General
-
Target
ab66db0680bb17229bb5f58cce60819b.exe
-
Size
271KB
-
Sample
210814-lmzg7681pn
-
MD5
ab66db0680bb17229bb5f58cce60819b
-
SHA1
0475f981560b705b59842cf81475f07eac2b5b68
-
SHA256
a0039d484f3134cad7e173c2bee0e089982b881711d99e19d61229b4854e02a5
-
SHA512
38a7502e643772dd1d1f793a5ca9ddd39146dd836f328a7413bb61effe5ab6d5e68accbdc2df979186a58870bb9cf45afe75708ce0d00ef1a5288a85d8dd5e4c
Static task
static1
Behavioral task
behavioral1
Sample
ab66db0680bb17229bb5f58cce60819b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ab66db0680bb17229bb5f58cce60819b.exe
Resource
win10v20210408
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
Extracted
raccoon
cd8dc1031358b1aec55cc6bc447df1018b068607
-
url4cnc
https://telete.in/jagressor_kz
Extracted
redline
@JABKA9983
51.89.92.99:5965
Extracted
redline
123
95.179.166.29:60101
Extracted
raccoon
471c70de3b4f9e4d493e418d1f60a90659057de0
-
url4cnc
https://telete.in/p1rosto100xx
Targets
-
-
Target
ab66db0680bb17229bb5f58cce60819b.exe
-
Size
271KB
-
MD5
ab66db0680bb17229bb5f58cce60819b
-
SHA1
0475f981560b705b59842cf81475f07eac2b5b68
-
SHA256
a0039d484f3134cad7e173c2bee0e089982b881711d99e19d61229b4854e02a5
-
SHA512
38a7502e643772dd1d1f793a5ca9ddd39146dd836f328a7413bb61effe5ab6d5e68accbdc2df979186a58870bb9cf45afe75708ce0d00ef1a5288a85d8dd5e4c
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Raccoon Stealer Payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-