General

  • Target

    file.exe

  • Size

    265KB

  • Sample

    231205-k3armaac3s

  • MD5

    5a89046e22c085a2891cdd999e0f0d47

  • SHA1

    92786a72b76446c2d8c0d7013e573243e87839f7

  • SHA256

    fd932cc727c801502c3c3250efa825a5bec52aa3343ce2d249c914c27288f425

  • SHA512

    a4ca0b3ca7286d08ff848ede99bb01d3b116596fda2fa29cd2d200f5bf99313909d644aedccecc17af498ccfc84276ddcee5e1c55668852de3113b8e72a5d451

  • SSDEEP

    3072:7DFaQytaulhnVAcMAh99Xn2jJbNMGfx3HzDapOUYkwxFZ4:fFH0nVJMAj9XnobiSx3TDapq

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://dskflherlkhopihsf.com

Attributes
  • url_path

    /d414f888bed8c202.php

rc4.plain

Targets

    • Target

      file.exe

    • Size

      265KB

    • MD5

      5a89046e22c085a2891cdd999e0f0d47

    • SHA1

      92786a72b76446c2d8c0d7013e573243e87839f7

    • SHA256

      fd932cc727c801502c3c3250efa825a5bec52aa3343ce2d249c914c27288f425

    • SHA512

      a4ca0b3ca7286d08ff848ede99bb01d3b116596fda2fa29cd2d200f5bf99313909d644aedccecc17af498ccfc84276ddcee5e1c55668852de3113b8e72a5d451

    • SSDEEP

      3072:7DFaQytaulhnVAcMAh99Xn2jJbNMGfx3HzDapOUYkwxFZ4:fFH0nVJMAj9XnobiSx3TDapq

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks