---
description: >-
  An Threat Intel lab talking about Stealer Malware and It`s behavior so here we
  go
---

# Red Stealer Blue Team Lab

Firstly after download the lab file wich is a SHA(265) hash we have to take this hash and start our journey with intel websites Mainly we will use&#x20;

* Whois
* VirusTotal
* MalwareBazaar
* ThreatFox
* Any Run&#x20;

## 1-Let\`s use Virus Total&#x20;

I took the hash and put in virus total&#x20;

&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FtjLTI73VtqcHhAHSPTvX%2Fimage.png?alt=media&#x26;token=bfbaee5b-30a3-46cc-8bf1-addf7e6b9905" alt=""><figcaption><p>and what a view btw </p></figcaption></figure>

we can Easily identify it is a Trojan&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FAojRAuCOn1RXYgV4vm2R%2Fimage.png?alt=media&#x26;token=2bd34799-1b64-4e02-83c3-dc036a004f30" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FCDjDaght2Hd4RBnK5GZq%2Fimage.png?alt=media&#x26;token=cab719b9-7352-442c-bb54-ae2d799771b5" alt=""><figcaption></figcaption></figure>

## 2- Details Section at Virus Total

Search For the Names for this Trojan and Found it easily&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FLo0gyEEnPtelQdBFa589%2Fimage.png?alt=media&#x26;token=9cf622f0-06b3-4544-b80e-8fd4204a3e40" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F0Y0XWkA3B8lo7HNv1wS6%2Fimage.png?alt=media&#x26;token=5107e6a8-c89f-40b0-b899-1e5a1c642755" alt=""><figcaption></figcaption></figure>

## 3- Still in the Details Section&#x20;

That gives us Fully Details of first Detection for this Trojan&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FOh623cRvIYYNEmRWaXSI%2Fimage.png?alt=media&#x26;token=f2ac67d3-b0c2-4a14-80e9-a30b30ddccbd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F5xQcHnbxeSLOdhMJsP4M%2Fimage.png?alt=media&#x26;token=893469db-9e8e-42cc-9541-b110958d808e" alt=""><figcaption></figcaption></figure>



## 4- What about Mitre Technique&#x20;

Ok For Me the Easily Way to detrimine the techique is fully understand What is the behaviour for owr Malware it collects data from the system before the exection so it is T1005&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fj1TJNKDl3a0oODLy63b3%2Fimage.png?alt=media&#x26;token=f1df5099-e63f-464b-94a4-7cbc3ad7aa84" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F2wNpnrdI0xs1I9JpCrKi%2Fimage.png?alt=media&#x26;token=669e2a55-d2ea-4778-969d-90ae53df68e4" alt=""><figcaption></figcaption></figure>

## 5-Let\`s see Behavior Section&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FjLwGiBLSlHMOY1GTDQhA%2Fimage.png?alt=media&#x26;token=5f18628b-ae5e-4b68-9af3-14ab7ddd3a7f" alt=""><figcaption></figcaption></figure>

It is Facebook soo weierd ):

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FbX0LEAUIjBWSQ7Y4kOV7%2Fimage.png?alt=media&#x26;token=ac4acc4d-a7f3-4ca4-88ce-b309ed6375b7" alt=""><figcaption></figcaption></figure>



## 6- We in the same behaviour section&#x20;

This is the First Communicated ip btw&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FZ8dKrqKjeske7HvlV9R4%2Fimage.png?alt=media&#x26;token=eece02f2-ae58-408d-8480-b2cc3a83b3d0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F3cllsOkjseg6indS0vth%2Fimage.png?alt=media&#x26;token=fad2d970-7d9c-4138-8778-4e43f8a92601" alt=""><figcaption></figcaption></figure>

## 7-Use WHOIS to determine the doamin&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fp2uamkgNRlzogUPFKuBQ%2Fimage.png?alt=media&#x26;token=649b46ae-d322-4488-ad6c-d7a0e71491a5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FKMViWSLJjmAmwT6ELjFO%2Fimage.png?alt=media&#x26;token=e8465862-2a60-4d4c-821f-1260eb5105b0" alt=""><figcaption></figcaption></figure>

## 8- To determine the Yara Rule we can go to MalwareBazzar

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FFS5diAoK2tf3ZYkl6GH4%2Fimage.png?alt=media&#x26;token=03ffaee9-ab45-4ee2-b670-620b19a0abbd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FeU9XM2mv6qG2HZn5Ulrr%2Fimage.png?alt=media&#x26;token=e6fc0cd8-e80e-4333-bd8f-65cfc12c2652" alt=""><figcaption></figcaption></figure>



## 8-To determine the Milicous IP I like Threat Fox

use ioc and give the ip&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FpnVLgJlvG37iewCgYKZ6%2Fimage.png?alt=media&#x26;token=13d9d2a7-ca34-4acc-bd28-3f35159f252a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FACkL8HPSbY4ZJ5NhT1v7%2Fimage.png?alt=media&#x26;token=e0d75b05-bec4-4ae2-a675-2b83fdfc3e59" alt=""><figcaption></figcaption></figure>

## 10- For the DLL we back to use behaviour section in Virus total again ):

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F7VZ9lqTJpREhLnzHZuJG%2Fimage.png?alt=media&#x26;token=1618409d-307c-4fac-b572-22ab3948f0ea" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FVPX71nwdznN3GHJz9eww%2Fimage.png?alt=media&#x26;token=85d94c1c-b863-46a5-955e-263aaedcce82" alt=""><figcaption></figcaption></figure>

#### Finally Easy lab but great , Thank you&#x20;



