General

  • Target

    3c56ab9f14f390d86b2453d144704c6775990b6a31b28fcb0ae43dc0fb996140

  • Size

    112KB

  • Sample

    220703-jnradsbaam

  • MD5

    bf4b557875c4ca58d7d52316c97d229e

  • SHA1

    b58d8922d7e9f71bc7907ccdcd1f236ab1922f63

  • SHA256

    3c56ab9f14f390d86b2453d144704c6775990b6a31b28fcb0ae43dc0fb996140

  • SHA512

    f0a60ae1d22cb1bff89f4c3355f68bbbaa1dfe8d76f41f2cee4f3158b559415b968eb6bd20a94aa3ddfca2326643f86e4244580a2ee3f96377a0e0e2d3d4a69a

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://andersenavoidably.bid/

http://cindyarrest.bid/

http://armoringchildlessnesss.bid/

rc4.i32
rc4.i32

Targets

    • Target

      3c56ab9f14f390d86b2453d144704c6775990b6a31b28fcb0ae43dc0fb996140

    • Size

      112KB

    • MD5

      bf4b557875c4ca58d7d52316c97d229e

    • SHA1

      b58d8922d7e9f71bc7907ccdcd1f236ab1922f63

    • SHA256

      3c56ab9f14f390d86b2453d144704c6775990b6a31b28fcb0ae43dc0fb996140

    • SHA512

      f0a60ae1d22cb1bff89f4c3355f68bbbaa1dfe8d76f41f2cee4f3158b559415b968eb6bd20a94aa3ddfca2326643f86e4244580a2ee3f96377a0e0e2d3d4a69a

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks