General

  • Target

    tmp

  • Size

    501KB

  • Sample

    230703-h3qrqsfd43

  • MD5

    70f331abf74c5b4351e71a45d834ada1

  • SHA1

    e828bd4f00d8f63c4205a9be7c6da1239e21e707

  • SHA256

    68af9af3506c7a35ef60026b6662cbc1fda0b36007a6eb48a974e4d7574db21f

  • SHA512

    aae6cc3c590d9cad22b58eadbe51dae8812dc111a8bf274ec5c5ee6a62d7f7ae6ce2851ae33ac816b0f7eb1d4eb009f0945198f96b19a6c97642d2caf209f39e

  • SSDEEP

    6144:Iyv496N16r+vkN9SUWcSVVKoxxfWf4qa9wR4uPH20nfoaNAQftrDdpiDKGASKGkP:bvLK+mSUWZXKojWf4+RVHhAlASKGk19

Malware Config

Extracted

Family

amadey

Version

3.83

C2

45.9.74.80/0bjdn2Z/index.php

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      tmp

    • Size

      501KB

    • MD5

      70f331abf74c5b4351e71a45d834ada1

    • SHA1

      e828bd4f00d8f63c4205a9be7c6da1239e21e707

    • SHA256

      68af9af3506c7a35ef60026b6662cbc1fda0b36007a6eb48a974e4d7574db21f

    • SHA512

      aae6cc3c590d9cad22b58eadbe51dae8812dc111a8bf274ec5c5ee6a62d7f7ae6ce2851ae33ac816b0f7eb1d4eb009f0945198f96b19a6c97642d2caf209f39e

    • SSDEEP

      6144:Iyv496N16r+vkN9SUWcSVVKoxxfWf4qa9wR4uPH20nfoaNAQftrDdpiDKGASKGkP:bvLK+mSUWZXKojWf4+RVHhAlASKGk19

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks