General

  • Target

    4680344150376448.zip

  • Size

    2.9MB

  • Sample

    210727-2yp5yh2z1j

  • MD5

    294d7c562f42ab2d557772d6bdc91886

  • SHA1

    fdd3dc9033babe1c87e82b352f776005f4c48592

  • SHA256

    fbc4e9a1412a7f56a69b998d625374f0fd53e94f3dc462bb338e2e0252ce0114

  • SHA512

    ac4b2ba09a49b7b0ae685d23f02ba5d4e42bf21c93afafe031ccff928a55acb3b52fcf3e8ed62fd0d1bf020ed057b6ee559204cdf1b72ae3f43eac057273003f

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

AniNEW

C2

akedauiver.xyz:80

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

zero_5k

C2

86.106.181.209:18845

Extracted

Family

redline

Botnet

sel21

C2

salkefard.xyz:80

Extracted

Family

vidar

Version

39.7

Botnet

865

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    865

Targets

    • Target

      242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499

    • Size

      3.0MB

    • MD5

      70800f0e430d4c9ae411aa87ef26870d

    • SHA1

      ae3108303791bf71f3d8a22a81950f56d064ec60

    • SHA256

      242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499

    • SHA512

      1746b4407479ab721c7df75bce318fc0251154732e988bd92a65a686da20f71cd7f9705e5a37bf939f4aa5bc64a722b8a73465c58517dc254377a28d20ac2c4c

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba Payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies Windows Defender Real-time Protection settings

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE GCleaner Downloader Activity M1

    • suricata: ET MALWARE GCleaner Downloader Activity M3

    • suricata: ET MALWARE GCleaner Related Downloader User-Agent

    • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

New Service

1
T1050

Registry Run Keys / Startup Folder

1
T1060

BITS Jobs

1
T1197

Hidden Files and Directories

1
T1158

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

BITS Jobs

1
T1197

Install Root Certificate

1
T1130

Hidden Files and Directories

1
T1158

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Tasks