General

  • Target

    2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178_JC.exe

  • Size

    307KB

  • Sample

    231011-nh6v4sbf6s

  • MD5

    ff4c4077fa41d66cb56b1d36807725ef

  • SHA1

    e9b7406f89d59173cce7ba2bca4b76e81e7e4896

  • SHA256

    2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178

  • SHA512

    aabcc790b994436f2cddca30c5ef1d4add34f8797aed2434110a6ab463836737b3297f8272c903b4fa3b55fe2e06d211eb62ff1fa3a7b9b23f1a8ed74fba34b9

  • SSDEEP

    3072:idp8I8wmeuildPcPTJhLFG05MO5yyniwKCArU1lgbyjAbOl:kp8IHmD6dPOFK0MOsynY8gmAK

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178_JC.exe

    • Size

      307KB

    • MD5

      ff4c4077fa41d66cb56b1d36807725ef

    • SHA1

      e9b7406f89d59173cce7ba2bca4b76e81e7e4896

    • SHA256

      2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178

    • SHA512

      aabcc790b994436f2cddca30c5ef1d4add34f8797aed2434110a6ab463836737b3297f8272c903b4fa3b55fe2e06d211eb62ff1fa3a7b9b23f1a8ed74fba34b9

    • SSDEEP

      3072:idp8I8wmeuildPcPTJhLFG05MO5yyniwKCArU1lgbyjAbOl:kp8IHmD6dPOFK0MOsynY8gmAK

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks