General

  • Target

    7aa58dc82b516c001de502dbde7cfb52e2f6d091d634f80a08d77ee36ff4925f

  • Size

    308KB

  • Sample

    230629-d46gcscg5v

  • MD5

    3c4731c05c7ee78adad0655ff603e8bb

  • SHA1

    e1b184a82769a4cf2092c13bc5fd88d38253e20d

  • SHA256

    7aa58dc82b516c001de502dbde7cfb52e2f6d091d634f80a08d77ee36ff4925f

  • SHA512

    e1a2a6e3b4b54cb83c2692d10900821107f6b67af22f561321e51deeea6e75c3cfff1b3d98b12ecb2ecf3a22c46b6ae4c082a00ad30e4932ddc8a2579bdae193

  • SSDEEP

    3072:G7lqviy8QB272n4gDo5nchg8bbv4/7S5yO2/unVRKx:Wqvbu72nRietD4/7S5

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      7aa58dc82b516c001de502dbde7cfb52e2f6d091d634f80a08d77ee36ff4925f

    • Size

      308KB

    • MD5

      3c4731c05c7ee78adad0655ff603e8bb

    • SHA1

      e1b184a82769a4cf2092c13bc5fd88d38253e20d

    • SHA256

      7aa58dc82b516c001de502dbde7cfb52e2f6d091d634f80a08d77ee36ff4925f

    • SHA512

      e1a2a6e3b4b54cb83c2692d10900821107f6b67af22f561321e51deeea6e75c3cfff1b3d98b12ecb2ecf3a22c46b6ae4c082a00ad30e4932ddc8a2579bdae193

    • SSDEEP

      3072:G7lqviy8QB272n4gDo5nchg8bbv4/7S5yO2/unVRKx:Wqvbu72nRietD4/7S5

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks