General

  • Target

    askar_loader.exe

  • Size

    7KB

  • Sample

    210602-w92s5gjprn

  • MD5

    f7b95569f9898370aea6f4b59b9e97fb

  • SHA1

    defb184aaa4eaacd51a9612048a52bd9825b66ec

  • SHA256

    604d21a93ab88cdc9d0b609e73766a13e5959644eb35c7bc4fa8967378846004

  • SHA512

    4a3c487743220b42af414f9dc5a461574c44c937eb2dec8c416171132f29ac0a8d396343bdae6a2321c4aa6799ecfe497779476654e0ea8b16a851d50a912670

Malware Config

Extracted

Family

redline

Botnet

SEL4

C2

157.90.251.148:59839

Extracted

Family

redline

Botnet

ServJason

C2

ergerge.top:80

Extracted

Family

redline

Botnet

first

C2

157.90.145.89:45614

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

danabot

Version

1827

Botnet

3

C2

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

redline

Botnet

1_06_ruz

C2

quropaloar.xyz:80

Extracted

Family

redline

Botnet

newbestbuild

C2

185.244.181.187:59417

Extracted

Family

raccoon

Botnet

78125e071eeca2464ec360507365f26c4d7e6e07

Attributes
  • url4cnc

    https://tttttt.me/olivesteppers1

rc4.plain
rc4.plain

Targets

    • Target

      askar_loader.exe

    • Size

      7KB

    • MD5

      f7b95569f9898370aea6f4b59b9e97fb

    • SHA1

      defb184aaa4eaacd51a9612048a52bd9825b66ec

    • SHA256

      604d21a93ab88cdc9d0b609e73766a13e5959644eb35c7bc4fa8967378846004

    • SHA512

      4a3c487743220b42af414f9dc5a461574c44c937eb2dec8c416171132f29ac0a8d396343bdae6a2321c4aa6799ecfe497779476654e0ea8b16a851d50a912670

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks