API tools faq
paste
Advertisement
VRad

#smokeloader_170823

VRad
Aug 20th, 2023 (edited)
347
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.92 KB | None | 0 0
raw download clone embed print report
  1. #IOC #OptiData #VR #smokeloader #lzh #pdf #RARsfx #packed
  2.  
  3. https://pastebin.com/GMwv38g4
  4.  
  5. previous_contact:
  6. https://pastebin.com/DgFvarG0
  7. https://pastebin.com/AayUSaXq
  8. https://pastebin.com/RDVXCe0J
  9. https://pastebin.com/QpG70u8T
  10. https://pastebin.com/BJzcXqkK
  11. https://pastebin.com/kBW7nkZ5
  12. https://pastebin.com/Z7zq0YkW
  13. https://pastebin.com/b8PkhMyN
  14. https://pastebin.com/hkskwKvc
  15. https://pastebin.com/JmthzrL4
  16. https://pastebin.com/1scwT0f8
  17. https://pastebin.com/MP3kCSSh
  18.  
  19. FAQ:
  20. https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader
  21. https://malpedia.caad.fkie.fraunhofer.de/details/win.xorist
  22. https://radetskiy.wordpress.com/2018/10/19/ioc_smokeloader_111018/
  23.  
  24.  
  25. attack_vector
  26. --------------
  27. email attach .lzh1 > .lzh2 > .exe > .pdf > .bat > execute .jpg [smokeloader]
  28.  
  29.  
  30. # # # # # # # #
  31. email_headers
  32. # # # # # # # #
  33. Received: from mail.agm.kh.ua (88.198.13.209)
  34. Received: from [194.187.111.205] (helo=[127.0.0.1]) by mail.agm.kh.ua with esmtpa (Exim 4.92)
  35. From: ДПС Украiни gov.ua <account@agm.kh.ua>
  36. Subject: Помилкове зарахування вiд 15.08.2023p.
  37. Date: Thu, 17 Aug 2023 06:39:29 +0000
  38. Message-ID: <B747255F-388A-4DC0-F86A-B3D475A42CF8@agm.kh.ua>
  39. Reply-To: "svyvanyaukr@meta.ua" <svyvanyaukr@meta.ua >
  40.  
  41.  
  42. # # # # # # # #
  43. files
  44. # # # # # # # #
  45. SHA-256 eaaef25918f5de5a755c88813cba1ae5da87d98d49f903ed88ddd6f33029828d
  46. File name Платiжна iнструкцiя Код документа 9312_0580_6944_3255.Archive.lzh [ LHARK ]
  47. File size 397.05 KB (406575 bytes)
  48.  
  49. SHA-256 1409d44a8858a7ecd81e8eceab7314dee31e1f7622cc780df4adb68d71998494
  50. File name 1.Платiжна iнструкцiя Код документа 9312_0580_6944_3255 [ LHARK ]
  51. File size 396.35 KB (405861 bytes)
  52.  
  53. SHA-256 c8286ba2b48eded78d0f168a63a1da3311f298eecf95eb6de3de09ee18060fe6
  54. File name 1.Платiжна iнструкцiя Код документа 9312_0580_6944_3255.pdf.exe [ WinRAR Self Extracting ]
  55. File size 375.74 KB (384754 bytes)
  56.  
  57. SHA-256 edfc02f5bb09b2c3871148d13f4bdcc2aa5444aa4dac170c8ab3342e353ce71a
  58. File name Payment_9312_0580_6944_3255.pdf [ PDF document, version 1.4 ] - clean, decoy
  59. File size 96.78 KB (99100 bytes)
  60.  
  61. SHA-256 0f438d68adc2af0ecafaacd25f42437d45fbe07ca4660bbec14ef246c57c7837
  62. File name Payment_9312_0580_6944_3255.bat [ ASCII text ]
  63. File size 45 B (45 bytes)
  64.  
  65. SHA-256 521526a7850de04b3cf1f592b932621a59e5af4b8d56e258443994edd42dbbce
  66. File name Pax_9312_0580_6944_3255_15.08.2023p.jpg [ PE32 executable (GUI) Intel 80386 ]
  67. File size 232.50 KB (238080 bytes)
  68.  
  69.  
  70. # # # # # # # #
  71. activity
  72. # # # # # # # #
  73.  
  74. PL_SCR email_attach
  75.  
  76. C2
  77.  
  78. metallergroup{ .ru/
  79. infomailforyoumak{ .ru/
  80. coinmakopenarea{ .su/
  81. internetcygane{ .ru/
  82. zallesman{ .ru/
  83. maxteroper{ .ru/
  84. kilomunara{ .com/
  85. napropertyhub{ .eu/
  86. nafillimonilini{ .net/
  87. goodlenuxilam{ .site/
  88. jimloamfilling{ .online/
  89. vertusupportjk{ .org/
  90. liverpulapp{ .ru/
  91. zarabovannyok{ .eu/
  92. cityofuganda{ .ug/
  93. hillespostelnm{ .eu/
  94. humanitarydp{ .ru/
  95. zaikaopentra{ .com.ru/
  96. zaikaopentra-com-ug{ .su/
  97. jslopasitmon{ .com/
  98. zaikadoctor{ .ru/
  99. sismasterhome{ .ru/
  100. supermarioprohozhdenie{ .ru/
  101. krasavchikoleg{ .net/
  102. samoramertut{ .ru/
  103. polinamailserverip{ .ru/
  104. lamazone{ .site/
  105. criticalosl{ .tech/
  106. maximprofile{ .net/
  107. kismamabeforyougo{ .ru/
  108. kissmafiabeforyoudied{ .ru/
  109. gondurasonline{ .ru/
  110.  
  111.  
  112. netwrk
  113. --------------
  114. 185.244.183.112 metallergroup{ .ru 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  115. 185.244.183.112 internetcygane{ .ru 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  116. 195.123.219.57 maximprofile{ .net 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  117. 185.244.183.112 jskgdhjkdfhjdkjhd844{ .ru 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  118. 195.123.219.57 azartnyjboy{ .com 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  119. 195.123.219.57 alegoomaster{ .com 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  120. 195.123.219.57 freesitucionap{ .com 80 HTTP POST / HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  121.  
  122. comp
  123. --------------
  124. n/a
  125.  
  126. proc
  127. --------------
  128. C:\Users\operator\Desktop\1.Платiжна iнструкцiя Код документа 9312_0580_6944_3255.pdf.exe
  129. "C:\Program Files\PDF\PDFXCview.exe" "C:\Users\operator\Desktop\Payment_9312_0580_6944_3255.pdf"
  130. C:\Windows\SysWOW64\cmd.exe /c ""C:\Users\operator\Desktop\Payment_9312_0580_6944_3255.bat" "
  131. C:\Users\operator\Desktop\Pax_9312_0580_6944_3255_15.08.2023p.jpg
  132.  
  133.  
  134. persist
  135. --------------
  136. n/a
  137.  
  138. drop
  139. --------------
  140. %userprofile%\Payment_9312_0580_6944_3255.pdf
  141. %userprofile%\Payment_9312_0580_6944_3255.bat
  142.  
  143.  
  144. # # # # # # # #
  145. additional info
  146. # # # # # # # #
  147. n/a
  148.  
  149.  
  150. # # # # # # # #
  151. VT & Intezer
  152. # # # # # # # #
  153. https://www.virustotal.com/gui/file/eaaef25918f5de5a755c88813cba1ae5da87d98d49f903ed88ddd6f33029828d/details
  154. https://www.virustotal.com/gui/file/1409d44a8858a7ecd81e8eceab7314dee31e1f7622cc780df4adb68d71998494/details
  155. https://www.virustotal.com/gui/file/c8286ba2b48eded78d0f168a63a1da3311f298eecf95eb6de3de09ee18060fe6/details
  156. https://analyze.intezer.com/analyses/0a484735-b3dc-49af-8a2f-e0af14b5bc54
  157. https://www.virustotal.com/gui/file/edfc02f5bb09b2c3871148d13f4bdcc2aa5444aa4dac170c8ab3342e353ce71a/details
  158. https://www.virustotal.com/gui/file/0f438d68adc2af0ecafaacd25f42437d45fbe07ca4660bbec14ef246c57c7837/details
  159. https://www.virustotal.com/gui/file/521526a7850de04b3cf1f592b932621a59e5af4b8d56e258443994edd42dbbce/details
  160. https://analyze.intezer.com/analyses/dffc731b-01d6-4355-8ac0-50e59f6828ad
  161.  
  162.  
  163. VR
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!