Overview

overview

10

Static

static

a712cc20b6...a7.exe

windows7_x64

10

a712cc20b6...a7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a712cc20b6de80a3a0e5e3575fd8eca7.exe

  • Size

    7.1MB

  • Sample

    211004-psyg6agce3

  • MD5

    a712cc20b6de80a3a0e5e3575fd8eca7

  • SHA1

    5f4e7c064aeaa93440580ccfd9fab019ad5035eb

  • SHA256

    07b3cf92babb177664467ac45682fe71f3835b6f8533868885297f1143e2ee4f

  • SHA512

    151486d9a2cda3671d36752ca582ebaf839cf9e2c99e31abb1b9268ef369c5fd41a481b608de838b480a88f2a8a21f6a745043f32799fa1418b7c6a77957be62

Score
10/10
redlinesmokeloadersocelarsvidar706933937anijamesfuckaspackv2backdoorevasioninfostealerstealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

jamesfuck

C2

65.108.20.195:6774

Extracted

Family

vidar

Version

41.1

Botnet

706

C2

https://mas.to/@bardak1ho

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Extracted

Family

vidar

Version

41.1

Botnet

933

C2

https://mas.to/@bardak1ho

Attributes
  • profile_id

    933

Extracted

Family

vidar

Version

41.1

Botnet

937

C2

https://mas.to/@bardak1ho

Attributes
  • profile_id

    937

Targets

    • Target

      a712cc20b6de80a3a0e5e3575fd8eca7.exe

    • Size

      7.1MB

    • MD5

      a712cc20b6de80a3a0e5e3575fd8eca7

    • SHA1

      5f4e7c064aeaa93440580ccfd9fab019ad5035eb

    • SHA256

      07b3cf92babb177664467ac45682fe71f3835b6f8533868885297f1143e2ee4f

    • SHA512

      151486d9a2cda3671d36752ca582ebaf839cf9e2c99e31abb1b9268ef369c5fd41a481b608de838b480a88f2a8a21f6a745043f32799fa1418b7c6a77957be62

    Score
    10/10
    redlinesmokeloadersocelarsvidar706933anijamesfuckaspackv2backdoorevasioninfostealerstealerthemidatrojan937

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks