Overview

overview

10

Static

static

C7304FF0966068...33.exe

windows7_x64

10

C7304FF0966068...33.exe

windows10_x64

10
General
Target

C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe

Size

4MB

Sample

211204-wlwhjsbdfj

Score
10/10
MD5

d13d7a330bd2b99acb5c445bb14ab499

SHA1

0a598d94482ab95fe1ecd2a0741eb39b7d7defb2

SHA256

c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347

SHA512

9c754fb692a95daeb895cfd4acbb09b84c80b217b5b7dfb27ae75bc9ae9560e8a8e09e49424fcffaba0e2f365b79fb51fc4a69f5b580f0ddb1308c896d33d82c

Malware Config

Extracted

Family

socelars
C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

raccoon
Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
Attributes
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
rc4.plain
rc4.plain

Extracted

Family

redline
Botnet

Chris
C2

194.104.136.5:46013

Extracted

Family

smokeloader
Version

2020
C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline
Botnet

media18
C2

91.121.67.60:2151

Extracted

Family

redline
Botnet

fucker2
C2

135.181.129.119:4805
Targets
Target

C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe

MD5

d13d7a330bd2b99acb5c445bb14ab499

Filesize

4MB

Score
10/10
SHA1

0a598d94482ab95fe1ecd2a0741eb39b7d7defb2

SHA256

c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347

SHA512

9c754fb692a95daeb895cfd4acbb09b84c80b217b5b7dfb27ae75bc9ae9560e8a8e09e49424fcffaba0e2f365b79fb51fc4a69f5b580f0ddb1308c896d33d82c

Tags

Signatures

  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

    Tags

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

    Tags

  • Socelars

    Description

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    Tags

  • Socelars Payload

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    Description

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    Tags

  • suricata: ET MALWARE Suspicious Download Setup_ exe

    Description

    suricata: ET MALWARE Suspicious Download Setup_ exe

    Tags

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Description

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Tags

  • ASPack v2.12-2.42

    Description

    Detects executables packed with ASPack v2.12-2.42

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Description

    Uses a legitimate geolocation service to find the infected system's geolocation info.

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation