General

  • Target

    5863ee77bdf2f8fe7955b4eb9e8e2b69.exe

  • Size

    284KB

  • Sample

    211127-j9j37scfg3

  • MD5

    5863ee77bdf2f8fe7955b4eb9e8e2b69

  • SHA1

    4f77690cd21d3779846c6f72c74702563a554e45

  • SHA256

    19019311222c7226c5ed48eaec321e411b836f171be5d0f429bcd3914ff2ee8b

  • SHA512

    378eafafb327fc4225ac0640e60fd5f99a287866f2a6a36e95c4d0b3db591788cc8c84a147283e046a822eb0fea76d7d24b0cfedc7af90a5589bb96211e4622e

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

vidar

Version

48.7

Botnet

706

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

zormion

C2

185.31.160.143:51281

Targets

MITRE ATT&CK Matrix ATT&CK v6

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks