Overview

overview

10

Static

static

b0fd10ea697a84...f0.exe

windows7_x64

10

b0fd10ea697a84...f0.exe

windows10_x64

10
General
Target

b0fd10ea697a84d539bea9739ac866f0.exe

Size

4MB

Sample

211025-fre5rageek

Score
10/10
MD5

b0fd10ea697a84d539bea9739ac866f0

SHA1

01f6a31a417a6dcaf34546549b44a6ad49995560

SHA256

e6b84ffaaeb4807ccac7c778f87d0b3545841e076063c8f594141430f791f0bc

SHA512

1daa7425391447b11eec5522ff7321f10b7afb6d19bc09825b91f4d5ce940df295a5d70a635a0d29936eaedf1639fb91ae31fdcc9ea65fa517db4096101f3e20

Malware Config

Extracted

Family

smokeloader
Version

2020
C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline
Botnet

sehrish
C2

135.181.129.119:4805

Extracted

Family

redline
Botnet

Chris
C2

194.104.136.5:46013
Targets
Target

b0fd10ea697a84d539bea9739ac866f0.exe

MD5

b0fd10ea697a84d539bea9739ac866f0

Filesize

4MB

Score
10/10
SHA1

01f6a31a417a6dcaf34546549b44a6ad49995560

SHA256

e6b84ffaaeb4807ccac7c778f87d0b3545841e076063c8f594141430f791f0bc

SHA512

1daa7425391447b11eec5522ff7321f10b7afb6d19bc09825b91f4d5ce940df295a5d70a635a0d29936eaedf1639fb91ae31fdcc9ea65fa517db4096101f3e20

Tags

Signatures

  • Process spawned unexpected child process

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

    Tags

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

    Tags

  • Socelars

    Description

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    Tags

  • Socelars Payload

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    Description

    suricata: ET MALWARE GCleaner Downloader Activity M5

    Tags

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    Description

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    Tags

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    Description

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    Tags

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Description

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Tags

  • ASPack v2.12-2.42

    Description

    Detects executables packed with ASPack v2.12-2.42

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation