General
-
Target
4662948923211776.zip
-
Size
3.4MB
-
Sample
210322-rfsefhp8yj
-
MD5
e83a75fd08033aecc0fe47f1e7932ea0
-
SHA1
64387464fa9cddb470b76f36ecee677fc1f4c445
-
SHA256
b145b9f9a935bb4a5a5f54e63dc0abef050c8b3c7552a7cd870744b3fb873063
-
SHA512
e75056c17470343bfe75e6c43198d41e63afccd8e4f74ea2dd3bfbf29ed0e3e1eb5bb5f0da4155ad2a0da64f913995cd39670a299815bd94234c1eb4615ac354
Static task
static1
Behavioral task
behavioral1
Sample
7dc8ba99829b20160eeb99435c0896055e2e96690dd924d611d959be7868cdf2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7dc8ba99829b20160eeb99435c0896055e2e96690dd924d611d959be7868cdf2.exe
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2020
http://funzel.info/upload/
http://doeros.xyz/upload/
http://vromus.com/upload/
http://hqans.com/upload/
http://vxeudy.com/upload/
http://poderoa.com/upload/
http://nezzzo.com/upload/
Extracted
redline
FB NEW TEST
94.103.94.239:3214
Extracted
dridex
10111
188.165.17.91:8443
81.0.236.90:6601
Extracted
raccoon
2ce901d964b370c5ccda7e4d68354ba040db8218
-
url4cnc
https://telete.in/tomarsjsmith3
Extracted
http://labsclub.com/welcome
Extracted
icedid
4052159376
house34vegas.uno
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
7dc8ba99829b20160eeb99435c0896055e2e96690dd924d611d959be7868cdf2
-
Size
3.5MB
-
MD5
06ba4eb5e4c4b967d200f4a7bd62342e
-
SHA1
490584d8559878bd1fe17a5f8a230ef58bef1f51
-
SHA256
7dc8ba99829b20160eeb99435c0896055e2e96690dd924d611d959be7868cdf2
-
SHA512
7403f615a1a0141c5d6570f41ae5a21640e2f53e706921057670fda6cb3f70cfab133003b4948370d56e35a4fc357a8651f5b49d525e0722ce7e92ffdca8a495
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Modifies boot configuration data using bcdedit
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Virtualization/Sandbox Evasion
1Impair Defenses
1Modify Registry
3Install Root Certificate
1