General

  • Target

    afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc

  • Size

    312KB

  • Sample

    221229-wqpkssgh8t

  • MD5

    88e84db01e522fe947af3f5359fa7fa4

  • SHA1

    90b859b5f355d9c5fa8500a403d16fd38f53a79f

  • SHA256

    afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc

  • SHA512

    0a7452621387c5e4009de2a78e531f1c2fd3f0a1964dc2f97066fb70af3ef30f19bd53def44cf0c41658f6faa81663153652886d497ae1aa0670218e14c376c5

  • SSDEEP

    6144:DLt0OQU1eXjJQX1G9AEsLbMSmLDsxyIxZ1WqqdS09R:Dh0OQU4XjJQX1VV/dYX

Malware Config

Targets

    • Target

      afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc

    • Size

      312KB

    • MD5

      88e84db01e522fe947af3f5359fa7fa4

    • SHA1

      90b859b5f355d9c5fa8500a403d16fd38f53a79f

    • SHA256

      afc2e82908e33ed18369797088e118c93880c07ed785946f6a351aa8bef739fc

    • SHA512

      0a7452621387c5e4009de2a78e531f1c2fd3f0a1964dc2f97066fb70af3ef30f19bd53def44cf0c41658f6faa81663153652886d497ae1aa0670218e14c376c5

    • SSDEEP

      6144:DLt0OQU1eXjJQX1G9AEsLbMSmLDsxyIxZ1WqqdS09R:Dh0OQU4XjJQX1VV/dYX

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks