General

  • Target

    4db6f4628dcd3a4ef8417290ad40c858047ceaed4daaff87a4a5f0d873745809.exe

  • Size

    252KB

  • Sample

    240229-f4ae2afb5v

  • MD5

    706afaee286c2e7055ec363a27482071

  • SHA1

    042b0398957cfc9a5d639238ce817fdb557633d2

  • SHA256

    4db6f4628dcd3a4ef8417290ad40c858047ceaed4daaff87a4a5f0d873745809

  • SHA512

    23e3438d14188e3d69adb01d16db731f7fc534022a09faeaa0d99eef02e365e18313d9d1cb175154fd46df74cb85c4c054022d822b23ae259c7c5f665011727d

  • SSDEEP

    3072:EiA5GwRCB1L3IYq6Tec1tzO0YaGs0quD+s7XzHg5tzTFnx:9Bd3IYe6zO08w8+sT7czT

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

Targets

    • Target

      4db6f4628dcd3a4ef8417290ad40c858047ceaed4daaff87a4a5f0d873745809.exe

    • Size

      252KB

    • MD5

      706afaee286c2e7055ec363a27482071

    • SHA1

      042b0398957cfc9a5d639238ce817fdb557633d2

    • SHA256

      4db6f4628dcd3a4ef8417290ad40c858047ceaed4daaff87a4a5f0d873745809

    • SHA512

      23e3438d14188e3d69adb01d16db731f7fc534022a09faeaa0d99eef02e365e18313d9d1cb175154fd46df74cb85c4c054022d822b23ae259c7c5f665011727d

    • SSDEEP

      3072:EiA5GwRCB1L3IYq6Tec1tzO0YaGs0quD+s7XzHg5tzTFnx:9Bd3IYe6zO08w8+sT7czT

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables Discord URL observed in first stage droppers

    • Detects executables containing URLs to raw contents of a Github gist

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables referencing many varying, potentially fake Windows User-Agents

    • UPX dump on OEP (original entry point)

    • Contacts a large (704) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks