General

  • Target

    b55a4fc69b0e890b98df19661425f6eccea52fa47528a1e1aaeeefd19fc7b5ab

  • Size

    241KB

  • Sample

    211208-px3mnsadaq

  • MD5

    142cc61d08c95e9c4de0823a6cee3007

  • SHA1

    70991156c8d2932f7cec34cbf31adaf64500ffc3

  • SHA256

    b55a4fc69b0e890b98df19661425f6eccea52fa47528a1e1aaeeefd19fc7b5ab

  • SHA512

    c231812a76e7ca3d8098bb4741a34f530b445d4026b9bc1b4077afcba4cf72faee92cb26a0a7eb55ba76ee118ab75ba129a8b920aeb0840e5f3d3182ea5141c4

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

195.133.47.114:38627

Extracted

Family

icedid

Campaign

3439131404

C2

grendafolz.com

Extracted

Family

systembc

C2

185.209.30.180:4001

Targets

    • Target

      b55a4fc69b0e890b98df19661425f6eccea52fa47528a1e1aaeeefd19fc7b5ab

    • Size

      241KB

    • MD5

      142cc61d08c95e9c4de0823a6cee3007

    • SHA1

      70991156c8d2932f7cec34cbf31adaf64500ffc3

    • SHA256

      b55a4fc69b0e890b98df19661425f6eccea52fa47528a1e1aaeeefd19fc7b5ab

    • SHA512

      c231812a76e7ca3d8098bb4741a34f530b445d4026b9bc1b4077afcba4cf72faee92cb26a0a7eb55ba76ee118ab75ba129a8b920aeb0840e5f3d3182ea5141c4

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks