#Cinoshi - Twitter Hashtag

over 3 years ago

@crep1x Some weeks ago I spottet a/this #Cinoshi campaign in the wild, distributed via #SmokeLoader. You can find my findings here: https://t.co/lBazqqu8BE

Gi7w0rm

@Gi7w0rm

over 3 years ago

ThreatActors continue to amaze me. #SmokeLoader -> Telegram Bio -> unidentified #Loader / #Stealer -> #CryptoMiner + #Ransomware + #RedLine Triage: https://t.co/d4cKdAL7QK The initial bin dropped by #SmokeLoader is an unidentified Loader/Stealer : hxxps://transfer.sh/get/oFBAuC/MavrodiBlack%202.exe it first reaches out to: hxxp://t.me/cinoshibot from the bio, it gets the C2: hxxps://central-cee-doja.ru It then continuously reaches out to this address via different endpoints (see image below) After successfully executing it loads 3 additional binaries: 1) hxxps://github.com/holdthismoney/icona/raw/main/version32.exe 2) hxxps://github.com/MavrodiBlack/sturdy-potato/raw/main/MavrodiBlack.exe 3) hxxps://transfer.sh/get/L0fiUE/[@]MavrodiBlack_alice.exe (without []) 1) loads a #CryptoMiner mining on hashvault[.]pro (With extra feature of a reliable BlueScreen through pagefault error on Win10) https://t.co/VOxtzfp4Fo 2) is a #Ransomware with some pretty cool animations. (Intezer: #GlobeImposter ) Actor: #JumperHacks DecryptionKey via: t[.]me/Imthepassword https://t.co/zqaN7Pv5qb 3) is #RedLine #Stealer with C2: 37.220.87[.]13:48790 @ET_Labs for detection rules on this noisy Stealer/Loader (maybe you also know what this is)

Gi7w0rm's tweet photo. ThreatActors continue to amaze me.
#SmokeLoader -> Telegram Bio -> unidentified #Loader / #Stealer -> #CryptoMiner + #Ransomware + #RedLine

Triage:
https://t.co/d4cKdAL7QK

The initial bin dropped by #SmokeLoader is an unidentified Loader/Stealer :
hxxps://transfer.sh/get/oFBAuC/MavrodiBlack%202.exe

it first reaches out to:
hxxp://t.me/cinoshibot

from the bio, it gets the C2:
hxxps://central-cee-doja.ru
It then continuously reaches out to this address via different endpoints (see image below)

After successfully executing it loads 3 additional binaries:
1) hxxps://github.com/holdthismoney/icona/raw/main/version32.exe
2)
hxxps://github.com/MavrodiBlack/sturdy-potato/raw/main/MavrodiBlack.exe
3)
hxxps://transfer.sh/get/L0fiUE/[@]MavrodiBlack_alice.exe (without [])

1) loads a #CryptoMiner mining on hashvault[.]pro
(With extra feature of a reliable BlueScreen through pagefault error on Win10)
https://t.co/VOxtzfp4Fo

2) is a #Ransomware with some pretty cool animations. (Intezer: #GlobeImposter )
Actor: #JumperHacks
DecryptionKey via: t[.]me/Imthepassword
https://t.co/zqaN7Pv5qb

3) is #RedLine #Stealer with C2: 37.220.87[.]13:48790

@ET_Labs for detection rules on this noisy Stealer/Loader (maybe you also know what this is)

9

165

45

35

37K

1

5

0

649

crep1x @crep1x

over 3 years ago

#Cinoshi stealer uses a Telegram channel as a Dead Drop Resolver (DDR), just like #Vidar stealer DDR: hxxps://t.]me/cinoshibot C2: hxxps://central-cee-doja.]ru/ The number of samples communicating with the DDR suggests that the malware is rather well distributed.