a751d63055d095450ccf41ecad484077.exe

General
Target

a751d63055d095450ccf41ecad484077.exe

Size

13MB

Sample

211119-q2zl9adea4

Score
10 /10
MD5

a751d63055d095450ccf41ecad484077

SHA1

b003a86573fa1d62584f27081aa8de5029e495e1

SHA256

5b77e331ff166d24ccaf781b84705bb6afcceaaa708024d54efc2a10f515c32a

SHA512

207ed821f9c312270f1ed9d51f79ca0fdf7cef067d73c8ecebe14267d2dd45e7b672f84cf7e32016e6ba76c3fb6ede2701bb02fd81ec7529b48779d6722a223b

Malware Config

Extracted

Family socelars
C2

http://www.gianninidesign.com/

Extracted

Family metasploit
Version windows/single_exec

Extracted

Family smokeloader
Version 2020
C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/
rc4.i32
rc4.i32

Extracted

Family vidar
Version 48.6
Botnet 937
C2

https://mastodon.online/@valhalla

https://koyu.space/@valhalla
Attributes
profile_id
937
Targets
Target

a751d63055d095450ccf41ecad484077.exe

MD5

a751d63055d095450ccf41ecad484077

Filesize

13MB

Score
10/10
SHA1

b003a86573fa1d62584f27081aa8de5029e495e1

SHA256

5b77e331ff166d24ccaf781b84705bb6afcceaaa708024d54efc2a10f515c32a

SHA512

207ed821f9c312270f1ed9d51f79ca0fdf7cef067d73c8ecebe14267d2dd45e7b672f84cf7e32016e6ba76c3fb6ede2701bb02fd81ec7529b48779d6722a223b

Tags

Signatures

  • Amadey

    Description

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    Tags

  • MetaSploit

    Description

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    Tags

  • Process spawned unexpected child process

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

    Tags

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

    Tags

  • Socelars

    Description

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    Tags

  • Socelars Payload

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

    Tags

  • Vidar Stealer

    Tags

  • ASPack v2.12-2.42

    Description

    Detects executables packed with ASPack v2.12-2.42

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Description

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation