Resubmissions

22-07-2021 23:36

210722-dg7f6xxryx 10

22-07-2021 23:31

210722-7f39811rfn 10

General

  • Target

    7E03737D683BC19280A5DC25BEFC85B6.exe

  • Size

    3.7MB

  • Sample

    210722-7f39811rfn

  • MD5

    7e03737d683bc19280a5dc25befc85b6

  • SHA1

    c6718f0a136b082720c7bebfda479ec882033a5e

  • SHA256

    7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449

  • SHA512

    09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.7

Botnet

933

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

redline

Botnet

Build2

C2

45.142.213.135:30059

Extracted

Family

redline

Botnet

Ani

C2

yoshelona.xyz:80

Targets

    • Target

      7E03737D683BC19280A5DC25BEFC85B6.exe

    • Size

      3.7MB

    • MD5

      7e03737d683bc19280a5dc25befc85b6

    • SHA1

      c6718f0a136b082720c7bebfda479ec882033a5e

    • SHA256

      7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449

    • SHA512

      09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE GCleaner Downloader Activity M1

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    • suricata: ET MALWARE Win32/Ficker Stealer Activity M3

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Cryptocurrency Miner

      Makes network request to known mining pool URL.

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks