General

  • Target

    b8bbc7002973a8cf4cdeadccdd05c02e923d5d3d0b5257bfe3ff03a7c99f7ca8

  • Size

    259KB

  • Sample

    230331-y5xwtsee31

  • MD5

    dfc4be9a5b419dc63d2eb07ab977fd1b

  • SHA1

    1d686d9fb6d83ca5d98570a02101c33bffa61fb3

  • SHA256

    b8bbc7002973a8cf4cdeadccdd05c02e923d5d3d0b5257bfe3ff03a7c99f7ca8

  • SHA512

    f885af54565d60822ac333955415f3594dab60da3799948a3a348e25e48288d6c978a1bf079ecf1fc2fed0737b7b4bfb8bc122e69badf7bd165d666cedf4f873

  • SSDEEP

    3072:3XPy4w2QhdI7OO69uqIvQANfdjNfXTmjW5cRJorJt:vJ01OdZ5NfjiRJGt

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      b8bbc7002973a8cf4cdeadccdd05c02e923d5d3d0b5257bfe3ff03a7c99f7ca8

    • Size

      259KB

    • MD5

      dfc4be9a5b419dc63d2eb07ab977fd1b

    • SHA1

      1d686d9fb6d83ca5d98570a02101c33bffa61fb3

    • SHA256

      b8bbc7002973a8cf4cdeadccdd05c02e923d5d3d0b5257bfe3ff03a7c99f7ca8

    • SHA512

      f885af54565d60822ac333955415f3594dab60da3799948a3a348e25e48288d6c978a1bf079ecf1fc2fed0737b7b4bfb8bc122e69badf7bd165d666cedf4f873

    • SSDEEP

      3072:3XPy4w2QhdI7OO69uqIvQANfdjNfXTmjW5cRJorJt:vJ01OdZ5NfjiRJGt

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks