General

  • Target

    f5b5c89e8d4e216a731c5fa57e53ebd9012c41f2d65c0c48eb45ccac021b4311_JC.exe

  • Size

    301KB

  • Sample

    230914-wnazmadh4z

  • MD5

    935c3103d5f0846c8b4e95d3839792bf

  • SHA1

    80ed9d1a8283ee5b4ad61b0ab8d5a2225612b47d

  • SHA256

    f5b5c89e8d4e216a731c5fa57e53ebd9012c41f2d65c0c48eb45ccac021b4311

  • SHA512

    092a7770c613bd63ac05f290f850e023fc6e61859b8ea2d554a4de4c35f4fc052e097ffdf82eb55520cd9ef6422afbe0b9c639ff58942453cbe17a55f29c281a

  • SSDEEP

    3072:g8lsnGvxeJlxXhQtP5rI3ilf9Ba49sHZxuoUTHHM3kKbet7YO8J:XigeJlxXatPZoEf9I49sSrTHHyrE

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

stealc

Botnet

1467882962796800663244393688

C2

http://85.209.11.51

Attributes
  • url_path

    /fefb4a458e1dc58b.php

rc4.plain

Targets

    • Target

      f5b5c89e8d4e216a731c5fa57e53ebd9012c41f2d65c0c48eb45ccac021b4311_JC.exe

    • Size

      301KB

    • MD5

      935c3103d5f0846c8b4e95d3839792bf

    • SHA1

      80ed9d1a8283ee5b4ad61b0ab8d5a2225612b47d

    • SHA256

      f5b5c89e8d4e216a731c5fa57e53ebd9012c41f2d65c0c48eb45ccac021b4311

    • SHA512

      092a7770c613bd63ac05f290f850e023fc6e61859b8ea2d554a4de4c35f4fc052e097ffdf82eb55520cd9ef6422afbe0b9c639ff58942453cbe17a55f29c281a

    • SSDEEP

      3072:g8lsnGvxeJlxXhQtP5rI3ilf9Ba49sHZxuoUTHHM3kKbet7YO8J:XigeJlxXatPZoEf9I49sSrTHHyrE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks