General

  • Target

    a73098a6b3db0ba29a660c287be364d5d676e9fece6495b8dfa90e48e29868fc

  • Size

    29KB

  • Sample

    230308-ffed3sea95

  • MD5

    1f2126ce6f8cc98a2159a33fa81b4285

  • SHA1

    aaf914b5e5f7d79ab387a07019033bb28c4f0956

  • SHA256

    a73098a6b3db0ba29a660c287be364d5d676e9fece6495b8dfa90e48e29868fc

  • SHA512

    621db8b88c8556c2dcd3401b38bb2b16d5cd75f54bc8fe8d1ed77ea699dd43776e3bb76c78bb86c1098951666b181808f0565e78666d534f0a469daac7c1f377

  • SSDEEP

    768:khafATBfqNGiP+x800ekJHwCukdqS+/td7N:cy2BfqNGMo/vpkQSOb7

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

https://humman.art/

http://humman.art/

rc4.i32
rc4.i32

Targets

    • Target

      a73098a6b3db0ba29a660c287be364d5d676e9fece6495b8dfa90e48e29868fc

    • Size

      29KB

    • MD5

      1f2126ce6f8cc98a2159a33fa81b4285

    • SHA1

      aaf914b5e5f7d79ab387a07019033bb28c4f0956

    • SHA256

      a73098a6b3db0ba29a660c287be364d5d676e9fece6495b8dfa90e48e29868fc

    • SHA512

      621db8b88c8556c2dcd3401b38bb2b16d5cd75f54bc8fe8d1ed77ea699dd43776e3bb76c78bb86c1098951666b181808f0565e78666d534f0a469daac7c1f377

    • SSDEEP

      768:khafATBfqNGiP+x800ekJHwCukdqS+/td7N:cy2BfqNGMo/vpkQSOb7

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks