General

  • Target

    8f7291954de2adb3a8b9492ba6ecea3bb02fced0ebbcde12863619b750ac768f

  • Size

    306KB

  • Sample

    230924-rm1fnshd58

  • MD5

    c2d5090f919b94098d3e5ce80d1933e6

  • SHA1

    ff12841679de2c56b1c26520814e64b2d4a0c911

  • SHA256

    8f7291954de2adb3a8b9492ba6ecea3bb02fced0ebbcde12863619b750ac768f

  • SHA512

    9bcac913b65fac89ff02ae1d2eb4def61b5d766be2abdc9bb7b2accb0a3dbcac52398737ceb107e29e4855ef3c29d598e0db641e5f39c167a17f796e52f16488

  • SSDEEP

    6144:m78V0bYaxiK0all6s7X1r04Fc+HcnCviG:mYSEaJ7X1r04f37

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      8f7291954de2adb3a8b9492ba6ecea3bb02fced0ebbcde12863619b750ac768f

    • Size

      306KB

    • MD5

      c2d5090f919b94098d3e5ce80d1933e6

    • SHA1

      ff12841679de2c56b1c26520814e64b2d4a0c911

    • SHA256

      8f7291954de2adb3a8b9492ba6ecea3bb02fced0ebbcde12863619b750ac768f

    • SHA512

      9bcac913b65fac89ff02ae1d2eb4def61b5d766be2abdc9bb7b2accb0a3dbcac52398737ceb107e29e4855ef3c29d598e0db641e5f39c167a17f796e52f16488

    • SSDEEP

      6144:m78V0bYaxiK0all6s7X1r04Fc+HcnCviG:mYSEaJ7X1r04f37

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks