Resubmissions

24-04-2021 06:39

210424-z9rcb7aepa 10

23-04-2021 19:10

210423-eqazybfbwe 10

23-04-2021 19:10

210423-11yc7me6fe 10

23-04-2021 18:20

210423-96m9f6fxjx 10

23-04-2021 13:38

210423-fv1qhsltzj 10

23-04-2021 13:38

210423-6hhapn6pdx 10

23-04-2021 13:38

210423-m5azl6mq1s 10

23-04-2021 13:38

210423-nlvbxenam6 10

23-04-2021 13:38

210423-y4rkc8l6ts 10

23-04-2021 05:23

210423-lejp16ex1n 10

General

  • Target

    keygen-step-4.exe

  • Size

    4.6MB

  • Sample

    210423-6hhapn6pdx

  • MD5

    563107b1df2a00f4ec868acd9e08a205

  • SHA1

    9cb9c91d66292f5317aa50d92e38834861e9c9b7

  • SHA256

    bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9

  • SHA512

    99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Malware Config

Extracted

Family

fickerstealer

C2

sodaandcoke.top:80

Extracted

Family

raccoon

Botnet

9afb493c6f82d08075dbbfa7d93ce97f1dbf4733

Attributes
  • url4cnc

    https://tttttt.me/antitantief3

rc4.plain
rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Targets

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
N/A

behavioral1

dcratfickerstealerinfostealerpersistencerat
Score
10/10

behavioral2

dcratfickerstealergluptebametasploitraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordropperevasioninfostealerloaderminerpersistenceratstealertrojan
Score
10/10

behavioral3

dcratfickerstealergluptebametasploitraccoonredlinesmokeloadertofseewarzoneratxmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoverydropperevasioninfostealerloaderminerpersistenceratspywarestealertrojan
Score
10/10

behavioral4

dcratfickerstealergluptebametasploitraccoonredlinesmokeloadertofseewarzoneratxmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoorfacebookdiscoverydropperevasioninfostealerloaderminerpersistencephishingratspywarestealertrojan
Score
10/10

behavioral5

dcratfickerstealergluptebametasploitsmokeloaderxmrigbackdoordiscoverydropperevasioninfostealerloaderminerpersistenceratspywarestealertrojan
Score
10/10

behavioral6

dcratfickerstealergluptebametasploitraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoverydropperevasioninfostealerloaderminerpersistenceratstealertrojan
Score
10/10

behavioral7

dcratfickerstealergluptebametasploitraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoverydropperevasioninfostealerloaderminerpersistenceratstealertrojan
Score
10/10

behavioral8

dcratfickerstealerraccoonredlinesmokeloaderwarzoneratxmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoveryevasioninfostealerminerpersistenceratspywarestealertrojan
Score
10/10

behavioral9

dcratfickerstealergluptebametasploitraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordropperevasioninfostealerloaderminerpersistenceratstealertrojan
Score
10/10

behavioral10

dcratfickerstealerraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoorevasioninfostealerminerpersistenceratstealertrojan
Score
10/10

behavioral11

dcratfickerstealerraccoonsmokeloadertofseexmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoveryevasioninfostealerminerpersistenceratstealertrojan
Score
10/10

behavioral12

dcratfickerstealergluptebametasploitraccoonredlinesmokeloaderwarzoneratxmrig9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoverydropperevasioninfostealerloaderminerpersistenceratspywarestealertrojan
Score
10/10