Overview

overview

10

Static

static

SecuriteIn...61.exe

windows7-x64

10

SecuriteIn...61.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.28867.21061.exe
  • Size 222KB
  • Sample221229-cy6phafc3w
  • SHA256 e7c3cff0ae5c18797117676076ccd7c501fc47d2e0da7e61826ed234eb4bed43
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
redlinesmokeloadervidar788installsbackdoorinfostealerspywarestealertrojan

Malware Config

Extracted

Family

  • redline

Botnet

  • installs

C2

  • 77.73.134.57:20368

Attributes
  • auth_value

    018d84fd84774560e4827f12acc7d4af

Extracted

Family

  • vidar

Version

  • 1.7

Botnet

  • 788

C2

  • https://t.me/robloxblackl

  • https://steamcommunity.com/profiles/76561199458928097

Attributes
  • profile_id

    788

Targets

    • Target
      SecuriteInfo.com.Win32.PWSX-gen.28867.21061.exe
    • Size 222KB
    • SHA256 e7c3cff0ae5c18797117676076ccd7c501fc47d2e0da7e61826ed234eb4bed43
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoortrojanredlinevidar788installsinfostealerspywarestealer

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks