Overview

overview

10

Static

static

1

6b57886745...10.exe

windows7-x64

10

6b57886745...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b5788674568961860422191b3a23010.exe

  • Size

    283KB

  • Sample

    230313-tdxdrsba98

  • MD5

    6b5788674568961860422191b3a23010

  • SHA1

    5ae408ce2dbf46b553a8e89db5b311ca40af3466

  • SHA256

    3358510dd07f7a0f84f6b8ff788bf5fb661c2259ebff3696c964f928a166a58c

  • SHA512

    32b11c9d8cc82f3cca441bc6d437a26113b785e2e6358fc9512701a0f04a1ea5d1640a9188a66fa6de77ae9f80f09f3c499944ee563d6f2439af0b0ee2590ce9

  • SSDEEP

    3072:IR/M5lL68U8+CTnMvkHFaMLdH2cj+l3CjixKud+fYpS9BOS1FtTxvC:+ULotlvCaMLtPaldxdIwr6tT

Score
10/10
redlinesmokeloadersystembcpub4backdoordiscoveryinfostealerspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://vispik.at/tmp/

http://ekcentric.com/tmp/

http://hbeat.ru/tmp/

http://mordo.ru/tmp/
rc4.i32
rc4.i32

Targets

    • Target

      6b5788674568961860422191b3a23010.exe

    • Size

      283KB

    • MD5

      6b5788674568961860422191b3a23010

    • SHA1

      5ae408ce2dbf46b553a8e89db5b311ca40af3466

    • SHA256

      3358510dd07f7a0f84f6b8ff788bf5fb661c2259ebff3696c964f928a166a58c

    • SHA512

      32b11c9d8cc82f3cca441bc6d437a26113b785e2e6358fc9512701a0f04a1ea5d1640a9188a66fa6de77ae9f80f09f3c499944ee563d6f2439af0b0ee2590ce9

    • SSDEEP

      3072:IR/M5lL68U8+CTnMvkHFaMLdH2cj+l3CjixKud+fYpS9BOS1FtTxvC:+ULotlvCaMLtPaldxdIwr6tT

    Score
    10/10
    smokeloaderpub4backdoortrojanredlinesystembcdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks