General

  • Target

    b6ac7e1e523a87ec0f972e1db54d170d

  • Size

    213KB

  • Sample

    210723-wq61lp3pjs

  • MD5

    b6ac7e1e523a87ec0f972e1db54d170d

  • SHA1

    cce2cb76039a972ed4f6550e1e1fff9e85cf84d9

  • SHA256

    201f2b8cd0d15399da2d0b98ff9b7d50d515deeea3f9435062b4b0a4548b0082

  • SHA512

    77d8638f51c51183d67f65455307e6d98b16eda4ba30a556935f39e94620f0eb8b4703ee8285e34728dd16528e20582d90b25f396372032a294b99ad6adb2d3c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.7

Botnet

408

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    408

Extracted

Family

redline

Botnet

123123123

C2

45.32.235.238:45555

Extracted

Family

redline

Botnet

@evilnotlive

C2

3.68.106.170:59223

Extracted

Family

redline

Botnet

555

C2

xaiandaran.xyz:80

Targets

    • Target

      b6ac7e1e523a87ec0f972e1db54d170d

    • Size

      213KB

    • MD5

      b6ac7e1e523a87ec0f972e1db54d170d

    • SHA1

      cce2cb76039a972ed4f6550e1e1fff9e85cf84d9

    • SHA256

      201f2b8cd0d15399da2d0b98ff9b7d50d515deeea3f9435062b4b0a4548b0082

    • SHA512

      77d8638f51c51183d67f65455307e6d98b16eda4ba30a556935f39e94620f0eb8b4703ee8285e34728dd16528e20582d90b25f396372032a294b99ad6adb2d3c

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Vidar Stealer

    • XMRig Miner Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

4
T1005

Command and Control

Web Service

1
T1102

Tasks