Resubmissions

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

04-06-2021 08:52

210604-jy9885jen2 10

General

  • Target

    install.rar

  • Size

    9.6MB

  • Sample

    210429-hlw8xbq2la

  • MD5

    042cfe2da364303b208632f1b160f51e

  • SHA1

    b314aaedb8c31789b14c508bd7bad8e2e34d4f61

  • SHA256

    65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

  • SHA512

    fe09d5ef9368ef9a827240a2ef5f5403d924fc77688632fadb7617dbb53bfbfa6f58f01e23df4ccaa87e9c4cbb20d8fb5e9a0505128bd02bd7df6c927b5134cd

Malware Config

Extracted

Family

redline

Botnet

EUR1

C2

younamebit.info:80

Extracted

Family

redline

Botnet

BBCbrow

C2

qurernenail.xyz:80

Extracted

Family

raccoon

Botnet

9afb493c6f82d08075dbbfa7d93ce97f1dbf4733

Attributes
  • url4cnc

    https://tttttt.me/antitantief3

rc4.plain
rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Extracted

Family

fickerstealer

C2

sodaandcoke.top:80

Extracted

Family

redline

Botnet

good_md

C2

188.119.112.16:41392

Extracted

Family

raccoon

Botnet

16992cd33145ccbb6feeacb4e84400a56448fa14

Attributes
  • url4cnc

    https://telete.in/baudemars

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

bea07c54d843fcd5517bbf13341a9e273e06979b

Attributes
  • url4cnc

    https://tttttt.me/iopioldpsergdg

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

afefd33a49c7cbd55d417545269920f24c85aa37

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Targets

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

4
T1031

Registry Run Keys / Startup Folder

4
T1060

Defense Evasion

Modify Registry

28
T1112

Disabling Security Tools

16
T1089

Install Root Certificate

4
T1130

Credential Access

Credentials in Files

12
T1081

Discovery

Software Discovery

4
T1518

Query Registry

20
T1012

System Information Discovery

24
T1082

Peripheral Device Discovery

4
T1120

Remote System Discovery

4
T1018

Collection

Data from Local System

12
T1005

Command and Control

Web Service

4
T1102

Tasks

static1

Score
N/A

behavioral1

raccoonredlinesocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733bbcbroweur1discoveryevasioninfostealerpersistencespywarestealerupx
Score
10/10

behavioral2

blacknetraccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral3

blacknetfickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral4

fickerstealerraccoonredlinesocelarsxmrigeur1discoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral5

raccoonredlinesmokeloadersocelars16992cd33145ccbb6feeacb4e84400a56448fa14afefd33a49c7cbd55d417545269920f24c85aa37bea07c54d843fcd5517bbf13341a9e273e06979beur1good_mdbackdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral6

raccoonredlinesmokeloadersocelars16992cd33145ccbb6feeacb4e84400a56448fa14afefd33a49c7cbd55d417545269920f24c85aa37bea07c54d843fcd5517bbf13341a9e273e06979beur1good_mdbackdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral7

fickerstealerraccoonredlinesmokeloadersocelarsxmrig16992cd33145ccbb6feeacb4e84400a56448fa14bea07c54d843fcd5517bbf13341a9e273e06979beur1good_mdbackdoordiscoveryevasioninfostealerminerpersistencespywarestealertrojan
Score
10/10

behavioral8

fickerstealerraccoonredlinesmokeloadersocelarsxmrig16992cd33145ccbb6feeacb4e84400a56448fa14afefd33a49c7cbd55d417545269920f24c85aa37bea07c54d843fcd5517bbf13341a9e273e06979beur1good_mdbackdoordiscoveryevasioninfostealerminerpersistencespywarestealertrojan
Score
10/10

behavioral9

blacknetraccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral10

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral11

fickerstealerraccoonredlinesocelarsxmrigeur1discoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral12

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral13

raccoonredlinesmokeloadersocelars16992cd33145ccbb6feeacb4e84400a56448fa149afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral14

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral15

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral16

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral17

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral18

raccoonredlinesmokeloadersocelars16992cd33145ccbb6feeacb4e84400a56448fa149afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral19

fickerstealerraccoonredlinesocelarsxmrigeur1facebookdiscoveryevasioninfostealerminerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral20

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral21

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1good_mdbackdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral22

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx
Score
10/10

behavioral23

fickerstealerraccoonredlinesocelarsxmrigfacebookdiscoveryevasioninfostealerminerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral24

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral25

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733backdoorfacebookdiscoveryevasioninfostealerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral26

raccoonredlinesmokeloadersocelars16992cd33145ccbb6feeacb4e84400a56448fa149afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoorfacebookdiscoveryevasioninfostealerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral27

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10

behavioral28

fickerstealerraccoonredlinesocelarsxmrigfacebookdiscoveryevasioninfostealerminerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral29

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733eur1backdoorfacebookdiscoveryevasioninfostealerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral30

raccoonredlinesmokeloadersocelars9afb493c6f82d08075dbbfa7d93ce97f1dbf4733bea07c54d843fcd5517bbf13341a9e273e06979beur1backdoorfacebookdiscoveryevasioninfostealerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral31

fickerstealerraccoonredlinesocelarsxmrigfacebookdiscoveryevasioninfostealerminerpersistencephishingspywarestealertrojanupx
Score
10/10

behavioral32

fickerstealerraccoonredlinesocelarsxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojanupx
Score
10/10