General

  • Target

    36d5257db370921850cf447f4cbda680121d96604b12a0958434c31d71fa9964

  • Size

    241KB

  • Sample

    220127-j719pshhaj

  • MD5

    63e53cb9c5fce8cb51c409a8d2e7def4

  • SHA1

    69aa4c4da55e3d33b60e6198250c47480b9548c9

  • SHA256

    36d5257db370921850cf447f4cbda680121d96604b12a0958434c31d71fa9964

  • SHA512

    c4d0f1a0d9ac9c7e8e711b6426d706fdd8ea359ac4ac60af99a158ab2a75bfcc2d74e5611766d25a0d083cdba490497b250c6c3c2d0d38811572c0abead8a203

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Targets

    • Target

      36d5257db370921850cf447f4cbda680121d96604b12a0958434c31d71fa9964

    • Size

      241KB

    • MD5

      63e53cb9c5fce8cb51c409a8d2e7def4

    • SHA1

      69aa4c4da55e3d33b60e6198250c47480b9548c9

    • SHA256

      36d5257db370921850cf447f4cbda680121d96604b12a0958434c31d71fa9964

    • SHA512

      c4d0f1a0d9ac9c7e8e711b6426d706fdd8ea359ac4ac60af99a158ab2a75bfcc2d74e5611766d25a0d083cdba490497b250c6c3c2d0d38811572c0abead8a203

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Executes dropped EXE

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks