General

  • Target

    3cf58ec9de521b32015552ca3024d1cd.exe

  • Size

    32KB

  • Sample

    210413-f93n1p8zbx

  • MD5

    3cf58ec9de521b32015552ca3024d1cd

  • SHA1

    539236ecd9d859f82f89311bfd564906aa98451e

  • SHA256

    ae3e0639c29e82ba61932616457bae4100c939c281643dacfaa1bd5ba2dc9ace

  • SHA512

    25d7bdc0c80b886bfdbf2d00fac9628899656bf56d6213e0ef75c2bd4f88117f34c7edd6f46caba291f7d64655ff486cb5bbf0fd6f8ea0996525b02b42f78599

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://94.140.114.59/1/

rc4.i32
rc4.i32

Targets

    • Target

      3cf58ec9de521b32015552ca3024d1cd.exe

    • Size

      32KB

    • MD5

      3cf58ec9de521b32015552ca3024d1cd

    • SHA1

      539236ecd9d859f82f89311bfd564906aa98451e

    • SHA256

      ae3e0639c29e82ba61932616457bae4100c939c281643dacfaa1bd5ba2dc9ace

    • SHA512

      25d7bdc0c80b886bfdbf2d00fac9628899656bf56d6213e0ef75c2bd4f88117f34c7edd6f46caba291f7d64655ff486cb5bbf0fd6f8ea0996525b02b42f78599

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks