Overview

overview

10

Static

static

3

0b174fea18...1a.exe

windows7-x64

10

0b174fea18...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b174fea183b59e9fd82bbbf4d6ca51a

  • Size

    3.9MB

  • Sample

    231230-cjrxssgfen

  • MD5

    0b174fea183b59e9fd82bbbf4d6ca51a

  • SHA1

    d3a5217af89a4144b292798fe35b81981f16f640

  • SHA256

    7e85e9eea33b5c3576d801f9206cba0132f81e569c31e0f76f0ba9229b50b083

  • SHA512

    6359c2dd3d33a519831d05ec058e3caaba6de4be2911ad1e519412e04d1d1ec537b07add719f366b4fa6936187a3e10c268e307fceca5eaaaa7278198085cd75

  • SSDEEP

    98304:xDCvLUBsgUtB/0xIOUg2im1HKHSCK85OXovU/FqL:x4LUCgQZ0mS2im1qSZaFUc

Score
10/10
nullmixersmokeloadervidar706pub5agilenetaspackv2backdoordropperstealertrojanupx

Malware Config

Extracted

Family

nullmixer

C2

http://razino.xyz/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

39.3

Botnet

706

C2

https://bandakere.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Targets

    • Target

      0b174fea183b59e9fd82bbbf4d6ca51a

    • Size

      3.9MB

    • MD5

      0b174fea183b59e9fd82bbbf4d6ca51a

    • SHA1

      d3a5217af89a4144b292798fe35b81981f16f640

    • SHA256

      7e85e9eea33b5c3576d801f9206cba0132f81e569c31e0f76f0ba9229b50b083

    • SHA512

      6359c2dd3d33a519831d05ec058e3caaba6de4be2911ad1e519412e04d1d1ec537b07add719f366b4fa6936187a3e10c268e307fceca5eaaaa7278198085cd75

    • SSDEEP

      98304:xDCvLUBsgUtB/0xIOUg2im1HKHSCK85OXovU/FqL:x4LUCgQZ0mS2im1qSZaFUc

    Score
    10/10
    nullmixersmokeloadervidar706pub5agilenetaspackv2backdoordropperstealertrojanupx

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

      droppernullmixer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Nirsoft

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks