Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f22c85988b5f9c2c58d4f0cdd3c5c5d4aa807d196a9e712b8880e46d9586fb52

  • Size

    321KB

  • Sample

    231012-brvg8afe5w

  • MD5

    5cff40f577549d49fa9c2e2bbdedeecd

  • SHA1

    836c2f689fde566efd6994a48aff4259e6f6a7eb

  • SHA256

    f22c85988b5f9c2c58d4f0cdd3c5c5d4aa807d196a9e712b8880e46d9586fb52

  • SHA512

    90afff56069cf39b44d6a6ad7bc92d317716a7e620075762f20915bc74085bf2a3d1be73d98e22df9ccf7400b6418e30b9bd7590d3fa1631fdb8e3932fe1c08d

  • SSDEEP

    6144:vV7th/mkLUNBOjxpYQLfbyuKUG6dda4N4:vpj+kLUnOjxpXLfbgGvP

Malware Config

Extracted

Family

smokeloader

Botnet

up4

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-file0.com/

http://file-file-file1.com/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Targets

    • Target

      f22c85988b5f9c2c58d4f0cdd3c5c5d4aa807d196a9e712b8880e46d9586fb52

    • Size

      321KB

    • MD5

      5cff40f577549d49fa9c2e2bbdedeecd

    • SHA1

      836c2f689fde566efd6994a48aff4259e6f6a7eb

    • SHA256

      f22c85988b5f9c2c58d4f0cdd3c5c5d4aa807d196a9e712b8880e46d9586fb52

    • SHA512

      90afff56069cf39b44d6a6ad7bc92d317716a7e620075762f20915bc74085bf2a3d1be73d98e22df9ccf7400b6418e30b9bd7590d3fa1631fdb8e3932fe1c08d

    • SSDEEP

      6144:vV7th/mkLUNBOjxpYQLfbyuKUG6dda4N4:vpj+kLUnOjxpXLfbgGvP

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Modifies Installed Components in the registry

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.