Overview

overview

10

Static

static

A75FFC6AB5...FD.exe

windows7_x64

10

A75FFC6AB5...FD.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    A75FFC6AB58574119E960EC0B1F72BFD.exe

  • Size

    3.0MB

  • Sample

    210905-bmvbnaeeg3

  • MD5

    a75ffc6ab58574119e960ec0b1f72bfd

  • SHA1

    f7addaaf851436721919294927253726b67ce17b

  • SHA256

    8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab

  • SHA512

    09520fdf40a16790b93b4ef14a0b177bd65956712d874d782c3b902f9a42869d3691aaf6d038468350b0bdc159c6cf376da94af580c4aa6f48250a7e60b99c5d

Score
10/10
redlinesmokeloadervidarvkeylogger706aspackv2backdoorinfostealerkeyloggerstealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://shellloader.com/welcome

Extracted

Family

vidar

Version

40.3

Botnet

706

C2

https://lenko349.tumblr.com/

Attributes
  • profile_id

    706

Targets

    • Target

      A75FFC6AB58574119E960EC0B1F72BFD.exe

    • Size

      3.0MB

    • MD5

      a75ffc6ab58574119e960ec0b1f72bfd

    • SHA1

      f7addaaf851436721919294927253726b67ce17b

    • SHA256

      8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab

    • SHA512

      09520fdf40a16790b93b4ef14a0b177bd65956712d874d782c3b902f9a42869d3691aaf6d038468350b0bdc159c6cf376da94af580c4aa6f48250a7e60b99c5d

    Score
    10/10
    redlinesmokeloaderaspackv2backdoorinfostealerthemidatrojanvidarvkeylogger706keyloggerstealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • VKeylogger

      A keylogger first seen in Nov 2020.

      stealerkeyloggervkeylogger

    • VKeylogger Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks