General
-
Target
SecuriteInfo.com.Heur.20230624152739349083246.exe
-
Size
901KB
-
Sample
230624-sxglzscg31
-
MD5
4d0f16309f1dfe19ab558a13624df4aa
-
SHA1
d188e8d274935043436c6cae0c56d24a974f6800
-
SHA256
8d8ae453a5773f10fddff520a45326b3d665f79e707898fa0e09b28084bfb1f9
-
SHA512
dc54240ec0a21e8719e9e212445ecbecb40c14eb5f6b7d74706976e879ddc14fbd324d83383f4c463e8c1c25166f2105ed613b7f3ad3a125214d68c484e1b005
-
SSDEEP
24576:XhAHI6vOZZU1gJVwHdoI8BV/MUxbO1P8n22:XiZsU+VI+BV/M6bsUn2
Static task
static1
Malware Config
Extracted
amadey
3.83
45.9.74.80/0bjdn2Z/index.php
Extracted
smokeloader
pub5
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Targets
-
-
Target
SecuriteInfo.com.Heur.20230624152739349083246.exe
-
Size
901KB
-
MD5
4d0f16309f1dfe19ab558a13624df4aa
-
SHA1
d188e8d274935043436c6cae0c56d24a974f6800
-
SHA256
8d8ae453a5773f10fddff520a45326b3d665f79e707898fa0e09b28084bfb1f9
-
SHA512
dc54240ec0a21e8719e9e212445ecbecb40c14eb5f6b7d74706976e879ddc14fbd324d83383f4c463e8c1c25166f2105ed613b7f3ad3a125214d68c484e1b005
-
SSDEEP
24576:XhAHI6vOZZU1gJVwHdoI8BV/MUxbO1P8n22:XiZsU+VI+BV/M6bsUn2
-
Detect Fabookie payload
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
2Impair Defenses
1Install Root Certificate
1Modify Registry
4