General

  • Target

    fbf060a08879b21d469d9da16345a592b4bbfed65f29839ed5a650c11abeeb01

  • Size

    335KB

  • Sample

    211111-pzw8nsgddr

  • MD5

    6d387a02090c701a3d6f90208314beca

  • SHA1

    7342a097297a8c68f2bd6acbb3cc41df63bc2f61

  • SHA256

    fbf060a08879b21d469d9da16345a592b4bbfed65f29839ed5a650c11abeeb01

  • SHA512

    39a78f3f20556d03a3d35eafe3f772594c72a385a8fe634b845bbe760b87263f7fd0841b7a18c509f0317a0e006bb1e0f5d5609b6ea61db67434614f7f8a69d0

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

777666777

C2

93.115.20.139:28978

Extracted

Family

icedid

Botnet

1217670233

C2

lakogrefop.rest

hangetilin.top

follytresh.co

zojecurf.store

Attributes
  • auth_var

    14

  • url_path

    /posts/

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

redline

Botnet

Test_3

C2

94.103.9.139:80

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

4557a7b982bafcd677193713fa5041fa32e7e61e

Attributes
  • url4cnc

    http://91.219.236.162/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

    http://193.38.54.238/agrybirdsgamerept

    http://74.119.192.122/agrybirdsgamerept

    http://91.219.236.240/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

2189c5f17d25883af847061b1a1ac5c6eaa79874

Attributes
  • url4cnc

    http://91.219.236.162/roswestnewros

    http://185.163.47.176/roswestnewros

    http://193.38.54.238/roswestnewros

    http://74.119.192.122/roswestnewros

    http://91.219.236.240/roswestnewros

    https://t.me/roswestnewros

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

50c313b36d3f8d7fbe6f877cfa147276293d39c6

Attributes
  • url4cnc

    http://91.219.236.162/jdex020001112

    http://185.163.47.176/jdex020001112

    http://193.38.54.238/jdex020001112

    http://74.119.192.122/jdex020001112

    http://91.219.236.240/jdex020001112

    https://t.me/jdex020001112

rc4.plain
rc4.plain

Targets

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Tasks