Overview

overview

10

Static

static

877c36519b...ad.exe

windows7_x64

10

877c36519b...ad.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    877c36519ba0d5bf41fadb5a80b012ad.exe

  • Size

    339KB

  • Sample

    210418-e58gmbh9bj

  • MD5

    877c36519ba0d5bf41fadb5a80b012ad

  • SHA1

    b1f1049d20e8bb2c3eeabec94421500de233b09a

  • SHA256

    3b019e395d076e03b3b4a2d9468d3acb36df69115e059119194fbd8dd6d1dd6b

  • SHA512

    9a9bb58e727ce664675c97c3eb91de9f0deab59f93ec55ac5116aaa01f573d8bacd66a2b6380c528f33cdaeae8efc79172dd7aa6c463ce36db2fedd18ef522fc

Score
10/10
asyncratredlinesmokeloaderbackdoordiscoveryinfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

asyncrat

C2

:

Mutex

Attributes
  • aes_key

  • anti_detection

  • autorun

  • bdos

  • delay

  • host

  • hwid

    Write

  • install_file

  • install_folder

    SfThYiEf8sDGLjVDfx.X3463rX3XCQjG6jWaq

  • mutex

  • pastebin_config

  • port

  • version

aes.plain

Extracted

Family

smokeloader

Version

2020

C2

http://greenco2020.top/

http://greenco2021.top/

http://greenco2022.top/
rc4.i32
rc4.i32

Targets

    • Target

      877c36519ba0d5bf41fadb5a80b012ad.exe

    • Size

      339KB

    • MD5

      877c36519ba0d5bf41fadb5a80b012ad

    • SHA1

      b1f1049d20e8bb2c3eeabec94421500de233b09a

    • SHA256

      3b019e395d076e03b3b4a2d9468d3acb36df69115e059119194fbd8dd6d1dd6b

    • SHA512

      9a9bb58e727ce664675c97c3eb91de9f0deab59f93ec55ac5116aaa01f573d8bacd66a2b6380c528f33cdaeae8efc79172dd7aa6c463ce36db2fedd18ef522fc

    Score
    10/10
    asyncratredlinesmokeloaderbackdoordiscoveryinfostealerpersistenceratspywarestealertrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Modifies WinLogon for persistence

      persistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Async RAT payload

      rat

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks