General

  • Target

    fb0da95e1a8ab5ec2fbcc67d887dd4306f005bac69517c4aab9bead6b055619d

  • Size

    351KB

  • Sample

    230414-y449hsdb8t

  • MD5

    8c65dfd195b504602e07348997c5e2a9

  • SHA1

    36034b56cdc20f540ced908b0f35d48f333d5c93

  • SHA256

    fb0da95e1a8ab5ec2fbcc67d887dd4306f005bac69517c4aab9bead6b055619d

  • SHA512

    e1fcd6d3766fdeee6af86a901f324344bffefd26c56d8e4cebe6335226b83ff763eb33d277f4a746969f1bac13120f88cdc0cac307a405ae88a14095ecca26d9

  • SSDEEP

    6144:pM8aI5CXByPeWQdPS35ZSp0VKl4WKeGTaM5xi:pMO5IYP3Qdq35ZeTfGTaMq

Malware Config

Extracted

Family

smokeloader

Botnet

pu10

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      fb0da95e1a8ab5ec2fbcc67d887dd4306f005bac69517c4aab9bead6b055619d

    • Size

      351KB

    • MD5

      8c65dfd195b504602e07348997c5e2a9

    • SHA1

      36034b56cdc20f540ced908b0f35d48f333d5c93

    • SHA256

      fb0da95e1a8ab5ec2fbcc67d887dd4306f005bac69517c4aab9bead6b055619d

    • SHA512

      e1fcd6d3766fdeee6af86a901f324344bffefd26c56d8e4cebe6335226b83ff763eb33d277f4a746969f1bac13120f88cdc0cac307a405ae88a14095ecca26d9

    • SSDEEP

      6144:pM8aI5CXByPeWQdPS35ZSp0VKl4WKeGTaM5xi:pMO5IYP3Qdq35ZeTfGTaMq

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks