Resubmissions

01/07/2023, 23:47

230701-3tde9saa45 10

01/07/2023, 23:40

230701-3n8n8aaa25 10

General

  • Target

    2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7

  • Size

    4.2MB

  • Sample

    230701-3n8n8aaa25

  • MD5

    ea191512e6ed56aa661ecb2deed1623e

  • SHA1

    a2198ccd7d00ab727618ca2368f9f8c54b01c5d3

  • SHA256

    2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7

  • SHA512

    7658e27038f60aa13df49bf48ac90a13cf77ef7e88e16453964b44e1cf9669ad3d06884692288a67a1dd3ffee89ce35e55750227e913bd3193dcc666f8bb8419

  • SSDEEP

    98304:sHejdaMKBnK2t4x+GwYIb4jYfCmAcZmPcxkk9cRj5MQL:sHGdaTBnK2tHG2UMdWGLcRWE

Malware Config

Extracted

Family

amadey

Version

3.83

C2

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

280623_rc_11

C2

rcn.tuktuk.ug:11285

Attributes
  • auth_value

    7dbd026b7e6c26ab5e41958efd6a2a6e

Targets

    • Target

      2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7

    • Size

      4.2MB

    • MD5

      ea191512e6ed56aa661ecb2deed1623e

    • SHA1

      a2198ccd7d00ab727618ca2368f9f8c54b01c5d3

    • SHA256

      2b30c78da77cb01371ef3e1fe61d70608227a5c1784ffe4366cb77461d4323e7

    • SHA512

      7658e27038f60aa13df49bf48ac90a13cf77ef7e88e16453964b44e1cf9669ad3d06884692288a67a1dd3ffee89ce35e55750227e913bd3193dcc666f8bb8419

    • SSDEEP

      98304:sHejdaMKBnK2t4x+GwYIb4jYfCmAcZmPcxkk9cRj5MQL:sHGdaTBnK2tHG2UMdWGLcRWE

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies security service

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks