e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a

General
Target

e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a

Size

305KB

Sample

220521-sky1hadbak

Score
10 /10
MD5

62e9a0a9002954fc9b9b7f3eb6961cea

SHA1

18a360987b4df973d3b5090582bdd03e0ff5cffd

SHA256

e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a

SHA512

750791e2c3c91df5ae3ad946571e232d810ed22bc83303a625a422c230285e9bdd0c5577623b4dc02bb91790769f59abdb5858bc97ad496773a594f49e66ccf3

Malware Config

Extracted

Family smokeloader
Version 2020
C2

https://ny-city-mall.com/search.php

https://fresh-cars.net/search.php

rc4.i32
rc4.i32
Targets
Target

e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a

MD5

62e9a0a9002954fc9b9b7f3eb6961cea

Filesize

305KB

Score
10/10
SHA1

18a360987b4df973d3b5090582bdd03e0ff5cffd

SHA256

e04f02af7697a106589fa281274a8ce60873902255803ec26b2fc4278cfe2a7a

SHA512

750791e2c3c91df5ae3ad946571e232d810ed22bc83303a625a422c230285e9bdd0c5577623b4dc02bb91790769f59abdb5858bc97ad496773a594f49e66ccf3

Tags

Signatures

  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

    Tags

  • suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    Description

    suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

    Tags

  • suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    Description

    suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

    Tags

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Deletes itself

  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection

Related Tasks

MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
      Defense Evasion
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Tasks