Overview

overview

10

Static

static

1

dik.rar

windows7-x64

10

dik.rar

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    dik.rar
  • Size 14.0MB
  • Sample240229-szpelsdc2w
  • SHA256 6c36e5d456335dd880fd2e168289af1a4af14d44df540ab55a3083eaa8dbf786
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
riseprosmokeloadertofseepub3backdoorevasionpersistencestealertrojan

Malware Config

Extracted

Family

  • tofsee

C2

  • vanaheim.cn

  • jotunheim.name

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://selebration17io.io/index.php

  • http://vacantion18ffeu.cc/index.php

  • http://valarioulinity1.net/index.php

  • http://buriatiarutuhuob.net/index.php

  • http://cassiosssionunu.me/index.php

  • http://sulugilioiu19.net/index.php

  • http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Extracted

Family

  • risepro

C2

  • 193.233.132.62

Extracted

Family

  • smokeloader

Botnet

  • pub3

Targets

    • Target
      dik.rar
    • Size 14.0MB
    • SHA256 6c36e5d456335dd880fd2e168289af1a4af14d44df540ab55a3083eaa8dbf786
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    riseprosmokeloadertofseepub3backdoorevasionpersistencestealertrojan

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks