General

  • Target

    ed2cace8232074ca0a148d8f7b9d3ea32fb169e048067facc07250a9598cafe2

  • Size

    197KB

  • Sample

    230411-f3v1caaf25

  • MD5

    a5762e95e2bbab82917c5d45e8763568

  • SHA1

    560858bc2d5fa46f7c9dbd2864b0584aa9f7ae56

  • SHA256

    ed2cace8232074ca0a148d8f7b9d3ea32fb169e048067facc07250a9598cafe2

  • SHA512

    5ebaf4692d3f192cc9b9b742f6476071c5cd4b8be525620f88a5fb52175e2d7bfd20aa640efd5660b54b0c1a5970f00315dbe54c3eb9c54162d595736d08aa73

  • SSDEEP

    3072:5mcuQh7O94Us6+E5BPLIM9XfZysemEVP4+8ofReQkIFw:I4S96REjL5Z/DEVPEieQkIS

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      ed2cace8232074ca0a148d8f7b9d3ea32fb169e048067facc07250a9598cafe2

    • Size

      197KB

    • MD5

      a5762e95e2bbab82917c5d45e8763568

    • SHA1

      560858bc2d5fa46f7c9dbd2864b0584aa9f7ae56

    • SHA256

      ed2cace8232074ca0a148d8f7b9d3ea32fb169e048067facc07250a9598cafe2

    • SHA512

      5ebaf4692d3f192cc9b9b742f6476071c5cd4b8be525620f88a5fb52175e2d7bfd20aa640efd5660b54b0c1a5970f00315dbe54c3eb9c54162d595736d08aa73

    • SSDEEP

      3072:5mcuQh7O94Us6+E5BPLIM9XfZysemEVP4+8ofReQkIFw:I4S96REjL5Z/DEVPEieQkIS

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks