General

  • Target

    NEAS.7afccce1de70c50cde71957550713e0768bfbbcad43b1db327064c9bc1c95c80_JC.exe

  • Size

    275KB

  • Sample

    231007-psby6aee86

  • MD5

    01d5d8772e367e210e38e4ce1365c7eb

  • SHA1

    2362b580bcba8527360c1f858e06ebaa376e7b61

  • SHA256

    7afccce1de70c50cde71957550713e0768bfbbcad43b1db327064c9bc1c95c80

  • SHA512

    1ab1abe0bbe9e715f58a9046ecde5a662ebeb267c6e609a39dfb7c9566f4cb566c1bfc567e229cea9470352badad8af5f32d0e42babf84cf3d252cd6d4c73e1f

  • SSDEEP

    3072:hOb09ZQtt4IDNArmEwNUoh5MaLj5vYoc8:w2Zkt4VrJW5hVLjR3c

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      NEAS.7afccce1de70c50cde71957550713e0768bfbbcad43b1db327064c9bc1c95c80_JC.exe

    • Size

      275KB

    • MD5

      01d5d8772e367e210e38e4ce1365c7eb

    • SHA1

      2362b580bcba8527360c1f858e06ebaa376e7b61

    • SHA256

      7afccce1de70c50cde71957550713e0768bfbbcad43b1db327064c9bc1c95c80

    • SHA512

      1ab1abe0bbe9e715f58a9046ecde5a662ebeb267c6e609a39dfb7c9566f4cb566c1bfc567e229cea9470352badad8af5f32d0e42babf84cf3d252cd6d4c73e1f

    • SSDEEP

      3072:hOb09ZQtt4IDNArmEwNUoh5MaLj5vYoc8:w2Zkt4VrJW5hVLjR3c

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks