Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d

  • Size

    1.6MB

  • Sample

    240501-21qthahg31

  • MD5

    7a1a1ef5364d1de84ccda20479a6be66

  • SHA1

    4141826fdaf7c15e6ee2f23ea0bdc2c5ef1e09ae

  • SHA256

    4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d

  • SHA512

    7d2cf5b4894af33c56497883b6dc9d0d69ce6beb7bc6615ee2ad0b3bf1467b4e6080ca570cacd112dd011e2764b0bd663a3d05d0a72462cbbbbf49a05a7cca36

  • SSDEEP

    24576:kmZ+I9s6x+YxgS7WvwCB06006XU6DixBQuGmTm:kmZ+Iqyri2NCBL6XU6mbQrm

Score
10/10
smokeloaderzgratpub3backdoorratspywaretrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php
rc4.i32
rc4.i32

Targets

    • Target

      4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d

    • Size

      1.6MB

    • MD5

      7a1a1ef5364d1de84ccda20479a6be66

    • SHA1

      4141826fdaf7c15e6ee2f23ea0bdc2c5ef1e09ae

    • SHA256

      4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d

    • SHA512

      7d2cf5b4894af33c56497883b6dc9d0d69ce6beb7bc6615ee2ad0b3bf1467b4e6080ca570cacd112dd011e2764b0bd663a3d05d0a72462cbbbbf49a05a7cca36

    • SSDEEP

      24576:kmZ+I9s6x+YxgS7WvwCB06006XU6DixBQuGmTm:kmZ+Iqyri2NCBL6XU6mbQrm

    Score
    10/10
    smokeloaderzgratpub3backdoorratspywaretrojan

    • Detect ZGRat V1

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks