Overview

overview

10

Static

static

c109431818...4a.exe

windows7_x64

10

c109431818...4a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c109431818f3989550ac0f9aa29033918f20c2bba34bf57ec786899e9e143b4a

  • Size

    3.1MB

  • Sample

    220314-sb9qmsgge3

  • MD5

    69c92564bb3061db02c7bd1671e86d4c

  • SHA1

    22133ec51f6b60b389a3d023741a3bc23476e967

  • SHA256

    c109431818f3989550ac0f9aa29033918f20c2bba34bf57ec786899e9e143b4a

  • SHA512

    1acbd2c37341282c24ea95d26d30ed3165539870b4b9a8c18494aadb3dda773ec0ee5e3c0eb5ba82ece928088ad87a20ee8003f7a43a7204a2e21612f49c5523

Score
10/10
redlinesmokeloadertofseevidar1177706@ywqmreda dadomani2installspizzadlyathruz876aspackv2backdoorevasioninfostealerpersistencestealertrojanupx

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

da da

C2

86.107.197.196:63065

Attributes
  • auth_value

    9b1654b30797c210c85bd0890936a5b9

Extracted

Family

redline

C2

5.206.224.220:81

Attributes
  • auth_value

    4330eefe7c0f986c945c8babe3202f28

Extracted

Family

vidar

Version

50.7

Botnet

1177

C2

https://ruhr.social/@sam9al

https://koyu.space/@samsa2l
Attributes
  • profile_id

    1177

Extracted

Family

redline

Botnet

ruz876

C2

185.215.113.7:5186

Attributes
  • auth_value

    4750f6742a496bbe74a981d51e7680ad

Extracted

Family

redline

Botnet

DomAni2

C2

flestriche.xyz:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

pizzadlyath

C2

65.108.101.231:14648

Attributes
  • auth_value

    e6050567aab45ec7a388fed4947afdc2

Extracted

Family

redline

Botnet

Installs

C2

94.23.1.92:12857

Attributes
  • auth_value

    c8e146507a5c0004dfcc77a7c5f15bc2

Extracted

Family

redline

Botnet

@ywqmre

C2

185.215.113.24:15994

Attributes
  • auth_value

    5a482aa0be2b5e01649fe7a3ce943422

Targets

    • Target

      c109431818f3989550ac0f9aa29033918f20c2bba34bf57ec786899e9e143b4a

    • Size

      3.1MB

    • MD5

      69c92564bb3061db02c7bd1671e86d4c

    • SHA1

      22133ec51f6b60b389a3d023741a3bc23476e967

    • SHA256

      c109431818f3989550ac0f9aa29033918f20c2bba34bf57ec786899e9e143b4a

    • SHA512

      1acbd2c37341282c24ea95d26d30ed3165539870b4b9a8c18494aadb3dda773ec0ee5e3c0eb5ba82ece928088ad87a20ee8003f7a43a7204a2e21612f49c5523

    Score
    10/10
    redlinetofseevidar1177706da daruz876aspackv2evasioninfostealerpersistencestealertrojanupxsmokeloader@ywqmredomani2installspizzadlyathbackdoor

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

New Service

1
T1050

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks