Overview

overview

10

Static

static

3

cb0bd08292...51.exe

windows7-x64

10

cb0bd08292...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb0bd08292eba04a78d128440ca59e51.exe

  • Size

    291KB

  • Sample

    231205-vwjq3ada9w

  • MD5

    cb0bd08292eba04a78d128440ca59e51

  • SHA1

    d7064eeb73405ad6397c8b14e6d93422685a53cc

  • SHA256

    806d2bc20d7e24a2de857235b9669d34b1a8444c8c4c7465e215326bbf341b01

  • SHA512

    5eb4993f6b782b7e5b209dfca65c4d7bc3de4cbffc4943faae627f5d41dc9dc669ffbbc60f63a2d6e7e544a087ffaf0096da2e141331fe86ab1a130bdabc8ae9

  • SSDEEP

    3072:cGriOYXdJgq1b/sa5dEFy39TsJhLySlexO+iZ5ULNDVZkTkI:h9va5dAytTsJ9ytxuoLNRiT

Score
10/10
raccoonredlinesmokeloaderredtestbackdoorevasioninfostealerstealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

redtest

C2

107.173.58.91:32870

Targets

    • Target

      cb0bd08292eba04a78d128440ca59e51.exe

    • Size

      291KB

    • MD5

      cb0bd08292eba04a78d128440ca59e51

    • SHA1

      d7064eeb73405ad6397c8b14e6d93422685a53cc

    • SHA256

      806d2bc20d7e24a2de857235b9669d34b1a8444c8c4c7465e215326bbf341b01

    • SHA512

      5eb4993f6b782b7e5b209dfca65c4d7bc3de4cbffc4943faae627f5d41dc9dc669ffbbc60f63a2d6e7e544a087ffaf0096da2e141331fe86ab1a130bdabc8ae9

    • SSDEEP

      3072:cGriOYXdJgq1b/sa5dEFy39TsJhLySlexO+iZ5ULNDVZkTkI:h9va5dAytTsJ9ytxuoLNRiT

    Score
    10/10
    raccoonredlinesmokeloaderredtestbackdoorevasioninfostealerstealerthemidatrojan

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks