General
-
Target
97plv.exe
-
Size
126KB
-
Sample
200912-8e3aanqvca
-
MD5
f2fa5be5e49bdb2c9ac0a72ce85e644c
-
SHA1
70f069a055c42c4ef76947b6782adfac18bec676
-
SHA256
c052e533b542cd51f375949236b479bea0571e6c795f3e29a617b92f2e689818
-
SHA512
3564ff3df6a5715cf00fade68311906b9851e0ae502e2c2609c17620861a0017170979175aadc5143566a52e085a702de3ca9d50cc28d7843604eb3a4bac806b
Static task
static1
Behavioral task
behavioral1
Sample
97plv.exe
Resource
win7
Behavioral task
behavioral2
Sample
97plv.exe
Resource
win10v200722
Malware Config
Extracted
smokeloader
2020
http://rexstat35x.xyz/statweb955/
http://dexspot2x.xyz/statweb955/
http://atxspot20x.xyz/statweb955/
http://rexspot7x.xyz/statweb955/
http://fdmail85.club/statweb955/
http://servicem977x.xyz/statweb955/
http://advertxman7x.xyz/statweb955/
http://starxpush7x.xyz/statweb955/
Targets
-
-
Target
97plv.exe
-
Size
126KB
-
MD5
f2fa5be5e49bdb2c9ac0a72ce85e644c
-
SHA1
70f069a055c42c4ef76947b6782adfac18bec676
-
SHA256
c052e533b542cd51f375949236b479bea0571e6c795f3e29a617b92f2e689818
-
SHA512
3564ff3df6a5715cf00fade68311906b9851e0ae502e2c2609c17620861a0017170979175aadc5143566a52e085a702de3ca9d50cc28d7843604eb3a4bac806b
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Executes dropped EXE
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
JavaScript code in executable
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-