General
-
Target
Anti Malware VS Malware Document.zip
-
Size
118.1MB
-
Sample
231028-vdn8tsea66
-
MD5
10381c0010548265a31da2da6f1611a3
-
SHA1
3f188fdca7ce79f014b3efa00b1707fb60664e72
-
SHA256
8f736d24115f70ad18ed620ec8c29efc805ea00e2ac72bb1e9078186488fa059
-
SHA512
30925324113e0bc692d38c44196b5fa78c1bdff449d361a011ab5f86ee09299071769691da1200a750a55e182e432907a58ada4c36de83ad60e6e2f2aead5445
-
SSDEEP
3145728:WcNV0c+BBchhJJnsNmDuzn2dOYIwWDB0tg:WcNqcAuD3gTY6wlg
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://77.91.68.29/fks/
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Extracted
formbook
4.1
4hc5
amandaastburyillustration.com
7141999.com
showshoe.info
sagemarlin.com
lithuaniandreamtime.com
therenixgroupllc.com
avalialooks.shop
vurporn.com
lemmy.systems
2816goldfinch.com
pacersun.com
checktrace.com
loadtransfer.site
matsuri-jujutsukaisen.com
iontrapper.science
5108010.com
beidixi.com
21305599.com
peakvitality.fitness
osisfeelingfee.com
Extracted
formbook
4.1
t6tg
dwolfgang.com
changeandcourse.com
sonexhospitallimited.com
izeera.com
7m9.lat
fem-studio.com
santocielostore.com
0xinxg7e50de2n7q2z.site
ssongg13026.cfd
promushealth.com
g7bety.com
molinoelvinculo.com
smallthingteamwork.world
zewagripro.shop
adam-automatik.com
raquelaranibar.com
aigeniusink.com
maddirazoki.com
nextino.app
verbenashungary.com
Extracted
lokibot
http://davinci.kalnet.top/_errorpages/davinci/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
agenttesla
Protocol: smtp- Host:
mail.greentnd.com - Port:
587 - Username:
[email protected] - Password:
xAu^5p6BT2vcelhn - Email To:
[email protected]
Extracted
loaderbot
http://185.236.76.77/cmd.php
Targets
-
-
Target
Anti Malware VS Malware Document.zip
-
Size
118.1MB
-
MD5
10381c0010548265a31da2da6f1611a3
-
SHA1
3f188fdca7ce79f014b3efa00b1707fb60664e72
-
SHA256
8f736d24115f70ad18ed620ec8c29efc805ea00e2ac72bb1e9078186488fa059
-
SHA512
30925324113e0bc692d38c44196b5fa78c1bdff449d361a011ab5f86ee09299071769691da1200a750a55e182e432907a58ada4c36de83ad60e6e2f2aead5445
-
SSDEEP
3145728:WcNV0c+BBchhJJnsNmDuzn2dOYIwWDB0tg:WcNqcAuD3gTY6wlg
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Formbook payload
-
LoaderBot executable
-
Downloads MZ/PE file
-
Stops running service(s)
-
Modifies file permissions
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-