General

  • Target

    8869ab0a6bce81b2f6d9673308cb5ca4b52c923d80fc2f967e4af65bca0018b6

  • Size

    304KB

  • Sample

    220521-rxjwnshfg7

  • MD5

    cf5ac73746d57f37b4177ff463089fa8

  • SHA1

    2f3b655ebd87b3119d3be9528a97a8cea497688a

  • SHA256

    8869ab0a6bce81b2f6d9673308cb5ca4b52c923d80fc2f967e4af65bca0018b6

  • SHA512

    cecc5f79991bc9bb291584c17a0a5b962153837451214bec5e2ccab2db4c8d7d8a23f4b7948600fb3fef0d4b3a92936119d0a225bc9a894c34df13ce65d49c81

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://bahninfo.at/upload/

http://img4mobi.com/upload/

http://equix.ru/upload/

http://worldalltv.com/upload/

http://negarehgallery.com/upload/

http://lite-server.ru/upload/

http://piratia/su/upload/

http://go-piratia.ru/upload/

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Targets

    • Target

      8869ab0a6bce81b2f6d9673308cb5ca4b52c923d80fc2f967e4af65bca0018b6

    • Size

      304KB

    • MD5

      cf5ac73746d57f37b4177ff463089fa8

    • SHA1

      2f3b655ebd87b3119d3be9528a97a8cea497688a

    • SHA256

      8869ab0a6bce81b2f6d9673308cb5ca4b52c923d80fc2f967e4af65bca0018b6

    • SHA512

      cecc5f79991bc9bb291584c17a0a5b962153837451214bec5e2ccab2db4c8d7d8a23f4b7948600fb3fef0d4b3a92936119d0a225bc9a894c34df13ce65d49c81

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Process Discovery

1
T1057

Tasks