Overview

overview

10

Static

static

E51038570D...C2.exe

windows7_x64

10

E51038570D...C2.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    E51038570D307A474C11DAD48A5503C2.exe

  • Size

    4.3MB

  • Sample

    210812-wax8jy98rx

  • MD5

    e51038570d307a474c11dad48a5503c2

  • SHA1

    ad6d23e0da5e05cac857111ce376d8cf6b46930a

  • SHA256

    65624215e9613e4922c32eb184b75ea1334a6a2fa32d45ef535918ef7b9a9eca

  • SHA512

    f8c918300375d63b46cc580827fe0bbdcaafd2ea51fffc134a10b97f8791d63da3063a4ba1cf6eb381ec63e41c4248bc354743348c9da8ece475f8b0eb3c5cd5

Score
10/10
smokeloadersocelarsvidar706aspackv2backdoorstealertrojan

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/
rc4.i32
rc4.i32

Targets

    • Target

      E51038570D307A474C11DAD48A5503C2.exe

    • Size

      4.3MB

    • MD5

      e51038570d307a474c11dad48a5503c2

    • SHA1

      ad6d23e0da5e05cac857111ce376d8cf6b46930a

    • SHA256

      65624215e9613e4922c32eb184b75ea1334a6a2fa32d45ef535918ef7b9a9eca

    • SHA512

      f8c918300375d63b46cc580827fe0bbdcaafd2ea51fffc134a10b97f8791d63da3063a4ba1cf6eb381ec63e41c4248bc354743348c9da8ece475f8b0eb3c5cd5

    Score
    10/10
    smokeloadersocelarsvidar706aspackv2backdoorstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks