General

  • Target

    5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71

  • Size

    241KB

  • Sample

    211208-lh26tacbe4

  • MD5

    424792509be0ea5b770d3e787f6cc337

  • SHA1

    546057d56a1d78c5cc3f38d1a5225e2531228f25

  • SHA256

    5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71

  • SHA512

    9742a8aaa14ad272c60e0d8ebfef619b6c172284a987e7d8425db8f5fc86c7f40456ed8e77a8aa930a435fda1ee228275903d01cee3ef777e4d6ff9089113c2c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

195.133.47.114:38627

Extracted

Family

icedid

Campaign

3439131404

C2

grendafolz.com

Extracted

Family

systembc

C2

185.209.30.180:4001

Targets

    • Target

      5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71

    • Size

      241KB

    • MD5

      424792509be0ea5b770d3e787f6cc337

    • SHA1

      546057d56a1d78c5cc3f38d1a5225e2531228f25

    • SHA256

      5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71

    • SHA512

      9742a8aaa14ad272c60e0d8ebfef619b6c172284a987e7d8425db8f5fc86c7f40456ed8e77a8aa930a435fda1ee228275903d01cee3ef777e4d6ff9089113c2c

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks