General

  • Target

    4523709ea153132fd0909dd20fb9c91d.bin

  • Size

    1005KB

  • Sample

    231112-cantsacd21

  • MD5

    36e920d790a84a0db1395de1d7d57aa5

  • SHA1

    f928eb9dcb37a0c2aad0a99678e2fbbac563c521

  • SHA256

    eddd501fd43474e502ffbe6e93ad9c2fab2f122e841884dda9b3b1a71e16f61e

  • SHA512

    059799b4396e5ec9faa70ae65824cffb96818759e3a786060bb234ff6ba6733ff9d4aa03add9274996a8deb46603c0558578721d8709ad62d715241540ac1457

  • SSDEEP

    24576:KLl1MFGkbIHWgSu2ROMHRHgS11Km6iV21YwS:eFRdJyf14iV21YX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

stealc

C2

http://77.91.68.247

Attributes
  • url_path

    /c36258786fdc16da.php

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Targets

    • Target

      1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e.exe

    • Size

      1.0MB

    • MD5

      4523709ea153132fd0909dd20fb9c91d

    • SHA1

      bf226616516111783b8dbb6911b76cc20891c4ac

    • SHA256

      1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e

    • SHA512

      0bce900dec9e8bc209b780decb9da1d8b49b0081376f6e9d120abd5ff7a7e280e0a67e67c8b3626d404ab6af85632ac984308e932bc94a94ecde9c19eb5f9bfd

    • SSDEEP

      24576:cyjzXGsADhSi4aejIsFCTGCdkDql+/8P2v53xVOya5c2ODy:LX2xDxheMMUGDq2xxVOya

    • Detect Mystic stealer payload

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Stops running service(s)

    • Executes dropped EXE

    • Adds Run key to start application

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand paypal.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks