General
-
Target
49B0C2F6D3FCA1576BE12271A8CF46D8.exe
-
Size
3.7MB
-
Sample
210322-fp89hak11s
-
MD5
49b0c2f6d3fca1576be12271a8cf46d8
-
SHA1
ba24871a391195cb0887495ad584b9d63456e1e8
-
SHA256
0713a5a824c755d4b2f231762930e20eb8e4399ec60d4a9da871cf23a4f4e003
-
SHA512
0cc489d946d845eb0c522644296ba1c8f62828dc3afd49f3c6ae2f8ed135f72f67cde487efa6c95c11f026aa90b9ccff8cb97a008ed659d38f36b099f47faf26
Static task
static1
Behavioral task
behavioral1
Sample
49B0C2F6D3FCA1576BE12271A8CF46D8.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
49B0C2F6D3FCA1576BE12271A8CF46D8.exe
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2020
http://funzel.info/upload/
http://doeros.xyz/upload/
http://vromus.com/upload/
http://hqans.com/upload/
http://vxeudy.com/upload/
http://poderoa.com/upload/
http://nezzzo.com/upload/
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
Extracted
redline
FB NEW TEST
94.103.94.239:3214
Extracted
icedid
1336056381
fsikiolker.uno
Extracted
redline
server
185.250.148.227:80
Extracted
cryptbot
basfs12.top
mormsd01.top
-
payload_url
http://akmes01.top/download.php?file=lv.exe
Extracted
raccoon
c46f13f8aadc028907d65c627fd9163161661f6c
-
url4cnc
https://telete.in/capibar
Extracted
raccoon
2ce901d964b370c5ccda7e4d68354ba040db8218
-
url4cnc
https://telete.in/tomarsjsmith3
Targets
-
-
Target
49B0C2F6D3FCA1576BE12271A8CF46D8.exe
-
Size
3.7MB
-
MD5
49b0c2f6d3fca1576be12271a8cf46d8
-
SHA1
ba24871a391195cb0887495ad584b9d63456e1e8
-
SHA256
0713a5a824c755d4b2f231762930e20eb8e4399ec60d4a9da871cf23a4f4e003
-
SHA512
0cc489d946d845eb0c522644296ba1c8f62828dc3afd49f3c6ae2f8ed135f72f67cde487efa6c95c11f026aa90b9ccff8cb97a008ed659d38f36b099f47faf26
-
CryptBot Payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
IcedID First Stage Loader
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-