CyberDefendersThreat IntelMediumRetiredURLhaus · VT · MalwareBazaar · VMRay
Scenario: A phishing email targeting faculty at an educational institution appeared to come from a trusted contact, claiming a $625,000 purchase and linking to a fake invoice download. The investigation required analyzing the email headers for spoofing, following the malicious link through a full malware delivery chain, and pivoting across threat intel platforms to identify the payload family, its C2 infrastructure, and its Telegram-based exfiltration channel.
Q1What is the sender's IP address with an SPF value of softfail and a DKIM value of fail?
What is the sender's IP address with an SPF value of softfail and a DKIM value of fail?
The email's authentication results show spf=softfail and dkim=fail against the spoofed sender domain — a strong initial red flag.
answer18.208.22.104
Q2What is the return path specified in this email?
What is the return path specified in this email?
answererikajohana.lopez@uptc.edu.co
Q3What is the IP address of the server hosting the malicious file related to malware distribution?
What is the IP address of the server hosting the malicious file related to malware distribution?
The "invoice" link in the email points directly to an installer hosted on this IP.
answer107.175.247.199
Q4Which malware family is responsible for cryptocurrency mining?
Which malware family is responsible for cryptocurrency mining?
URLhaus tags the same malicious URL with three families — the CoinMiner tag identifies the cryptomining component.
answerCoinMiner
Q5Based on the previous analysis of the cryptocurrency malware sample, what URL does this malware request?
Based on the previous analysis of the cryptocurrency malware sample, what URL does this malware request?
Based on the previous analysis of the cryptocurrency malware sample, what URL does this malware request?
VirusTotal's Relations tab for the CoinMiner payload shows its contacted URLs, including a secondary staging host.
answerhttp://ripley.studio/loader/uploads/Qanjttrbv.jpeg
Q6Based on the BitRAT malware sample analysis, what is the executable's name in the first value added to the registry auto-run key?
Based on the BitRAT malware sample analysis, what is the executable's name in the first value added to the registry auto-run key?
ANY.RUN flags a registry write to HKCU\Software\Microsoft\Windows\CurrentVersion\Run — classic persistence.
answerJzwvix.exe
Q7Based on the BitRAT analysis, what is the SHA-256 hash of the file previously downloaded and added to the autorun keys?
Based on the BitRAT analysis, what is the SHA-256 hash of the file previously downloaded and added to the autorun keys?
answerbf7628695c2df7a3020034a065397592a1f8850e59f9a448b555bc1c8c639539
Q8What is the URL in the HTTP request used by the loader to retrieve the BitRAT malware?
What is the URL in the HTTP request used by the loader to retrieve the BitRAT malware?
answerhttp://107.175.247.199/loader/server.exe
Q9What is the delay (in seconds) caused by the PowerShell command according to the BitRAT analysis?
What is the delay (in seconds) caused by the PowerShell command according to the BitRAT analysis?
What is the delay (in seconds) caused by the PowerShell command according to the BitRAT analysis?
The PowerShell command line is Base64-encoded; decoding it in CyberChef reveals a hardcoded sleep value.
answer50 seconds
Q10What is the C2 domain used by the BitRAT malware?
What is the C2 domain used by the BitRAT malware?
answergh9st.mywire.org
Q11According to the AsyncRAT analysis, what is the Telegram Bot ID used by this malware?
According to the AsyncRAT analysis, what is the Telegram Bot ID used by this malware?
According to the AsyncRAT analysis, what is the Telegram Bot ID used by this malware?
Network capture in the sandbox shows a GET request to the Telegram Bot API with the bot ID embedded directly in the URL path.
answerbot5610920260

IOC Summary

ItemValue
Spoofed Sender IP18.208.22.104 (SPF softfail, DKIM fail)
Return Patherikajohana.lopez@uptc.edu.co
Malware Host IP107.175.247.199
Cryptomining FamilyCoinMiner
Secondary Staging URLhttp://ripley.studio/loader/uploads/Qanjttrbv.jpeg
BitRAT Autorun ExecutableJzwvix.exe
BitRAT SHA-256bf7628695c2df7a3020034a065397592a1f8850e59f9a448b555bc1c8c639539
BitRAT Loader URLhttp://107.175.247.199/loader/server.exe
Evasion Delay50 seconds (PowerShell sleep)
BitRAT C2 Domaingh9st.mywire.org
Telegram Bot ID (AsyncRAT)bot5610920260
Lessons learned: SPF/DKIM failures on a spoofed "trusted contact" are a fast, reliable first filter — checking authentication results before ever touching the link should be step one on any phishing triage. This case chains three payload families (CoinMiner, BitRAT, AsyncRAT) off a single malicious URL, which is a reminder that "the malware" is often a delivery pipeline, not a single sample — pulling every payload URLhaus and MalwareBazaar associate with a host is worth the extra few minutes. Base64-encoded PowerShell is trivial to defeat with CyberChef's From Base64 recipe and should never be treated as effective obfuscation. Finally, both BitRAT and AsyncRAT here lean on legitimate infrastructure (dynamic DNS for C2, the Telegram Bot API for exfil) specifically because it blends into normal traffic — which is exactly why DNS logging and egress monitoring for Telegram API calls from non-messaging processes is worth alerting on.