General
-
Target
8D744F7BEA76B2CFF67501320174DC53.exe
-
Size
3.9MB
-
Sample
210821-fljpzlts36
-
MD5
8d744f7bea76b2cff67501320174dc53
-
SHA1
e7d3db7eeb2d01ae30cc1a8e628379224c9cd583
-
SHA256
e1c8f91a01400615df83126a8b3a323425f30b5480d405b26adf2d924c21464f
-
SHA512
43ad02202fe084be08d9b1a09c282e26eec0aa01862a3fc26f7579b4eaf1e48adad49b361b88775c23c54a88b1ae212836eeb89b4e615a50bb61856eec07a0c7
Static task
static1
Behavioral task
behavioral1
Sample
8D744F7BEA76B2CFF67501320174DC53.exe
Resource
win7v20210410
Malware Config
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
redline
pab3
185.215.113.15:61506
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
redline
dibild
135.148.139.222:33569
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
redline
19.08
95.181.172.100:6795
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
8D744F7BEA76B2CFF67501320174DC53.exe
-
Size
3.9MB
-
MD5
8d744f7bea76b2cff67501320174dc53
-
SHA1
e7d3db7eeb2d01ae30cc1a8e628379224c9cd583
-
SHA256
e1c8f91a01400615df83126a8b3a323425f30b5480d405b26adf2d924c21464f
-
SHA512
43ad02202fe084be08d9b1a09c282e26eec0aa01862a3fc26f7579b4eaf1e48adad49b361b88775c23c54a88b1ae212836eeb89b4e615a50bb61856eec07a0c7
-
Glupteba Payload
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Nirsoft
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
3Web Service
1