Overview

overview

10

Static

static

3

eeb18dec0f...71.exe

windows7-x64

10

eeb18dec0f...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eeb18dec0f9402e96fb629ab201890d8b2fcfeb45e890e42e3a79a799e575771

  • Size

    164KB

  • Sample

    230807-cyjjzadb47

  • MD5

    1b94e6504da7365a7ac9e5f1c37ea714

  • SHA1

    b2c784470f5400680f275943aacfcbef6cda5c88

  • SHA256

    eeb18dec0f9402e96fb629ab201890d8b2fcfeb45e890e42e3a79a799e575771

  • SHA512

    6b86bdea9ed18fc11e32c0ce7e6883677fa5e3dfad053200e6757a51cc4b11a5adf0757853c9b4421796e7789d75af17c686ca513a9d442a7a0fa093920d012e

  • SSDEEP

    3072:sSGL9TvjYP99HQjQQeTXE61nB1KpyehJqCFQUDjp5AJ:IL9jjYlaQ9E6B2yeHPOJ

Score
10/10
rhadamanthyssmokeloadersystembcsummbackdoorspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

C2

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/
rc4.i32
rc4.i32

Extracted

Family

systembc

C2

discordcdn8839248.com:4327

chinabar821994.com:4327

Targets

    • Target

      eeb18dec0f9402e96fb629ab201890d8b2fcfeb45e890e42e3a79a799e575771

    • Size

      164KB

    • MD5

      1b94e6504da7365a7ac9e5f1c37ea714

    • SHA1

      b2c784470f5400680f275943aacfcbef6cda5c88

    • SHA256

      eeb18dec0f9402e96fb629ab201890d8b2fcfeb45e890e42e3a79a799e575771

    • SHA512

      6b86bdea9ed18fc11e32c0ce7e6883677fa5e3dfad053200e6757a51cc4b11a5adf0757853c9b4421796e7789d75af17c686ca513a9d442a7a0fa093920d012e

    • SSDEEP

      3072:sSGL9TvjYP99HQjQQeTXE61nB1KpyehJqCFQUDjp5AJ:IL9jjYlaQ9E6B2yeHPOJ

    Score
    10/10
    rhadamanthyssmokeloadersystembcsummbackdoorstealertrojanspyware

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks