r/Malware • u/mozgie • 11h ago

api.wakhtar.com

Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone seen this or similar one ?

4 Upvotes

70% Upvoted

3 comments sorted by

0

u/mozgie 11h ago

"61","39.014719100","10.0.0.11","239.255.255.250","UDP","77","59319 > 15600 Len=35"

"62","39.033050300","10.0.0.21","10.0.0.1","DNS","75","Standard query 0x43eb A api.wakhtar.com"

"63","39.052508800","10.0.0.1","10.0.0.21","DNS","107","Standard query response 0x43eb A api.wakhtar.com A 104.21.26.118 A 172.67.168.69"

"64","39.059908800","10.0.0.21","104.21.26.118","TCP","66","56495 > 443 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM"

"65","39.084130800","104.21.26.118","10.0.0.21","TCP","66","443 > 56495 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1400 SACK_PERM WS=8192"

"66","39.084262800","10.0.0.21","104.21.26.118","TCP","54","56495 > 443 [ACK] Seq=1 Ack=1 Win=65280 Len=0"

2

u/mozgie 11h ago

I can share the full csv's if someone can assist me in identifying what it is; I'm curious to find the payload. Thank you

5

u/bearert0ken 7h ago

Those two IPs you're seeing are both Cloudflare anycast addresses, so the malware author is using Cloudflare as a free reverse proxy to hide their actual C2 server. You can't just block the IP without nuking a ton of legitimate traffic, which is exactly why they do it.

The TLS handshake completing on 443 means everything after that is encrypted and your PCAP won't show you the actual C2 traffic. Go back and grab the ClientHello packet right after that ACK and pull the JA3 fingerprint from it, sometimes matches to known families.

VM/ARM check before execution is standard sandbox evasion, it just refuses to run anywhere it thinks it's being watched. The RAM execution you mentioned sounds like process hollowing or reflective injection, payload probably never touches disk which is why AV missed it. Run your dump through Volatility and use malfind, look for PE headers injected into processes like svchost or explorer that have no business having them.

Also worth noting that UDP packet to 239.255.255.250 on line 61, that's SSDP multicast. Might just be Windows noise but could be the malware doing LAN recon before it reports back.