthreatintel @1ZRR4H @abuse_ch @c0ns010 @James_inthe_box @JRoosen @shotgunner101 @wwp96 @yungmay0

[Ranger @RangXOR]

Had to crawl through ~13000 lines of _horribly_ written #Java code, but I've finally managed to fully #ReverseEngineer the #Qealler payload 👩‍🔬
The #packer was way simpler than I thought - it was just like 200x larger than it needed to be 🤮

https://t.co/2kvUzgZpa7

[Ranger @RangXOR]

Just over 25 hours later and #VT is up to 19/58 ⬆️
https://t.co/h4gNWvhTBT

Thanks @JAMESWT_MHT and @Abjuri5t!

[Ranger @RangXOR]

🆕 #Qealler sample (yay?)

31.7.61[.]2:80 is the new #CnC server and my new target🎯
https://t.co/TJzd4cjf8J
The server is once again hosted at @PrivateLayer (check your inbox, I have seen this pattern before)

🏖️Sandbox report: https://t.co/rmLoGGypQ3

[Ranger @RangXOR]

https://t.co/h4gNWvhTBT
3/58 detection ratio on #VT

Can't find payload URL (in class rn, will look later). Should be somewhere on fmjplastering[.]co[.]uk

Spent better part of the last week fully #reversing the 508a10013321a191f9699f24b542b04a sample👩‍🔬 - hopefully done soon🤞

[Ranger @RangXOR]

CC
@PrivateLayer
@0xthreatintel @1ZRR4H @Abjuri5t @corq @cybersyrupblog @DR_N0b0dyh @GardenerSantana @James_inthe_box @JAMESWT_MHT @JCyberSec_ @JRoosen @Malwaredev @malwrhunterteam @pan_kmb @shotgunner101 @vmray @wwp96 @yungmay0

[MalwareHunterTeam @malwrhunterteam]

"cobaltstrike_shellcode.exe": b6e5152533f4b53ee38457f3106ba6f5701038b66bb6236504c5aeebc9cde5ef
fuckyourserver[.]xyz
104.168.166[.]124
😂
@Spam404
cc @VK_Intel @bryceabdo @JAMESWT_MHT

[Ranger @RangXOR]

CC
@abuse_ch @Abjuri5t @GardenerSantana @HybridAnalysis @James_inthe_box @JAMESWT_MHT @Malwaredev @pan_kmb @shotgunner101 @wwp96 @yungmay0

p.s. I left the #Qealler sample running in my VM... it's still trying to connect to the CnC an hour later 🤣

[Ranger @RangXOR]

One emailed PCAP later and #Qealler's new #CnC server is down. Big thanks to @PrivateLayer's Abuse Team💘

recent sandbox report: https://t.co/Sy2Z9zqLV7
✅ Confirmed via dynamic analysis (see screenshot)

NOTHING makes me happier than watching malware get lost on its way home 😈

[Ranger @RangXOR]

#Qealler is back 🆕
The #CnC server at 179.43.145[.]245 - currently hosted at @PrivateLayer

https://t.co/q1TxzX9mn2

New sample (discovered by @wwp96) appears to be an updated instance of the #infostealer - at first glance the code is slightly more sophisticated

[1/2]