Overview

overview

10

Static

static

URLScan

urlscan

1

https://oneqanatclub...

windows7-x64

10

https://oneqanatclub...

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://oneqanatclub.com/O4uYeU5lV6dN_0UrzBx4sNtDjheJnvEjQ8xUsiyyfa0/?clck=1580b126227a97924669dc06f0c24968&sid=17357599

  • Sample

    221005-22txjsgbbr

Score
10/10
privateloaderredlinesmokeloaderbackdoorevasioninfostealerloaderthemidatrojanupxvmprotect

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12
Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Targets

    • Target

      https://oneqanatclub.com/O4uYeU5lV6dN_0UrzBx4sNtDjheJnvEjQ8xUsiyyfa0/?clck=1580b126227a97924669dc06f0c24968&sid=17357599

    Score
    10/10
    privateloaderredlinesmokeloaderbackdoorevasioninfostealerloaderthemidatrojanupxvmprotect

    • Detects Smokeloader packer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks