General

  • Target

    f9cddffe29a568c5081326c66c760f1738b02b24a2be41335804b293fba0cfeb

  • Size

    336KB

  • Sample

    211111-psmewsgdbp

  • MD5

    b58d560c8c169796611097c7fd6f4b04

  • SHA1

    58c2ad02f5eee150110936799d20d4e65ba1d314

  • SHA256

    f9cddffe29a568c5081326c66c760f1738b02b24a2be41335804b293fba0cfeb

  • SHA512

    581b443a19fe8199128ccb97e969b394777e81229a206fc1f4eacede4cbd05c96c068aa53595acdefbe412e87039518dfa0e3dc50082062d575dc8116e2dc273

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

777666777

C2

93.115.20.139:28978

Extracted

Family

icedid

Botnet

1217670233

C2

lakogrefop.rest

hangetilin.top

follytresh.co

zojecurf.store

Attributes
  • auth_var

    14

  • url_path

    /posts/

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

redline

Botnet

Test_3

C2

94.103.9.139:80

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

4557a7b982bafcd677193713fa5041fa32e7e61e

Attributes
  • url4cnc

    http://91.219.236.162/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

    http://193.38.54.238/agrybirdsgamerept

    http://74.119.192.122/agrybirdsgamerept

    http://91.219.236.240/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

2189c5f17d25883af847061b1a1ac5c6eaa79874

Attributes
  • url4cnc

    http://91.219.236.162/roswestnewros

    http://185.163.47.176/roswestnewros

    http://193.38.54.238/roswestnewros

    http://74.119.192.122/roswestnewros

    http://91.219.236.240/roswestnewros

    https://t.me/roswestnewros

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

50c313b36d3f8d7fbe6f877cfa147276293d39c6

Attributes
  • url4cnc

    http://91.219.236.162/jdex020001112

    http://185.163.47.176/jdex020001112

    http://193.38.54.238/jdex020001112

    http://74.119.192.122/jdex020001112

    http://91.219.236.240/jdex020001112

    https://t.me/jdex020001112

rc4.plain
rc4.plain

Targets

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Tasks