Overview

overview

10

Static

static

fe8daa47f1...be.exe

windows7_x64

10

fe8daa47f1...be.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe8daa47f13ee79866fed98b841f1fbe.exe

  • Size

    319KB

  • Sample

    210812-3ydfdrlr8x

  • MD5

    fe8daa47f13ee79866fed98b841f1fbe

  • SHA1

    53b9f827e5f9e379b493cec584b7d1eedb4e086e

  • SHA256

    586f145c1eec37adb07432372972ea8837917f8c1696af8664ee8a6ff86c107e

  • SHA512

    dee686aa9b815e898f402a4424754f6f0f3b82430d83bb884ccf8892600742d642f79f4c42f795b855f722dea35b85640356c78a04079fdb8721be3b9cf40fd3

Score
10/10
raccoonredlinesmokeloader2ca2376c561d1af7f8b9e6f3256b06220a3db187471c70de3b4f9e4d493e418d1f60a90659057de0@gasfer_darkcd8dc1031358b1aec55cc6bc447df1018b068607backdoorevasioninfostealerstealersuricatathemidatrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@gasfer_dark

C2

207.154.240.76:80

Extracted

Family

raccoon

Botnet

2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Targets

    • Target

      fe8daa47f13ee79866fed98b841f1fbe.exe

    • Size

      319KB

    • MD5

      fe8daa47f13ee79866fed98b841f1fbe

    • SHA1

      53b9f827e5f9e379b493cec584b7d1eedb4e086e

    • SHA256

      586f145c1eec37adb07432372972ea8837917f8c1696af8664ee8a6ff86c107e

    • SHA512

      dee686aa9b815e898f402a4424754f6f0f3b82430d83bb884ccf8892600742d642f79f4c42f795b855f722dea35b85640356c78a04079fdb8721be3b9cf40fd3

    Score
    10/10
    raccoonredlinesmokeloader2ca2376c561d1af7f8b9e6f3256b06220a3db187471c70de3b4f9e4d493e418d1f60a90659057de0@gasfer_darkcd8dc1031358b1aec55cc6bc447df1018b068607backdoorevasioninfostealerstealersuricatathemidatrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Raccoon Stealer Payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks