Overview

overview

10

Static

static

askar_loader.exe

windows7_x64

10

askar_loader.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    askar_loader.exe

  • Size

    7KB

  • Sample

    210602-xcm79zye2x

  • MD5

    f7b95569f9898370aea6f4b59b9e97fb

  • SHA1

    defb184aaa4eaacd51a9612048a52bd9825b66ec

  • SHA256

    604d21a93ab88cdc9d0b609e73766a13e5959644eb35c7bc4fa8967378846004

  • SHA512

    4a3c487743220b42af414f9dc5a461574c44c937eb2dec8c416171132f29ac0a8d396343bdae6a2321c4aa6799ecfe497779476654e0ea8b16a851d50a912670

Score
10/10
danabotgluptebametasploitplugxraccoonredlinesmokeloader1_06_ruz3firstnewbestbuildsel4servjasonbackdoorbankerdiscoverydropperinfostealerloaderspywarestealertrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

first

C2

157.90.145.89:45614

Extracted

Family

redline

Botnet

SEL4

C2

157.90.251.148:59839

Extracted

Family

redline

Botnet

1_06_ruz

C2

quropaloar.xyz:80

Extracted

Family

redline

Botnet

newbestbuild

C2

185.244.181.187:59417

Extracted

Family

redline

Botnet

ServJason

C2

ergerge.top:80

Extracted

Family

danabot

Version

1827

Botnet

3

C2

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443
Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32

Targets

    • Target

      askar_loader.exe

    • Size

      7KB

    • MD5

      f7b95569f9898370aea6f4b59b9e97fb

    • SHA1

      defb184aaa4eaacd51a9612048a52bd9825b66ec

    • SHA256

      604d21a93ab88cdc9d0b609e73766a13e5959644eb35c7bc4fa8967378846004

    • SHA512

      4a3c487743220b42af414f9dc5a461574c44c937eb2dec8c416171132f29ac0a8d396343bdae6a2321c4aa6799ecfe497779476654e0ea8b16a851d50a912670

    Score
    10/10
    gluptebametasploitraccoonredline1_06_ruzfirstnewbestbuildsel4backdoordropperinfostealerloaderstealertrojandanabotplugxsmokeloader3servjasonbankerdiscoveryspyware

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks