General
-
Target
c11b2bb64d96b760e066d3c708efa2f2.exe
-
Size
207KB
-
Sample
210723-fpy47eh8sx
-
MD5
c11b2bb64d96b760e066d3c708efa2f2
-
SHA1
dbfd9e6c888255def78b7c142df4ed16638b3784
-
SHA256
d6206c05051cd22da3912b1d30df468f0c0571b4b34a8fe2c912f82ff05a8e6a
-
SHA512
5a3db7089090a0e4d495a2b195c9faa85cafa79a7bb59222216de4e61c0b846609d80b57ef9ecfaabc5143da194615c861f8fe1305293f1c085aed82a5fbd593
Static task
static1
Behavioral task
behavioral1
Sample
c11b2bb64d96b760e066d3c708efa2f2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
c11b2bb64d96b760e066d3c708efa2f2.exe
Resource
win10v20210410
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
fickerstealer
93.115.18.205:80
Extracted
vidar
39.7
408
https://shpak125.tumblr.com/
-
profile_id
408
Extracted
redline
123123123
45.32.235.238:45555
Extracted
redline
@evilnotlive
3.68.106.170:59223
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
udacha123@mail2tor.com
Targets
-
-
Target
c11b2bb64d96b760e066d3c708efa2f2.exe
-
Size
207KB
-
MD5
c11b2bb64d96b760e066d3c708efa2f2
-
SHA1
dbfd9e6c888255def78b7c142df4ed16638b3784
-
SHA256
d6206c05051cd22da3912b1d30df468f0c0571b4b34a8fe2c912f82ff05a8e6a
-
SHA512
5a3db7089090a0e4d495a2b195c9faa85cafa79a7bb59222216de4e61c0b846609d80b57ef9ecfaabc5143da194615c861f8fe1305293f1c085aed82a5fbd593
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-