General

  • Target

    vbc.exe

  • Size

    24KB

  • Sample

    230127-zac4lsed8s

  • MD5

    28cfc00452c4e3e6c0082fdca3c520fc

  • SHA1

    1260166c856aee0225371c7ab269f3a228cf8fb5

  • SHA256

    93b17c9c6d764b7e218d2d1669e8bd68059da3fe346936071b012d22d52fb35e

  • SHA512

    8413d173f55e5fe9d8fd415fd1f9e76358916ee1de5d1e6dbab3a1b18b0848011e76f7a2ee332f4fca64e8dcb26a8d1492c8d1ebe9ad165eba84c8dda6065af8

  • SSDEEP

    96:IEfPqlezZjTldKYgr+Doo+HzQLCmNeit3l/kSw6k7l6xiRQe3T3erAo00wGvzNt:IEfPql6VpJ/oGlL/kHH7l6Ej7e

Malware Config

Targets

    • Target

      vbc.exe

    • Size

      24KB

    • MD5

      28cfc00452c4e3e6c0082fdca3c520fc

    • SHA1

      1260166c856aee0225371c7ab269f3a228cf8fb5

    • SHA256

      93b17c9c6d764b7e218d2d1669e8bd68059da3fe346936071b012d22d52fb35e

    • SHA512

      8413d173f55e5fe9d8fd415fd1f9e76358916ee1de5d1e6dbab3a1b18b0848011e76f7a2ee332f4fca64e8dcb26a8d1492c8d1ebe9ad165eba84c8dda6065af8

    • SSDEEP

      96:IEfPqlezZjTldKYgr+Doo+HzQLCmNeit3l/kSw6k7l6xiRQe3T3erAo00wGvzNt:IEfPql6VpJ/oGlL/kHH7l6Ej7e

    • Detect PureCrypter injector

    • Detects Smokeloader packer

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks