Overview

overview

10

Static

static

3

money generator.exe

windows10-1703-x64

10

Resubmissions

04-06-2023 19:29

230604-x7lqxaea5x 10

11-05-2023 23:54

230511-3x28ssba52 10

11-05-2023 21:10

230511-zz6gfsch6y 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    money generator.dat

  • Size

    5KB

  • Sample

    230511-3x28ssba52

  • MD5

    8c72631836822bafd97a2bd198261322

  • SHA1

    2f0975e53ce034637d83b3d8df4a30fd5db29c50

  • SHA256

    be44bee1f8fe8f7a4aa42fc8e0c9e8ab37bd4e0a724a5e0d1f817c6cbf5f8745

  • SHA512

    12240570eed4948d967dcec1dae5261c3a450a1b3c45b4f8df90c4a6499865d8f6e4df47f573abfb28e30495a00aa55de3e3b87b1193f527cc25ce958004c6c4

  • SSDEEP

    96:BEumoTbuz1Kuz1yluz15dnX1GqDUtLv8e7cpRuw5bzNt:BvmoP0K0yl05J1Gq2Lv8ecRD9

Score
10/10
redlinesmokeloadervidarsprgbackdoorinfostealerstealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/
rc4.i32
rc4.i32

Targets

    • Target

      money generator.dat

    • Size

      5KB

    • MD5

      8c72631836822bafd97a2bd198261322

    • SHA1

      2f0975e53ce034637d83b3d8df4a30fd5db29c50

    • SHA256

      be44bee1f8fe8f7a4aa42fc8e0c9e8ab37bd4e0a724a5e0d1f817c6cbf5f8745

    • SHA512

      12240570eed4948d967dcec1dae5261c3a450a1b3c45b4f8df90c4a6499865d8f6e4df47f573abfb28e30495a00aa55de3e3b87b1193f527cc25ce958004c6c4

    • SSDEEP

      96:BEumoTbuz1Kuz1yluz15dnX1GqDUtLv8e7cpRuw5bzNt:BvmoP0K0yl05J1Gq2Lv8ecRD9

    Score
    10/10
    redlinesmokeloadervidarsprgbackdoorinfostealerstealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks