General

  • Target

    08031632893793e3a6150c4f4e1d9c3c4b9cf3e69437aa202d909d80ce8afd5c

  • Size

    185KB

  • Sample

    211026-sqqajshgf7

  • MD5

    d64e1ef83e81a1de85ac1edf507891e8

  • SHA1

    142c77ec3e72ae949662b623800b17519d7727c7

  • SHA256

    08031632893793e3a6150c4f4e1d9c3c4b9cf3e69437aa202d909d80ce8afd5c

  • SHA512

    4d03f9f9eeeb6741f94e9bb78e4b744134c7d5f948d2057c5ad70b6805b6db557f03926e60dfef8ea14cda7ca84f4771d29671bc2bd8b96ce5f11baaa9554445

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

11111

C2

93.115.20.139:28978

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

41.6

Botnet

754

C2

https://mas.to/@lilocc

Attributes
  • profile_id

    754

Extracted

Family

icedid

Campaign

1892459423

C2

portedauthenticati.ink

Extracted

Family

redline

Botnet

fdsfds342

C2

jemanyrnwh.xyz:80

Extracted

Family

redline

Botnet

third

C2

45.153.240.158:49626

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes
  • url4cnc

    http://telegin.top/agrybirdsgamerept

    http://ttmirror.top/agrybirdsgamerept

    http://teletele.top/agrybirdsgamerept

    http://telegalive.top/agrybirdsgamerept

    http://toptelete.top/agrybirdsgamerept

    http://telegraf.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Targets

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

3
T1089

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Tasks