Resubmissions

28-03-2022 07:58

220328-jty77adcdp 10

25-03-2022 09:29

220325-lf232adhh3 1

25-03-2022 09:16

220325-k8tfxsaddl 10

24-03-2022 20:10

220324-yx6trsdgg5 1

21-03-2022 09:00

220321-kyfgbaafh9 10

21-03-2022 08:57

220321-kw1dpsafg5 4

20-03-2022 10:09

220320-l64pjscaen 10

19-03-2022 11:38

220319-nr4gcaghhr 10

General

  • Target

    setup_x86_x64_install.zip

  • Size

    6.2MB

  • Sample

    220328-jty77adcdp

  • MD5

    3569ac6e04296e88444d7ecf799c71b7

  • SHA1

    79a7f1e0fed008058afa803bdcf3172379808309

  • SHA256

    1cb6869826cf5ea749658c7622c8b4ecbcbb5c5e167ebc6623a01a0e0483e0f7

  • SHA512

    3de27b865db8ae753ca012771c71ca5e49e83aa4ebbac339938f722cb04c276a09925c759e0eaacaa842e69fb90ec7fb23e77a6411d2b1bc9d0f7b352f8091c8

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.6

Botnet

706

C2

https://dimonbk83.tumblr.com/

Attributes
  • profile_id

    706

Targets

    • Target

      setup_x86_x64_install.exe

    • Size

      6.2MB

    • MD5

      d2f0cfac1c354f041c7b243f3df94d0a

    • SHA1

      dfc03d06e799018485dc2dd72f997a0fef3d83a1

    • SHA256

      3faadb2356253a3c76b42691c13dd3c05b0df75fbf543041bd7afc478b9a838c

    • SHA512

      ed4b434001a16e0d81d59a5be9a26d31be8fb518ddc9e98dd22ca031761ab88ec9d4d479f11b2c0febfb90960061159836c806952d9e0c5cf9239654a5b7e6d6

    • Modifies Windows Defender Real-time Protection settings

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

      suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    • OnlyLogger Payload

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks