General
-
Target
f3ffa11b2e253229250bd92dfec5596bbe1e9da52a6fe714b6bf7beec3f342d4
-
Size
145KB
-
Sample
210926-e8b9raeda9
-
MD5
05350a2957b6b3f28bd01cb318ed6bfe
-
SHA1
6f20e594d0c3ad1d1cc78e3fcf85c48148c0b0ff
-
SHA256
f3ffa11b2e253229250bd92dfec5596bbe1e9da52a6fe714b6bf7beec3f342d4
-
SHA512
91d5b21e664c49ee6d76cde359d6a37bff22a358fe5232a433736463583b21a06cd572df2fb35da78116dd8ded7619beba94b1ac600e7701628fd74123a20220
Static task
static1
Behavioral task
behavioral1
Sample
f3ffa11b2e253229250bd92dfec5596bbe1e9da52a6fe714b6bf7beec3f342d4.exe
Resource
win10-en-20210920
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Extracted
raccoon
f6d7183c9e82d2a9b81e6c0608450aa66cefb51f
-
url4cnc
https://t.me/justoprostohello
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Targets
-
-
Target
f3ffa11b2e253229250bd92dfec5596bbe1e9da52a6fe714b6bf7beec3f342d4
-
Size
145KB
-
MD5
05350a2957b6b3f28bd01cb318ed6bfe
-
SHA1
6f20e594d0c3ad1d1cc78e3fcf85c48148c0b0ff
-
SHA256
f3ffa11b2e253229250bd92dfec5596bbe1e9da52a6fe714b6bf7beec3f342d4
-
SHA512
91d5b21e664c49ee6d76cde359d6a37bff22a358fe5232a433736463583b21a06cd572df2fb35da78116dd8ded7619beba94b1ac600e7701628fd74123a20220
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-