Overview

overview

10

Static

static

3

d055a2cfcc...JC.exe

windows7-x64

10

d055a2cfcc...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356_JC.exe

  • Size

    239KB

  • Sample

    231001-zgmlmadd9t

  • MD5

    195e87075a7924b2e8b6cc880c05b28e

  • SHA1

    04e998ce99a1498b205245918c891fd553dbbb75

  • SHA256

    d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356

  • SHA512

    c8a8f541670d6ea5f566097dbc376a10443b39d6ae72367c80711016a09810e3d8652e54c5b0f76993302256f0ef8c57e41d47bf9e95414f8dbe4886ea8f5347

  • SSDEEP

    3072:iXjliYBn8cXICsADr2w5m7TfXKBjINDmOMhTd/kPgRSHY6p5V40J:ifxXI5WKwyfXKBszqhgDL4

Score
10/10
smokeloaderpub4backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/
rc4.i32
rc4.i32

Targets

    • Target

      d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356_JC.exe

    • Size

      239KB

    • MD5

      195e87075a7924b2e8b6cc880c05b28e

    • SHA1

      04e998ce99a1498b205245918c891fd553dbbb75

    • SHA256

      d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356

    • SHA512

      c8a8f541670d6ea5f566097dbc376a10443b39d6ae72367c80711016a09810e3d8652e54c5b0f76993302256f0ef8c57e41d47bf9e95414f8dbe4886ea8f5347

    • SSDEEP

      3072:iXjliYBn8cXICsADr2w5m7TfXKBjINDmOMhTd/kPgRSHY6p5V40J:ifxXI5WKwyfXKBszqhgDL4

    Score
    10/10
    smokeloaderpub4backdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks