General
-
Target
231101-qxmf5aha4s_pw_infected.zip
-
Size
350KB
-
Sample
231101-q2rxeaha8w
-
MD5
59aaea00d7775dba3a01035c0bc83d2d
-
SHA1
c0fc77e7ab0abc54fc62f46b1f0ffe1da6d0eb14
-
SHA256
979bafa3a03f682b5c12787e99b26c515be22b14e88aa2ea9438520ccd0dee40
-
SHA512
ff620954224e955a77e7e5e6649868fe8be15ba8680ad207c83f272bb3409d6d880c32d939a755cec6d84e01c22b5c8adba0a3ef361c51c160cc4785a7ee3447
-
SSDEEP
6144:MJ8g2D16vjYdHbtxiJxTiHjIWdFQLPH3Ph25rOdUZhZVS/6wyeU0+bvAqJxS:MKrJxiJxTiHjfvQLvpqryGqywye2bS
Static task
static1
Behavioral task
behavioral1
Sample
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
http://yvzgz.cyou/index.php
https://yvzgz.cyou/index.php
Extracted
redline
grome
77.91.124.86:19084
Extracted
redline
kinza
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
smokeloader
up3
Extracted
redline
pixelnew
194.49.94.11:80
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
raccoon
6a6a005b9aa778f606280c5fa24ae595
http://195.123.218.98:80
http://31.192.23
-
user_agent
SunShineMoonLight
Extracted
C:\K1LqbcE4P.README.txt
https://getsession.org
Targets
-
-
Target
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107
-
Size
957KB
-
MD5
ff7ab8fec0deee7115073ff4cadc7895
-
SHA1
1ca961d70848b831d6a1505ab9df2c6595df314a
-
SHA256
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107
-
SHA512
8a204cdd18790894d2803b66bc0a19ef13132eeca026e19ba30365969a2726665c007c64ab3e9add367f9c479e99e07fa32750dd0129baa872eb4af1a4723431
-
SSDEEP
12288:EbcPJo2dAKlpItf+BV3XHSlHYBPHJqXbmxoRj3cQpRnRu9cdTjBi+e:RP22dAK4tf+BVHHkIoRj3cQD5i+
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect ZGRat V1
-
Glupteba payload
-
Raccoon Stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1