Resubmissions

01-02-2022 09:10

220201-k4279scee5 10

15-01-2022 13:42

220115-qztyzsefhn 10

12-01-2022 12:30

220112-ppk3nacfbl 10

10-01-2022 10:49

220110-mwsd7sebe3 10

07-01-2022 20:35

220107-zc2jzsdaeq 10

07-01-2022 10:05

220107-l4rxzacba8 10

06-01-2022 22:46

220106-2qch5abff5 10

06-01-2022 19:07

220106-xsnxqabhfl 10

06-01-2022 15:26

220106-svedvabda5 10

06-01-2022 15:25

220106-st3p2sbgcq 10

General

  • Target

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

  • Size

    339KB

  • Sample

    220110-mwsd7sebe3

  • MD5

    b75726b4b619811b4c50d917822a4083

  • SHA1

    ed8b418d7357609ce03c4f7123c0bb711b9d227d

  • SHA256

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

  • SHA512

    59516fdf6334f4005c7881322eb9a057939804e18ba8f13d0cb48fdc460aab19570c482e87700c6884807e1c885864ed422646f3150d9df731a10ecf5a7e05c9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Targets

    • Target

      4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

    • Size

      339KB

    • MD5

      b75726b4b619811b4c50d917822a4083

    • SHA1

      ed8b418d7357609ce03c4f7123c0bb711b9d227d

    • SHA256

      4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

    • SHA512

      59516fdf6334f4005c7881322eb9a057939804e18ba8f13d0cb48fdc460aab19570c482e87700c6884807e1c885864ed422646f3150d9df731a10ecf5a7e05c9

    • Arkei

      Arkei is an infostealer written in C++.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Arkei Stealer Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Creates new service(s)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks