General

  • Target

    NEAS.1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e.exe

  • Size

    1.0MB

  • Sample

    231111-mlhr1see67

  • MD5

    4523709ea153132fd0909dd20fb9c91d

  • SHA1

    bf226616516111783b8dbb6911b76cc20891c4ac

  • SHA256

    1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e

  • SHA512

    0bce900dec9e8bc209b780decb9da1d8b49b0081376f6e9d120abd5ff7a7e280e0a67e67c8b3626d404ab6af85632ac984308e932bc94a94ecde9c19eb5f9bfd

  • SSDEEP

    24576:cyjzXGsADhSi4aejIsFCTGCdkDql+/8P2v53xVOya5c2ODy:LX2xDxheMMUGDq2xxVOya

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelnew2.0

C2

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Targets

    • Target

      NEAS.1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e.exe

    • Size

      1.0MB

    • MD5

      4523709ea153132fd0909dd20fb9c91d

    • SHA1

      bf226616516111783b8dbb6911b76cc20891c4ac

    • SHA256

      1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e

    • SHA512

      0bce900dec9e8bc209b780decb9da1d8b49b0081376f6e9d120abd5ff7a7e280e0a67e67c8b3626d404ab6af85632ac984308e932bc94a94ecde9c19eb5f9bfd

    • SSDEEP

      24576:cyjzXGsADhSi4aejIsFCTGCdkDql+/8P2v53xVOya5c2ODy:LX2xDxheMMUGDq2xxVOya

    • Detect Mystic stealer payload

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks