General
-
Target
e42efa54b3ecec51bd18a6f8ecd72f65.exe
-
Size
207KB
-
Sample
210723-73sbxmscc6
-
MD5
e42efa54b3ecec51bd18a6f8ecd72f65
-
SHA1
15982b19c101faac047caecf1fb3f41ab3c12345
-
SHA256
98748a03aeda89cd33105254527ba92b2f7d070b794c648f2e7c823f68030809
-
SHA512
af2c351128c009f39a77d40f8c723053bc703b7bed2ed4768ddb621c2d6e4da426bd0faacaa4b763c11e6aedb0f7931730d355d8397329ec7881ae735cba4455
Static task
static1
Behavioral task
behavioral1
Sample
e42efa54b3ecec51bd18a6f8ecd72f65.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e42efa54b3ecec51bd18a6f8ecd72f65.exe
Resource
win10v20210410
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
fickerstealer
93.115.18.205:80
Extracted
redline
123123123
45.32.235.238:45555
Extracted
vidar
39.7
408
https://shpak125.tumblr.com/
-
profile_id
408
Extracted
redline
@evilnotlive
3.68.106.170:59223
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
udacha123@mail2tor.com
Targets
-
-
Target
e42efa54b3ecec51bd18a6f8ecd72f65.exe
-
Size
207KB
-
MD5
e42efa54b3ecec51bd18a6f8ecd72f65
-
SHA1
15982b19c101faac047caecf1fb3f41ab3c12345
-
SHA256
98748a03aeda89cd33105254527ba92b2f7d070b794c648f2e7c823f68030809
-
SHA512
af2c351128c009f39a77d40f8c723053bc703b7bed2ed4768ddb621c2d6e4da426bd0faacaa4b763c11e6aedb0f7931730d355d8397329ec7881ae735cba4455
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-