General

  • Target

    https://cdn.discordapp.com/attachments/1211236203525840908/1211237262600306708/release_file_v2_0.rar?ex=65ed779b&is=65db029b&hm=d92dc89cae20880c8ba7be66594a20432fce482dc1495680034b69fece23ddf9&?space=File.zip

  • Sample

    240225-ppm71scc61

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

risepro

C2

193.233.132.62

Targets

    • Target

      https://cdn.discordapp.com/attachments/1211236203525840908/1211237262600306708/release_file_v2_0.rar?ex=65ed779b&is=65db029b&hm=d92dc89cae20880c8ba7be66594a20432fce482dc1495680034b69fece23ddf9&?space=File.zip

    • Detect ZGRat V1

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks