General

  • Target

    0d1334075336455a13a36fd909417556.exe

  • Size

    32KB

  • Sample

    210413-z8z98kbnp2

  • MD5

    0d1334075336455a13a36fd909417556

  • SHA1

    4f1937f0eeeb697ef992547701295134fde65c20

  • SHA256

    33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9

  • SHA512

    d1f51355db6c4b040196b2588b8f21ef94d11901c7e8ea2c3632622adc791721d044c9a9448c8344406e5cbad2083f140caf9492d3dfef12724d22bb6e549971

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://94.140.115.43/1/

rc4.i32
rc4.i32

Targets

    • Target

      0d1334075336455a13a36fd909417556.exe

    • Size

      32KB

    • MD5

      0d1334075336455a13a36fd909417556

    • SHA1

      4f1937f0eeeb697ef992547701295134fde65c20

    • SHA256

      33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9

    • SHA512

      d1f51355db6c4b040196b2588b8f21ef94d11901c7e8ea2c3632622adc791721d044c9a9448c8344406e5cbad2083f140caf9492d3dfef12724d22bb6e549971

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks